@gjermundgaraba/effect-actions 0.15.0 → 0.17.0

package/dist/Action.d.mts

@@ -1,12 +1,10 @@
-import { Anyone } from "./contract/rules.mjs";
+import { Anyone } from "./contract/caller.mjs";
 import { BuiltIn, BuiltIns, Forbidden, InvalidInput, Issue, Refusal, Unauthenticated } from "./contract/errors.mjs";
 import { ActionOf, AnyImplementation, Authorize, BuildError, BuildServices, Holding, Implementation, Known, Member, Offered, OptionalUnless, Protected, RequestOf, SelectedOf, Served, Serving } from "./contract/implementation.mjs";
 import { Call } from "./contract/call.mjs";
 import { Image } from "./contract/media.mjs";
 import { Context, Effect, Layer, Schema, Scope } from "effect";
-declare namespace Action_d_exports {
-  export { Action, Any, AnyImplementation, Anyone, Authorize, BuildError, BuildServices, BuiltIn, Client, ClientOptions, Errors, Forbidden, Handler, Handlers, Image, Implementation, InvalidInput, Issue, Mcp, Options, Refusal, Unauthenticated, allowAll, byName, client, implement, layer, make };
-}
+//#region src/contract/Action.d.ts
 type Codec = Schema.Codec<unknown, unknown, never, never>;
 type Fields = {
   readonly [key: string]: Codec;
@@ -213,4 +211,4 @@ export interface ClientOptions<A extends Any> {
  */
 export declare function client<const Apps extends Served, const O extends ClientOptions<ActionOf<Member<Apps>>> = {}>(implementations: Apps, ...options: OptionalUnless<O, ClientOptions<ActionOf<Member<Apps>>> & O & NoInfer<Known<O, ClientOptions<Any>>>>): Effect.Effect<Client<Apps, Offered<O, ActionOf<Member<Apps>>>>, BuildError<Holding<Member<Apps>, SelectedOf<O, Apps>>, SelectedOf<O, Apps>>, BuildServices<Holding<Member<Apps>, SelectedOf<O, Apps>>, SelectedOf<O, Apps>> | Scope.Scope>;
 //#endregion
-export { Action_d_exports, type AnyImplementation, Anyone, type Authorize, type BuildError, type BuildServices, BuiltIn, Forbidden, Image, type Implementation, InvalidInput, type Issue, Refusal, Unauthenticated };
+export { type AnyImplementation, Anyone, type Authorize, type BuildError, type BuildServices, BuiltIn, Forbidden, Image, type Implementation, InvalidInput, type Issue, Refusal, Unauthenticated };

package/dist/Action.mjs

@@ -1,5 +1,7 @@
+import { Anyone } from "./contract/caller.mjs";
 import { BuiltIn, Forbidden, InvalidInput, Refusal, Unauthenticated } from "./contract/errors.mjs";
-import { Anyone, assertKnown, assertName, assertOnce, assertOwnTags, errorList, projectedErrors } from "./contract/rules.mjs";
+import { assertKnown, assertName, assertOnce } from "./contract/names.mjs";
+import { assertOwnTags, errorList, projectedErrors } from "./contract/declared.mjs";
 import { Implementation, builders, built, memoized, select, toList } from "./contract/implementation.mjs";
 import { inputOf } from "./contract/call.mjs";
 import { Image } from "./contract/media.mjs";

package/dist/ActionCli.d.mts

@@ -1,8 +1,8 @@
-import { Declaring } from "./contract/rules.mjs";
 import { BuiltIn } from "./contract/errors.mjs";
 import { ActionOf, BuildError, BuildServices, Holding, Known, Member, RequestOf, Selected, SelectedOf, Selection, Served } from "./contract/implementation.mjs";
-import { Action_d_exports, Any } from "./Action.mjs";
+import { Any } from "./Action.mjs";
 import { VerifierError } from "./authentication/provider.mjs";
+import { Declaring } from "./contract/declared.mjs";
 import { Options, UserError } from "./cli/commands.mjs";
 import { AnyHttp, Options as Options$2 } from "./http/client.mjs";
 import "./ActionHttp.mjs";

