effect 4.0.1 → 4.0.3

package/dist/ai/McpServer.js

@@ -138,9 +138,10 @@ export class McpServer extends /*#__PURE__*/Context.Service()("effect/ai/McpServ
     const prompts = [];
     const notificationsQueue = yield* Queue.make();
     const notificationDelivery = {
-      consumers: 0
+      consumers: 0,
+      listChangeRevision: 0
     };
-    const pendingListChanges = new Set();
+    const pendingListChanges = new Map();
     const dispatcher = (yield* Scheduler).makeDispatcher();
     const notifications = yield* RpcClient.makeNoSerialization(BroadcastServerNotificationRpcs, {
       spanPrefix: "McpServer/Notifications",
@@ -161,14 +162,19 @@ export class McpServer extends /*#__PURE__*/Context.Service()("effect/ai/McpServ
         };
         let enqueued = false;
         if (message.tag.includes("list_changed")) {
-          if (!pendingListChanges.has(message.tag)) {
+          const revision = ++notificationDelivery.listChangeRevision;
+          const pending = pendingListChanges.get(message.tag);
+          if (pending !== undefined) {
+            // A coalesced change may be newer than an intervening subscription.
+            pending.listChangeRevision = revision;
+          } else {
+            queued.listChangeRevision = revision;
             enqueued = true;
-            const tag = message.tag;
+            pendingListChanges.set(message.tag, queued);
             dispatcher.scheduleTask(() => {
-              Queue.offerUnsafe(notificationsQueue, queued);
               pendingListChanges.delete(message.tag);
+              Queue.offerUnsafe(notificationsQueue, queued);
             }, 0);
-            pendingListChanges.add(tag);
           }
         } else {
           enqueued = true;
@@ -424,6 +430,7 @@ const MCP_SESSION_ID_HEADER = "mcp-session-id";
 const MCP_PROTOCOL_VERSION_HEADER = "mcp-protocol-version";
 const MCP_INVALID_BATCH_METHOD = "invalid/json-rpc-batch";
 const cancelledResponses = /*#__PURE__*/new WeakMap();
+const httpPostResponses = /*#__PURE__*/new WeakMap();
 const requestKey = requestId => `${typeof requestId}:${requestId}`;
 class McpClientKey extends Data.Class {}
 /**
@@ -517,10 +524,17 @@ const runWithRuntime = /*#__PURE__*/Effect.fnUntraced(function* (options, runtim
       }
     });
   });
+  let writeFromClient;
+  const {
+    core,
+    notificationDelivery,
+    notifications
+  } = internalState.get(server);
   const handlers = yield* runtime.installHandlers({
-    core: internalState.get(server).core,
+    core,
     subscribeServerNotifications: PubSub.subscribe(serverNotifications),
-    ...(!protocol.supportsNotifications ? {} : {
+    getListChangeRevision: () => notificationDelivery.listChangeRevision,
+    ...(!protocol.supportsNotifications || options.allowSubscriptions === false ? {} : {
       sendNotification,
       markSubscriptionCancelled: (clientId, requestId) => Effect.sync(() => {
         cancelRequest(clientId, requestId);
@@ -556,10 +570,15 @@ const runWithRuntime = /*#__PURE__*/Effect.fnUntraced(function* (options, runtim
             if (request._tag === "Interrupt") {
               // A cancelled reverse request may never receive a reply.
               removeReverseRequestClient(requestKey(request.requestId), key);
+              return sendNotification(key.profile.protocolVersion, key.clientId, {
+                tag: "notifications/cancelled",
+                payload: {
+                  requestId: request.requestId
+                }
+              });
             }
-            // Ack & co are not part of FromServerEncoded, but the JSON-RPC
-            // serializer encodes them symmetrically for reverse control flow
-            return protocol.send(key.clientId, request);
+            // Effect RPC control messages are not part of the MCP protocol.
