@gjermundgaraba/effect-actions 0.14.0 → 0.16.0

package/dist/Action.d.mts

@@ -26,7 +26,7 @@ export interface Mcp {
    * `annotations.destructiveHint`, meaningful for a write only. Left out, a write is listed as
    * destructive, MCP's default: state `false` for one that only adds, MCP's "only additive
    * updates". One that replaces, removes or interrupts, such as an edit or a restart, stays
-   * destructive.
+   * destructive, an update of a stored flag such as "read" included.
    */
   readonly destructiveHint?: boolean | undefined;
   /** `annotations.idempotentHint`, meaningful for a write only. */

package/dist/ActionCli.d.mts

@@ -1,19 +1,17 @@
+import { Declaring } from "./contract/rules.mjs";
 import { BuiltIn } from "./contract/errors.mjs";
 import { ActionOf, BuildError, BuildServices, Holding, Known, Member, RequestOf, Selected, SelectedOf, Selection, Served } from "./contract/implementation.mjs";
-import { Action_d_exports, Any, Errors } from "./Action.mjs";
+import { Action_d_exports, Any } from "./Action.mjs";
 import { VerifierError } from "./authentication/provider.mjs";
 import { Options, UserError } from "./cli/commands.mjs";
 import { AnyHttp, Options as Options$2 } from "./http/client.mjs";
+import "./ActionHttp.mjs";
 import { Effect, Schema } from "effect";
 import { HttpClient, HttpClientError } from "effect/http";
 import { Command } from "effect/cli";
 //#region src/cli/ActionCli.d.ts
-interface AnyBinding {
-  readonly authentication?: {
-    readonly error: Errors;
-  } | undefined;
+interface AnyBinding extends Declaring {
   readonly actions: ReadonlyArray<Any>;
-  readonly error: Errors;
 }
 /**
  * Make a command of your own fail as a derived command does. Give it what the command calls, the

package/dist/ActionCli.mjs

@@ -1,7 +1,6 @@
-import { assertDistinct, assertKnown } from "./contract/rules.mjs";
+import { assertDistinct, assertKnown, bindingErrors, projectedErrors } from "./contract/rules.mjs";
 import { Implementation, acquire, assertHeld, select, toList } from "./contract/implementation.mjs";
-import { withVerifierErrors } from "./authentication/provider.mjs";
-import { assertInBinding, methods } from "./http/client.mjs";
+import { client } from "./ActionHttp.mjs";
 import { command as command$1, failingAsDerived } from "./cli/commands.mjs";
 import { Cause, Effect, Logger, Runtime } from "effect";
 import { Command } from "effect/cli";
@@ -17,8 +16,7 @@ import { Command } from "effect/cli";
 * `Effect.tapError(() => Console.error(…))`: a `UserError` wrapped around the result would
 * replace its JSON.
 */
-const toUserError = (calls) => "actions" in calls ? failingAsDerived(calls.actions, (action) => endpointErrorsOf(calls, action)) : failingAsDerived(calls, () => []);
-const endpointErrorsOf = (binding, action) => withVerifierErrors(action, binding.error, binding.authentication?.error);
+const toUserError = (calls) => "actions" in calls ? failingAsDerived(calls.actions, (action) => bindingErrors(action, calls)) : failingAsDerived(calls, (action) => projectedErrors(action));
 const runWithBuildOfItsOwn = (app, action, input) => {
 	const thisActionOnly = Implementation.share([action], app);
 	return Effect.flatMap(acquire([thisActionOnly]), (bound) => {
@@ -34,11 +32,15 @@ const theImplementationOf = (apps, action) => {
 };
 const inProcess = (apps, action, options) => {
 	const app = theImplementationOf(apps, action);
-	return command$1(action, (input) => runWithBuildOfItsOwn(app, action, input), options);
+	return command$1(action, (input) => runWithBuildOfItsOwn(app, action, input), options, projectedErrors(action));
 };
-const overHttp = (binding, action, options, client) => {
-	assertInBinding(binding.actions, action);
-	return command$1(action, (input) => Effect.flatMap(methods(binding, client), (methodOf) => methodOf(action)(input)), options, endpointErrorsOf(binding, action));
+const overHttp = (binding, action, options, client$1) => {
+	if (!binding.actions.includes(action)) throw new Error(`Action "${action.name}" is not in this HTTP binding`);
+	return command$1(action, (input) => Effect.flatMap(client(binding, client$1), (methods) => {
+		const method = methods[action.name];
+		if (method === void 0) throw new Error(`No client method for ${action.name}`);
+		return method(input);
+	}), options, bindingErrors(action, binding));
 };
 const aggregateCommand = (name, actions, commands, own, project) => {
 	const derived = actions.map((action) => ({

