@gjermundgaraba/effect-actions 0.19.0 → 0.20.0

package/dist/Action.d.mts

@@ -4,7 +4,6 @@ import { ActionOf, AnyImplementation, Authorize, BuildError, BuildServices, Hold
 import { Call } from "./contract/call.mjs";
 import { Image } from "./contract/media.mjs";
 import { Context, Effect, Layer, Schema, Scope } from "effect";
-//#region src/contract/Action.d.ts
 type Codec = Schema.Codec<unknown, unknown, never, never>;
 type Fields = {
   readonly [key: string]: Codec;
@@ -259,5 +258,4 @@ export interface ClientOptions<A extends Any> {
  * - A builder acquiring a client of its own implementation is refused by the compiler, TS7022, and with the types bypassed never completes: call the services both use instead.
  */
 export declare function client<const Apps extends Served, const O extends ClientOptions<ActionOf<Member<Apps>>> = {}>(implementations: Apps, ...options: OptionalUnless<O, ClientOptions<ActionOf<Member<Apps>>> & O & NoInfer<Known<O, ClientOptions<Any>>>>): Effect.Effect<Client<Apps, Offered<O, ActionOf<Member<Apps>>>>, BuildError<Holding<Member<Apps>, SelectedOf<O, Apps>>, SelectedOf<O, Apps>>, BuildServices<Holding<Member<Apps>, SelectedOf<O, Apps>>, SelectedOf<O, Apps>> | Scope.Scope>;
-//#endregion
 export { type AnyImplementation, Anyone, type Authorize, type BuildError, type BuildServices, BuiltIn, Forbidden, Image, type Implementation, InvalidInput, type Issue, Refusal, Unauthenticated };

package/dist/Action.mjs

@@ -6,7 +6,7 @@ import { Implementation, builders, built, memoized, select, toList } from "./con
 import { inputOf } from "./contract/call.mjs";
 import { Image } from "./contract/media.mjs";
 import { Array as Array$1, Cause, Context, Effect, Predicate, Schema } from "effect";
-//#region src/contract/Action.ts
+// src/contract/Action.ts
 const NoInput = Schema.Record(Schema.String, Schema.Never);
 const codecOf = (schema) => Schema.isSchema(schema) ? schema : Reflect.ownKeys(schema).length === 0 ? NoInput : Schema.Struct(schema);
 function make(name, options) {
@@ -90,5 +90,4 @@ function client(served, options) {
 	assertOnce("action", apps.flatMap((app) => app.actions), heldOnce);
 	return Effect.map(built(apps), (bound) => Object.fromEntries(bound.map(([action, run]) => [action.name, methodOf(action, run)])));
 }
-//#endregion
 export { Anyone, BuiltIn, Forbidden, Image, InvalidInput, Refusal, Unauthenticated, allowAll, byName, client, implement, layer, make };

package/dist/ActionCli.d.mts

@@ -8,7 +8,6 @@ import "./ActionHttp.mjs";
 import { Effect } from "effect";
 import { HttpClient } from "effect/http";
 import { CliError, Command } from "effect/cli";
-//#region src/cli/ActionCli.d.ts
 interface AnyBinding extends Declaring {
   readonly actions: ReadonlyArray<Any>;
 }
@@ -81,6 +80,7 @@ type Local<App, A extends Any> = Effect.Effect<A["success"]["Type"], A["error"][
  *
  * - A success is its JSON on stdout, indented by two spaces, or `render`'s text; nothing for an action without `success`. Its Effect logs and `Console` output go to stderr; other writes as `logToStderr` says.
  * - A declared error is its JSON on stderr, under Effect CLI's `ERROR` heading, the command failing with a `UserError` whose `cause` is the error, exit 1 or its `Runtime.errorExitCode`; a refusal as `Action.Unauthenticated` and `Action.Forbidden` say; input that does not decode, in `--input` or a flag's JSON value, is `InvalidInput`'s JSON there, while a missing flag or a rejected choice is Effect CLI's own parse error.
+ * - Effect CLI styles what it prints, a failure's JSON included, on a terminal and, from Effect 4.0.6, wherever `FORCE_COLOR` forces colour: for plain text there, set `NO_COLOR` or provide `TerminalCapabilities.TerminalCapabilities` with `canColor: false`.
  * - A failure no schema encodes, a builder's or an accepted error that does not encode, is a `UserError` printed as its tag or name and its message, then its causes, never its other fields; a defect, an undeclared failure, or a success that does not encode is the command's defect, which `runMain` reports as `logToStderr` says.
  * - Provide services with `Command.provide` on the command, built when an action runs: provided around `Command.run`, they are built before parsing, so `--help` and a mistyped flag open the database.
  * - Each run builds the action's implementation, its builder and an authorizer an Effect builds, and releases them after the call, even where the host already built them; implementations passed beside it are not built.
@@ -161,5 +161,4 @@ export declare function remote<const H extends AnyHttp, const O extends Selectio
  * - It moves the default logger only: a host layer's `Console` output, the global `console.log`, and a logger writing through `Console.log` such as `Logger.consoleJson`, still reach stdout; log JSON with `Logger.withConsoleError(Logger.formatJson)`.
  */
 export declare const logToStderr: <A, E, R>(self: Effect.Effect<A, E, R>) => Effect.Effect<A, never, R>;
-//#endregion
 export { type Options as CommandOptions, Options$1 as Options, type UserError };

package/dist/ActionCli.mjs

@@ -5,7 +5,7 @@ import { client } from "./ActionHttp.mjs";
 import { command as command$1, failingAsDerived } from "./cli/commands.mjs";
 import { Cause, Effect, Logger, Runtime } from "effect";
 import { Command } from "effect/cli";
-//#region src/cli/ActionCli.ts
+// src/cli/ActionCli.ts
 /**
 * Make a command of your own fail as a derived command does. Give it what the command calls, the
 * binding of `ActionHttp.client` or `ActionRpc.client`, or the actions of `Action.client`, and
@@ -80,6 +80,7 @@ const checkedCommandsOf = (commands, actions) => {
 *
 * - A success is its JSON on stdout, indented by two spaces, or `render`'s text; nothing for an action without `success`. Its Effect logs and `Console` output go to stderr; other writes as `logToStderr` says.
 * - A declared error is its JSON on stderr, under Effect CLI's `ERROR` heading, the command failing with a `UserError` whose `cause` is the error, exit 1 or its `Runtime.errorExitCode`; a refusal as `Action.Unauthenticated` and `Action.Forbidden` say; input that does not decode, in `--input` or a flag's JSON value, is `InvalidInput`'s JSON there, while a missing flag or a rejected choice is Effect CLI's own parse error.
+* - Effect CLI styles what it prints, a failure's JSON included, on a terminal and, from Effect 4.0.6, wherever `FORCE_COLOR` forces colour: for plain text there, set `NO_COLOR` or provide `TerminalCapabilities.TerminalCapabilities` with `canColor: false`.
 * - A failure no schema encodes, a builder's or an accepted error that does not encode, is a `UserError` printed as its tag or name and its message, then its causes, never its other fields; a defect, an undeclared failure, or a success that does not encode is the command's defect, which `runMain` reports as `logToStderr` says.
 * - Provide services with `Command.provide` on the command, built when an action runs: provided around `Command.run`, they are built before parsing, so `--help` and a mistyped flag open the database.
 * - Each run builds the action's implementation, its builder and an authorizer an Effect builds, and releases them after the call, even where the host already built them; implementations passed beside it are not built.
@@ -137,5 +138,4 @@ const logToStderr = (self) => self.pipe(Effect.catchCause((cause) => {
 	});
 	return Effect.andThen(Runtime.getErrorReported(squashed) ? Effect.logError(cause) : Effect.void, Effect.die(reportedDefectKeepingCause));
 }), Effect.provideService(Logger.LogToStderr, true));
-//#endregion
 export { command, logToStderr, make, remote, remoteCommand, toUserError };