+            return Effect.void;
           },
           supportsAck: true,
           supportsTransferables: false,
@@ -636,12 +655,13 @@ const runWithRuntime = /*#__PURE__*/Effect.fnUntraced(function* (options, runtim
       if (response._tag === "Exit") {
         const requests = activeRequests.get(clientId);
         const key = requestKey(response.requestId);
-        const cancelled = requests?.get(key)?.cancelled;
+        const active = requests?.get(key);
         if (requests !== undefined && requests.delete(key) && requests.size === 0) {
           activeRequests.delete(clientId);
         }
-        if (cancelled === true) {
+        if (active?.cancelled === true) {
           if (transport === "custom") return Effect.void;
+          if (active.httpPost !== undefined) active.httpPost.expected--;
           cancelledResponses.set(response, response.requestId);
           return protocol.send(clientId, response);
         }
@@ -663,174 +683,206 @@ const runWithRuntime = /*#__PURE__*/Effect.fnUntraced(function* (options, runtim
       }
       return protocol.send(clientId, response);
     },
-    run: f => protocol.run((clientId, request_) => {
-      const fiber = Fiber.getCurrent();
-      const request = request_;
-      const httpRequest = isHttp ? Context.getOrUndefined(fiber.context, HttpServerRequest.HttpServerRequest) : undefined;
-      if (httpRequest !== undefined && request._tag !== "Eof") {
-        appendPreResponseHandlerUnsafe(httpRequest, (_, response) => Effect.succeed(response.status === 200 && response.body._tag === "Uint8Array" && response.body.contentLength === 0 ? HttpServerResponse.empty({
-          headers: Headers.remove(response.headers, "content-type"),
-          status: 202
-        }) : response));
-      }
-      switch (request._tag) {
-        case "Request":
-          {
-            const headers = isHttp ? Context.getUnsafe(Fiber.getCurrent().context, HttpServerRequest.HttpServerRequest).headers : Headers.fromInput(request.headers);
-            const cancellationRequest = request.tag === "notifications/cancelled" && typeof request.payload === "object" && request.payload !== null && "requestId" in request.payload && (typeof request.payload.requestId === "string" || typeof request.payload.requestId === "number") ? activeRequests.get(clientId)?.get(requestKey(request.payload.requestId)) : undefined;
-            const prepare = cancellationRequest === undefined ? runtime.prepareRequest(clientId, headers, request) : Effect.succeed(cancellationRequest.prepared);
-            return Effect.gen(function* () {
-              const prepared = yield* prepare;
-              const clientState = clientStates.get(clientId);
-              if (isHttp && clientState === undefined) {
-                // HTTP EOF only ends the request body; handlers and streamed replies may still be running.
-                yield* Scope.addFinalizer(Context.getUnsafe(fiber.context, Scope.Scope), Effect.sync(() => disconnectClient(clientId)));
-              }
-              const session = prepared.binding;
-              const selectedProtocol = prepared.protocol;
-              // Select before dated payload decoding: legacy requests use
-              // their session's adapter; modern requests carry their own version.