package/dist/ActionHttp.mjs

@@ -1,7 +1,7 @@
-import { Anyone, assertDistinct, assertOnce, assertOwnTags, errorList, projectedErrors } from "./contract/rules.mjs";
-import { acquire, provideHandlers, servedBy, toList } from "./contract/implementation.mjs";
-import { assertAuthentication, providerOf, withVerifierErrors } from "./authentication/provider.mjs";
-import { declared } from "./http/declared.mjs";
+import { Anyone, bindingErrors, bindingOf, declared, projectedErrors } from "./contract/rules.mjs";
+import { acquire, provideHandlers, servingOf } from "./contract/implementation.mjs";
+import { providerOf } from "./authentication/provider.mjs";
+import { inputParseOptions } from "./contract/call.mjs";
 import { methods } from "./http/client.mjs";
 import { SchemaErrors, schemaErrors } from "./http/schema-errors.mjs";
 import { Context, Effect, Layer, Scope } from "effect";
@@ -19,28 +19,24 @@ const apiOf = (group, endpoints) => {
 const endpointOf = (action, path, errors) => HttpApiEndpoint.post(action.name, path, {
 	payload: action.input.pipe(HttpApiSchema.asJson()),
 	success: action.success,
-	error: projectedErrors(action, errors).flatMap(declared)
+	error: errors.flatMap(declared)
 });
 const withinLayerMiddleware = (endpoint, middleware = []) => middleware.reduce((inner, key) => inner.middleware(key), endpoint);
 function make(actions, options = {}) {
-	assertOnce("action", actions);
-	const errors = errorList(options.error);
-	assertOwnTags("ActionHttp binding", errors);
-	assertAuthentication(actions, options.authentication);
+	const bound = bindingOf("ActionHttp binding", actions, options);
 	const mount = mountSegments(options.prefix);
-	const security = options.authentication?.["~middleware"];
+	const security = bound.authentication?.["~middleware"];
 	const endpoints = actions.map((action) => {
 		const isPublic = security === void 0 || action.caller === Anyone;
-		const endpoint = endpointOf(action, absolutePath([...mount, action.name]), withVerifierErrors(action, errors, options.authentication?.error)).annotate(OpenApi.Description, action.description);
+		const endpoint = endpointOf(action, absolutePath([...mount, action.name]), bindingErrors(action, bound)).annotate(OpenApi.Description, action.description);
 		return isPublic ? endpoint : endpoint.middleware(security);
 	});
 	const api = apiOf(groupName(mount), endpoints);
 	return {
 		actions,
-		error: errors,
+		...bound,
 		prefix: absolutePath(mount),
-		api,
-		authentication: options.authentication
+		api
 	};
 }
 const buildInEmptyContext = (group) => Layer.fromBuild((memoMap, scope) => Effect.setContext(Layer.buildWithMemoMap(group, memoMap, scope), Context.empty()));
@@ -52,40 +48,32 @@ var StepUp = class extends HttpApiMiddleware.Service()("effect-actions/ActionHtt
 var JsonContentType = class extends HttpApiMiddleware.Service()("effect-actions/ActionHttp/JsonContentType") {};
 const jsonContentType = () => Layer.succeed(JsonContentType, (route) => Effect.flatMap(HttpServerRequest.HttpServerRequest, (request) => request.headers["content-type"] === void 0 ? Effect.succeed(HttpServerResponse.text("Unsupported content-type: none", { status: 415 })) : route));
 function layer(binding, served, options = {}) {
-	const apps = servedBy("HTTP binding", binding.actions, toList(served), options.actions);
-	const actions = apps.flatMap((app) => app.actions);
-	assertAuthentication(actions, binding.authentication);
-	assertDistinct("middleware", options.middleware ?? [], (key) => key.key);
+	const { apps, actions, authentication } = servingOf("HTTP binding", binding, served, options);
 	const mount = mountSegments(binding.prefix);
 	const name = groupName(mount);
 	const api = apiOf(name, actions.map((action) => {
-		const endpoint = withinLayerMiddleware(endpointOf(action, absolutePath([...mount, action.name]), binding.error).middleware(JsonContentType).middleware(SchemaErrors), options.middleware);
-		return action.caller === Anyone || binding.authentication === void 0 ? endpoint : endpoint.middleware(StepUp).middleware(binding.authentication["~middleware"]);
-	})).annotate(HttpApi.PayloadParseOptions, {
-		errors: "all",
-		onExcessProperty: "error"
-	});
+		const endpoint = withinLayerMiddleware(endpointOf(action, absolutePath([...mount, action.name]), projectedErrors(action, binding.error)).middleware(JsonContentType).middleware(SchemaErrors), options.middleware);
+		return action.caller === Anyone || authentication === void 0 ? endpoint : endpoint.middleware(StepUp).middleware(authentication["~middleware"]);
+	})).annotate(HttpApi.PayloadParseOptions, inputParseOptions);
 	const handlers = Layer.unwrap(Effect.gen(function* () {
 		const bound = yield* acquire(apps);
-		const auth = actions.some((action) => action.caller !== Anyone) ? binding.authentication : void 0;
-		const authentication = auth === void 0 ? Layer.empty : yield* Effect.map(providerOf(auth), (provider) => Layer.mergeAll(Layer.succeed(auth["~middleware"], provider.middleware), Layer.succeed(StepUp, provider.stepUp)));
+		const security = authentication === void 0 ? Layer.empty : yield* Effect.map(providerOf(authentication), (provider) => Layer.mergeAll(Layer.succeed(authentication["~middleware"], provider.middleware), Layer.succeed(StepUp, provider.stepUp)));
 		const hostProvidedMiddleware = yield* Effect.forEach(options.middleware ?? [], (key) => Effect.map(Effect.service(key), (service) => Layer.succeed(key, service)));
 		const byName = Object.fromEntries(bound.map(([action, run]) => [action.name, (request) => run(request.payload)]));
 		return HttpApiBuilder.group(api, name, (builder) => builder.handleAll(byName)).pipe(Layer.provide([
 			schemaErrors(),
 			jsonContentType(),
-			authentication,
+			security,
 			...hostProvidedMiddleware
 		]), buildInEmptyContext);
 	})).pipe(provideHandlers(apps));
 	return HttpApiBuilder.layer(api).pipe(Layer.provide(handlers), Layer.provide(startupBeneathRequest()));
 }
-const erasedClient = (binding, options) => Effect.map(methods(binding, options), (methodOf) => Object.fromEntries(binding.actions.map((action) => [action.name, methodOf(action)])));
 function client(binding, options) {
-	return erasedClient(binding, options);
+	return methods(binding, options);
 }
 function fetchClient(binding, { fetch, ...options } = {}) {
-	return erasedClient(binding, options).pipe(Effect.provide(FetchHttpClient.layer), Effect.provideService(FetchHttpClient.Fetch, fetch ?? ((input, init) => globalThis.fetch(input, init))), Effect.runSync);
+	return methods(binding, options).pipe(Effect.provide(FetchHttpClient.layer), Effect.provideService(FetchHttpClient.Fetch, fetch ?? ((input, init) => globalThis.fetch(input, init))), Effect.runSync);
 }
 //#endregion
 export { client, fetchClient, layer, make };