package/dist/ActionCli.mjs

@@ -1,4 +1,5 @@
-import { assertDistinct, assertKnown, bindingErrors, projectedErrors } from "./contract/rules.mjs";
+import { assertDistinct, assertKnown } from "./contract/names.mjs";
+import { bindingErrors, projectedErrors } from "./contract/declared.mjs";
 import { Implementation, acquire, assertHeld, select, toList } from "./contract/implementation.mjs";
 import { client } from "./ActionHttp.mjs";
 import { command as command$1, failingAsDerived } from "./cli/commands.mjs";

package/dist/ActionHttp.d.mts

@@ -1,8 +1,9 @@
-import { Anyone, Certain, ErrorsOf } from "./contract/rules.mjs";
+import { Anyone } from "./contract/caller.mjs";
 import { BuiltIn, BuiltIns } from "./contract/errors.mjs";
 import { BuildError, Holding, Known, Member, MiddlewareOf, Protected, Selected, Served, Serving } from "./contract/implementation.mjs";
-import { Action_d_exports, Any, Errors } from "./Action.mjs";
+import { Any, Errors } from "./Action.mjs";
 import { Any as Any$1, DescriptorOf, Identity, Matching, PublicOnly, RemoteRequest, Required, ServedProvider, ServerBuildServices, VerifierError } from "./authentication/provider.mjs";
+import { Certain, ErrorsOf } from "./contract/declared.mjs";
 import { AnyHttp, Client, MethodError, Options } from "./http/client.mjs";
 import { Context, Effect, FileSystem, Layer, Path, Schema, Types } from "effect";
 import { Etag, HttpClient, HttpPlatform, HttpRouter } from "effect/http";

package/dist/ActionHttp.mjs

@@ -1,7 +1,9 @@
-import { Anyone, bindingErrors, bindingOf, declared, projectedErrors } from "./contract/rules.mjs";
+import { Anyone } from "./contract/caller.mjs";
+import { bindingErrors, bindingOf, projectedErrors } from "./contract/declared.mjs";
 import { acquire, provideHandlers, servingOf } from "./contract/implementation.mjs";
 import { providerOf } from "./authentication/provider.mjs";
 import { inputParseOptions } from "./contract/call.mjs";
+import { declared } from "./contract/status.mjs";
 import { methods } from "./http/client.mjs";
 import { SchemaErrors, schemaErrors } from "./http/schema-errors.mjs";
 import { Context, Effect, Layer, Scope } from "effect";

package/dist/ActionMcp.d.mts

@@ -1,5 +1,5 @@
 import { ActionOf, BuildError, BuildServices, Holding, Known, Member, Protected, SelectedOf, Selection, Served, ServedRequest } from "./contract/implementation.mjs";
-import { Action_d_exports, Any } from "./Action.mjs";
+import { Any } from "./Action.mjs";
 import { Any as Any$1, Matching, ProviderOf, RemoteRequest, Required, ServerBuildServices } from "./authentication/provider.mjs";
 import { Client, ClientOptions, McpCallError, Params, RequestOptions, client, request } from "./mcp/client.mjs";
 import { Cause, Effect, Layer, Stdio } from "effect";
@@ -25,14 +25,21 @@ export interface Options<E = never, R = never, A extends Any = Any> extends Omit
   readonly features?: Layer.Layer<never, E, R> | undefined;
 }
 /**
- * One Streamable HTTP MCP endpoint: `Options`, every native `McpServer.layerHttp` option,
- * `allowedOrigins` among them, except `protocols` and `allowSessionTermination`, which are fixed,
- * with `path` defaulting to `/mcp`, and `requestScoped`.
+ * One Streamable HTTP MCP endpoint: `Options`, `authentication`, `requestScoped`, and every native
+ * `McpServer.layerHttp` option, `allowedOrigins` among them, except `protocols` and
+ * `allowSessionTermination`, which are fixed.
  */
 export interface LayerHttpOptions<E = never, R = never, A extends Any = Any> extends Options<E, R, A>, Omit<Parameters<typeof McpServer.layerHttp>[0], "protocols" | "path" | "allowSessionTermination"> {
   /** The endpoint's route; defaults to `/mcp`. */
   readonly path?: HttpRouter.PathInput;
   readonly authentication?: Any$1;
+  /**
+   * Whether MCP 2026-07-28 clients may subscribe, holding a stream open for list changes and
+   * resource updates. Defaults to whether `features` are given: an endpoint of actions alone
+   * registers its tools once, before any client connects, and serves no resource. Pass `true`
+   * where a handler changes the server through `McpServer.McpServer`.
+   */
+  readonly allowSubscriptions?: boolean | undefined;
   /**
    * `true` runs a server per request, as Effect's `McpServer.layerHttpRequestScoped` does, for a
    * host such as Cloudflare Workers where nothing may outlive a request. It speaks MCP 2026-07-28