-              clientStates.set(clientId, {
-                protocol: selectedProtocol,
-                profile: prepared.profile ?? clientState?.profile,
-                sessionHeaders: isHttp && headers[MCP_SESSION_ID_HEADER] !== undefined ? Headers.fromInput({
-                  [MCP_SESSION_ID_HEADER]: headers[MCP_SESSION_ID_HEADER]
-                }) : clientState?.sessionHeaders
-              });
-              if (request.tag === MCP_INVALID_BATCH_METHOD) {
-                return yield* sendRequestError(clientId, request.id, new InvalidRequest({
-                  message: "JSON-RPC batches are not supported"
-                }));
-              }
-              if (httpRequest !== undefined && session !== undefined) {
-                appendPreResponseHandlerUnsafe(httpRequest, (_, res) => Effect.succeed(HttpServerResponse.setHeader(res, MCP_PROTOCOL_VERSION_HEADER, session.protocol.protocolVersion)));
+    run: f => {
+      writeFromClient = f;
+      return protocol.run((clientId, request_) => {
+        const fiber = Fiber.getCurrent();
+        const request = request_;
+        const httpRequest = isHttp ? Context.getOrUndefined(fiber.context, HttpServerRequest.HttpServerRequest) : undefined;
+        if (httpRequest !== undefined && request._tag !== "Eof") {
+          appendPreResponseHandlerUnsafe(httpRequest, (_, response) => Effect.succeed(response.status === 200 && response.body._tag === "Uint8Array" && response.body.contentLength === 0 ? HttpServerResponse.empty({
+            headers: Headers.remove(response.headers, "content-type"),
+            status: 202
+          }) : response));
+        }
+        switch (request._tag) {
+          case "Request":
+            {
+              if (httpRequest !== undefined && request.isNotification !== true) {
+                const httpPost = httpPostResponses.get(httpRequest) ?? {
+                  expected: 0
+                };
+                httpPost.expected++;
+                httpPostResponses.set(httpRequest, httpPost);
               }
-              const routedRequest = runtime.routeClientRequest(selectedProtocol, request);
-              const rpc = runtime.clientRpcs.requests.get(routedRequest.tag);
-              const isClientNotification = selectedProtocol.clientNotificationRpcs.requests.has(request.tag);
-              if (rpc && isClientNotification && request.isNotification) {
-                if (!session && selectedProtocol.runtime._tag === "Stateful") {
-                  if (httpRequest) {
-                    appendPreResponseHandlerUnsafe(httpRequest, () => Effect.succeed(HttpServerResponse.empty({
-                      status: headers[MCP_SESSION_ID_HEADER] === undefined ? 400 : 404
-                    })));
-                  }
-                  return;
+              const headers = isHttp ? Context.getUnsafe(Fiber.getCurrent().context, HttpServerRequest.HttpServerRequest).headers : Headers.fromInput(request.headers);
+              const cancellationRequest = request.tag === "notifications/cancelled" && typeof request.payload === "object" && request.payload !== null && "requestId" in request.payload && (typeof request.payload.requestId === "string" || typeof request.payload.requestId === "number") ? activeRequests.get(clientId)?.get(requestKey(request.payload.requestId)) : undefined;
+              const prepare = cancellationRequest === undefined ? runtime.prepareRequest(clientId, headers, request) : Effect.succeed(cancellationRequest.prepared);
+              return Effect.gen(function* () {
+                const prepared = yield* prepare;
+                const clientState = clientStates.get(clientId);
+                if (isHttp && clientState === undefined) {
+                  // HTTP EOF only ends the request body; handlers and streamed replies may still be running.
+                  yield* Scope.addFinalizer(Context.getUnsafe(fiber.context, Scope.Scope), Effect.sync(() => disconnectClient(clientId)));
                 }
-                const decode = selectedProtocol.payloadCodecs(rpc).decode(request.payload);
-                return yield* Effect.gen(function* () {
-                  const payload = yield* decode;
-                  if (request.tag === "notifications/cancelled") {
-                    const cancellation = yield* selectedProtocol.normalizeCancellation(payload);
-                    const key = requestKey(cancellation.requestId);
-                    let ownerClientId = clientId;
-                    if (isHttp) {
-                      if (session === undefined) {
-                        return;
+                const session = prepared.binding;
+                const selectedProtocol = prepared.protocol;
+                // Select before dated payload decoding: legacy requests use
+                // their session's adapter; modern requests carry their own version.