package/dist/ActionMcp.d.mts

@@ -1,6 +1,7 @@
 import { ActionOf, BuildError, BuildServices, Holding, Known, Member, Protected, SelectedOf, Selection, Served, ServedRequest } from "./contract/implementation.mjs";
 import { Action_d_exports, Any } from "./Action.mjs";
 import { Any as Any$1, Matching, ProviderOf, RemoteRequest, Required, ServerBuildServices } from "./authentication/provider.mjs";
+import { Client, ClientOptions, McpCallError, Params, RequestOptions, client, request } from "./mcp/client.mjs";
 import { Cause, Effect, Layer, Stdio } from "effect";
 import { McpSchema, McpServer } from "effect/ai";
 import { HttpRouter } from "effect/http";
@@ -24,16 +25,29 @@ export interface Options<E = never, R = never, A extends Any = Any> extends Omit
   readonly features?: Layer.Layer<never, E, R> | undefined;
 }
 /**
- * One Streamable HTTP MCP endpoint, speaking MCP 2026-07-28, 2025-11-25 or 2025-06-18, as the
- * client negotiates: `Options`, and every native `McpServer.layerHttp` option, `allowedOrigins`
- * among them, except `protocols` and `allowSessionTermination`, which are fixed, with `path`
- * defaulting to `/mcp`. A client of a 2025 revision opens a session with `initialize`, which
- * lasts until that client ends it with a DELETE, answered 204, or the process stops.
+ * One Streamable HTTP MCP endpoint: `Options`, `authentication`, `requestScoped`, and every native
+ * `McpServer.layerHttp` option, `allowedOrigins` among them, except `protocols` and
+ * `allowSessionTermination`, which are fixed.
  */
 export interface LayerHttpOptions<E = never, R = never, A extends Any = Any> extends Options<E, R, A>, Omit<Parameters<typeof McpServer.layerHttp>[0], "protocols" | "path" | "allowSessionTermination"> {
   /** The endpoint's route; defaults to `/mcp`. */
   readonly path?: HttpRouter.PathInput;
   readonly authentication?: Any$1;
+  /**
+   * Whether MCP 2026-07-28 clients may subscribe, holding a stream open for list changes and
+   * resource updates. Defaults to whether `features` are given: an endpoint of actions alone
+   * registers its tools once, before any client connects, and serves no resource. Pass `true`
+   * where a handler changes the server through `McpServer.McpServer`.
+   */
+  readonly allowSubscriptions?: boolean | undefined;
+  /**
+   * `true` runs a server per request, as Effect's `McpServer.layerHttpRequestScoped` does, for a
+   * host such as Cloudflare Workers where nothing may outlive a request. It speaks MCP 2026-07-28
+   * alone, so a client that opens with `initialize` is refused, and it keeps no session. It has
+   * no subscriptions, so `allowSubscriptions` is ignored, and native `features` send no
+   * list-change notification and cannot use `McpServer.elicit`.
+   */
+  readonly requestScoped?: boolean | undefined;
 }
 type ToolRequestContext<R> = Exclude<R, McpSchema.McpRequestContext | McpServer.McpServer>;
 type HttpToolRequestContext<R> = Exclude<ToolRequestContext<R>, HttpRouter.Provided>;
@@ -47,7 +61,8 @@ type Inferring<D, A extends Any> = [D] extends [undefined] ? [Protected<A>] exte
  * Serve MCP tools over one Streamable HTTP endpoint, speaking MCP 2026-07-28, 2025-11-25 or
  * 2025-06-18, as the client negotiates. A 2026-07-28 request stands alone; a client of a 2025
  * revision opens a session with `initialize`, which holds what it sent there and no identity,
- * and lasts until that client ends it with a DELETE, answered 204, or the process stops.
+ * and lasts until that client ends it with a DELETE, answered 204, or the process stops. For a
+ * serverless host, see `requestScoped`.
  *
  * Protected tools need the `authentication` descriptor their contracts name, and the
  * provider `Authentication.layer` builds from it. On an endpoint of protected tools only,
@@ -76,4 +91,5 @@ export declare function layerHttp<const Apps extends Served, const O extends Sel
  * request identity or authority; each implementation's `authorize` runs for its protected actions.
  */
 export declare function runStdio<const Apps extends Served, const O extends Selection<ActionOf<Member<Apps>>> = {}, E = never, R = never>(implementations: Apps, options: Options<E, R, ActionOf<Member<Apps>>> & O & NoInfer<Known<O, Options<E, R, Any>>>): Effect.Effect<void, BuildError<Holding<Member<Apps>, SelectedOf<O, Apps>>, SelectedOf<O, Apps>> | Cause.IllegalArgumentError | E, BuildServices<Holding<Member<Apps>, SelectedOf<O, Apps>>, SelectedOf<O, Apps>> | Stdio.Stdio | ToolRequestContext<ServedRequest<Member<Apps>, SelectedOf<O, Apps>>> | Features<R>>;
-//#endregion
+//#endregion
+export { type Client, type ClientOptions, McpCallError, type Params, type RequestOptions, client, request };

