@gjermundgaraba/effect-actions 0.18.1 → 0.18.2

package/dist/ActionCli.d.mts

@@ -97,7 +97,7 @@ type CallServices<C, A extends Any> = C extends Effect.Effect<infer M, unknown,
  * `Command.withSubcommands` on the result would put in the derived ones' place. `remote` calls a
  * server instead. A test runs it in memory, with no process:
  * `Command.runWith(command, { version })(args)`.
- * Guide: `docs/ActionCli.md` in this package; in an application: `examples/notes-service/src/commands.ts`.
+ * Guide: `docs/ActionCli.md` in this package; in an application: `examples/assistant/src/commands.ts`.
  */
 export declare function make<const Apps extends Served, const O extends Selection<ActionOf<Member<Apps>>> = {}, const Own extends Subcommands = []>(implementations: Apps, options: O & NoInfer<Options$1<ActionOf<Member<Apps>>>> & NoInfer<KnownOptions<O, Options$1, ActionOf<Member<Apps>>>> & {
   readonly subcommands?: Own | undefined;

package/dist/ActionCli.mjs

@@ -86,7 +86,7 @@ function remoteCommand(binding, action, options) {
 * `Command.withSubcommands` on the result would put in the derived ones' place. `remote` calls a
 * server instead. A test runs it in memory, with no process:
 * `Command.runWith(command, { version })(args)`.
-* Guide: `docs/ActionCli.md` in this package; in an application: `examples/notes-service/src/commands.ts`.
+* Guide: `docs/ActionCli.md` in this package; in an application: `examples/assistant/src/commands.ts`.
 */
 function make(implementations, options) {
 	const apps = toList(implementations);

package/dist/ActionHttp.d.mts

@@ -112,12 +112,13 @@ export declare function layer<const H extends AnyHttp, const Apps extends Served
  * `transformClient: HttpClient.mapRequest(HttpClientRequest.bearerToken(token))`. The native
  * client itself stays available: `HttpApiClient.make(Http.api)`.
  *
- * A call fails with a declared error value (the action's own, or a built-in
- * `InvalidInput`, `Unauthenticated` or `Forbidden`), a native `HttpClientError` when the
- * server could not be reached or answered with a status or body the contract does not
- * declare, or a `SchemaError` when the success does not decode. An input that does not encode
- * fails with `InvalidInput`, and nothing is sent. A call also fails with what the client
- * `transformClient` returns fails with, as it is, and requires what that client requires.
+ * A call fails with a declared error value (the action's own, the binding's, a built-in
+ * `InvalidInput`, `Unauthenticated` or `Forbidden`, or on a protected action its descriptor's),
+ * a native `HttpClientError` when the server could not be reached or answered with a status or
+ * body the contract does not declare, or a `SchemaError` when the success does not decode. An
+ * input that does not encode fails with `InvalidInput`, and nothing is sent. A call also fails
+ * with what the client `transformClient` returns fails with, as it is, and requires what that
+ * client requires.
  */
 export declare function client<const H extends AnyHttp>(binding: H, options?: Options): Effect.Effect<Client<H>, never, HttpClient.HttpClient>;
 export declare function client<const H extends AnyHttp, E, R>(binding: H, options: Options<E, R>): Effect.Effect<Client<H, E, R>, never, HttpClient.HttpClient>;