package/dist/ActionMcp.mjs

@@ -1,4 +1,7 @@
-import { Anyone, assertAuthentication, assertOnce, hintsOf, projectedErrors } from "./contract/rules.mjs";
+import { Anyone, assertAuthentication } from "./contract/caller.mjs";
+import { assertOnce } from "./contract/names.mjs";
+import { projectedErrors } from "./contract/declared.mjs";
+import { hintsOf } from "./contract/hints.mjs";
 import { acquire, provideHandlers, select, toList } from "./contract/implementation.mjs";
 import { promote, providerOf } from "./authentication/provider.mjs";
 import { inputParseOptions } from "./contract/call.mjs";
@@ -148,7 +151,7 @@ const namesItsMethod = (request) => Effect.match(request.json, {
 	onFailure: () => true,
 	onSuccess: (body) => !Predicate.hasProperty(body, "method") || body.method === request.headers["mcp-method"]
 });
-function layerHttp(apps, { actions, features, path = defaultPath, authentication, requestScoped, ...options }) {
+function layerHttp(apps, { actions, features, path = defaultPath, authentication, requestScoped, allowSubscriptions = features !== void 0, ...options }) {
 	const selected = select(toList(apps), actions);
 	const served = selected.flatMap((app) => app.actions);
 	assertAuthentication(served, authentication);
@@ -160,7 +163,8 @@ function layerHttp(apps, { actions, features, path = defaultPath, authentication
 		...options,
 		path,
 		protocols,
-		allowSessionTermination: true
+		allowSessionTermination: true,
+		allowSubscriptions
 	}), features, authentication);
 	if (authentication === void 0) return transport;
 	const required = requiresAuthentication(served);

package/dist/ActionRpc.d.mts

@@ -1,9 +1,10 @@
-import { Anyone, Certain, ErrorsOf } from "./contract/rules.mjs";
+import { Anyone } from "./contract/caller.mjs";
 import { BuiltIn, BuiltIns } from "./contract/errors.mjs";
 import { BuildError, Holding, Known, Member, MiddlewareOf, Protected, Selected, Served, Serving } from "./contract/implementation.mjs";
 import { Call } from "./contract/call.mjs";
-import { Action_d_exports, Any as Any$1, Errors } from "./Action.mjs";
+import { Any as Any$1, Errors } from "./Action.mjs";
 import { Any as Any$2, DescriptorOf, Identity, Matching, PublicOnly, RemoteRequest, Required, ServedProvider, ServerBuildServices, VerifierError } from "./authentication/provider.mjs";
+import { Certain, ErrorsOf } from "./contract/declared.mjs";
 import { Context, Effect, Layer, Schema, Scope, Types } from "effect";
 import { HttpRouter } from "effect/http";
 import { Rpc, RpcClient, RpcClientError, RpcGroup, RpcMiddleware, RpcServer } from "effect/rpc";
@@ -144,4 +145,5 @@ export type ClientOptions = Omit<NonNullable<Parameters<typeof RpcClient.make>[1
  * or with Effect's own `RpcClientError` when the server could not be reached.
  */
 export declare function client<const B extends Any>(binding: B, options?: ClientOptions): Effect.Effect<Client<B>, never, RpcClient.Protocol | Scope.Scope>;
-//#endregion
+//#endregion
+export {};

package/dist/ActionRpc.mjs

@@ -1,4 +1,5 @@
-import { Anyone, bindingErrors, bindingOf } from "./contract/rules.mjs";
+import { Anyone } from "./contract/caller.mjs";
+import { bindingErrors, bindingOf } from "./contract/declared.mjs";
 import { acquire, provideHandlers, servingOf } from "./contract/implementation.mjs";
 import { providerOf } from "./authentication/provider.mjs";
 import { checked, decodeInput } from "./contract/call.mjs";