+                clientStates.set(clientId, {
+                  protocol: selectedProtocol,
+                  profile: prepared.profile ?? clientState?.profile,
+                  sessionHeaders: isHttp && headers[MCP_SESSION_ID_HEADER] !== undefined ? Headers.fromInput({
+                    [MCP_SESSION_ID_HEADER]: headers[MCP_SESSION_ID_HEADER]
+                  }) : clientState?.sessionHeaders
+                });
+                if (request.tag === MCP_INVALID_BATCH_METHOD) {
+                  return yield* sendRequestError(clientId, request.id, new InvalidRequest({
+                    message: "JSON-RPC batches are not supported"
+                  }));
+                }
+                if (httpRequest !== undefined && session !== undefined) {
+                  appendPreResponseHandlerUnsafe(httpRequest, (_, res) => Effect.succeed(runtime.resolveRequest(clientId, headers) === undefined ? HttpServerResponse.empty({
+                    status: 404
+                  }) : HttpServerResponse.setHeader(res, MCP_PROTOCOL_VERSION_HEADER, session.protocol.protocolVersion)));
+                }
+                const routedRequest = runtime.routeClientRequest(selectedProtocol, request);
+                const rpc = runtime.clientRpcs.requests.get(routedRequest.tag);
+                const isClientNotification = selectedProtocol.clientNotificationRpcs.requests.has(request.tag);
+                if (rpc && isClientNotification && request.isNotification) {
+                  if (!session && selectedProtocol.runtime._tag === "Stateful") {
+                    if (httpRequest) {
+                      appendPreResponseHandlerUnsafe(httpRequest, () => Effect.succeed(HttpServerResponse.empty({
+                        status: headers[MCP_SESSION_ID_HEADER] === undefined ? 400 : 404
+                      })));
+                    }
+                    return;
+                  }
+                  const decode = selectedProtocol.payloadCodecs(rpc).decode(request.payload);
+                  return yield* Effect.gen(function* () {
+                    const payload = yield* decode;
+                    if (request.tag === "notifications/cancelled") {
+                      const cancellation = yield* selectedProtocol.normalizeCancellation(payload);
+                      const key = requestKey(cancellation.requestId);
+                      let ownerClientId = clientId;
+                      if (isHttp) {
+                        if (session === undefined) {
+                          return;
+                        }
+                        // Each HTTP POST has its own transport ID, but cancellation belongs to the session.
+                        const owner = Array.from(activeRequests).find(([, requests]) => requests.get(key)?.prepared.binding === session);
+                        if (owner === undefined) {
+                          return;
+                        }
+                        ownerClientId = owner[0];
                       }
-                      // Each HTTP POST has its own transport ID, but cancellation belongs to the session.
-                      const owner = Array.from(activeRequests).find(([, requests]) => requests.get(key)?.prepared.binding === session);
-                      if (owner === undefined) {
+                      if (!cancelRequest(ownerClientId, cancellation.requestId)) {
                         return;
                       }
-                      ownerClientId = owner[0];
-                    }
-                    if (!cancelRequest(ownerClientId, cancellation.requestId)) {
-                      return;
+                      return yield* f(ownerClientId, {
+                        _tag: "Interrupt",
+                        requestId: cancellation.requestId
+                      });
                     }
-                    return yield* f(ownerClientId, {
-                      _tag: "Interrupt",
-                      requestId: cancellation.requestId
-                    });
+                    const handler = handlers.mapUnsafe.get(rpc.key);
+                    const handled = handler ? handler.handler(payload, {
+                      rpc,
+                      requestId: RpcMessage.RequestId(request.id),
+                      client: new Rpc.ServerClient(clientId),
+                      headers
+                    }) : Effect.void;
+                    return yield* prepared.requestContext === undefined ? handled : Effect.provideService(handled, McpRequestContext, prepared.requestContext);
+                  }).pipe(Effect.ignoreCause);
+                }
+                if (!rpc || isClientNotification) {
+                  if (request.isNotification) {
+                    return;
                   }