package/dist/Authentication.d.mts

@@ -41,8 +41,8 @@ export interface ProtectedResource {
 export interface RefusalResponseOptions<D extends Any = Any> {
   /**
    * The descriptor refusing, whose scheme decides the challenge: Bearer's, below, when left
-   * out; another scheme's 401 names that scheme, and nothing steps up under it. An error it
-   * declares is sent as its endpoints declare it.
+   * out; another HTTP scheme's or Basic's 401 names that scheme, an API key's none, and nothing
+   * steps up under it. An error it declares is sent as its endpoints declare it.
    */
   readonly authentication?: D | undefined;
   /** The OAuth protected resource refusing: the one given to `layer`. */
@@ -63,9 +63,9 @@ type DeclaredOf<D> = D extends {
  * `authorization` presented a bearer token, or the `insufficient_scope` of a `Forbidden`
  * naming scopes. Given the protected resource `layer` was, every challenge names its metadata
  * URL and a 401's its `scopesRequired`. Under a descriptor of another scheme, it is the JSON
- * and status alone, a 401 naming that scheme. An error `authentication` declares is sent as
- * its endpoints declare it, its JSON with its status. `HttpServerResponse.toWeb` gives it as a
- * web `Response`.
+ * and status alone, a 401 naming that scheme, or none for an API key. An error
+ * `authentication` declares is sent as its endpoints declare it, its JSON with its status.
+ * `HttpServerResponse.toWeb` gives it as a web `Response`.
  */
 export declare const refusalResponse: <D extends Any = never>(error: Refusal | DeclaredOf<D>, options?: RefusalResponseOptions<D>) => HttpServerResponse.HttpServerResponse;
 /** What `make` takes besides the name and the identity. */

package/dist/Authentication.mjs

@@ -52,9 +52,9 @@ const withNoStoreAndChallenge = (response, challenge) => HttpServerResponse.setH
 * `authorization` presented a bearer token, or the `insufficient_scope` of a `Forbidden`
 * naming scopes. Given the protected resource `layer` was, every challenge names its metadata
 * URL and a 401's its `scopesRequired`. Under a descriptor of another scheme, it is the JSON
-* and status alone, a 401 naming that scheme. An error `authentication` declares is sent as
-* its endpoints declare it, its JSON with its status. `HttpServerResponse.toWeb` gives it as a
-* web `Response`.
+* and status alone, a 401 naming that scheme, or none for an API key. An error
+* `authentication` declares is sent as its endpoints declare it, its JSON with its status.
+* `HttpServerResponse.toWeb` gives it as a web `Response`.
 */
 const refusalResponse = (error, options) => {
 	const authentication = options?.authentication;

package/docs/Action-failures.md

@@ -43,5 +43,5 @@ The tasks are in [Action.md](Action.md).
 - `Type 'CurrentUser' is not assignable to type 'never'` where a program calling an `Action.client` runs, or `Type 'CurrentUser' is missing the following properties from type 'Scope'` at `it.effect`: a call to a protected action reads the caller from its own context, never from the one the client was acquired in. Provide the caller around the call.
 - `Type 'Scope' is not assignable to type 'never'` where a program runs, or `Service not found: effect/Scope` in plain JavaScript: acquiring an `Action.client` builds, as a layer does. Acquire it in a builder or a layer, or run the program in `Effect.scoped`.
 - A builder runs on every request, or a route owes `HttpRouter.Request<"Requires", X>` for `X`, a service its builder yields: acquiring an `Action.client` runs the builders, and a handler acquires one on every request. Acquire the client in the builder, and call it in the handler.
-- An `Action.client` call dies with a `SchemaError`: the handler's success, or what it fails with, does not pass through its codec. A failure follows the `SchemaError` in the cause, as `Cause.pretty` shows. Return what the success schema accepts, and fail with an error the action declares.
+- An `Action.client` call dies with a `SchemaError`: the handler's success, or what it fails with, does not pass through its codec. The cause holds the failure beside the `SchemaError`, as `Cause.pretty` shows: before it for a failure the action's errors reject, undeclared or breaking a check, after it for one they accept that does not encode. Return what the success schema accepts, and fail with an error the action declares.
 - `InvalidInput` with `Expected <Class>` from an `Action.client` call given a plain object: an input that is a class encodes only its instances. Pass `new Class({ ... })`.

package/docs/Action-in-process.md

@@ -70,7 +70,7 @@ export const builders = Action.layer([status, identity, issues, attachments, adm
 