package/dist/ActionToolkit.d.mts

@@ -1,6 +1,6 @@
 import { BuiltIns } from "./contract/errors.mjs";
 import { ActionOf, BuildError, BuildServices, Holding, Known, Member, Offered, OptionalUnless, RequestOf, SelectedOf, Served, Serving } from "./contract/implementation.mjs";
-import { Action_d_exports, Any } from "./Action.mjs";
+import { Any } from "./Action.mjs";
 import { Effect, Layer, Schema } from "effect";
 import { Prompt, Tool, Toolkit } from "effect/ai";
 //#region src/toolkit/ActionToolkit.d.ts
@@ -85,4 +85,5 @@ export interface Approval {
  * `examples/kitchen-sink/src/assistant/handlers.ts`.
  */
 export declare const openApprovals: ({ content: messages }: Prompt.Prompt) => ReadonlyArray<Approval>;
-//#endregion
+//#endregion
+export {};

package/dist/ActionToolkit.mjs

@@ -1,4 +1,6 @@
-import { assertOnce, hintsOf, projectedErrors } from "./contract/rules.mjs";
+import { assertOnce } from "./contract/names.mjs";
+import { projectedErrors } from "./contract/declared.mjs";
+import { hintsOf } from "./contract/hints.mjs";
 import { Implementation, acquire, provideHandlers, select, toList } from "./contract/implementation.mjs";
 import { Effect, Schema } from "effect";
 import { Tool, Toolkit } from "effect/ai";

package/dist/Authentication.d.mts

@@ -1,8 +1,8 @@
-import { ErrorsOf } from "./contract/rules.mjs";
 import { Refusal } from "./contract/errors.mjs";
 import { Known, OptionalUnless } from "./contract/implementation.mjs";
 import { Errors } from "./Action.mjs";
 import { Any, Descriptor, Provider, Security } from "./authentication/provider.mjs";
+import { ErrorsOf } from "./contract/declared.mjs";
 import { Array, Context, Effect, Layer, Option, Redacted, Scope } from "effect";
 import { HttpRouter, HttpServerResponse } from "effect/http";
 import { HttpApiSecurity } from "effect/http-api";

package/dist/Authentication.mjs

@@ -1,5 +1,5 @@
 import { Unauthenticated, scopeToken } from "./contract/errors.mjs";
-import { assertOwnTags, errorList } from "./contract/rules.mjs";
+import { assertOwnTags, errorList } from "./contract/declared.mjs";
 import { providerOf } from "./authentication/provider.mjs";
 import { answer, answerStepUp, bearer, challenge, declaredResponse, isRefusal, isStepUp, plain } from "./authentication/refusal.mjs";
 import { Context, Effect, Layer, Match, Option, Predicate, Redacted } from "effect";

package/dist/authentication/provider.d.mts

@@ -1,7 +1,7 @@
-import { Anyone } from "../contract/rules.mjs";
+import { Anyone } from "../contract/caller.mjs";
 import { Refusal } from "../contract/errors.mjs";
 import { BuildServices, Protected, ServedRequest, Serving } from "../contract/implementation.mjs";
-import { Action_d_exports, Any as Any$1, Errors } from "../Action.mjs";
+import { Any as Any$1, Errors } from "../Action.mjs";
 import { Context, Effect } from "effect";
 import { HttpRouter, HttpServerResponse } from "effect/http";
 import { HttpApiMiddleware, HttpApiSecurity } from "effect/http-api";

package/dist/authentication/refusal.mjs

@@ -1,5 +1,5 @@
 import { Forbidden, Refusal, Unauthenticated } from "../contract/errors.mjs";
-import { declared, httpApiStatusOf } from "../contract/rules.mjs";
+import { declared, httpApiStatusOf } from "../contract/status.mjs";
 import { Cause, Context, Effect, Exit, Option, Predicate, Ref, Schema } from "effect";
 import { HttpServerResponse } from "effect/http";
 //#region src/authentication/refusal.ts