package/dist/ActionHttp.d.mts

@@ -8,7 +8,6 @@ import { AnyHttp, Client, MethodError, Options } from "./http/client.mjs";
 import { Context, Effect, FileSystem, Layer, Path, Schema, Types } from "effect";
 import { Etag, HttpClient, HttpClientError, HttpPlatform, HttpRouter } from "effect/http";
 import { HttpApi, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware } from "effect/http-api";
-//#region src/http/ActionHttp.d.ts
 /** What `fetchClient` takes: `client`'s options, and the `fetch` its calls send with. */
 export interface FetchClientOptions<E = HttpClientError.HttpClientError, R = never> extends Options<E, R> {
   /**
@@ -146,7 +145,7 @@ export declare function make<const Actions extends ReadonlyArray<Any>>(actions:
  * - The 415 keeps from every handler what another site's page can send without a CORS preflight, such as a form post carrying the user's cookie; the server's CORS policy decides the rest.
  * - Router middleware providing a request service `X` is declared `HttpRouter.middleware<{ provides: X }>()`: without the type argument it runs and the layer still owes `X`.
  * - `HttpRouter.provideRequest(layer)` builds its layer once, at startup, so it never provides an identity or a tenant.
- * - A request body is read whole, however large, unless the host provides `HttpServerRequest.MaxBodySize` to `HttpRouter.serve`, limiting every route that reads its body whole, MCP endpoints included; a body a route reads as a stream is not limited. On Node a request over it gets no response, its connection closed, never a 413; `HttpRouter.toWebHandler` ignores it, so limit bodies in the platform serving the handler.
+ * - A request body is read whole, however large, unless the host provides `HttpServerRequest.MaxBodySize` to `HttpRouter.serve`, limiting every route that reads its body whole, MCP endpoints included; a body a route reads as a stream is not limited. On Node a request over it is an empty 413 from Effect 4.0.6, and before it gets no response, its connection closed; `HttpRouter.toWebHandler` ignores it, so limit bodies in the platform serving the handler.
  * - An `ErrorReporter` the server runs with is given, as `Info`, a handler's declared failure and an input that does not decode, never a refusal or a refused credential: give an error class `override readonly [ErrorReporter.ignore] = true` to keep it out, and drop `Info` for a built-in error, which takes no mark.
  */
 export declare function layer<const H extends AnyHttp, const Apps extends Served>(binding: H, implementations: Apps): HttpLayer<H, Apps, []>;
@@ -174,5 +173,4 @@ export declare function client<const H extends AnyHttp, E, R>(binding: H, option
  */
 export declare function fetchClient<const H extends AnyHttp>(binding: H, options?: FetchClientOptions): Client<H>;
 export declare function fetchClient<const H extends AnyHttp, E, R>(binding: H, options: FetchClientOptions<E, R>): Client<H, E, R>;
-//#endregion
 export { type AnyHttp as Any, type Client, type Options as ClientOptions, type MethodError, Options$1 as Options };

package/dist/ActionHttp.mjs

@@ -9,7 +9,7 @@ import { SchemaErrors, schemaErrors } from "./http/schema-errors.mjs";
 import { Context, Effect, Layer, Scope } from "effect";
 import { FetchHttpClient, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import { HttpApi, HttpApiBuilder, HttpApiEndpoint, HttpApiGroup, HttpApiMiddleware, HttpApiSchema, OpenApi } from "effect/http-api";
-//#region src/http/ActionHttp.ts
+// src/http/ActionHttp.ts
 const mountSegments = (prefix) => (prefix ?? "/api").split("/").filter((segment) => segment !== "");
 const absolutePath = (segments) => `/${segments.join("/")}`;
 const groupName = (mount) => mount.join("/") || "/";
@@ -77,5 +77,4 @@ function client(binding, options) {
 function fetchClient(binding, { fetch, ...options } = {}) {
 	return methods(binding, options).pipe(Effect.provide(FetchHttpClient.layer), Effect.provideService(FetchHttpClient.Fetch, fetch ?? ((input, init) => globalThis.fetch(input, init))), Effect.runSync);
 }
-//#endregion
 export { client, fetchClient, layer, make };

package/dist/ActionMcp.d.mts

@@ -5,7 +5,6 @@ import { Client, ClientOptions, McpCallError, Params, RequestOptions, client, re
 import { Cause, Effect, Layer, Stdio } from "effect";
 import { McpSchema, McpServer } from "effect/ai";
 import { HttpRouter } from "effect/http";
-//#region src/mcp/ActionMcp.d.ts
 /**
  * An MCP server, over HTTP or stdio: every native `McpServer.layerStdio` option but `protocols`,
  * the server information, `instructions` and `extensions` among them, the actions `A` that are
@@ -118,5 +117,4 @@ export declare function layerHttp<const Apps extends Served, const O extends Sel
  * - The layers provided around it log to stdout, among the protocol's lines: apply `ActionCli.logToStderr` to the program, last, as its JSDoc says.
  */
 export declare function runStdio<const Apps extends Served, const O extends Selection<ActionOf<Member<Apps>>> = {}, E = never, R = never>(implementations: Apps, options: Options<E, R, ActionOf<Member<Apps>>> & O & NoInfer<Known<O, Options<E, R, Any>>>): Effect.Effect<void, BuildError<Holding<Member<Apps>, SelectedOf<O, Apps>>, SelectedOf<O, Apps>> | Cause.IllegalArgumentError | E, BuildServices<Holding<Member<Apps>, SelectedOf<O, Apps>>, SelectedOf<O, Apps>> | Stdio.Stdio | ToolRequestContext<ServedRequest<Member<Apps>, SelectedOf<O, Apps>>> | Features<R>>;
-//#endregion
 export { type Client, type ClientOptions, McpCallError, type Params, type RequestOptions, client, request };