 // kitchen-sink/src/server.ts
 Layer.mergeAll(
-  HttpRouter.serve(publicRoutes).pipe(Layer.provide(listen(publicPort))),
+  HttpRouter.serve(Layer.merge(publicRoutes, socket)).pipe(Layer.provide(listen(publicPort))),
   HttpRouter.serve(adminRoutes).pipe(Layer.provide(listen(adminPort))),
 ).pipe(Layer.provide(builders), Layer.provide(memory));
 ```

package/docs/Action.md

@@ -68,7 +68,7 @@ uses every option, sharing some by spreading a constant (`IssueWriteErrors`, `ch
   import it ([setup.md](setup.md#bundle-for-a-browser)).
 - **The name** matches `[A-Za-z0-9_-]{1,128}`, is not `then`, and is unique within each binding,
   MCP endpoint, Toolkit, CLI and client holding it.
-- **For no arguments, omit `input`.** A `Schema.Struct({})` accepts any value but `null`, and MCP
+- **For no arguments, omit `input`.** A `Schema.Struct({})` accepts any value but `null` and `undefined`, and MCP
   refuses it as a tool's input ([ActionMcp.md](ActionMcp.md#describe-tools-to-a-model)).
 - **A field callers may omit is `Schema.optional`.** On the wire it also takes `null`, read as
   left out, as a tool's schema lists; a typed client refuses `null`. `Schema.optionalKey` takes

package/docs/ActionMcp-failures.md

@@ -24,7 +24,7 @@ Search for a fragment of the message. The tasks are in [ActionMcp.md](ActionMcp.
 - A hand-written HTTP request answers 400 with JSON-RPC error `-32602`, `Required request metadata is missing` or `io.modelcontextprotocol/clientCapabilities request metadata is required`: it names 2026-07-28 in `MCP-Protocol-Version` and its `params._meta` lacks `io.modelcontextprotocol/protocolVersion`, for the first message, or `io.modelcontextprotocol/clientCapabilities`, for the second. Build it with `ActionMcp.request`, or copy the `curl` of [mcp-tools](../examples/mcp-tools/README.md#connect-a-client).
 - A hand-written HTTP request answers 400 with JSON-RPC error `-32020`, `MCP-Protocol-Version header is required`, `Mcp-Method header does not match request method` or `Mcp-Name header does not match request parameters`: those headers repeat a 2026-07-28 request's revision, method and `tools/call` name, and one is absent or differs from its body. Build it with `ActionMcp.request`.
 - A hand-written HTTP request answers an empty 406: its `Accept` header does not list both `application/json` and `text/event-stream`, as `*/*` does not. Send both.
-- A client asking for 2025-03-26 or 2024-11-05 is offered 2025-11-25, and disconnects if it cannot speak it: HTTP and stdio serve 2026-07-28, 2025-11-25 and 2025-06-18. Update the client.
+- A client asking for 2025-03-26 or 2024-11-05 is offered 2025-11-25, and disconnects if it cannot speak it: HTTP and stdio serve 2026-07-28, 2025-11-25 and 2025-06-18, a `requestScoped` endpoint 2026-07-28 alone. Update the client.
 - A request written by hand to a stdio server answers JSON-RPC error `-32602`, `Invalid request metadata`: it is neither preceded by `initialize` nor carries the 2026-07-28 metadata. Open with `initialize` and `notifications/initialized`, or give the request's `_meta` its `io.modelcontextprotocol/protocolVersion` and `io.modelcontextprotocol/clientCapabilities`.
 - A client reports a broken transport from a stdio subprocess: something wrote to stdout. The global `console.log` did, or a layer provided around `runStdio` did, through the default logger, or through `Console` or a logger such as `Logger.consoleJson`, which `logToStderr` does not move. Remove the write, apply `ActionCli.logToStderr` last, or log JSON with `Logger.withConsoleError(Logger.formatJson)`.
 - A request carrying an `Origin` gets an empty 403: the origin is not in `allowedOrigins`. Add the exact origin, if the deployment trusts it.

package/docs/ActionMcp.md

@@ -130,9 +130,9 @@ tool's read-only hint, and the contract's `mcp` option holds its `title`, its ot
 - MCP takes a write as destructive unless it states `destructiveHint: false`: one that only adds.
 - A tool's input is one object with keys. Omit `input` for a tool without arguments, and wrap a