package/dist/cli/commands.d.mts

@@ -1,5 +1,5 @@
 import "../contract/errors.mjs";
-import { Action_d_exports, Any } from "../Action.mjs";
+import { Any } from "../Action.mjs";
 import { Effect, Runtime, Types } from "effect";
 import { CliError, Command } from "effect/cli";
 //#region src/cli/commands.d.ts
@@ -44,4 +44,5 @@ export declare class UserError<out E = unknown> extends CliError.UserError {
   get reason(): E;
   get [Runtime.errorExitCode](): number;
 }
-//#endregion
+//#endregion
+export {};

package/dist/cli/commands.mjs

@@ -1,5 +1,6 @@
+import { literalValues, members, unsuspended } from "../contract/ast.mjs";
 import { InvalidInput } from "../contract/errors.mjs";
-import { assertDistinct, literalValues, members, unsuspended } from "../contract/rules.mjs";
+import { assertDistinct } from "../contract/names.mjs";
 import { decodeInput } from "../contract/call.mjs";
 import { withStderrConsole } from "../stdio/console.mjs";
 import { Console, Effect, Option, Predicate, Record, Runtime, Schema, SchemaAST, Stdio, Stream } from "effect";

package/dist/contract/ast.mjs

@@ -0,0 +1,10 @@
+import { SchemaAST } from "effect";
+//#region src/contract/ast.ts
+const unsuspended = (ast) => SchemaAST.isSuspend(ast) ? unsuspended(ast.thunk()) : ast;
+const members = (ast) => {
+	const resolved = unsuspended(ast);
+	return SchemaAST.isUnion(resolved) ? resolved.types.flatMap(members) : [resolved];
+};
+const literalValues = (ast) => SchemaAST.isLiteral(ast) ? [ast.literal] : SchemaAST.isEnum(ast) ? ast.enums.map(([, value]) => value) : [void 0];
+//#endregion
+export { literalValues, members, unsuspended };

package/dist/contract/call.d.mts

@@ -1,6 +1,6 @@
 import "./errors.mjs";
 import "./implementation.mjs";
-import { Action_d_exports, Any } from "../Action.mjs";
+import { Any } from "../Action.mjs";
 import { Effect, Schema } from "effect";
 //#region src/contract/call.d.ts
 /**

package/dist/contract/caller.d.mts

@@ -0,0 +1,9 @@
+import "../Action.mjs";
+//#region src/contract/caller.d.ts
+/**
+ * The caller of a public action, `caller: Action.Anyone`: anyone, signed in or not, and no
+ * authorizer runs for it. Registered globally, so two copies of the package agree on it, as they
+ * agree on a name.
+ */
+export declare const Anyone: unique symbol;
+//#endregion

package/dist/contract/caller.mjs

@@ -0,0 +1,12 @@
+//#region src/contract/caller.ts
+/**
+* The caller of a public action, `caller: Action.Anyone`: anyone, signed in or not, and no
+* authorizer runs for it. Registered globally, so two copies of the package agree on it, as they
+* agree on a name.
+*/
+const Anyone = Symbol.for("@gjermundgaraba/effect-actions/Anyone");
+const assertAuthentication = (actions, authentication) => {
+	for (const action of actions) if (action.caller !== Anyone && (authentication === void 0 || action.caller.key !== authentication.identity.key)) throw new Error(`Protected action '${action.name}' requires its matching authentication descriptor`);
+};
+//#endregion
+export { Anyone, assertAuthentication };

package/dist/contract/{rules.d.mts → declared.d.mts}

@@ -1,6 +1,7 @@
-import { Action_d_exports, Errors } from "../Action.mjs";
-import { SchemaAST, Types } from "effect";
-//#region src/contract/rules.d.ts
+import "./caller.mjs";
+import { Errors } from "../Action.mjs";
+import { Types } from "effect";
+//#region src/contract/declared.d.ts
 type ListOf<G> = G extends Errors ? G : readonly [G];
 /**
  * The errors options `O` declare, as at run time: those `error` always gives, or, where it may
@@ -23,10 +24,5 @@ export interface Declaring {
     readonly error: Errors;
   } | undefined;
 }
-/**
- * The caller of a public action, `caller: Action.Anyone`: anyone, signed in or not, and no
- * authorizer runs for it. Registered globally, so two copies of the package agree on it, as they
- * agree on a name.
- */
-export declare const Anyone: unique symbol;
-//#endregion
+//#endregion
+export {};