package/dist/ActionMcp.mjs

@@ -1,20 +1,18 @@
-import { Anyone } from "./contract/rules.mjs";
-import { provideHandlers, select, toList } from "./contract/implementation.mjs";
-import { bindTools } from "./toolkit/tools.mjs";
-import { fieldKey, httpProtocol, isMisplaced, liftOf, liftedFrom, protocols } from "./mcp/protocol.mjs";
-import { assertAuthentication, promote, providerOf } from "./authentication/provider.mjs";
+import { Anyone, assertAuthentication, assertOnce, hintsOf, projectedErrors } from "./contract/rules.mjs";
+import { acquire, provideHandlers, select, toList } from "./contract/implementation.mjs";
+import { promote, providerOf } from "./authentication/provider.mjs";
+import { inputParseOptions } from "./contract/call.mjs";
+import { defaultPath, fieldKey, httpProtocol, isMisplaced, liftOf, liftedFrom, protocols } from "./mcp/protocol.mjs";
 import { recordStepUp } from "./authentication/refusal.mjs";
 import { withStderrConsole } from "./stdio/console.mjs";
-import { Cause, Context, Effect, ErrorReporter, Exit, Fiber, JsonPointer, Layer, Option, Predicate, References, Result, Schema, Stream } from "effect";
-import { AiError, McpSchema, McpServer, Tool, Toolkit } from "effect/ai";
+import { McpCallError, client, request } from "./mcp/client.mjs";
+import { Cause, Context, Effect, ErrorReporter, Exit, Fiber, JsonPointer, Layer, Predicate, Schema } from "effect";
+import { AiError, McpSchema, McpServer } from "effect/ai";
 import { HttpRouter, HttpServerRequest } from "effect/http";
+import { Base64 } from "effect/encoding";
 //#region src/mcp/ActionMcp.ts
-const strictToolProjection = {
-	label: "MCP tool",
-	tool: (tool) => tool.annotate(Tool.Strict, true)
-};
 const isToolArgumentsSchema = Schema.is(McpSchema.ToolJson);
-const nativeToolJsonSchema = (schema, strict) => {
+const toolJsonSchema = (schema, strict) => {
 	const document = Schema.toJsonSchemaDocument(schema, { onExcessProperty: strict ? "error" : "ignore" });
 	const [scope, key] = Predicate.isString(document.schema.$ref) ? JsonPointer.parseUriFragment(document.schema.$ref) ?? [] : [];
 	const root = scope === "$defs" && key !== void 0 ? document.definitions[key] : document.schema;
@@ -24,7 +22,7 @@ const nativeToolJsonSchema = (schema, strict) => {
 	};
 };
 const assertToolShapes = (lifted) => {
-	const inputs = lifted.map(([action]) => action).filter((action) => !isToolArgumentsSchema(nativeToolJsonSchema(Schema.toCodecJson(action.input), true))).map(({ name }) => name);
+	const inputs = lifted.map(([action]) => action).filter((action) => !isToolArgumentsSchema(toolJsonSchema(Schema.toCodecJson(action.input), true))).map(({ name }) => name);
 	if (inputs.length > 0) throw new Error(`MCP tool input must be one object with keys, such as a struct: ${inputs.join(", ")}`);
 	const misplaced = lifted.filter(([action, lift]) => isMisplaced(action, lift)).map(([{ name }]) => name);
 	if (misplaced.length > 0) throw new Error(`MCP media must be the success or an array of it, or a top-level field of a struct success, one, optional or a required array: ${misplaced.join(", ")}`);
@@ -47,99 +45,84 @@ const contentBlockOf = ({ kind, field, value }) => ({
 	mimeType: value.mimeType,
 	...field === void 0 ? {} : { _meta: { [fieldKey]: field } }
 });
-const parameterValidationErrorOf = (error) => AiError.isAiError(error) && Predicate.isTagged(error.reason, "ToolParameterValidationError") ? error.reason : void 0;
-const omitRequestServices = Context.omit(McpSchema.McpRequestContext, McpSchema.McpServerClient, HttpServerRequest.HttpServerRequest, References.CurrentLogLevel);
-const registerToolsLiftingMedia = Effect.fnUntraced(function* (toolkit, lifts) {
+const toolOf = (action, outputSchema) => Effect.map(Schema.decodeUnknownEffect(McpSchema.ToolJson)(toolJsonSchema(Schema.toCodecJson(action.input), true)), (inputSchema) => new McpSchema.Tool({
+	name: action.name,
+	description: action.description,
+	inputSchema,
+	outputSchema,
+	annotations: {
+		...action.mcp.title === void 0 ? {} : { title: action.mcp.title },
+		...hintsOf(action)
+	},
+	_meta: action.mcp._meta === void 0 ? void 0 : { ...action.mcp._meta }
+}));
+const registerTools = Effect.fnUntraced(function* (apps, authentication) {
 	const registry = yield* McpServer.McpServer;
-	const built = yield* toolkit.pipe(Effect.updateContext((context) => Context.merge(context, Context.mergeAll(...Object.values(toolkit.tools).flatMap((tool) => {
-		const key = Context.Service(tool.id);
-		return Option.toArray(Context.getOption(context, key)).map((handler) => Context.make(key, {
-			...handler,
-			context: omitRequestServices(handler.context)
-		}));
-	})))));
-	const retainedServices = omitRequestServices(yield* Effect.context());
-	const propagateInterruptOrReportInternal = (cause) => {
-		const failure = Cause.findFail(cause);
-		return Result.isFailure(failure) && !Cause.hasDies(cause) ? Effect.failCause(failure.failure) : Effect.logError(cause).pipe(Effect.andThen(Effect.provideContext(ErrorReporter.report(cause), retainedServices)), Effect.as(textErrorResult(nativeInternalErrorText)));