   union, an array or a scalar in a field.
-- An argument the schema refuses, an undeclared one included, is answered by the native server
-  before the handler runs, as an `isError` result whose text is `Invalid parameters for tool
-  '<name>': …`, not `InvalidInput`. So constrain in the schema
+- An argument the schema refuses, an undeclared one included, never reaches the handler: it
+  is an `isError` result, text `Invalid parameters for tool '<name>': …`, not `InvalidInput`,
+  and to 2025-06-18 a JSON-RPC error. So constrain in the schema
   what a model may send: an id written into an upstream URL is not made safe by
   `encodeURIComponent`, which leaves `..` alone.
 - A `Schema.makeFilter` check adds nothing to the tool's listed input schema, and

package/docs/README.md

@@ -15,9 +15,10 @@ first (step 5), before the examples and the pages.
    limit, with no mark or with one that understates what is lost. If an output says it was
    truncated, read that page again alone.
 2. **Start from the example closest to what you are building** ([Examples](#examples)). Its
-   README has a layout tree and a "Where to look" table naming the file for each thing. Copy its
-   layout and idioms: the examples are the reference for how code is written. An example shows
-   one way, not the rules, the alternatives or the traps: read steps 3 and 4 even when it fits.
+   README has a layout tree, and all but quickstart's a "Where to look" table naming the file
+   for each thing. Copy its layout and idioms: the examples are the reference for how code is
+   written. An example shows one way, not the rules, the alternatives or the traps: read steps
+   3 and 4 even when it fits.
 3. **Read [Action.md](Action.md) completely.** Every surface builds on it.
 4. **Read the page of each surface you serve** ([Pages](#pages)), and the example files its task
    sections link.

package/docs/guarantees.md

@@ -22,9 +22,9 @@ One call, on each surface. An HTTP route is `POST <prefix>/<action>` with a JSON
 - **An action without input** takes `{}` and nothing else, on every surface. Over HTTP, send the body `{}` typed as JSON: no body is a **400**, and no `Content-Type` a **415**.
 - **A media field**, `Action.Image`, is `{ "data": "<base64>", "mimeType": "image/png" }` inside the JSON on every surface but MCP, which lifts it out of `structuredContent` into a block of its own: [Return images and other media](ActionMcp.md#return-images-and-other-media).
 - **A failure the action's errors reject**, undeclared or breaking a check, is its call's defect on every surface, beside the `SchemaError` saying why. A class error's checks are not rerun: one built with `disableChecks` is accepted, and fails to encode instead.
-- **Internal failures are never sent.** The cause of a defect goes to the log and, over HTTP, MCP and RPC, to the call's `ErrorReporter`s: those the server runs with, as provided around `HttpRouter.serve` or `Testing.layer`, win over those provided to one surface's layer, which only fill in what a request lacks.
+- **Internal failures are never sent.** Over HTTP, MCP and RPC, the cause of a defect goes to the log and to the call's `ErrorReporter`s: those the server runs with, as provided around `HttpRouter.serve` or `Testing.layer`, win over those provided to one surface's layer, which only fill in what a request lacks.
 - **Messages for invalid input.** A message for input that does not decode names paths and what the schema expects, never a field's value. A path names every key it passes through, a record's keys and an undeclared key included, so never key a record by a secret such as an email or a token. A schema's own `message` annotation, or a filter's message, is sent as written, so never put the input in one.