-                  const handler = handlers.mapUnsafe.get(rpc.key);
-                  const handled = handler ? handler.handler(payload, {
-                    rpc,
+                  return yield* sendRequestError(clientId, request.id, new MethodNotFound({
+                    message: `Method not found: ${request.tag}`
+                  }));
+                }
+                const decoded = yield* Effect.result(selectedProtocol.payloadCodecs(rpc).decode(request.payload));
+                if (Result.isFailure(decoded)) {
+                  return yield* request.isNotification ? Effect.void : sendRequestError(clientId, request.id, new InvalidParams({
+                    message: "Invalid method parameters"
+                  }));
+                }
+                if (request.isNotification !== true) {
+                  const requests = activeRequests.get(clientId) ?? new Map();
+                  requests.set(requestKey(request.id), {
                     requestId: RpcMessage.RequestId(request.id),
-                    client: new Rpc.ServerClient(clientId),
-                    headers
-                  }) : Effect.void;
-                  return yield* prepared.requestContext === undefined ? handled : Effect.provideService(handled, McpRequestContext, prepared.requestContext);
-                }).pipe(Effect.ignoreCause);
-              }
-              if (!rpc || isClientNotification) {
-                if (request.isNotification) {
-                  return;
+                    prepared,
+                    cancelled: false,
+                    httpPost: httpRequest === undefined ? undefined : httpPostResponses.get(httpRequest)
+                  });
+                  activeRequests.set(clientId, requests);
                 }
-                return yield* sendRequestError(clientId, request.id, new MethodNotFound({
-                  message: `Method not found: ${request.tag}`
-                }));
-              }
-              const decoded = yield* Effect.result(selectedProtocol.payloadCodecs(rpc).decode(request.payload));
-              if (Result.isFailure(decoded)) {
-                return yield* request.isNotification ? Effect.void : sendRequestError(clientId, request.id, new InvalidParams({
-                  message: "Invalid method parameters"
-                }));
-              }
-              if (request.isNotification !== true) {
-                const requests = activeRequests.get(clientId) ?? new Map();
-                requests.set(requestKey(request.id), {
-                  prepared,
-                  cancelled: false
-                });
-                activeRequests.set(clientId, requests);
-              }
-              const handled = f(clientId, routedRequest);
-              return yield* prepared.requestContext === undefined ? handled : Effect.provideService(handled, McpRequestContext, prepared.requestContext);
-            }).pipe(Effect.catch(error => request.isNotification ? Effect.void : sendRequestError(clientId, request.id, Predicate.isTagged(error, "ProtocolError") ? McpProtocolInternal.ProtocolError.fromFeature(error) : new InvalidParams({
-              message: "Invalid request metadata"
-            }))));
-          }
-        case "Ping":
-        case "Ack":
-        case "Interrupt":
-          return f(clientId, request);
-        case "Eof":
-          if (!isHttp) {
-            disconnectClient(clientId);
-          }
-          return f(clientId, request);
-        case "Pong":
-        case "Exit":
-        case "Chunk":
-        case "ClientProtocolError":
-        case "Defect":
-          {
-            const requestId = request._tag === "Exit" ? requestKey(request.requestId) : undefined;
-            const session = isHttp ? runtime.resolveRequest(clientId, Context.getUnsafe(Fiber.getCurrent().context, HttpServerRequest.HttpServerRequest).headers) : undefined;
-            const waiting = requestId === undefined ? undefined : reverseRequestClients.get(requestId);
-            const reverseKey = waiting?.find(key => isHttp ? key.profile === session?.negotiatedProfile : key.clientId === clientId);
-            if (request._tag === "Exit" && reverseKey === undefined) {
-              return Effect.void;
+                const handled = f(clientId, routedRequest);
+                return yield* prepared.requestContext === undefined ? handled : Effect.provideService(handled, McpRequestContext, prepared.requestContext);
+              }).pipe(Effect.catch(error => request.isNotification ? Effect.void : sendRequestError(clientId, request.id, Predicate.isTagged(error, "ProtocolError") ? McpProtocolInternal.ProtocolError.fromFeature(error) : new InvalidParams({
+                message: "Invalid request metadata"
+              }))));
             }