-	};
-	const invalidParamsOrInternal = (cause) => {
-		const failure = Cause.findFail(cause);
-		if (Result.isSuccess(failure)) {
-			const { error } = failure.success;
-			const invalid = Context.get(Cause.reasonAnnotations(failure.success), Toolkit.FailureOrigin) === "parameters" ? parameterValidationErrorOf(error) : void 0;
-			if (invalid !== void 0) return Effect.fail(new McpSchema.InvalidParams({ message: invalid.message }));
-		}
-		return propagateInterruptOrReportInternal(cause);
-	};
-	const registrations = yield* Effect.forEach(Object.entries(built.tools), ([name, tool]) => Effect.gen(function* () {
-		const strict = Tool.getStrictMode(tool) === true;
-		const decodeOptions = {
-			onExcessProperty: strict ? "error" : "ignore",
-			errors: "all"
+	const bound = yield* acquire(apps);
+	const built = yield* Effect.context();
+	const internalError = (cause) => Effect.logError(cause).pipe(Effect.andThen(ErrorReporter.report(cause)), Effect.as(textErrorResult(nativeInternalErrorText)));
+	const internalErrorOnDefect = (cause) => Cause.hasDies(cause) ? internalError(cause) : Effect.failCause(cause);
+	for (const [action, run] of bound) {
+		const lift = liftOf(action.success);
+		const media = lift.fields.length === 0 ? void 0 : lift;
+		const structured = media === void 0 ? Schema.toCodecJson(action.success) : media.rest === void 0 ? void 0 : Schema.toCodecJson(media.rest);
+		const outputSchema = structured === void 0 ? void 0 : yield* Schema.decodeUnknownEffect(McpSchema.ToolOutputJson)(toolJsonSchema(structured, false)).pipe(Effect.orDie);
+		const tool = yield* toolOf(action, outputSchema).pipe(Effect.orDie);
+		const decode = Schema.decodeUnknownEffect(Schema.toCodecJson(action.input), inputParseOptions);
+		const encoder = (schema) => {
+			const encode = Schema.encodeUnknownEffect(Schema.toCodecJson(schema));
+			return (value) => Effect.orDie(encode(value));
 		};
-		const lift = lifts.get(name);
-		const media = lift === void 0 || lift.fields.length === 0 ? void 0 : lift;
-		const structured = media === void 0 ? tool.successSchema : media.rest === void 0 ? void 0 : Schema.toCodecJson(media.rest);
-		const outputSchema = structured === void 0 ? void 0 : yield* Schema.decodeUnknownEffect(McpSchema.ToolOutputJson)(nativeToolJsonSchema(structured, false)).pipe(Effect.orDie);
-		const inputSchema = yield* Schema.decodeUnknownEffect(McpSchema.ToolJson)(nativeToolJsonSchema(tool.parametersSchema, strict)).pipe(Effect.orDie);
+		const encodeSuccess = encoder(action.success);
+		const encodeFailure = encoder(Schema.Union(projectedErrors(action)));
+		const call = authentication === void 0 || action.caller === Anyone ? run : (input) => recordStepUp(promote(authentication, run(input)));
 		const liftedFieldNames = new Set(media?.fields.map(({ name }) => name));
-		const resultWithLiftedMedia = ({ encodedResult, result }) => {
+		const resultOf = (encoded, success) => {
 			if (media === void 0) return new McpSchema.CallToolResult({
 				isError: false,
-				structuredContent: encodedResult,
-				content: nativeJsonTextOf(encodedResult)
+				structuredContent: encoded,
+				content: nativeJsonTextOf(encoded)
 			});
-			const blocks = liftedFrom(media, result).map(contentBlockOf);
+			const blocks = liftedFrom(media, success).map(contentBlockOf);
 			if (structured === void 0) return new McpSchema.CallToolResult({
 				isError: false,
 				content: blocks
 			});
-			const encodedRestOfStruct = Predicate.isObject(encodedResult) ? Object.fromEntries(Object.entries(encodedResult).filter(([key]) => !liftedFieldNames.has(key))) : encodedResult;
+			const encodedRestOfStruct = Predicate.isObject(encoded) ? Object.fromEntries(Object.entries(encoded).filter(([key]) => !liftedFieldNames.has(key))) : encoded;
 			return new McpSchema.CallToolResult({
 				isError: false,
 				structuredContent: encodedRestOfStruct,
 				content: [...nativeJsonTextOf(encodedRestOfStruct), ...blocks]
 			});
 		};
-		return {
-			tool: new McpSchema.Tool({
-				name,
-				description: Tool.getDescription(tool),
-				inputSchema,
-				outputSchema,
-				annotations: {
-					...Context.getOption(tool.annotations, Tool.Title).pipe(Option.map((title) => ({ title })), Option.getOrUndefined),
-					readOnlyHint: Context.get(tool.annotations, Tool.Readonly),
-					destructiveHint: Context.get(tool.annotations, Tool.Destructive),
-					idempotentHint: Context.get(tool.annotations, Tool.Idempotent),
-					openWorldHint: Context.get(tool.annotations, Tool.OpenWorld)
-				},
-				_meta: Context.getOrUndefined(tool.annotations, Tool.Meta)
-			}),
-			annotations: tool.annotations,
-			handle: (payload) => built.handle(name, payload ?? {}, void 0, decodeOptions).pipe(Stream.unwrap, Stream.runLast, Effect.flatMap(Effect.fromOption), Effect.flatMap((result) => !result.isFailure ? Effect.succeed(resultWithLiftedMedia(result)) : result.failureOrigin === "handler" ? Effect.succeed(new McpSchema.CallToolResult({