-- **Earlier MCP revisions.** The MCP column is MCP 2026-07-28. A 2025-11-25 or 2025-06-18 client, over HTTP or stdio, gets `structuredContent` only for a success that is an object, and any other success as its text block alone, a string unquoted; a 2025-06-18 client gets invalid arguments as a JSON-RPC error instead of a result. Over HTTP such a client opens a session, which on an endpoint serving a protected tool only a signed-in caller does: it signs in for every request there, a public tool's call and `tools/list` included. Stdio authenticates nothing: the host provides the identity around `runStdio` ([Serve tools over stdio](ActionMcp.md#serve-tools-over-stdio)).
+- **Earlier MCP revisions.** The MCP column is 2026-07-28. A 2025-11-25 or 2025-06-18 client, over HTTP or stdio, gets `structuredContent` only for a success that is an object, and any other success as its text block alone, a string unquoted; a 2025-06-18 client gets invalid arguments as a JSON-RPC error instead of a result. Over HTTP such a client opens a session, which on an endpoint serving a protected tool only a signed-in caller does: it signs in for every request there, a public tool's call and `tools/list` included. A `requestScoped` endpoint serves only 2026-07-28, and only `POST`. Stdio authenticates nothing: the host provides the identity around `runStdio` ([Serve tools over stdio](ActionMcp.md#serve-tools-over-stdio)).
 - **Request bodies have no size limit** unless the host sets one, on every route of the server, MCP endpoints included ([Serve the routes](ActionHttp.md#serve-the-routes)).
 
 [kitchen-sink/test/identity/identity.test.ts](../examples/kitchen-sink/test/identity/identity.test.ts) asserts the 401 and the 403 as sent, and [assistant/test/toolkit.test.ts](../examples/assistant/test/toolkit.test.ts) a refusal as a Toolkit result.
@@ -38,7 +38,7 @@ What the library does not do, where a reader might expect it to:
 - **Filter tool discovery by caller.** `tools/list` names every tool its endpoint serves, protected ones included, to anyone who may list them. Serve public tools on an endpoint of their own if signed-out callers must not see the protected ones.
 - **Limit requests.** A rate limit is the handler's, failing with an error its action declares, or middleware's.
 - **Allow browsers across origins.** CORS for JSON routes is the host's, with `HttpRouter.cors`; an MCP endpoint refuses a browser `Origin` it does not list ([Allow browser clients](ActionMcp.md#allow-browser-clients)).
-- **Stream, upload or retry.** Actions are unary JSON calls. One decoded input, one success or one declared error. Every HTTP route is a `POST`, a read-only action's included; RPC needs a protocol speaking JSON.
-- **Expire MCP sessions, or serve MCP features other than tools.** A session a client of a 2025 revision opens over HTTP lasts until that client ends it or the process stops, and a `requestScoped` endpoint opens none ([Serve tools over HTTP](ActionMcp.md#serve-tools-over-http)). Prompts and resources are Effect's native ones, given as `features` ([Add native prompts and resources](ActionMcp.md#add-native-prompts-and-resources)).
+- **Stream, upload or retry.** Actions are unary JSON calls: one input, one success or one declared error. Every HTTP route is a `POST`, a read-only action's included; RPC needs a protocol speaking JSON.
+- **Expire MCP sessions, or serve MCP features other than tools.** A session a client of a 2025 revision opens over HTTP lasts until that client ends it or the process stops ([Serve tools over HTTP](ActionMcp.md#serve-tools-over-http)). Prompts and resources are Effect's native ones, given as `features` ([Add native prompts and resources](ActionMcp.md#add-native-prompts-and-resources)).
 - **Mix identities.** An action names one identity service, and a remote surface one authentication descriptor.
 - **Harden a deployment.** Real token validation, request limits and error reporting are the application's. The examples mark each shortcut they take `DEMO ONLY`: [examples](../examples/README.md).

package/docs/setup.md

@@ -13,12 +13,12 @@ When something fails, search [setup-failures.md](setup-failures.md). Reading ord
 pnpm add @gjermundgaraba/effect-actions effect@~4.0.4
 ```
 