package/dist/ActionMcp.mjs

@@ -9,19 +9,32 @@ import { defaultPath, fieldKey, httpProtocol, isMisplaced, liftOf, liftedFrom, p
 import { recordStepUp } from "./authentication/refusal.mjs";
 import { withStderrConsole } from "./stdio/console.mjs";
 import { McpCallError, client, request } from "./mcp/client.mjs";
-import { Cause, Context, Effect, ErrorReporter, Exit, Fiber, JsonPointer, Layer, Predicate, Schema } from "effect";
+import { Cause, Context, Effect, ErrorReporter, Exit, Fiber, JsonPointer, Layer, Option, Predicate, Schema, Stdio, Stream } from "effect";
 import { AiError, McpSchema, McpServer } from "effect/ai";
 import { HttpRouter, HttpServerRequest } from "effect/http";
 import { Base64 } from "effect/encoding";
-//#region src/mcp/ActionMcp.ts
+// src/mcp/ActionMcp.ts
 const isToolArgumentsSchema = Schema.is(McpSchema.ToolJson);
+const isJson = Schema.is(Schema.Json);
+const definitionsReferenced = (value) => {
+	if (value === null || Predicate.isString(value) || Predicate.isNumber(value) || Predicate.isBoolean(value)) return [];
+	if (Array.isArray(value)) return value.flatMap(definitionsReferenced);
+	return Object.entries(value).flatMap(([field, nested]) => {
+		if (field !== "$ref") return definitionsReferenced(nested);
+		const [scope, key] = Predicate.isString(nested) ? JsonPointer.parseUriFragment(nested) ?? [] : [];
+		return scope === "$defs" && key !== void 0 ? [key] : [];
+	});
+};
 const toolJsonSchema = (schema, strict) => {
 	const document = Schema.toJsonSchemaDocument(schema, { onExcessProperty: strict ? "error" : "ignore" });
-	const [scope, key] = Predicate.isString(document.schema.$ref) ? JsonPointer.parseUriFragment(document.schema.$ref) ?? [] : [];
-	const root = scope === "$defs" && key !== void 0 ? document.definitions[key] : document.schema;
-	return root === void 0 || Object.keys(document.definitions).length === 0 ? root : {
+	const [scope, key] = Predicate.isString(document.schema["$ref"]) ? JsonPointer.parseUriFragment(document.schema["$ref"]) ?? [] : [];
+	const inlined = scope === "$defs" && key !== void 0 ? key : void 0;
+	const root = inlined === void 0 ? document.schema : document.definitions[inlined];
+	if (root === void 0) return void 0;
+	const definitions = inlined !== void 0 && ![root, ...Object.values(document.definitions)].flatMap((schema) => isJson(schema) ? definitionsReferenced(schema) : []).includes(inlined) ? Object.fromEntries(Object.entries(document.definitions).filter(([name]) => name !== inlined)) : document.definitions;
+	return Object.keys(definitions).length === 0 ? root : {
 		...root,
-		$defs: document.definitions
+		$defs: definitions
 	};
 };
 const assertToolShapes = (lifted) => {
@@ -151,6 +164,7 @@ const namesItsMethod = (request) => Effect.match(request.json, {
 	onFailure: () => true,
 	onSuccess: (body) => !Predicate.hasProperty(body, "method") || body.method === request.headers["mcp-method"]
 });
+const readsItsBody = (route) => Effect.flatMap(HttpServerRequest.HttpServerRequest, (request) => request.method === "POST" ? Effect.andThen(request.text, route) : route);
 function layerHttp(apps, { actions, features, path = defaultPath, authentication, requestScoped, allowSubscriptions = features !== void 0, ...options }) {
 	const selected = select(toList(apps), actions);
 	const served = selected.flatMap((app) => app.actions);
@@ -166,17 +180,21 @@ function layerHttp(apps, { actions, features, path = defaultPath, authentication
 		allowSessionTermination: true,
 		allowSubscriptions
 	}), features, authentication);
-	if (authentication === void 0) return transport;
+	if (authentication === void 0) return transport.pipe(Layer.provide(HttpRouter.middleware(readsItsBody).layer));
 	const required = requiresAuthentication(served);
-	const middleware = HttpRouter.middleware(Effect.map(providerOf(authentication), (runtime) => (route) => Effect.flatMap(HttpServerRequest.HttpServerRequest, (request) => request.method !== "POST" || required(request.headers) ? runtime.http(route, false) : Effect.flatMap(namesItsMethod(request), (named) => runtime.http(route, named)))));
+	const middleware = HttpRouter.middleware(Effect.map(providerOf(authentication), (runtime) => (route) => Effect.flatMap(HttpServerRequest.HttpServerRequest, (request) => request.method !== "POST" || required(request.headers) ? runtime.http(readsItsBody(route), false) : Effect.flatMap(namesItsMethod(request), (named) => runtime.http(readsItsBody(route), named)))));
 	return transport.pipe(Layer.provide(middleware.layer));
 }
+const isJsonLine = (line) => Option.isSome(Schema.decodeOption(Schema.fromJsonString(Schema.Json))(line));
+const jsonLinesOnly = Layer.effect(Stdio.Stdio, Effect.map(Stdio.Stdio, (stdio) => Stdio.make({
+	...stdio,
+	stdin: stdio.stdin.pipe(Stream.decodeText, Stream.splitLines, Stream.filter(isJsonLine), Stream.map((line) => `${line}\n`), Stream.encodeText)
+})));
 function runStdio(apps, { actions, features, ...options }) {
 	const transport = server(select(toList(apps), actions), McpServer.layerStdio({
 		...options,
 		protocols
-	}), features);
+	}).pipe(Layer.provide(jsonLinesOnly)), features);
 	return Layer.launch(transport).pipe(withStderrConsole, Effect.forkChild, Effect.flatMap(Fiber.await), Effect.flatMap((exit) => Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause) ? Effect.failCause(exit.cause) : Effect.void));
 }
-//#endregion
 export { McpCallError, client, layerHttp, request, runStdio };

package/dist/ActionRpc.d.mts

@@ -8,7 +8,6 @@ import { Certain, ErrorsOf } from "./contract/declared.mjs";
 import { Context, Effect, Layer, Schema, Scope, Types } from "effect";
 import { HttpRouter } from "effect/http";
 import { Rpc, RpcClient, RpcClientError, RpcGroup, RpcMiddleware, RpcServer } from "effect/rpc";
-//#region src/rpc/ActionRpc.d.ts
 type BindingError = Errors[number];
 type ErrorOf<A extends Any$1, E extends Errors, D> = Schema.Union<ReadonlyArray<A["error"][number] | E[number] | VerifierError<A, D> | BuiltIns>>;
 type RpcOf<A extends Any$1, E extends Errors, D> = A extends Any$1 ? Rpc.Rpc<A["name"], A["input"], A["success"], ErrorOf<A, E, D>> : never;
@@ -158,5 +157,4 @@ export type ClientOptions = Omit<NonNullable<Parameters<typeof RpcClient.make>[1
  * - The socket belongs to the Layer providing the protocol, not to the `Scope` around the client: provided around one call, it opens a socket for that call alone.
  */
 export declare function client<const B extends Any>(binding: B, options?: ClientOptions): Effect.Effect<Client<B>, never, RpcClient.Protocol | Scope.Scope>;
-//#endregion
 export {};

package/dist/ActionRpc.mjs

@@ -7,7 +7,7 @@ import { Cause, Effect, ErrorReporter, Layer, Predicate, Result, Schema, SchemaT
 import { HttpClientRequest, HttpServerRequest } from "effect/http";
 import { HttpApiBuilder } from "effect/http-api";
 import { Rpc, RpcClient, RpcGroup, RpcSerialization, RpcServer } from "effect/rpc";
-//#region src/rpc/ActionRpc.ts
+// src/rpc/ActionRpc.ts
 function make(actions, options = {}) {
 	const bound = bindingOf("ActionRpc binding", actions, options);
 	const group = RpcGroup.make(...actions.map((action) => Rpc.make(action.name, {
@@ -30,8 +30,8 @@ var InternalError = class extends Error {
 	}
 };
 var DeclaredFailure = class {
-	json;
 	[ErrorReporter.ignore] = true;
+	json;
 	constructor(json) {
 		this.json = json;
 	}
@@ -98,5 +98,4 @@ function client(binding, options) {
 		}));
 	});
 }
-//#endregion
 export { client, layer, make };

package/dist/ActionToolkit.d.mts

@@ -3,7 +3,6 @@ import { ActionOf, BuildError, BuildServices, Holding, Known, Member, Offered, O
 import { Any } from "./Action.mjs";
 import { Effect, Layer, Schema } from "effect";
 import { Prompt, Tool, Toolkit } from "effect/ai";
-//#region src/toolkit/ActionToolkit.d.ts
 type NativeTool<A extends Any, R> = Tool.Tool<A["name"], {
   readonly parameters: Schema.toCodecJson<A["input"]>;
   readonly success: Schema.toCodecJson<A["success"]>;
@@ -104,5 +103,4 @@ export interface Approval {
  * `examples/kitchen-sink/src/assistant/handlers.ts`.
  */
 export declare const openApprovals: ({ content: messages }: Prompt.Prompt) => ReadonlyArray<Approval>;
-//#endregion
 export {};

package/dist/ActionToolkit.mjs

@@ -4,7 +4,7 @@ import { hintsOf } from "./contract/hints.mjs";
 import { Implementation, acquire, provideHandlers, select, toList } from "./contract/implementation.mjs";
 import { Effect, Schema } from "effect";
 import { Tool, Toolkit } from "effect/ai";
-//#region src/toolkit/ActionToolkit.ts
+// src/toolkit/ActionToolkit.ts
 const annotateIfGiven = (tool, key, value) => value === void 0 ? tool : tool.annotate(key, value);
 const annotateFromContract = (tool, action) => {
 	const { readOnlyHint, destructiveHint, idempotentHint, openWorldHint } = hintsOf(action);
@@ -64,5 +64,4 @@ const openApprovals = ({ content: messages }) => {
 		}];
 	});
 };
-//#endregion
 export { make, openApprovals };