-				isError: true,
-				content: nativeJsonTextOf(result.encodedResult)
-			})) : Effect.failCause(Cause.annotate(Cause.fail(result.result), Context.make(Toolkit.FailureOrigin, result.failureOrigin ?? "result")))), Effect.catchCause(invalidParamsOrInternal), Effect.provideContext(retainedServices))
-		};
-	}));
-	for (const registration of registrations) yield* registry.addTool(registration);
+		yield* registry.addTool({
+			tool,
+			annotations: Context.empty(),
+			handle: (payload) => Effect.annotateCurrentSpan({
+				tool: action.name,
+				parameters: payload ?? {}
+			}).pipe(Effect.andThen(() => decode(payload ?? {})), Effect.mapError(({ message }) => new McpSchema.InvalidParams({ message: new AiError.ToolParameterValidationError({
+				toolName: action.name,
+				description: message
+			}).message })), Effect.flatMap((input) => call(input).pipe(Effect.matchEffect({
+				onFailure: (error) => Effect.map(encodeFailure(error), (encoded) => new McpSchema.CallToolResult({
+					isError: true,
+					content: nativeJsonTextOf(encoded)
+				})),
+				onSuccess: (success) => Effect.map(encodeSuccess(success), (encoded) => resultOf(encoded, success))
+			}))), Effect.catchCause(internalErrorOnDefect), Effect.updateContext((request) => Context.merge(built, request)))
+		});
+	}
 });
 const server = (apps, transport, features = Layer.empty, authentication) => {
-	const binding = bindTools(apps, authentication === void 0 ? strictToolProjection : {
-		...strictToolProjection,
-		handler: (run, action) => (input) => action.caller === Anyone ? run(input) : recordStepUp(promote(authentication, run(input)))
-	});
+	assertOnce("MCP tool", apps.flatMap((app) => app.actions));
 	const lifted = apps.flatMap((app) => app.actions.map((action) => [action, liftOf(action.success)]));
 	assertToolShapes(lifted);
-	const lifts = new Map(lifted.map(([{ name }, lift]) => [name, lift]));
+	const names = new Set(lifted.map(([{ name }]) => name));
 	const register = Effect.gen(function* () {
-		const registry = yield* McpServer.McpServer;
-		const namesClaimedByFeatures = registry.tools.flatMap(({ tool }) => lifts.has(tool.name) ? [tool.name] : []);
+		const namesClaimedByFeatures = (yield* McpServer.McpServer).tools.flatMap(({ tool }) => names.has(tool.name) ? [tool.name] : []);
 		if (namesClaimedByFeatures.length > 0) return yield* Effect.die(/* @__PURE__ */ new Error(`Duplicate MCP tool: ${namesClaimedByFeatures.join(", ")}, claimed by an action and a native feature`));
-		const handlers = yield* Layer.build(binding.layer);
-		yield* registerToolsLiftingMedia(binding.toolkit, lifts).pipe(Effect.setContext(Context.add(handlers, McpServer.McpServer, registry)));
+		yield* registerTools(apps, authentication);
 	});
 	return Layer.effectDiscard(register).pipe(Layer.provide(features), Layer.provide(transport), Layer.fresh, provideHandlers(apps));
 };
@@ -149,7 +132,7 @@ const anonymousMethods = /* @__PURE__ */ new Set([
 	"notifications/cancelled"
 ]);
 const requiresAuthentication = (actions) => {
-	const open = new Set(actions.filter(({ caller }) => caller === Anyone).map(({ name }) => name));
+	const open = new Set(actions.filter(({ caller }) => caller === Anyone).flatMap(({ name }) => [name, `=?base64?${Base64.encode(name)}?=`]));
 	return (headers) => {
 		if (open.size === 0) return true;
 		if (headers["mcp-protocol-version"] !== httpProtocol.protocolVersion) return true;
@@ -165,15 +148,20 @@ const namesItsMethod = (request) => Effect.match(request.json, {
 	onFailure: () => true,
 	onSuccess: (body) => !Predicate.hasProperty(body, "method") || body.method === request.headers["mcp-method"]
 });
-function layerHttp(apps, { actions, features, path, authentication, ...options }) {
+function layerHttp(apps, { actions, features, path = defaultPath, authentication, requestScoped, allowSubscriptions = features !== void 0, ...options }) {
 	const selected = select(toList(apps), actions);
 	const served = selected.flatMap((app) => app.actions);
 	assertAuthentication(served, authentication);
-	const transport = server(selected, McpServer.layerHttp({
+	const transport = server(selected, requestScoped === true ? McpServer.layerHttpRequestScoped({
+		...options,
+		path,
+		protocols: [httpProtocol]
+	}) : McpServer.layerHttp({
 		...options,
-		path: path ?? "/mcp",
+		path,
 		protocols,
-		allowSessionTermination: true
+		allowSessionTermination: true,
+		allowSubscriptions
 	}), features, authentication);
 	if (authentication === void 0) return transport;
 	const required = requiresAuthentication(served);
@@ -188,4 +176,4 @@ function runStdio(apps, { actions, features, ...options }) {
 	return Layer.launch(transport).pipe(withStderrConsole, Effect.forkChild, Effect.flatMap(Fiber.await), Effect.flatMap((exit) => Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause) ? Effect.failCause(exit.cause) : Effect.void));
 }
 //#endregion
-export { layerHttp, runStdio };
+export { McpCallError, client, layerHttp, request, runStdio };