-            if (reverseKey !== undefined && requestId !== undefined) {
-              removeReverseRequestClient(requestId, reverseKey);
+          case "Ping":
+          case "Ack":
+          case "Interrupt":
+            return f(clientId, request);
+          case "Eof":
+            if (!isHttp) {
+              disconnectClient(clientId);
             }
-            const targetClientId = reverseKey?.clientId ?? clientId;
-            const clientState = clientStates.get(targetClientId);
-            const selectedProtocol = clientState?.protocol ?? runtime.protocols[0];
-            const profile = reverseKey?.profile ?? clientState?.profile ?? {
-              protocolVersion: selectedProtocol.protocolVersion,
-              clientCapabilities: {},
-              clientInfo: {
-                name: "unknown",
-                version: "unknown"
+            return f(clientId, request);
+          case "Pong":
+          case "Exit":
+          case "Chunk":
+          case "ClientProtocolError":
+          case "Defect":
+            {
+              const requestId = request._tag === "Exit" ? requestKey(request.requestId) : undefined;
+              const session = isHttp ? runtime.resolveRequest(clientId, Context.getUnsafe(Fiber.getCurrent().context, HttpServerRequest.HttpServerRequest).headers) : undefined;
+              const waiting = requestId === undefined ? undefined : reverseRequestClients.get(requestId);
+              const reverseKey = waiting?.find(key => isHttp ? key.profile === session?.negotiatedProfile : key.clientId === clientId);
+              if (request._tag === "Exit" && reverseKey === undefined) {
+                return Effect.void;
               }
-            };
-            return RcMap.get(clients, new McpClientKey({
-              clientId: targetClientId,
-              profile
-            })).pipe(Effect.flatMap(({
-              write
-            }) => write(request)), Effect.scoped);
+              if (reverseKey !== undefined && requestId !== undefined) {
+                removeReverseRequestClient(requestId, reverseKey);
+              }
+              const targetClientId = reverseKey?.clientId ?? clientId;
+              const clientState = clientStates.get(targetClientId);
+              const selectedProtocol = clientState?.protocol ?? runtime.protocols[0];
+              const profile = reverseKey?.profile ?? clientState?.profile ?? {
+                protocolVersion: selectedProtocol.protocolVersion,
+                clientCapabilities: {},
+                clientInfo: {
+                  name: "unknown",
+                  version: "unknown"
+                }
+              };
+              return RcMap.get(clients, new McpClientKey({
+                clientId: targetClientId,
+                profile
+              })).pipe(Effect.flatMap(({
+                write
+              }) => write(request)), Effect.scoped);
+            }
+        }
+      });
+    }
+  });
+  if (isHttp) {
+    // Stop requests that can no longer receive client replies after termination.
+    yield* runtime.onSessionTerminated(binding => {
+      const interrupts = [];
+      for (const [clientId, requests] of activeRequests) {
+        for (const {
+          prepared,
+          requestId
+        } of requests.values()) {
+          if (prepared.binding === binding && cancelRequest(clientId, requestId)) {
+            interrupts.push(writeFromClient(clientId, {
+              _tag: "Interrupt",
+              requestId
+            }));
           }
+        }
       }
-    })
-  });
-  const {
-    notificationDelivery,
-    notifications
-  } = internalState.get(server);
+      return Effect.all(interrupts, {
+        discard: true
+      });
+    });
+  }
   yield* Effect.acquireRelease(Effect.sync(() => {
     notificationDelivery.consumers++;
   }), () => Effect.sync(() => {
@@ -840,6 +892,7 @@ const runWithRuntime = /*#__PURE__*/Effect.fnUntraced(function* (options, runtim
   yield* Queue.take(notifications).pipe(Effect.flatMap(Effect.fnUntraced(function* (queued) {
     const {
       delivered,
+      listChangeRevision,
       notification,
       targetClientId,
       requestContext,
@@ -848,7 +901,8 @@ const runWithRuntime = /*#__PURE__*/Effect.fnUntraced(function* (options, runtim
     if (McpProtocolInternal.isSubscriptionServerNotification(notification)) {
       yield* PubSub.publish(serverNotifications, {
         notification,
-        targetClientId
+        targetClientId,
+        listChangeRevision
       });
     }
     const clientIds = yield* patchedProtocol.clientIds;
@@ -1061,19 +1115,33 @@ const mcpStdioSerialization = protocols => {
  * **Details**
  *
  * POST serves JSON-RPC and accepted notification-only requests return `202`.