package/dist/Authentication.d.mts

@@ -6,7 +6,6 @@ import { ErrorsOf } from "./contract/declared.mjs";
 import { Array, Context, Effect, Layer, Option, Redacted, Scope } from "effect";
 import { HttpRouter, HttpServerResponse } from "effect/http";
 import { HttpApiSecurity } from "effect/http-api";
-//#region src/authentication/Authentication.d.ts
 /**
  * The bearer token of an `Authorization` header, `authorization`, or none, read as Effect's
  * `HttpApiSecurity.bearer` reads it for routes and MCP: the scheme matched case-insensitively,
@@ -190,5 +189,4 @@ export type Protection<I, Name extends string> = HttpRouter.Middleware<{
  * - An erased descriptor, `Any`, provides no service the types can name: its identity is `unknown`, which would discharge every request service the route owes.
  */
 export declare const protect: <I, A, S extends Security, Name extends string, E extends Errors>(authentication: Descriptor<I, A, S, Name, E>) => Protection<I, Name>;
-//#endregion
 export type { Any, Descriptor, Provider };

package/dist/Authentication.mjs

@@ -5,7 +5,7 @@ import { answer, answerStepUp, bearer, challenge, declaredResponse, isRefusal, i
 import { Context, Effect, Layer, Match, Option, Predicate, Redacted } from "effect";
 import { HttpEffect, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import { HttpApiBuilder, HttpApiMiddleware, HttpApiSecurity } from "effect/http-api";
-//#region src/authentication/Authentication.ts
+// src/authentication/Authentication.ts
 const bearerAuthorizationHeader = /^[ \t]*Bearer +(.*[^ \t])[ \t]*$/i;
 /**
 * The bearer token of an `Authorization` header, `authorization`, or none, read as Effect's
@@ -191,5 +191,4 @@ function layer(authentication, verify, options = {}) {
 * - An erased descriptor, `Any`, provides no service the types can name: its identity is `unknown`, which would discharge every request service the route owes.
 */
 const protect = (authentication) => HttpRouter.middleware()(Effect.map(providerOf(authentication), (runtime) => (route) => runtime.route(route)));
-//#endregion
 export { bearerTokenOf, layer, make, protect, refusalResponse };

package/dist/Testing.d.mts

@@ -1,7 +1,6 @@
 import { Served } from "./testing/memory.mjs";
 import { Layer } from "effect";
 import { HttpClient, HttpRouter } from "effect/http";
-//#region src/testing/Testing.d.ts
 /**
  * The native `HttpClient`, answered by `handler` instead of the network: a web handler the test
  * serves and disposes of, which other tests and raw web `Request`s may share, such as
@@ -29,5 +28,4 @@ export declare function layer(handler: (request: Request) => Promise<Response>):
  * - It never requires `FileSystem`, `Path`, `HttpPlatform` or `Etag.Generator`: one provided around it is the routes', and `HttpServer.layerServices`' defaults stand in for the rest, whose `FileSystem` is a no-op, so a file the routes read is `NotFound` until `NodeFileSystem.layer` is provided around it.
  * - It answers HTTP requests and cannot upgrade a WebSocket: give an rpc layer `RpcServer.layerProtocolHttp` in the test, and its client `RpcClient.layerProtocolHttp` over this layer.
  */
-export declare function layer<A, E, R>(routes: Layer.Layer<A, E, R>): Layer.Layer<HttpClient.HttpClient, E, Exclude<HttpRouter.Request.Without<R> | HttpRouter.Request.Only<"Requires", R> | HttpRouter.Request.Only<"GlobalRequires", R>, Served>>;
-//#endregion
+export declare function layer<A, E, R>(routes: Layer.Layer<A, E, R>): Layer.Layer<HttpClient.HttpClient, E, Exclude<HttpRouter.Request.Without<R> | HttpRouter.Request.Only<"Requires", R> | HttpRouter.Request.Only<"GlobalRequires", R>, Served>>;

package/dist/Testing.mjs

@@ -1,7 +1,7 @@
 import { clientOf } from "./testing/memory.mjs";
 import { Cause, Console, Context, Effect, ErrorReporter, FileSystem, Layer, Option, Path } from "effect";
 import { Etag, HttpEffect, HttpPlatform, HttpRouter } from "effect/http";
-//#region src/testing/Testing.ts
+// src/testing/Testing.ts
 function layer(routes) {
 	if (!Layer.isLayer(routes)) return clientOf(routes);
 	return Layer.unwrap(Effect.gen(function* () {
@@ -13,5 +13,4 @@ function layer(routes) {
 	}));
 }
 const isReported = (cause) => cause.reasons.some((reason) => Cause.isFailReason(reason) && !ErrorReporter.isIgnored(reason.error) || Cause.isDieReason(reason) && !ErrorReporter.isIgnored(reason.defect));
-//#endregion
 export { layer };

package/dist/authentication/provider.d.mts

@@ -5,7 +5,6 @@ import { Any as Any$1, Errors } from "../Action.mjs";
 import { Context, Effect } from "effect";
 import { HttpRouter, HttpServerResponse } from "effect/http";
 import { HttpApiMiddleware, HttpApiSecurity } from "effect/http-api";
-//#region src/authentication/provider.d.ts
 /** One native security scheme: Bearer unless a descriptor names another. */
 export type Security = HttpApiSecurity.HttpApiSecurity;
 /** What a native scheme decodes: a `Redacted` token or key, or Basic credentials. */
@@ -127,5 +126,4 @@ export type VerifierError<A extends Any$1, D> = A["caller"] extends typeof Anyon
   readonly error: infer E extends Errors;
 } ? E[number] : never;
 export type ServedProvider<App, A extends Any$1, D> = [Protected<Serving<App, A>>] extends [never] ? never : ProviderOf<D>;
-//#endregion
 export { Runtime$1 as Runtime };

package/dist/authentication/provider.mjs

@@ -1,7 +1,6 @@
 import { Unauthenticated } from "../contract/errors.mjs";
 import { Effect, Option } from "effect";
-//#region src/authentication/provider.ts
+// src/authentication/provider.ts
 const providerOf = (auth) => Effect.flatMap(Effect.service(auth["~provider"]), (provider) => provider.descriptor === auth ? Effect.succeed(provider) : Effect.die(/* @__PURE__ */ new Error(`Authentication "${auth.name}": the descriptor named here is not the one its provider was built from (build both from one descriptor)`)));
 const promote = (auth, run) => Effect.flatMap(Effect.serviceOption(auth["~verified"]), (actor) => Option.isSome(actor) ? Effect.provideService(run, auth.identity, actor.value) : Effect.fail(new Unauthenticated()));
-//#endregion
 export { promote, providerOf };

package/dist/authentication/refusal.mjs

@@ -3,7 +3,7 @@ import { declared, httpApiStatusOf } from "../contract/status.mjs";
 import { errorSchemas } from "../contract/declared.mjs";
 import { Cause, Context, Effect, Exit, Option, Predicate, Ref, Schema } from "effect";
 import { HttpServerResponse } from "effect/http";
-//#region src/authentication/refusal.ts
+// src/authentication/refusal.ts
 const responseOf = (schema, error) => HttpServerResponse.jsonUnsafe(Schema.encodeUnknownSync(Schema.toCodecJson(schema))(error), { status: httpApiStatusOf(schema.ast) ?? 422 });
 /** `error` answered as an endpoint declaring `errors` answers it, if one of them declares it. */
 const declaredResponse = (errors, error) => {
@@ -43,5 +43,4 @@ const answerStepUp = (route, metadataUrl) => Effect.gen(function* () {
 	const diedOrInterruptedAfterRefusal = Exit.isFailure(exit) && (Cause.hasDies(exit.cause) || Cause.hasInterrupts(exit.cause));
 	return Option.isSome(refused) && !diedOrInterruptedAfterRefusal ? answer(refused.value, metadataUrl) : yield* exit;
 });
-//#endregion
 export { answer, answerStepUp, bearer, challenge, declaredResponse, isRefusal, isStepUp, plain, recordStepUp };