package/dist/ActionRpc.mjs

@@ -1,28 +1,23 @@
-import { InvalidInput } from "./contract/errors.mjs";
-import { Anyone, assertDistinct, assertOnce, assertOwnTags, errorList, projectedErrors } from "./contract/rules.mjs";
-import { acquire, provideHandlers, servedBy, toList } from "./contract/implementation.mjs";
-import { checked } from "./contract/call.mjs";
-import { assertAuthentication, providerOf, withVerifierErrors } from "./authentication/provider.mjs";
+import { Anyone, bindingErrors, bindingOf } from "./contract/rules.mjs";
+import { acquire, provideHandlers, servingOf } from "./contract/implementation.mjs";
+import { providerOf } from "./authentication/provider.mjs";
+import { checked, decodeInput } from "./contract/call.mjs";
 import { Cause, Effect, ErrorReporter, Layer, Predicate, Result, Schema, SchemaTransformation } from "effect";
 import { HttpClientRequest, HttpServerRequest } from "effect/http";
 import { HttpApiBuilder } from "effect/http-api";
 import { Rpc, RpcClient, RpcGroup, RpcSerialization, RpcServer } from "effect/rpc";
 //#region src/rpc/ActionRpc.ts
-const declaredErrorsOf = (action, errors, authentication) => projectedErrors(action, withVerifierErrors(action, errors, authentication?.error));
 function make(actions, options = {}) {
-	assertOnce("action", actions);
-	const errors = errorList(options.error);
-	assertOwnTags("ActionRpc binding", errors);
-	assertAuthentication(actions, options.authentication);
+	const bound = bindingOf("ActionRpc binding", actions, options);
+	const group = RpcGroup.make(...actions.map((action) => Rpc.make(action.name, {
+		payload: action.input,
+		success: action.success,
+		error: Schema.Union(bindingErrors(action, bound))
+	})));
 	return {
 		actions,
-		error: errors,
-		group: RpcGroup.make(...actions.map((action) => Rpc.make(action.name, {
-			payload: action.input,
-			success: action.success,
-			error: Schema.Union(declaredErrorsOf(action, errors, options.authentication))
-		}))),
-		authentication: options.authentication
+		...bound,
+		group
 	};
 }
 const credentialFromRpcHeaders = (security, headers) => HttpApiBuilder.securityDecode(security).pipe(Effect.provideService(HttpServerRequest.HttpServerRequest, HttpServerRequest.fromClientRequest(HttpClientRequest.get("/", { headers }))), Effect.provideService(HttpServerRequest.ParsedSearchParams, {}));
@@ -60,14 +55,11 @@ const callBoundaryOf = (error) => {
 	});
 };
 const handlerOf = (action, run, steps, error) => {
-	const decodeStrictly = Schema.decodeUnknownEffect(Schema.toCodecJson(action.input), {
-		errors: "all",
-		onExcessProperty: "error"
-	});
+	const decode = decodeInput(action);
 	const encode = Schema.encodeUnknownEffect(Schema.toCodecJson(action.success));
 	const boundary = callBoundaryOf(error);
 	return (payload, options) => {
-		const call = Effect.suspend(() => decodeStrictly(payload)).pipe(Effect.mapError(InvalidInput.fromSchemaError), Effect.flatMap(run), Effect.flatMap(encode));
+		const call = Effect.suspend(() => decode(payload)).pipe(Effect.flatMap(run), Effect.flatMap(encode));
 		const wrapped = steps.reduce((inner, step) => Effect.suspend(() => step(inner, {
 			...options,
 			payload
@@ -76,12 +68,8 @@ const handlerOf = (action, run, steps, error) => {
 	};
 };
 function layer(binding, served, options = {}) {
-	const apps = servedBy("RPC binding", binding.actions, toList(served), options.actions);
-	const actions = apps.flatMap((app) => app.actions);
-	assertAuthentication(actions, binding.authentication);
+	const { apps, actions, authentication } = servingOf("RPC binding", binding, served, options);
 	const middleware = options.middleware ?? [];
-	assertDistinct("middleware", middleware, (key) => key.key);
-	const auth = actions.some((action) => action.caller !== Anyone) ? binding.authentication : void 0;
 	const jsonGroup = RpcGroup.make(...actions.map((action) => Rpc.make(action.name, {
 		payload: Schema.Json,
 		success: Schema.Json,
@@ -91,9 +79,9 @@ function layer(binding, served, options = {}) {
 		const { codecFor } = yield* RpcServer.Protocol;
 		if (codecFor !== RpcSerialization.json.codecFor) return yield* Effect.die(/* @__PURE__ */ new Error("ActionRpc serves a protocol speaking JSON: RpcSerialization.layerJson, layerNdjson, layerJsonRpc or layerNdJsonRpc, not another codec, such as schema-binary's"));
 		const listedMiddleware = yield* Effect.forEach(middleware, (key) => Effect.service(key));
-		const authenticate = auth === void 0 ? void 0 : yield* authenticationStepOf(auth);
+		const authenticate = authentication === void 0 ? void 0 : yield* authenticationStepOf(authentication);
 		const bound = yield* acquire(apps);
-		const byName = Object.fromEntries(bound.map(([action, run]) => [action.name, handlerOf(action, run, action.caller === Anyone || authenticate === void 0 ? listedMiddleware : [...listedMiddleware, authenticate], Schema.Union(declaredErrorsOf(action, binding.error, binding.authentication)))]));
+		const byName = Object.fromEntries(bound.map(([action, run]) => [action.name, handlerOf(action, run, action.caller === Anyone || authenticate === void 0 ? listedMiddleware : [...listedMiddleware, authenticate], Schema.Union(bindingErrors(action, binding)))]));
 		return jsonGroup.toLayer(byName);
 	})).pipe(provideHandlers(apps));
 	return RpcServer.layer(jsonGroup, { disableFatalDefects: true }).pipe(Layer.provide(handlers));