-| Need                                | Add                                                              |
-| ----------------------------------- | ---------------------------------------------------------------- |
-| Node HTTP server, stdio host or CLI | `@effect/platform-node@~4.0.4`                                   |
-| Tests                               | `vitest@^5.0.3` and `@effect/vitest@~4.0.4`, as dev dependencies |
-| Type checking                       | `typescript@^7.0.2`, as a dev dependency                         |
-| Running a TypeScript entrypoint     | `tsx`, as a dev dependency: `node --import tsx <entrypoint>.ts`  |
+| Need                                | Add                                                             |
+| ----------------------------------- | --------------------------------------------------------------- |
+| Node HTTP server, stdio host or CLI | `@effect/platform-node@~4.0.4`                                  |
+| Tests                               | `vitest@^5` and `@effect/vitest@~4.0.4`, as dev dependencies    |
+| Type checking                       | `typescript@^7.0.2`, as a dev dependency                        |
+| Running a TypeScript entrypoint     | `tsx`, as a dev dependency: `node --import tsx <entrypoint>.ts` |
 
 The `effect` peer admits the 4.0.x patches from the oldest whose APIs the package uses, and no
 minor release: a minor release may change the unstable Effect modules the surfaces build on.

package/examples/kitchen-sink/README.md

@@ -253,21 +253,21 @@ search for in the file.
 
 ### ActionToolkit
 
-| Export or option                                    | File                                 |
-| --------------------------------------------------- | ------------------------------------ |
-| `make`: `actions`, `needsApproval` (a boolean rule) | `src/issues/assistant.ts`            |
-| `toolkit` given to `LanguageModel`                  | `src/issues/assistant.ts` (`triage`) |
-| `layer`, and the caller per turn                    | `src/agent.ts`                       |
-| `toolkit` and the model yielded in a builder        | `src/assistant/handlers.ts`          |
-| `layer` provided to the routes                      | `src/routes.ts` (`assistantTools`)   |
-| An approval answered in a later request             | `src/assistant/handlers.ts`          |
-| `tools.handle`, a call made by hand                 | `test/issues/assistant.test.ts`      |
+| Export or option                                          | File                                 |
+| --------------------------------------------------------- | ------------------------------------ |
+| `make`: `actions`, `needsApproval` (a boolean rule)       | `src/issues/assistant.ts`            |
+| `toolkit` given to `LanguageModel`                        | `src/issues/assistant.ts` (`triage`) |
+| `layer`, and the caller per turn                          | `src/agent.ts`                       |
+| `toolkit` and the model yielded in a builder              | `src/assistant/handlers.ts`          |
+| `layer` provided to the routes                            | `src/routes.ts` (`assistantTools`)   |
+| An approval answered in a later request (`openApprovals`) | `src/assistant/handlers.ts`          |
+| `tools.handle`, a call made by hand                       | `test/issues/assistant.test.ts`      |
 