package/dist/cli/commands.d.mts

@@ -2,7 +2,6 @@ import "../contract/errors.mjs";
 import { Any } from "../Action.mjs";
 import { Effect, Option, Runtime, Types } from "effect";
 import { CliError, Command } from "effect/cli";
-//#region src/cli/commands.d.ts
 type Field<A extends Any> = A["input"]["Encoded"] extends (infer E) ? true extends Types.IsUnion<E> ? never : E extends ReadonlyArray<unknown> ? never : E extends object ? string extends keyof E ? never : Extract<keyof E, string> : never : never;
 type StdinField<A extends Any> = A["input"]["Encoded"] extends (infer E) ? Exclude<Field<A>, { [K in keyof E]-?: {} extends Pick<E, K> ? K : never; }[keyof E]> : never;
 /** How one command of `A` is named, takes its input and prints its result. */
@@ -67,5 +66,4 @@ export declare class UserError<out E = unknown> extends CliError.UserError {
   get reason(): E;
   get [Runtime.errorExitCode](): number;
 }
-//#endregion
 export {};

package/dist/cli/commands.mjs

@@ -6,7 +6,7 @@ import { decodeInput } from "../contract/call.mjs";
 import { withStderrConsole } from "../stdio/console.mjs";
 import { Console, Effect, Option, Predicate, Record, Runtime, Schema, SchemaAST, Stdio, Stream } from "effect";
 import { CliError, Command, Flag, Param } from "effect/cli";
-//#region src/cli/commands.ts
+// src/cli/commands.ts
 const kebab = (name) => {
 	const kebabbed = name.replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/_/g, "-").replace(/^-+|-+$/g, "").toLowerCase();
 	return kebabbed === "" ? name : kebabbed;
@@ -324,5 +324,4 @@ const command = (action, execute, options, errors) => {
 	}, ({ input, args: values, json }) => run(parsedFields(input, values), json ? void 0 : render));
 	return stdinHelp === void 0 ? Command.withDescription(command, description) : command.pipe(Command.withDescription(`${description}\n\n${stdinHelp}`), Command.withShortDescription(description));
 };
-//#endregion
 export { UserError, command, failingAsDerived, kebab };

package/dist/contract/ast.mjs

@@ -1,10 +1,9 @@
 import { SchemaAST } from "effect";
-//#region src/contract/ast.ts
+// src/contract/ast.ts
 const unsuspended = (ast) => SchemaAST.isSuspend(ast) ? unsuspended(ast.thunk()) : ast;
 const members = (ast) => {
 	const resolved = unsuspended(ast);
 	return SchemaAST.isUnion(resolved) ? resolved.types.flatMap(members) : [resolved];
 };
 const literalValues = (ast) => SchemaAST.isLiteral(ast) ? [ast.literal] : SchemaAST.isEnum(ast) ? ast.enums.map(([, value]) => value) : [void 0];
-//#endregion
 export { literalValues, members, unsuspended };

package/dist/contract/call.d.mts

@@ -2,12 +2,10 @@ import "./errors.mjs";
 import "./implementation.mjs";
 import { Any } from "../Action.mjs";
 import { Effect, Schema } from "effect";
-//#region src/contract/call.d.ts
 /**
  * A call of `A` answering `R`. It may leave its input out when `{}` is a valid encoded input,
  * such as for an action declared without `input` or one whose every field has a decoding
  * default, and then sends the input `{}` decodes to. Every client shares this rule:
  * `ActionHttp.client`, `ActionRpc.client`, `ActionMcp.client` and `Action.client`.
  */
-export type Call<A extends Any, R> = {} extends A["input"]["Encoded"] ? (...input: [] | [input: A["input"]["Type"]]) => R : (input: A["input"]["Type"]) => R;
-//#endregion
+export type Call<A extends Any, R> = {} extends A["input"]["Encoded"] ? (...input: [] | [input: A["input"]["Type"]]) => R : (input: A["input"]["Type"]) => R;

package/dist/contract/call.mjs

@@ -1,6 +1,6 @@
 import { InvalidInput } from "./errors.mjs";
 import { Effect, Schema } from "effect";
-//#region src/contract/call.ts
+// src/contract/call.ts
 /**
 * How HTTP, RPC, MCP and a command decode a request's input: reporting every issue, and refusing a
 * field the input does not declare.
@@ -19,5 +19,4 @@ const checked = (action, send) => {
 	const encode = Schema.encodeUnknownEffect(Schema.toCodecJson(action.input), { errors: "all" });
 	return (...args) => inputOf(action, args).pipe(Effect.tap(encode), Effect.mapError(InvalidInput.fromSchemaError), Effect.flatMap(send));
 };
-//#endregion
 export { checked, decodeInput, inputOf, inputParseOptions };

package/dist/contract/caller.d.mts

@@ -1,9 +1,7 @@
 import "../Action.mjs";
-//#region src/contract/caller.d.ts
 /**
  * The caller of a public action, `caller: Action.Anyone`: anyone, signed in or not, and no
  * authorizer runs for it. Registered globally, so two copies of the package agree on it, as they
  * agree on a name.
  */
-export declare const Anyone: unique symbol;
-//#endregion
+export declare const Anyone: unique symbol;

package/dist/contract/caller.mjs

@@ -1,4 +1,4 @@
-//#region src/contract/caller.ts
+// src/contract/caller.ts
 /**
 * The caller of a public action, `caller: Action.Anyone`: anyone, signed in or not, and no
 * authorizer runs for it. Registered globally, so two copies of the package agree on it, as they
@@ -8,5 +8,4 @@ const Anyone = Symbol.for("@gjermundgaraba/effect-actions/Anyone");
 const assertAuthentication = (actions, authentication) => {
 	for (const action of actions) if (action.caller !== Anyone && (authentication === void 0 || action.caller.key !== authentication.identity.key)) throw new Error(`Protected action '${action.name}' requires its matching authentication descriptor (give it the authentication whose identity the action's caller names)`);
 };
-//#endregion
 export { Anyone, assertAuthentication };

package/dist/contract/declared.d.mts

@@ -1,7 +1,6 @@
 import "./caller.mjs";
 import { Errors } from "../Action.mjs";
 import { Types } from "effect";
-//#region src/contract/declared.d.ts
 type ListOf<G> = G extends Errors ? G : readonly [G];
 /**
  * The errors options `O` declare, as at run time: those `error` always gives, or, where it may
@@ -24,5 +23,4 @@ export interface Declaring {
     readonly error: Errors;
   } | undefined;
 }
-//#endregion
 export {};

package/dist/contract/declared.mjs

@@ -4,7 +4,7 @@ import { builtIns } from "./errors.mjs";
 import { assertOnce } from "./names.mjs";
 import { httpApiStatusOf } from "./status.mjs";
 import { Predicate, Schema, SchemaAST } from "effect";
-//#region src/contract/declared.ts
+// src/contract/declared.ts
 const errorList = (error) => error === void 0 ? [] : Schema.isSchema(error) ? [error] : error;
 const ownsNothing = (ast) => httpApiStatusOf(ast) === void 0 && ast.checks === void 0 && ast.encoding === void 0;
 const schemasOf = (ast) => !ownsNothing(ast) ? [ast] : SchemaAST.isSuspend(ast) ? schemasOf(ast.thunk()) : SchemaAST.isUnion(ast) ? ast.types.flatMap(schemasOf) : [ast];
@@ -51,5 +51,4 @@ const bindingOf = (what, actions, options) => {
 	for (const action of actions) assertDistinctTags(`${what} of "${action.name}"`, bindingErrors(action, bound));
 	return bound;
 };
-//#endregion
 export { assertDistinctTags, bindingErrors, bindingOf, errorList, errorSchemas, projectedErrors };