- * Modern routing-header mismatches and unsupported protocol versions return
- * JSON-RPC errors with status `400`; unknown modern RPC methods return a
- * JSON-RPC method-not-found error with status `404`. Unsupported HTTP methods
- * return `405`. Requests carrying an `Origin` header are rejected unless the
- * exact origin appears in `allowedOrigins`; Origin-less non-browser clients
+ * Header mismatches, unsupported protocol versions, and invalid session-header
+ * usage return JSON-RPC errors with status `400`.
+ * Unknown modern RPC methods return a JSON-RPC method-not-found error with
+ * status `404`. Session requests without `MCP-Protocol-Version` use the version
+ * negotiated at initialization. Unsupported HTTP methods return `405`.
+ * Requests with an `Origin` header are rejected unless the exact origin
+ * appears in `allowedOrigins`; Origin-less non-browser clients
  * remain valid. The surrounding HTTP server remains responsible for binding
  * to an appropriate interface and installing authentication.
  *
+ * With `allowSessionTermination`, a DELETE carrying `Mcp-Session-Id` ends that
+ * session with `204` and interrupts its in-flight requests; later requests with
+ * that id get `404`. DELETE validates the session and `MCP-Protocol-Version`
+ * headers like POST. Without the option, or when only sessionless revisions
+ * such as `v2026_07_28` are configured, DELETE returns `405`. Any caller
+ * holding a session id can end that session, so authenticate requests in the
+ * surrounding router.
+ *
+ * Set `allowSubscriptions: false` to disable `v2026_07_28` subscriptions.
+ * Discovery advertises `listChanged: false`, and `subscriptions/listen` returns
+ * Method not found. Request-scoped progress and logs, legacy protocols, and
+ * default subscription behavior are unchanged.
+ *
  * `layerHttp` always implements the single-endpoint Streamable HTTP topology.
  * Using `v2024_11_05` here is a custom compatibility transport for that
  * revision's schema. It does not implement the historical two-endpoint
- * HTTP+SSE transport, GET SSE, event resumption, session expiry, or client
- * session termination.
+ * HTTP+SSE transport, GET SSE, event resumption, or session expiry.
  *
  * @see {@link layerStdio} for exposing the server over stdio
  * @see {@link layer} for the base MCP server layer without a transport protocol
@@ -1084,17 +1152,7 @@ const mcpStdioSerialization = protocols => {
  */
 export const layerHttp = options => {
   const runtime = McpRuntime.layer(options.protocols);
-  const methodNotAllowedResponse = HttpServerResponse.empty({
-    status: 405,
-    headers: {
-      allow: "POST"
-    }
-  });
-  const methodNotAllowed = request => isAllowedMcpOrigin(request, options.allowedOrigins) ? Effect.succeed(methodNotAllowedResponse) : Effect.succeed(HttpServerResponse.empty({
-    status: 403
-  }));
-  const routes = Layer.mergeAll(HttpRouter.add("GET", options.path, methodNotAllowed), HttpRouter.add("PUT", options.path, methodNotAllowed), HttpRouter.add("PATCH", options.path, methodNotAllowed), HttpRouter.add("DELETE", options.path, methodNotAllowed), HttpRouter.add("OPTIONS", options.path, methodNotAllowed));
-  return Layer.merge(layerWithRuntime(options, "http"), routes).pipe(Layer.provide(layerMcpProtocolHttp(options)), Layer.provide(runtime), Layer.provide(RpcSerialization.layerJsonRpc()));
+  return layerWithRuntime(options, "http").pipe(Layer.provide(layerMcpProtocolHttp(options)), Layer.provide(runtime), Layer.provide(RpcSerialization.layerJsonRpc()));
 };
 const layerMcpProtocolHttp = options => Layer.effect(RpcServer.Protocol)(Effect.gen(function* () {
   const runtime = yield* McpRuntime.ServerRuntime;
@@ -1103,6 +1161,22 @@ const layerMcpProtocolHttp = options => Layer.effect(RpcServer.Protocol)(Effect.
