@gjermundgaraba/effect-actions 0.15.0 → 0.16.0

package/dist/ActionMcp.d.mts

@@ -25,14 +25,21 @@ export interface Options<E = never, R = never, A extends Any = Any> extends Omit
   readonly features?: Layer.Layer<never, E, R> | undefined;
 }
 /**
- * One Streamable HTTP MCP endpoint: `Options`, every native `McpServer.layerHttp` option,
- * `allowedOrigins` among them, except `protocols` and `allowSessionTermination`, which are fixed,
- * with `path` defaulting to `/mcp`, and `requestScoped`.
+ * One Streamable HTTP MCP endpoint: `Options`, `authentication`, `requestScoped`, and every native
+ * `McpServer.layerHttp` option, `allowedOrigins` among them, except `protocols` and
+ * `allowSessionTermination`, which are fixed.
  */
 export interface LayerHttpOptions<E = never, R = never, A extends Any = Any> extends Options<E, R, A>, Omit<Parameters<typeof McpServer.layerHttp>[0], "protocols" | "path" | "allowSessionTermination"> {
   /** The endpoint's route; defaults to `/mcp`. */
   readonly path?: HttpRouter.PathInput;
   readonly authentication?: Any$1;
+  /**
+   * Whether MCP 2026-07-28 clients may subscribe, holding a stream open for list changes and
+   * resource updates. Defaults to whether `features` are given: an endpoint of actions alone
+   * registers its tools once, before any client connects, and serves no resource. Pass `true`
+   * where a handler changes the server through `McpServer.McpServer`.
+   */
+  readonly allowSubscriptions?: boolean | undefined;
   /**
    * `true` runs a server per request, as Effect's `McpServer.layerHttpRequestScoped` does, for a
    * host such as Cloudflare Workers where nothing may outlive a request. It speaks MCP 2026-07-28

package/dist/ActionMcp.mjs

@@ -148,7 +148,7 @@ const namesItsMethod = (request) => Effect.match(request.json, {
 	onFailure: () => true,
 	onSuccess: (body) => !Predicate.hasProperty(body, "method") || body.method === request.headers["mcp-method"]
 });
-function layerHttp(apps, { actions, features, path = defaultPath, authentication, requestScoped, ...options }) {
+function layerHttp(apps, { actions, features, path = defaultPath, authentication, requestScoped, allowSubscriptions = features !== void 0, ...options }) {
 	const selected = select(toList(apps), actions);
 	const served = selected.flatMap((app) => app.actions);
 	assertAuthentication(served, authentication);
@@ -160,7 +160,8 @@ function layerHttp(apps, { actions, features, path = defaultPath, authentication
 		...options,
 		path,
 		protocols,
-		allowSessionTermination: true
+		allowSessionTermination: true,
+		allowSubscriptions
 	}), features, authentication);
 	if (authentication === void 0) return transport;
 	const required = requiresAuthentication(served);

