@gjermundgaraba/effect-actions 0.20.0 → 0.21.0

package/dist/mcp/request.d.mts

@@ -0,0 +1,40 @@
+import { Schema } from "effect";
+import { Headers, HttpClientRequest } from "effect/http";
+/**
+ * An MCP request's parameters, as `request` takes them: JSON, with any `_meta`, leaving
+ * out an `undefined` one, as a caller may. A helper passing on whole params types them as this,
+ * and a tool's `arguments` as `Schema.Json`, never `unknown`.
+ */
+export interface Params {
+  readonly _meta?: {
+    readonly [key: string]: Schema.Json;
+  };
+  readonly [key: string]: Schema.Json | undefined;
+}
+/** Where a `request` goes, and with what headers. */
+export interface RequestOptions {
+  /**
+   * The endpoint, resolved by the `HttpClient` that sends the request: relative under `Testing.layer`.
+   * Defaults to `/mcp`, as `client`'s does; converting to a web `Request` needs an absolute
+   * one.
+   */
+  readonly url?: string;
+  /**
+   * Headers sent beside the routing ones `request` fills in, such as `Authorization`; a routing
+   * header wins over a given one of its name.
+   */
+  readonly headers?: Headers.Input;
+}
+/**
+ * One stateless MCP request of `method` with `params`, as `layerHttp` serves it,
+ * as the native request value: the JSON-RPC envelope, the 2026-07-28 headers (`Accept`,
+ * `MCP-Protocol-Version`, `MCP-Method`), `mcp-name` from
+ * `params.uri` for `resources/read` and `params.name` otherwise, and the client metadata in
+ * `_meta` are filled in, under any `_meta` given, such as a `progressToken`; the protocol
+ * version is always the request's own. The test sends it: `HttpClient.execute` answers the
+ * response as the endpoint sent it, whatever its status, and `HttpClientRequest.toWebResult`
+ * gives the web `Request` a web handler or `fetch` takes, once `url` is absolute. It is for a test
+ * asserting on what `client` decodes away, such as `tools/list`, a refusal's challenge, or
+ * a call its types would not send.
+ */
+export declare const request: (method: string, params?: Params, { headers, url }?: RequestOptions) => HttpClientRequest.HttpClientRequest;

package/dist/mcp/request.mjs

@@ -0,0 +1,51 @@
+import { defaultPath, httpProtocol } from "./protocol.mjs";
+import { Predicate } from "effect";
+import { HttpClientRequest } from "effect/http";
+// src/mcp/request.ts
+/** The routing headers and JSON-RPC body of the request `request` builds. */
+const statelessRequest = (method, params) => {
+	const { protocolVersion } = httpProtocol;
+	const name = method === "resources/read" ? params["uri"] : params["name"];
+	return {
+		headers: {
+			accept: "application/json, text/event-stream",
+			"mcp-protocol-version": protocolVersion,
+			"mcp-method": method,
+			...Predicate.isString(name) ? { "mcp-name": name } : {}
+		},
+		body: {
+			jsonrpc: "2.0",
+			id: 1,
+			method,
+			params: {
+				...params,
+				_meta: {
+					"io.modelcontextprotocol/clientCapabilities": {},
+					"io.modelcontextprotocol/clientInfo": {
+						name: "effect-actions",
+						version: "0"
+					},
+					...params._meta,
+					"io.modelcontextprotocol/protocolVersion": protocolVersion
+				}
+			}
+		}
+	};
+};
+/**
+* One stateless MCP request of `method` with `params`, as `layerHttp` serves it,
+* as the native request value: the JSON-RPC envelope, the 2026-07-28 headers (`Accept`,
+* `MCP-Protocol-Version`, `MCP-Method`), `mcp-name` from
+* `params.uri` for `resources/read` and `params.name` otherwise, and the client metadata in
+* `_meta` are filled in, under any `_meta` given, such as a `progressToken`; the protocol
+* version is always the request's own. The test sends it: `HttpClient.execute` answers the
+* response as the endpoint sent it, whatever its status, and `HttpClientRequest.toWebResult`
+* gives the web `Request` a web handler or `fetch` takes, once `url` is absolute. It is for a test
+* asserting on what `client` decodes away, such as `tools/list`, a refusal's challenge, or
+* a call its types would not send.
+*/
+const request = (method, params = {}, { headers = {}, url = defaultPath } = {}) => {
+	const { headers: routingHeaders, body } = statelessRequest(method, params);
+	return HttpClientRequest.post(url).pipe(HttpClientRequest.setHeaders(headers), HttpClientRequest.setHeaders(routingHeaders), HttpClientRequest.bodyJsonUnsafe(body));
+};
+export { request, statelessRequest };