package/dist/contract/errors.d.mts

@@ -1,5 +1,4 @@
 import { Schema } from "effect";
-//#region src/contract/errors.d.ts
 declare const Issue: Schema.Struct<{
   readonly path: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Finite]>>;
   readonly message: Schema.String;
@@ -100,5 +99,4 @@ export type BuiltIns = (typeof builtIns)[number];
 export declare const BuiltIn: Schema.Union<readonly [typeof InvalidInput, typeof Unauthenticated, typeof Forbidden]>;
 /** A built-in failure: `InvalidInput | Refusal`. */
 export type BuiltIn = (typeof BuiltIn)["Type"];
-//#endregion
 export { Issue };

package/dist/contract/errors.mjs

@@ -1,5 +1,5 @@
 import { Effect, Predicate, Schema, SchemaIssue } from "effect";
-//#region src/contract/errors.ts
+// src/contract/errors.ts
 const defaultedMessage = (fallback) => Schema.String.pipe(Schema.withConstructorDefault(Effect.succeed(fallback)));
 const Issue = Schema.Struct({
 	path: Schema.Array(Schema.Union([Schema.String, Schema.Finite])),
@@ -89,5 +89,4 @@ const Refusal = Schema.Union(refusals);
 const builtIns = [InvalidInput, ...refusals];
 /** The built-in failures as one schema: `Schema.is(Action.BuiltIn)(error)`. */
 const BuiltIn = Schema.Union(builtIns);
-//#endregion
 export { BuiltIn, Forbidden, InvalidInput, Refusal, Unauthenticated, builtIns, scopeToken };

package/dist/contract/hints.mjs

@@ -1,4 +1,4 @@
-//#region src/contract/hints.ts
+// src/contract/hints.ts
 /**
 * An action's MCP tool hints, MCP's defaults where its `mcp` leaves one out, except that a read
 * is not destructive where MCP's default would say it is: no tool idempotent and every tool
@@ -11,5 +11,4 @@ const hintsOf = ({ readOnly, mcp }) => ({
 	idempotentHint: mcp.idempotentHint ?? false,
 	openWorldHint: mcp.openWorldHint ?? true
 });
-//#endregion
 export { hintsOf };

package/dist/contract/implementation.d.mts

@@ -2,7 +2,6 @@ import { Anyone } from "./caller.mjs";
 import { Refusal } from "./errors.mjs";
 import { Any } from "../Action.mjs";
 import { Context, Effect, Layer, Scope } from "effect";
-//#region src/contract/implementation.d.ts
 /** Decoded values at the dispatch boundary every surface shares. */
 export type ErasedValue = Any["input"]["Type"];
 /**
@@ -39,8 +38,6 @@ export declare class Implementation<A extends Any, RequestServices extends {
   readonly [name: string]: unknown;
 }, EX, RX, RA = never, EAX = never, RAX = never> {
   #private;
-  /** The contracts this implementation answers. */
-  readonly actions: ReadonlyArray<A>;
   /** Type-only: each action's handler's request-time requirements. */
   readonly "~request": RequestServices;
   /** Type-only: what building its handlers fails with. */
@@ -53,9 +50,9 @@ export declare class Implementation<A extends Any, RequestServices extends {
   readonly "~authorizeBuildError": EAX;
   /** Type-only: what building its authorizer needs. */
   readonly "~authorizeBuildServices": RAX;
-  constructor(
   /** The contracts this implementation answers. */
-  actions: ReadonlyArray<A>,
+  readonly actions: ReadonlyArray<A>;
+  constructor(actions: ReadonlyArray<A>,
   /** Builds each action paired with its handler: its own builder, or the one it shares. */
   handlers: Memoized<Bound, EX, RX>,
   /** Builds its authorizer. */
@@ -189,5 +186,4 @@ export type BuildServices<App, Listed extends Any = OwnActions<App>> = App exten
   readonly "~buildServices": infer RX;
   readonly "~authorizeBuildServices": infer RAX;
 } ? RX | ([Protected<Serving<App, Listed>>] extends [never] ? never : RAX) : never;
-//#endregion
 export {};

package/dist/contract/implementation.mjs

@@ -3,7 +3,7 @@ import { Unauthenticated } from "./errors.mjs";
 import { assertDistinct, assertOnce, heldOnce } from "./names.mjs";
 import { projectedErrors } from "./declared.mjs";
 import { Array, Cause, Context, Effect, Exit, Layer, Option, Schema } from "effect";
-//#region src/contract/implementation.ts
+// src/contract/implementation.ts
 const uniqueKey = () => Math.random().toString(36).slice(2);
 const memoized = (build) => {
 	const key = Context.Service(`effect-actions/Implementation/${uniqueKey()}`);
@@ -22,6 +22,7 @@ const memoized = (build) => {
 * failures and services of the authorizer's builder.
 */
 var Implementation = class Implementation {
+	/** The contracts this implementation answers. */
 	actions;
 	#handlers;
 	#authorizer;
@@ -168,5 +169,4 @@ const dispatch = (action, handle, before) => {
 	});
 	return (input) => Effect.scoped(authentication.pipe(Effect.andThen(authorization), Effect.andThen(Effect.suspend(() => handle(input))), Effect.catchCause(declaredOrDefect))).pipe(Effect.annotateLogs(actionAttributes), Effect.withSpan(action.name, { attributes: actionAttributes }, { captureStackTrace: false }));
 };
-//#endregion
 export { Implementation, acquire, assertHeld, builders, built, memoized, notHeld, provideHandlers, select, servingOf, toList };

package/dist/contract/media.d.mts

@@ -1,5 +1,4 @@
 import { Schema, SchemaAST } from "effect";
-//#region src/contract/media.d.ts
 /**
  * An image, a media field of a success: `{ data: Uint8Array, mimeType: string }`, `mimeType` such
  * as `image/png`. A top-level field of a struct success, one, optional, or a required array, or the
@@ -13,5 +12,4 @@ import { Schema, SchemaAST } from "effect";
 export declare const Image: Schema.Struct<{
   readonly data: Schema.Uint8Array;
   readonly mimeType: Schema.String;
-}>;
-//#endregion
+}>;

package/dist/contract/media.mjs

@@ -1,5 +1,5 @@
 import { Schema } from "effect";
-//#region src/contract/media.ts
+// src/contract/media.ts
 const mediaKindAnnotation = "effect-actions/media";
 const Media = Schema.Struct({
 	data: Schema.Uint8Array,
@@ -18,5 +18,4 @@ const Media = Schema.Struct({
 const Image = Media.annotate({ [mediaKindAnnotation]: "image" });
 const isMarked = (ast) => ast.annotations?.[mediaKindAnnotation] === "image";
 const kindOf = (ast) => isMarked(ast) && ast.encoding === void 0 ? "image" : void 0;
-//#endregion
 export { Image, Media, isMarked, kindOf };

package/dist/contract/names.mjs

@@ -1,4 +1,4 @@
-//#region src/contract/names.ts
+// src/contract/names.ts
 const namePattern = "[A-Za-z0-9_-]{1,128}";
 const validName = new RegExp(`^${namePattern}$`);
 const assertName = (name) => {
@@ -23,5 +23,4 @@ const assertKnown = (what, keys, names, fix) => {
 	const unknown = keys.filter((key) => !names.includes(key));
 	if (unknown.length > 0) throw new Error(`Unknown ${what}: ${unknown.join(", ")} (${fix})`);
 };
-//#endregion
 export { assertDistinct, assertKnown, assertName, assertOnce, heldOnce };