package/dist/contract/declared.mjs

@@ -0,0 +1,42 @@
+import { literalValues, members } from "./ast.mjs";
+import { Anyone, assertAuthentication } from "./caller.mjs";
+import { builtIns } from "./errors.mjs";
+import { assertOnce } from "./names.mjs";
+import { Predicate, Schema, SchemaAST } from "effect";
+//#region src/contract/declared.ts
+const errorList = (error) => error === void 0 ? [] : Schema.isSchema(error) ? [error] : error;
+const projectedErrors = (action, surface = []) => [.../* @__PURE__ */ new Set([
+	...builtIns,
+	...action.error,
+	...surface
+])];
+/**
+* Every error a binding's call of `action` declares: the built-in ones, the action's, the
+* binding's and, where `action` is protected, its authentication's.
+*/
+const bindingErrors = (action, binding) => projectedErrors(action, action.caller === Anyone || binding.authentication === void 0 ? binding.error : [...binding.error, ...binding.authentication.error]);
+const encodedTags = (ast) => members(SchemaAST.toEncoded(ast)).flatMap((member) => {
+	const tag = SchemaAST.isObjects(member) ? member.propertySignatures.find((property) => property.name === "_tag")?.type : void 0;
+	return tag === void 0 ? [] : members(tag).flatMap(literalValues).filter(Predicate.isString);
+});
+const builtInTags = new Set(builtIns.flatMap((error) => encodedTags(error.ast)));
+const assertOwnTags = (what, errors) => {
+	const tag = errors.flatMap((error) => encodedTags(error.ast)).find((tag) => builtInTags.has(tag));
+	if (tag !== void 0) throw new Error(`${what}: error _tag "${tag}" is built in, and declared on every surface`);
+};
+/**
+* The checks `ActionHttp.make` and `ActionRpc.make` share: each action once, no built-in error in
+* `error`, and the descriptor every protected action names. Returns `error` as a list.
+*/
+const bindingOf = (what, actions, options) => {
+	assertOnce("action", actions);
+	const error = errorList(options.error);
+	assertOwnTags(what, error);
+	assertAuthentication(actions, options.authentication);
+	return {
+		error,
+		authentication: options.authentication
+	};
+};
+//#endregion
+export { assertOwnTags, bindingErrors, bindingOf, errorList, projectedErrors };

package/dist/contract/hints.mjs

@@ -0,0 +1,14 @@
+//#region src/contract/hints.ts
+/**
+* An action's MCP tool hints, MCP's defaults where its `mcp` leaves one out: a write destructive,
+* a read not, no tool idempotent and every tool open-world. A given value passes through, as MCP
+* calls `destructiveHint` and `idempotentHint` meaningless on a read-only tool.
+*/
+const hintsOf = ({ readOnly, mcp }) => ({
+	readOnlyHint: readOnly,
+	destructiveHint: mcp.destructiveHint ?? !readOnly,
+	idempotentHint: mcp.idempotentHint ?? false,
+	openWorldHint: mcp.openWorldHint ?? true
+});
+//#endregion
+export { hintsOf };

package/dist/contract/implementation.d.mts

@@ -1,6 +1,6 @@
-import { Anyone } from "./rules.mjs";
+import { Anyone } from "./caller.mjs";
 import { Refusal } from "./errors.mjs";
-import { Action_d_exports, Any } from "../Action.mjs";
+import { Any } from "../Action.mjs";
 import { Context, Effect, Layer, Scope } from "effect";
 //#region src/contract/implementation.d.ts
 /** Decoded values at the dispatch boundary every surface shares. */
@@ -192,4 +192,5 @@ export type BuildServices<App, Listed extends Any = OwnActions<App>> = App exten
   readonly "~buildServices": infer RX;
   readonly "~authorizeBuildServices": infer RAX;
 } ? RX | ([Protected<Serving<App, Listed>>] extends [never] ? never : RAX) : never;
-//#endregion
+//#endregion
+export {};