 ### ActionCli
 
 | Export or option                                               | File                                       |
 | -------------------------------------------------------------- | ------------------------------------------ |
-| `remote`: `name`, `commands`                                   | `src/cli.ts`                               |
+| `remote`: `name`, `commands`, `client`                         | `src/cli.ts`                               |
 | `commands`: `stdin`, `positional`, `aliases`, `render`, `name` | `src/cli.ts`                               |
 | A client from `Config`, its credentials optional               | `src/cli.ts`                               |
 | `make`, with a trusted identity the host supplies              | `src/ops.ts`                               |
@@ -299,9 +299,9 @@ Left out because this application has no honest place for them:
 - `Action.implement` with a plain record of handlers: every implementation of several actions
   here has a builder. `implementation.actions`. `mcp._meta`.
 - `ActionCli.command` and `remoteCommand`, one action as one command; `make`'s and `remote`'s
-  `actions`; `remote`'s static `client` option. Both CLIs here are aggregates of every action,
-  and the remote one reads its client from `Config`. `subcommands` and `toUserError`, a command
-  written by hand: [notes-service](../notes-service/) has one.
+  `actions`. Both CLIs here are aggregates of every action, and the remote one reads its client
+  from `Config`. `subcommands` and `toUserError`, a command written by hand:
+  [notes-service](../notes-service/) has two.
 - `ActionRpc.layer`'s `actions`, `Rpc.group`, and `ActionRpc.client`'s options.
 - A binding's other fields, `Http.actions`, `Http.error` and `Http.authentication`.
 - `ActionMcp`'s `path`, `description`, `websiteUrl`, `icons` and `extensions`; `fetchClient`'s

package/examples/kitchen-sink/src/stdio.ts

@@ -14,7 +14,8 @@ import { status } from "./workspaces/handlers.js";
 import { WorkspaceRegistry } from "./workspaces/registry.js";
 
 // Entrypoint: an MCP server a local agent starts as a subprocess, such as
-// `claude mcp add tracker -- node --import tsx examples/kitchen-sink/src/stdio.ts`.
+// `claude mcp add tracker -- "$PWD/node_modules/.bin/tsx" "$PWD/examples/kitchen-sink/src/stdio.ts"`
+// from the repository root: mcp-tools' README says why the paths are full.
 // It lists the implementations it serves itself, and imports nothing of the HTTP router. They
 // are those of the `/mcp` endpoint, with its tools and features and the same `authorize`.
 // stdio is a local surface: it takes no `authentication`, since no token arrives.

package/examples/notes-service/README.md

@@ -103,7 +103,7 @@ src/
 ├── server.ts          entrypoint: the HTTP server
 ├── worker.ts          entrypoint: a fetch handler for a serverless host
 ├── stdio.ts           entrypoint: MCP for a local agent
-├── commands.ts        the commands calling the server, one written by hand, and their connection
+├── commands.ts        the commands calling the server, two written by hand, and their connection
 ├── cli.ts             entrypoint: the commands
 └── browser.ts         client module: promises for a web page
 test/

package/examples/notes-service/src/stdio.ts

@@ -10,7 +10,8 @@ import { NoteStore } from "./notes/store.js";
 import { status } from "./status/handlers.js";
 
 // Entrypoint: an MCP server a local agent starts as a subprocess, such as
-// `claude mcp add notes -- node --import tsx examples/notes-service/src/stdio.ts`.
+// `claude mcp add notes -- "$PWD/node_modules/.bin/tsx" "$PWD/examples/notes-service/src/stdio.ts"`
+// from the repository root: mcp-tools' README says why the paths are full.
 // The same implementations as the HTTP server, and the same `authorize`. No token arrives
 // over stdio, so this host names the caller itself. It is a process of its own with services
 // of its own: this in-memory store holds its notes, not the running server's. To share them,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/effect-actions",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "Define Effect action contracts once and project them onto HTTP, MCP, Effect RPC, native Toolkits, and CLIs.",
   "keywords": [
     "ai-agents",
@@ -56,9 +56,9 @@
     "effect": "4.0.5",
     "tsx": "4.23.15",
     "typescript": "7.0.2",
-    "vite": "npm:@voidzero-dev/vite-plus-core@1.2.0",
-    "vite-plus": "1.2.0",
-    "vitest": "5.0.4"
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.3.0",
+    "vite-plus": "1.3.0",
+    "vitest": "5.0.5"
   },
   "peerDependencies": {
     "effect": "~4.0.4"
@@ -66,7 +66,7 @@
   "devEngines": {
     "packageManager": {
       "name": "pnpm",
-      "version": "12.5.1",
+      "version": "12.14.0",
       "onFail": "download"
     },
     "runtime": {