package/dist/contract/status.mjs

@@ -1,5 +1,5 @@
 import { SchemaAST } from "effect";
-//#region src/contract/status.ts
+// src/contract/status.ts
 const httpApiStatusOf = SchemaAST.resolveAt("httpApiStatus");
 const statusThroughSuspensions = (ast) => httpApiStatusOf(ast) ?? (SchemaAST.isSuspend(ast) ? statusThroughSuspensions(ast.thunk()) : void 0);
 /** One error schema, from `errorSchemas`, as an endpoint declares it: with its status, 422 without one. */
@@ -7,5 +7,4 @@ const declared = (error) => {
 	const status = statusThroughSuspensions(error.ast);
 	return status === void 0 ? error.annotate({ httpApiStatus: 422 }) : httpApiStatusOf(error.ast) === void 0 ? error.annotate({ httpApiStatus: status }) : error;
 };
-//#endregion
 export { declared, httpApiStatusOf };

package/dist/http/client.d.mts

@@ -5,7 +5,6 @@ import { Any as Any$1, VerifierError } from "../authentication/provider.mjs";
 import { Effect, Schema } from "effect";
 import { HttpClient, HttpClientError } from "effect/http";
 import { HttpApi, HttpApiClient } from "effect/http-api";
-//#region src/http/client.d.ts
 /**
  * The native `HttpApiClient.make` options except `transformResponse`, which may change a call's
  * success, failure or services the method types cannot follow: `baseUrl`, and `transformClient`,
@@ -58,5 +57,4 @@ export interface AnyHttp {
  * what its `transformClient` adds.
  */
 export type Client<H extends AnyHttp, E = never, R = never> = { readonly [A in H["actions"][number] as A["name"]]: Method<A, H["error"][number] | VerifierError<A, H["authentication"]>, E, R>; };
-//#endregion
 export {};

package/dist/http/client.mjs

@@ -2,7 +2,7 @@ import { checked } from "../contract/call.mjs";
 import { Effect } from "effect";
 import { HttpClient } from "effect/http";
 import { HttpApiClient } from "effect/http-api";
-//#region src/http/client.ts
+// src/http/client.ts
 const methodsWith = (http, httpClient, baseUrl) => Effect.map(HttpApiClient.makeWith(http.api, {
 	baseUrl,
 	httpClient
@@ -15,5 +15,4 @@ const methodsWith = (http, httpClient, baseUrl) => Effect.map(HttpApiClient.make
 	}));
 });
 const methods = (http, { baseUrl, transformClient } = {}) => Effect.flatMap(HttpClient.HttpClient, (native) => transformClient === void 0 ? methodsWith(http, native, baseUrl) : methodsWith(http, transformClient(native), baseUrl));
-//#endregion
 export { methods };

package/dist/http/schema-errors.mjs

@@ -1,9 +1,8 @@
 import { InvalidInput } from "../contract/errors.mjs";
 import { Effect } from "effect";
 import { HttpApiMiddleware } from "effect/http-api";
-//#region src/http/schema-errors.ts
+// src/http/schema-errors.ts
 const responseEncodingKinds = /* @__PURE__ */ new Set(["Body", "ResponseHeaders"]);
 var SchemaErrors = class extends HttpApiMiddleware.Service()("effect-actions/http/SchemaErrors", { error: [InvalidInput] }) {};
 const schemaErrors = () => HttpApiMiddleware.layerSchemaErrorTransform(SchemaErrors, (failure) => Effect.fail(responseEncodingKinds.has(failure.kind) ? failure : InvalidInput.fromSchemaError(failure.cause)));
-//#endregion
 export { SchemaErrors, schemaErrors };

package/dist/mcp/client.d.mts

@@ -4,7 +4,6 @@ import { Any } from "../Action.mjs";
 import { Any as Any$1, VerifierError } from "../authentication/provider.mjs";
 import { Effect, Schema } from "effect";
 import { Headers, HttpClient, HttpClientError, HttpClientRequest } from "effect/http";
-//#region src/mcp/client.d.ts
 /**
  * An MCP request's parameters, as `request` takes them: JSON, with any `_meta`, leaving
  * out an `undefined` one, as a caller may. A helper passing on whole params types them as this,
@@ -136,5 +135,4 @@ export declare function client<const Actions extends ReadonlyArray<Any>, E, R, D
  * a call its types would not send.
  */
 export declare const request: (method: string, params?: Params, { headers, url }?: RequestOptions) => HttpClientRequest.HttpClientRequest;
-//#endregion
 export {};

package/dist/mcp/client.mjs

@@ -8,11 +8,11 @@ import { Effect, Match, Option, Predicate, Schema } from "effect";
 import { McpSchema } from "effect/ai";
 import { HttpClient, HttpClientRequest } from "effect/http";
 import { Sse } from "effect/encoding";
-//#region src/mcp/client.ts
+// src/mcp/client.ts
 /** The routing headers and JSON-RPC body of the request `request` builds. */
 const statelessRequest = (method, params) => {
 	const { protocolVersion } = httpProtocol;
-	const name = method === "resources/read" ? params.uri : params.name;
+	const name = method === "resources/read" ? params["uri"] : params["name"];
 	return {
 		headers: {
 			accept: "application/json, text/event-stream",
@@ -159,5 +159,4 @@ const request = (method, params = {}, { headers = {}, url = defaultPath } = {})
 	const { headers: routingHeaders, body } = statelessRequest(method, params);
 	return HttpClientRequest.post(url).pipe(HttpClientRequest.setHeaders(headers), HttpClientRequest.setHeaders(routingHeaders), HttpClientRequest.bodyJsonUnsafe(body));
 };
-//#endregion
 export { McpCallError, client, request, statelessRequest };

package/dist/mcp/protocol.mjs

@@ -3,7 +3,7 @@ import { Media, isMarked, kindOf } from "../contract/media.mjs";
 import { Predicate, Schema, SchemaAST } from "effect";
 import { McpProtocol } from "effect/ai";
 import { Base64 } from "effect/encoding";
-//#region src/mcp/protocol.ts
+// src/mcp/protocol.ts
 const httpProtocol = McpProtocol.v2026_07_28;
 const protocols = [
 	McpProtocol.v2026_07_28,
@@ -133,5 +133,4 @@ const unliftedFrom = (lift, result) => {
 		return field.name === void 0 || value === void 0 ? [] : [[field.name, value]];
 	})]);
 };
-//#endregion
 export { defaultPath, fieldKey, httpProtocol, isMisplaced, liftOf, liftedFrom, protocols, unliftedFrom };

package/dist/stdio/console.mjs

@@ -1,5 +1,5 @@
 import { Clock, Console, Effect, Function, Predicate } from "effect";
-//#region src/stdio/console.ts
+// src/stdio/console.ts
 const stderrConsole = (console, clock) => {
 	const counts = /* @__PURE__ */ new Map();
 	const timers = /* @__PURE__ */ new Map();
@@ -60,5 +60,4 @@ const stderrConsole = (console, clock) => {
 	};
 };
 const withStderrConsole = (effect) => Effect.provideServiceEffect(effect, Console.Console, Effect.zipWith(Effect.service(Console.Console), Effect.service(Clock.Clock), stderrConsole));
-//#endregion
 export { withStderrConsole };

package/dist/testing/memory.d.mts

@@ -1,6 +1,4 @@
 import { Layer } from "effect";
 import { HttpClient, HttpRouter, HttpServer } from "effect/http";
-//#region src/testing/memory.d.ts
 /** What in-memory routes may leave to the host: the router, the platform, nothing per request. */
-export type Served = HttpRouter.HttpRouter | HttpRouter.Request<"Requires", never> | HttpRouter.Request<"GlobalRequires", never> | HttpRouter.Request<"Error", any> | HttpRouter.Request<"GlobalError", any> | Layer.Success<typeof HttpServer.layerServices>;
-//#endregion
+export type Served = HttpRouter.HttpRouter | HttpRouter.Request<"Requires", never> | HttpRouter.Request<"GlobalRequires", never> | HttpRouter.Request<"Error", any> | HttpRouter.Request<"GlobalError", any> | Layer.Success<typeof HttpServer.layerServices>;

package/dist/testing/memory.mjs

@@ -1,6 +1,6 @@
 import { Effect, Layer, Predicate, Stream } from "effect";
 import { FetchHttpClient, HttpBody, HttpClient, HttpClientRequest } from "effect/http";
-//#region src/testing/memory.ts
+// src/testing/memory.ts
 const relativeUrlOrigin = "http://localhost/";
 const withWebStreamBodyInCurrentContext = (request) => {
 	const body = request.body;
@@ -22,5 +22,4 @@ const clientOf = (handler) => {
 		return Effect.flatMap(withWebStreamBodyInCurrentContext(sent), (ready) => native.postprocess(Effect.succeed(ready)).pipe(Effect.provideService(FetchHttpClient.Fetch, fetch)));
 	}), native.preprocess))).pipe(Layer.provide(Layer.fresh(FetchHttpClient.layer)));
 };
-//#endregion
 export { clientOf };

package/docs/Authentication-advanced.md

@@ -149,8 +149,12 @@ export const requestPolicy = HttpRouter.middleware(
           return HttpServerResponse.text("Host not allowed", { status: 403 });
         }
 