package/dist/contract/implementation.mjs

@@ -1,5 +1,7 @@
+import { Anyone, assertAuthentication } from "./caller.mjs";
 import { Unauthenticated } from "./errors.mjs";
-import { Anyone, assertAuthentication, assertDistinct, assertOnce, projectedErrors } from "./rules.mjs";
+import { assertDistinct, assertOnce } from "./names.mjs";
+import { projectedErrors } from "./declared.mjs";
 import { Array, Cause, Context, Effect, Exit, Layer, Option, Schema } from "effect";
 //#region src/contract/implementation.ts
 const uniqueKey = () => Math.random().toString(36).slice(2);
@@ -152,13 +154,7 @@ const dispatch = (action, handle, before) => {
 		} else reasons.push(reason);
 		return yield* Effect.failCause(Cause.fromReasons(reasons));
 	});
-	return (input) => {
-		const handled = Effect.withSpan(Effect.annotateLogs(Effect.suspend(() => handle(input)), actionAttributes), action.name, {
-			captureStackTrace: false,
-			attributes: actionAttributes
-		});
-		return Effect.scoped(authentication.pipe(Effect.andThen(authorization), Effect.andThen(handled), Effect.catchCause(declaredOrDefect)));
-	};
+	return (input) => Effect.scoped(authentication.pipe(Effect.andThen(authorization), Effect.andThen(Effect.suspend(() => handle(input))), Effect.catchCause(declaredOrDefect))).pipe(Effect.annotateLogs(actionAttributes), Effect.withSpan(action.name, { attributes: actionAttributes }, { captureStackTrace: false }));
 };
 //#endregion
 export { Implementation, acquire, assertHeld, builders, built, memoized, provideHandlers, select, servingOf, toList };

package/dist/contract/names.mjs

@@ -0,0 +1,25 @@
+//#region src/contract/names.ts
+const validName = /^[A-Za-z0-9_-]{1,128}$/;
+const assertName = (what, name) => {
+	if (!validName.test(name) || name === "then") throw new Error(`Invalid ${what}: ${name}`);
+};
+const assertDistinct = (what, items, nameOf, claimantOf = nameOf) => {
+	const seen = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const name = nameOf(item);
+		const claimant = claimantOf(item);
+		const other = seen.get(name);
+		if (other !== void 0) {
+			const by = other === claimant ? "" : `, claimed by ${other} and ${claimant}`;
+			throw new Error(`Duplicate ${what}: ${name}${by}`);
+		}
+		seen.set(name, claimant);
+	}
+};
+const assertOnce = (what, actions) => assertDistinct(what, actions, (action) => action.name);
+const assertKnown = (what, keys, names) => {
+	const unknown = keys.filter((key) => !names.includes(key));
+	if (unknown.length > 0) throw new Error(`Unknown ${what}: ${unknown.join(", ")}`);
+};
+//#endregion
+export { assertDistinct, assertKnown, assertName, assertOnce };

package/dist/contract/status.mjs

@@ -0,0 +1,18 @@
+import { unsuspended } from "./ast.mjs";
+import { Schema, SchemaAST } from "effect";
+//#region src/contract/status.ts
+const httpApiStatusOf = SchemaAST.resolveAt("httpApiStatus");
+const statusThroughSuspensions = (ast) => httpApiStatusOf(ast) ?? (SchemaAST.isSuspend(ast) ? statusThroughSuspensions(ast.thunk()) : void 0);
+/**
+* `error` as an endpoint declares it: each member of a union without a status of its own apart,
+* each with its status, 422 without one.
+*/
+const declared = (error) => {
+	const status = statusThroughSuspensions(error.ast);
+	if (status !== void 0) return [httpApiStatusOf(error.ast) === void 0 ? error.annotate({ httpApiStatus: status }) : error];
+	const resolved = unsuspended(error.ast);
+	if (SchemaAST.isUnion(resolved) && resolved.checks === void 0 && resolved.encoding === void 0) return resolved.types.flatMap((member) => declared(Schema.make(member)));
+	return [error.annotate({ httpApiStatus: 422 })];
+};
+//#endregion
+export { declared, httpApiStatusOf };