package/dist/mcp/watch.mjs

@@ -0,0 +1,115 @@
+import { InvalidInput } from "../contract/errors.mjs";
+import { isTransientStatus } from "../contract/status.mjs";
+import { Checked, Gap, untaggedOccurrenceOf } from "../contract/occurrence.mjs";
+import { defaultNextPoll } from "../contract/feed.mjs";
+import { reasonOf } from "../contract/codes.mjs";
+import { Receiving, webhookFed } from "../contract/receiving.mjs";
+import { Failed, readOn } from "../contract/push.mjs";
+import { WebhookCallback, WebhookTarget } from "../contract/subscribe.mjs";
+import { failingWhenSilent, failingWhenUnanswered, isTransient } from "../contract/transient.mjs";
+import { Active, Failed as Failed$1, Heartbeat, Occurred, PollEvents, SubscribeEvents, Terminated, UnsubscribeEvents, WireError, codes } from "./events.mjs";
+import { McpCallError, NoReply, ProtocolError, StatusError, bodyOf, callError, failWith, framesOf, isEventStream } from "./reply.mjs";
+import { request } from "./request.mjs";
+import { Duration, Effect, Match, Option, Predicate, Schema, Stream } from "effect";
+// src/mcp/watch.ts
+/** Reads one message as a request's reply: its result, by `success`, or its error. */
+const replyOf = (success) => Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Union([Schema.Struct({ result: success }), Schema.Struct({ error: WireError })])));
+const pollReplyOf = replyOf(PollEvents.successSchema);
+const Frame = Schema.Union([
+	Schema.Struct({ error: WireError }),
+	Schema.Struct({
+		method: Schema.String,
+		params: Schema.optional(Schema.Json)
+	}),
+	Schema.Struct({ result: Schema.Unknown })
+]);
+const decodeFrame = Schema.decodeUnknownOption(Schema.fromJsonString(Frame));
+const reading = (rpc, read) => {
+	const decode = Schema.decodeUnknownOption(rpc.payloadSchema);
+	return (params) => Option.map(decode(params), read);
+};
+const subscribeReplyOf = replyOf(SubscribeEvents.successSchema);
+const unsubscribeReplyOf = replyOf(UnsubscribeEvents.successSchema);
+const encodeCallback = Schema.encodeSync(WebhookCallback);
+const encodeTarget = Schema.encodeSync(WebhookTarget);
+const transientReason = (reason) => Match.value(reason).pipe(Match.tag("StatusError", ({ status }) => isTransientStatus(status)), Match.tag("ProtocolError", ({ code }) => code === codes.internal), Match.orElse(() => false));
+const isMcpCallError = Schema.is(McpCallError);
+const transient = Predicate.or(isTransient, Predicate.compose(isMcpCallError, ({ reason }) => transientReason(reason)));
+/**
+* The transport of one subscription over an MCP endpoint served by `layerHttp`: `events/poll`
+* for each page, and `events/stream` read as it arrives, each failing as the endpoint answered.
+*/
+const transportOf = ({ http, url, event, refusedWith }, input) => {
+	const { name } = event;
+	const untagged = untaggedOccurrenceOf(event);
+	const occurrenceOf = (wire) => untagged({
+		...wire,
+		cursor: wire.cursor ?? null
+	});
+	const failed = (method, error) => reasonOf(name, error) ?? (error.code === codes.invalidParams ? new InvalidInput({ message: error.message }) : callError(method, name, new ProtocolError(error)));
+	const sent = (method, params) => Effect.filterOrElse(http.execute(request(method, {
+		name,
+		arguments: input,
+		...params