     protocol
   } = yield* RpcServer.makeProtocolWithHttpEffect().pipe(Effect.provideService(RpcSerialization.RpcSerialization, mcpHttpSerialization));
   const router = yield* HttpRouter.HttpRouter;
+  const allowSessionTermination = options.allowSessionTermination === true && runtime.protocols.some(protocol => protocol.runtime._tag === "Stateful");
+  const forbidden = Effect.succeed(HttpServerResponse.empty({
+    status: 403
+  }));
+  const withAllowedOrigin = handler => request => isAllowedMcpOrigin(request, options.allowedOrigins) ? handler(request) : forbidden;
+  const methodNotAllowedResponse = Effect.succeed(HttpServerResponse.empty({
+    status: 405,
+    headers: {
+      allow: allowSessionTermination ? "POST, DELETE" : "POST"
+    }
+  }));
+  const methodNotAllowed = withAllowedOrigin(() => methodNotAllowedResponse);
+  for (const method of ["GET", "PUT", "PATCH", "OPTIONS"]) {
+    yield* router.add(method, options.path, methodNotAllowed);
+  }
+  yield* router.add("DELETE", options.path, allowSessionTermination ? withAllowedOrigin(request => runtime.terminateHttpSession(request.headers)) : methodNotAllowed);
   yield* router.add("POST", options.path, request => {
     if (!isAllowedMcpOrigin(request, options.allowedOrigins)) {
       return Effect.succeed(HttpServerResponse.empty({
@@ -1126,14 +1200,26 @@ const layerMcpProtocolHttp = options => Layer.effect(RpcServer.Protocol)(Effect.
       if (admission._tag === "Rejected") {
         return admission.response;
       }
-      const response = Effect.map(httpEffect, response => {
+      const toResponse = response => {
         // Completed responses may already contain notifications followed by the result.
         const hasMultipleMessages = response.body._tag === "Uint8Array" && response.body.body.subarray(0, -1).includes(10);
         return admission.isSubscription || response.body._tag === "Stream" || hasMultipleMessages ? toServerSentEvents(response, admission.isSubscription) : response;
+      };
+      if (admission.acknowledge) {
+        return yield* Effect.catchCause(Effect.map(httpEffect, toResponse), () => Effect.succeed(HttpServerResponse.empty({
+          status: 202
+        })));
+      }
+      return yield* Effect.flatMap(httpEffect, response => {
+        if (response.body._tag !== "Uint8Array" || response.body.body.length > 0) {
+          return Effect.succeed(toResponse(response));
+        }
+        // Only fully cancelled request POSTs may return an empty SSE response.
+        // https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#sending-messages-to-the-server
+        return httpPostResponses.get(request)?.expected === 0 ? Effect.succeed(HttpServerResponse.stream(Stream.empty, {
+          contentType: "text/event-stream"
+        })) : Effect.die(new Error("MCP request ended without writing its response"));
       });
-      return yield* admission.acknowledge ? Effect.catchCause(response, () => Effect.succeed(HttpServerResponse.empty({
-        status: 202
-      }))) : response;
     });
   });
   return protocol;