package/dist/http/client.d.mts

@@ -1,6 +1,6 @@
 import { BuiltIns } from "../contract/errors.mjs";
 import { Call } from "../contract/call.mjs";
-import { Action_d_exports, Any, Errors } from "../Action.mjs";
+import { Any, Errors } from "../Action.mjs";
 import { Any as Any$1, VerifierError } from "../authentication/provider.mjs";
 import { Effect, Schema } from "effect";
 import { HttpClient, HttpClientError } from "effect/http";
@@ -38,4 +38,5 @@ export interface AnyHttp {
  * with what its descriptor's verifier declares.
  */
 export type Client<H extends AnyHttp> = { readonly [A in H["actions"][number] as A["name"]]: Method<A, H["error"][number] | VerifierError<A, H["authentication"]>>; };
-//#endregion
+//#endregion
+export {};

package/dist/mcp/client.d.mts

@@ -1,6 +1,6 @@
 import { BuiltIn } from "../contract/errors.mjs";
 import { Call } from "../contract/call.mjs";
-import { Action_d_exports, Any } from "../Action.mjs";
+import { Any } from "../Action.mjs";
 import { Any as Any$1, VerifierError } from "../authentication/provider.mjs";
 import { Effect, Schema } from "effect";
 import { Headers, HttpClient, HttpClientError, HttpClientRequest } from "effect/http";
@@ -45,15 +45,47 @@ export interface RequestOptions {
   readonly url?: string;
   readonly headers?: Headers.Input;
 }
+declare const StatusError_base: Schema.Class<StatusError, Schema.TaggedStruct<"StatusError", {
+  readonly status: Schema.Int;
+  readonly body: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The endpoint answered with an HTTP status other than 200, and a body no declared error decodes. */
+declare class StatusError extends StatusError_base {}
+declare const ProtocolError_base: Schema.Class<ProtocolError, Schema.TaggedStruct<"ProtocolError", {
+  readonly code: Schema.Finite;
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The endpoint answered with a JSON-RPC error, such as the native server's for invalid arguments
+ * or an unknown tool.
+ */
+declare class ProtocolError extends ProtocolError_base {}
+declare const NoReply_base: Schema.Class<NoReply, Schema.TaggedStruct<"NoReply", {
+  readonly body: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The endpoint answered 200 without a JSON-RPC reply to read, as JSON or as an event stream. */
+declare class NoReply extends NoReply_base {}
+declare const UndeclaredError_base: Schema.Class<UndeclaredError, Schema.TaggedStruct<"UndeclaredError", {
+  readonly text: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The tool returned an error whose text decodes as none of the action's declared errors. */
+declare class UndeclaredError extends UndeclaredError_base {}
+declare const NoStructuredContent_base: Schema.Class<NoStructuredContent, Schema.TaggedStruct<"NoStructuredContent", {
+  readonly body: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The tool returned a result without the structured content its action's success needs. */
+declare class NoStructuredContent extends NoStructuredContent_base {}
 declare const McpCallError_base: Schema.Class<McpCallError, Schema.TaggedStruct<"McpCallError", {
+  readonly tool: Schema.String;
+  readonly reason: Schema.Union<readonly [typeof StatusError, typeof ProtocolError, typeof NoReply, typeof UndeclaredError, typeof NoStructuredContent]>;
   readonly message: Schema.String;
 }>, import("effect/Cause").YieldableError>;
 /**
- * An answer a client method cannot read as the action's success or a declared error, such as
- * the native server's message for invalid arguments or an unknown tool, or a result without
- * its structured content. Its message holds the answer. Structured content that does not
- * decode as the success is a `SchemaError` instead, and a request that fails an
- * `HttpClientError`.
+ * An answer a client method cannot read as the action's success or a declared error: `reason`
+ * says which, with what the endpoint sent, so a caller branches on it with
+ * `Effect.catchReason("McpCallError", "StatusError", ...)`. `message` names the tool and the
+ * reason. Structured content that does not decode as the success is a `SchemaError` instead,
+ * and a request that fails an `HttpClientError`.
  */
 export declare class McpCallError extends McpCallError_base {}
 type CallError<A extends Any, D> = A["error"][number]["Type"] | VerifierError<A, D>["Type"] | BuiltIn | Schema.SchemaError | HttpClientError.HttpClientError | McpCallError;
@@ -84,4 +116,5 @@ export declare function client<const Actions extends ReadonlyArray<Any>, D exten
  * a call its types would not send.
  */
 export declare const request: (method: string, params?: Params, { headers, url }?: RequestOptions) => HttpClientRequest.HttpClientRequest;
-//#endregion
+//#endregion
+export {};