package/docs/ActionMcp-failures.md

@@ -19,6 +19,7 @@ Search for a fragment of the message. The tasks are in [ActionMcp.md](ActionMcp.
 - An MCP client gets an `isError` refusal, not the 401 or 403 it re-authorizes on: the handler sent a notification first, which starts the response, so its refusal is a tool result. Refuse in `authorize`.
 - A client that opens with `initialize` gets 401 where it lists the tools or calls a public one, on an endpoint that also serves protected tools: a session's every request authenticates. Sign the client in, or serve the public tools on an endpoint of their own.
 - A client that opens with `initialize`, such as Codex, gets 400 with JSON-RPC error `-32020`, `MCP-Protocol-Version header is required`, or 401 signed out where the endpoint serves a protected tool, and a `DELETE` gets 405: the endpoint is `requestScoped`, which speaks MCP 2026-07-28 alone and keeps no session. Connect that client to an endpoint without it, on a host that keeps a process running.
+- `subscriptions/listen` answered with JSON-RPC error `-32601`, Method not found: an endpoint without `features` has no 2026-07-28 subscriptions unless `allowSubscriptions` is `true`, and a `requestScoped` one has none. Pass `true` where a handler changes the server through `McpServer.McpServer`.
 - A request over HTTP answers 400, `MCP-Session-Id header is required; send initialize to start a session`: its `MCP-Protocol-Version` header is absent or names a 2025 revision, so it is a session's request, and it follows no `initialize`. One answering 404 names a session that ended, or one of a process since restarted: the client opens another.
 - A hand-written HTTP request answers 400 with JSON-RPC error `-32602`, `Required request metadata is missing` or `io.modelcontextprotocol/clientCapabilities request metadata is required`: it names 2026-07-28 in `MCP-Protocol-Version` and its `params._meta` lacks `io.modelcontextprotocol/protocolVersion`, for the first message, or `io.modelcontextprotocol/clientCapabilities`, for the second. Build it with `ActionMcp.request`, or copy the `curl` of [mcp-tools](../examples/mcp-tools/README.md#connect-a-client).
 - A hand-written HTTP request answers 400 with JSON-RPC error `-32020`, `MCP-Protocol-Version header is required`, `Mcp-Method header does not match request method` or `Mcp-Name header does not match request parameters`: those headers repeat a 2026-07-28 request's revision, method and `tools/call` name, and one is absent or differs from its body. Build it with `ActionMcp.request`.

package/docs/ActionMcp.md

@@ -25,22 +25,22 @@ Import `@gjermundgaraba/effect-actions/ActionMcp`.
 
 `implementations` is one implementation or a list.
 
-| Option                               | Meaning                                                    |
-| ------------------------------------ | ---------------------------------------------------------- |
-| `name`, `version`                    | Required server information.                               |
-| `description`, `websiteUrl`, `icons` | Optional server information.                               |
-| `instructions`                       | Optional text for the model about the server as a whole.   |
-| `extensions`                         | Optional native capability extensions.                     |
-| `actions`                            | The implementations' actions that are tools; default all.  |
-| `features`                           | One Layer of native resources, prompts and tools to serve. |
-| `path`                               | HTTP only: the endpoint's path; defaults to `/mcp`.        |
-| `allowedOrigins`                     | HTTP only: the exact origins allowed; none by default.     |
-| `allowSubscriptions`                 | HTTP only: `false` turns off 2026-07-28 subscriptions.     |
-| `requestScoped`                      | HTTP only: `true` runs a server per request.               |
-| `authentication`                     | HTTP only: the protected tools' authentication descriptor. |
+| Option                               | Meaning                                                     |
+| ------------------------------------ | ----------------------------------------------------------- |
+| `name`, `version`                    | Required server information.                                |
+| `description`, `websiteUrl`, `icons` | Optional server information.                                |
+| `instructions`                       | Optional text for the model about the server as a whole.    |
+| `extensions`                         | Optional native capability extensions.                      |
+| `actions`                            | The implementations' actions that are tools; default all.   |
+| `features`                           | One Layer of native resources, prompts and tools to serve.  |
+| `path`                               | HTTP only: the endpoint's path; defaults to `/mcp`.         |
+| `allowedOrigins`                     | HTTP only: the exact origins allowed; none by default.      |
+| `allowSubscriptions`                 | HTTP only: 2026-07-28 subscriptions; default if `features`. |
+| `requestScoped`                      | HTTP only: `true` runs a server per request.                |
+| `authentication`                     | HTTP only: the protected tools' authentication descriptor.  |
 
 All but `actions`, `features`, `authentication` and `requestScoped` are Effect's own `McpServer`
-options, passed through. Its `protocols` and `allowSessionTermination` are not options.
+options. Its `protocols` and `allowSessionTermination` are not options.
 
 `client` takes `url`, default `/mcp`, `transformClient`, and the endpoint's `authentication`, so an
 error its verifier declares decodes; `request` takes `url` and `headers`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/effect-actions",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Define Effect action contracts once and project them onto HTTP, MCP, Effect RPC, native Toolkits, and CLIs.",
   "keywords": [
     "ai-agents",