+	}, { url })), (response) => response.status === 200, (response) => Effect.flatMap(response.text, (body) => failWith(refusedWith, body, callError(method, name, new StatusError({
+		status: response.status,
+		body
+	})))));
+	/** The result of one `method` request, or what its error reply fails with. */
+	const answered = (method, params, decodeReply) => Effect.gen(function* () {
+		const messages = yield* bodyOf(method, name, yield* sent(method, params));
+		const reply = messages.flatMap((message) => Option.toArray(decodeReply(message))).at(-1);
+		if (reply === void 0) return yield* callError(method, name, new NoReply({ body: messages.join("\n") }));
+		if ("error" in reply) return yield* failed(method, reply.error);
+		return reply.result;
+	}).pipe(failingWhenUnanswered);
+	const poll = (cursor) => Effect.gen(function* () {
+		const result = yield* answered("events/poll", { cursor }, pollReplyOf);
+		return {
+			events: yield* Effect.forEach(result.events, occurrenceOf),
+			cursor: result.cursor ?? null,
+			truncated: result.truncated === true,
+			hasMore: result.hasMore === true,
+			nextPoll: result.nextPollMs === void 0 ? defaultNextPoll : Duration.millis(result.nextPollMs)
+		};
+	});
+	const readers = new Map(Object.entries({
+		[Active._tag]: reading(Active, ({ cursor = null, truncated }) => Effect.succeed([truncated === true ? Gap.make({ cursor }) : Checked.make({ cursor })])),
+		[Occurred._tag]: reading(Occurred, (params) => Effect.map(occurrenceOf(params), (occurrence) => [occurrence])),
+		[Heartbeat._tag]: reading(Heartbeat, ({ cursor = null }) => Effect.succeed([Checked.make({ cursor })])),
+		[Failed$1._tag]: reading(Failed$1, () => Effect.succeed([Failed.make({})])),
+		[Terminated._tag]: reading(Terminated, ({ error }) => Effect.fail(failed("events/stream", error)))
+	}));
+	const framed = (data) => Option.match(decodeFrame(data), {
+		onNone: () => Effect.succeed([]),
+		onSome: (frame) => {
+			if ("error" in frame) return Effect.fail(failed("events/stream", frame.error));
+			if (!("method" in frame)) return Effect.succeed([]);
+			const reader = readers.get(frame.method);
+			if (reader === void 0) return Effect.succeed([]);
+			return Option.getOrElse(reader(frame.params), () => Effect.as(Effect.logWarning(`MCP event "${name}" sent a frame that does not decode: ${data}`), []));
+		}
+	});
+	const read = (response) => framesOf("events/stream", name, response).pipe(failingWhenSilent, Stream.mapEffect(framed), Stream.flattenIterable);
+	const stream = (cursor) => Stream.unwrap(Effect.map(failingWhenUnanswered(sent("events/stream", { cursor })), (response) => isEventStream(response) ? read(response) : Stream.fromIterableEffect(failingWhenUnanswered(Effect.flatMap(response.text, framed))))).pipe(readOn("MCP", name));
+	return {
+		name,
+		poll,
+		stream,
+		webhook: {
+			receiver: Effect.service(Receiving),
+			subscribe: ({ delivery, cursor, ttlMs }) => answered("events/subscribe", {
+				delivery: {
+					mode: "webhook",
+					...encodeCallback(delivery)
+				},
+				cursor,
+				...ttlMs === void 0 ? {} : { ttlMs }
+			}, subscribeReplyOf),
+			unsubscribe: ({ delivery }) => Effect.asVoid(answered("events/unsubscribe", { delivery: encodeTarget(delivery) }, unsubscribeReplyOf)),
+			read: webhookFed(event)
+		},
+		transient
+	};
+};
+export { transportOf };