-        const origin = request.headers.origin;
+        const origin = request.headers["origin"];
 
+        // The request's own origin is that of a page served from this port directly. Behind a
+        // proxy ending TLS it is an `http:` one from Effect 4.0.6, whose `originalUrl` takes the
+        // scheme of the connection, whatever `X-Forwarded-Proto` says, so the public URL's
+        // origin is among `origins`.
         if (origin !== undefined && origin !== url.value.origin && !origins.includes(origin)) {
           return HttpServerResponse.text("Origin not allowed", { status: 403 });
         }

package/docs/setup.md

@@ -25,8 +25,7 @@ minor release: a minor release may change the unstable Effect modules the surfac
 Keep the tilde in `package.json`: `^4.0.4`, which npm writes for `effect@4.0.4`, admits a minor
 release outside the peer range. `npm install effect@~4.0.4` keeps it.
 
-Node `^22.12.0 || ^24.0.0 || >=26.0.0`: the package's `engines`, where its `devEngines` is
-what developing the library itself takes. TypeScript 7 or newer. ESM only. The repository checks the
+Node `>=26`: the package's `engines`, the Node the library is developed and tested on. TypeScript 7 or newer. ESM only. The repository checks the
 examples with a stricter `tsconfig.json`; this is the minimum a project needs. The package's modules resolve only through its
 `exports`, which `"module": "nodenext"` reads, as a bundler project's
 `"moduleResolution": "bundler"` does. `"strict": true` is required, by Effect:

package/examples/kitchen-sink/src/request-policy.ts

@@ -25,8 +25,12 @@ export const requestPolicy = HttpRouter.middleware(
           return HttpServerResponse.text("Host not allowed", { status: 403 });
         }
 
-        const origin = request.headers.origin;
+        const origin = request.headers["origin"];
 
+        // The request's own origin is that of a page served from this port directly. Behind a
+        // proxy ending TLS it is an `http:` one from Effect 4.0.6, whose `originalUrl` takes the
+        // scheme of the connection, whatever `X-Forwarded-Proto` says, so the public URL's
+        // origin is among `origins`.
         if (origin !== undefined && origin !== url.value.origin && !origins.includes(origin)) {
           return HttpServerResponse.text("Origin not allowed", { status: 403 });
         }

package/examples/kitchen-sink/test/request-policy.test.ts

@@ -1,6 +1,7 @@
 import { afterAll, describe, expect, it } from "@effect/vitest";
-import { Effect, Layer } from "effect";
-import { HttpRouter, HttpServer } from "effect/http";
+import { NodeHttpServer } from "@effect/platform-node";
+import { ConfigProvider, Effect, Layer } from "effect";
+import { HttpClient, HttpClientRequest, HttpRouter, HttpServer } from "effect/http";
 import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
 import * as Testing from "@gjermundgaraba/effect-actions/Testing";
 import { Http } from "../src/Api.js";
@@ -114,6 +115,41 @@ describe("the request policy", () => {
     expect([here.status, foreignHost.status]).toEqual([200, 403]);
   });
 
+  // Behind a proxy ending TLS, Node's server sees `http:`: the public URL's origin is allowed by
+  // name, not as the request's own, so a page of it is answered whatever the proxy forwards.
+  it.effect("answers the public URL's page behind a proxy ending TLS", () =>
+    Effect.gen(function* () {
+      const client = yield* HttpClient.HttpClient;
+
+      const status = (origin: string) =>
+        client
+          .execute(
+            HttpClientRequest.post("/api/v1/getStatus").pipe(
+              HttpClientRequest.setHeaders({ origin, "x-forwarded-proto": "https" }),
+              HttpClientRequest.bodyJsonUnsafe({}),
+            ),
+          )
+          .pipe(Effect.map((response) => response.status));
+
+      expect([
+        yield* status("https://tracker.example"),
+        yield* status("https://evil.example"),
+      ]).toEqual([200, 403]);
+    }).pipe(
+      Effect.provide(
+        HttpRouter.serve(publicRoutes, { disableLogger: true, disableListenLog: true }).pipe(
+          Layer.provide(memory),
+          Layer.provideMerge(NodeHttpServer.layerTest),
+          Layer.provide(
+            ConfigProvider.layer(
+              ConfigProvider.fromEnvRecord({ PUBLIC_URL: "https://tracker.example" }),
+            ),
+          ),
+        ),
+      ),
+    ),
+  );
+
   // `Testing.layer(handler)` gives the typed clients the same handler the raw requests hit.
   it.effect("leaves the typed client, served from the same web handler, alone", () =>
     Effect.gen(function* () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gjermundgaraba/effect-actions",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "Define Effect action contracts once and project them onto HTTP, MCP, Effect RPC, native Toolkits, and CLIs.",
   "keywords": [
     "ai-agents",
@@ -49,15 +49,15 @@
     "access": "public"
   },
   "devDependencies": {
-    "@effect/platform-node": "4.0.5",
-    "@effect/vitest": "4.0.5",
+    "@effect/platform-node": "4.0.6",
+    "@effect/vitest": "4.0.6",
     "@modelcontextprotocol/client": "2.3.1",
     "@types/node": "26.6.5",
-    "effect": "4.0.5",
+    "effect": "4.0.6",
     "tsx": "4.23.15",
     "typescript": "7.0.2",
-    "vite": "npm:@voidzero-dev/vite-plus-core@1.3.0",
-    "vite-plus": "1.3.0",
+    "vite": "npm:@voidzero-dev/vite-plus-core@1.4.0",
+    "vite-plus": "1.4.0",
     "vitest": "5.0.5"
   },
   "peerDependencies": {
@@ -66,25 +66,21 @@
   "devEngines": {
     "packageManager": {
       "name": "pnpm",
-      "version": "12.14.0",
+      "version": "12.15.0",
       "onFail": "download"
-    },
-    "runtime": {
-      "name": "node",
-      "version": "^22.18.0 || ^24.11.0 || >=26.0.0",
-      "onFail": "error"
     }
   },
   "engines": {
-    "node": "^22.12.0 || ^24.0.0 || >=26.0.0"
+    "node": ">=26"
   },
   "scripts": {
     "build": "vp pack",
     "dev": "vp pack --watch",
     "test": "vp test",
     "check": "vp check",
-    "example": "node --import tsx examples/notes-service/src/server.ts",
-    "test:package": "vp run build && node --import tsx scripts/test-package.ts",
-    "docs:sync": "node --import tsx scripts/sync-skill.ts"
+    "example": "vpx examples/notes-service/src/server.ts",
+    "test:package": "vp run build && vpx scripts/test-package.ts",
+    "docs:sync": "vpx scripts/sync-skill.ts",
+    "ready": "vp check && vp test && vp run test:package"
   }
 }