package/dist/ActionToolkit.mjs

@@ -1,20 +1,35 @@
-import { Implementation, provideHandlers, select, toList } from "./contract/implementation.mjs";
-import { bindTools } from "./toolkit/tools.mjs";
+import { assertOnce, hintsOf, projectedErrors } from "./contract/rules.mjs";
+import { Implementation, acquire, provideHandlers, select, toList } from "./contract/implementation.mjs";
+import { Effect, Schema } from "effect";
+import { Tool, Toolkit } from "effect/ai";
 //#region src/toolkit/ActionToolkit.ts
+const annotateIfGiven = (tool, key, value) => value === void 0 ? tool : tool.annotate(key, value);
+const annotateFromContract = (tool, action) => {
+	const { readOnlyHint, destructiveHint, idempotentHint, openWorldHint } = hintsOf(action);
+	const { title, _meta } = action.mcp;
+	const hinted = tool.annotate(Tool.Readonly, readOnlyHint).annotate(Tool.Destructive, destructiveHint).annotate(Tool.Idempotent, idempotentHint).annotate(Tool.OpenWorld, openWorldHint);
+	return annotateIfGiven(annotateIfGiven(hinted, Tool.Title, title), Tool.Meta, _meta === void 0 ? void 0 : { ..._meta });
+};
+const jsonToolOf = (action) => Tool.make(action.name, {
+	description: action.description,
+	parameters: Schema.toCodecJson(action.input),
+	success: Schema.toCodecJson(action.success),
+	failure: Schema.toCodecJson(Schema.Union(projectedErrors(action))),
+	failureMode: "return"
+});
 function make(apps, options) {
 	const served = select(toList(apps), options?.actions);
 	const needsApproval = options?.needsApproval;
-	const { toolkit, layer } = bindTools(served, {
-		label: "tool",
-		tool: (tool, action, app) => Object.assign(needsApproval === void 0 ? tool : tool.setNeedsApproval((input, context) => needsApproval({
-			name: action.name,
-			action,
-			input
-		}, context)), { id: `${Implementation.runKey(app)}/${action.name}` })
-	});
+	assertOnce("tool", served.flatMap((app) => app.actions));
+	const toolOf = (action, app) => Object.assign(needsApproval === void 0 ? jsonToolOf(action) : jsonToolOf(action).setNeedsApproval((input, context) => needsApproval({
+		name: action.name,
+		action,
+		input
+	}, context)), { id: `${Implementation.runKey(app)}/${action.name}` });
+	const toolkit = Toolkit.make(...served.flatMap((app) => app.actions.map((action) => annotateFromContract(toolOf(action, app), action))));
 	return {
 		toolkit,
-		layer: layer.pipe(provideHandlers(served))
+		layer: toolkit.toLayer(Effect.map(acquire(served), (bound) => Object.fromEntries(bound.map(([action, run]) => [action.name, run])))).pipe(provideHandlers(served))
 	};
 }
 /**

package/dist/Authentication.mjs

@@ -1,8 +1,7 @@
 import { Unauthenticated, scopeToken } from "./contract/errors.mjs";
 import { assertOwnTags, errorList } from "./contract/rules.mjs";
 import { providerOf } from "./authentication/provider.mjs";
-import { answer, answerStepUp, bearer, challenge, isRefusal, isStepUp, plain } from "./authentication/refusal.mjs";
-import { declaredResponse } from "./http/declared.mjs";
+import { answer, answerStepUp, bearer, challenge, declaredResponse, isRefusal, isStepUp, plain } from "./authentication/refusal.mjs";
 import { Context, Effect, Layer, Match, Option, Predicate, Redacted } from "effect";
 import { HttpEffect, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import { HttpApiBuilder, HttpApiMiddleware, HttpApiSecurity } from "effect/http-api";