package/dist/rpc/watch.mjs

@@ -0,0 +1,39 @@
+import { NotServed, SubscriptionError, Unsupported } from "../Event.mjs";
+import { readOn } from "../contract/push.mjs";
+import { isTransientReason, receivedFrom } from "../contract/transient.mjs";
+import { Cause, Effect, Match, Predicate, Schema, Stream } from "effect";
+import { HttpClientError } from "effect/http";
+import { RpcClientError } from "effect/rpc";
+// src/rpc/watch.ts
+const isRpcClientError = Schema.is(RpcClientError.RpcClientError);
+const isAnsweredReason = Schema.is(Schema.Union([
+	Schema.instanceOf(HttpClientError.TransportError),
+	Schema.instanceOf(HttpClientError.StatusCodeError),
+	Schema.instanceOf(HttpClientError.DecodeError)
+]));
+const cutResponses = ["HTTP response ended before RPC request completed", "Received empty HTTP response"];
+/** Whether a watch's failure over an rpc protocol is one a reconnect may outlast. */
+const isRpcTransient = Predicate.or(Cause.isTimeoutError, (error) => isRpcClientError(error) && Match.value(error.reason).pipe(Match.tag("SocketReadError", "SocketWriteError", "SocketOpenError", () => true), Match.tag("SocketCloseError", ({ code }) => code < 4e3 || code > 4999), Match.tag("HttpError", ({ cause }) => isAnsweredReason(cause) && isTransientReason(cause)), Match.tag("RpcClientDefect", ({ message }) => cutResponses.some((fragment) => message.includes(fragment))), Match.orElse(() => false)));
+const isUnknownTag = (tag) => {
+	const message = `Unknown request tag: ${tag}`;
+	return (cause) => cause.reasons.some((reason) => Cause.isDieReason(reason) && (Predicate.hasProperty(reason.defect, "message") ? reason.defect.message === message : reason.defect === message));
+};
+/**
+* The transport of one subscription to `event` over its stream rpc: the stream alone, since an
+* rpc serves no poll, failing as `NotServed` where the server serves no such rpc, and once it goes
+* silent where `silenceEnds`.
+*/
+const transportOf = (event, stream, silenceEnds) => {
+	const notServed = Stream.fail(SubscriptionError.of(event.name, new NotServed()));
+	const unknownTag = isUnknownTag(event.name);
+	return {
+		name: event.name,
+		poll: () => Effect.fail(SubscriptionError.of(event.name, new Unsupported({
+			feature: "deliveryMode",
+			value: "poll"
+		}))),
+		stream: (cursor) => stream(cursor).pipe(Stream.catchCauseIf(unknownTag, () => notServed), silenceEnds ? receivedFrom("RPC", event.name) : readOn("RPC", event.name)),
+		transient: isRpcTransient
+	};
+};
+export { isRpcTransient, transportOf };

package/dist/stdio/console.mjs

@@ -3,7 +3,9 @@ import { Clock, Console, Effect, Function, Predicate } from "effect";
 const stderrConsole = (console, clock) => {
 	const counts = /* @__PURE__ */ new Map();
 	const timers = /* @__PURE__ */ new Map();
-	const write = (...args) => console.error(...args);
+	const write = (...args) => {
+		console.error(...args);
+	};
 	const elapsed = (label, data) => {
 		const start = timers.get(label);
 		if (start !== void 0) {
@@ -32,7 +34,9 @@ const stderrConsole = (console, clock) => {
 			counts.delete(label);
 		},
 		debug: write,
-		dir: (item) => write("%O", item),
+		dir: (item) => {
+			write("%O", item);
+		},
 		dirxml: write,
 		error: write,
 		group,
@@ -40,7 +44,9 @@ const stderrConsole = (console, clock) => {
 		groupEnd: Function.constVoid,
 		info: write,
 		log: write,
-		table: (data) => write(data),
+		table: (data) => {
+			write(data);
+		},
 		time: (label = "default") => {
 			if (!timers.has(label)) timers.set(label, clock.monotonicTimeNanosUnsafe());
 		},
@@ -48,9 +54,11 @@ const stderrConsole = (console, clock) => {
 			elapsed(label, []);
 			timers.delete(label);
 		},
-		timeLog: (label = "default", ...data) => elapsed(label, data),
+		timeLog: (label = "default", ...data) => {
+			elapsed(label, data);
+		},
 		trace: (...args) => {
-			const { stack = "" } = /* @__PURE__ */ new Error();
+			const { stack = "" } = /* @__PURE__ */ new Error("console.trace");
 			const [_header, _traceFrame, ...callerFrames] = stack.split("\n");
 			const callerStack = callerFrames.join("\n");
 			writeLabelKeepingFormat("Trace", args);

package/dist/testing/memory.d.mts

@@ -1,4 +1,4 @@
 import { Layer } from "effect";
 import { HttpClient, HttpRouter, HttpServer } from "effect/http";
 /** What in-memory routes may leave to the host: the router, the platform, nothing per request. */
-export type Served = HttpRouter.HttpRouter | HttpRouter.Request<"Requires", never> | HttpRouter.Request<"GlobalRequires", never> | HttpRouter.Request<"Error", any> | HttpRouter.Request<"GlobalError", any> | Layer.Success<typeof HttpServer.layerServices>;
+export type Served = HttpRouter.HttpRouter | HttpRouter.Request<"Requires", never> | HttpRouter.Request<"GlobalRequires", never> | HttpRouter.Request<"Error", unknown> | HttpRouter.Request<"GlobalError", unknown> | Layer.Success<typeof HttpServer.layerServices>;

package/dist/testing/memory.mjs

@@ -3,7 +3,7 @@ import { FetchHttpClient, HttpBody, HttpClient, HttpClientRequest } from "effect
 // src/testing/memory.ts
 const relativeUrlOrigin = "http://localhost/";
 const withWebStreamBodyInCurrentContext = (request) => {
-	const body = request.body;
+	const { body } = request;
 	if (!Predicate.isTagged(body, "Stream")) return Effect.succeed(request);
 	return Effect.map(Stream.toReadableStreamEffect(body.stream), (readable) => HttpClientRequest.setBody(request, HttpBody.raw(readable, {
 		contentType: body.contentType,
@@ -11,10 +11,10 @@ const withWebStreamBodyInCurrentContext = (request) => {
 	})).pipe(HttpClientRequest.updateHeaders(() => request.headers)));
 };
 const clientOf = (handler) => {
-	const fetch = (input, init) => {
+	const fetch = async (input, init) => {
 		const request = new Request(input, init);
 		if (!request.headers.has("host")) request.headers.set("host", new URL(request.url).host);
-		return handler(request);
+		return await handler(request);
 	};
 	return Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (native) => HttpClient.makeWith((request) => Effect.flatMap(request, (mapped) => {
 		const resolved = URL.canParse(mapped.url) ? null : URL.parse(mapped.url, relativeUrlOrigin);

package/dist/webhook/address.mjs

@@ -0,0 +1,47 @@
+import { Effect, Function, Result } from "effect";
+import { Host, IpNetwork, NetAddress } from "effect/net";
+// src/webhook/address.ts
+const notGlobal = [
+	"0.0.0.0/8",
+	"10.0.0.0/8",
+	"100.64.0.0/10",
+	"127.0.0.0/8",
+	"169.254.0.0/16",
+	"172.16.0.0/12",
+	"192.0.0.0/24",
+	"192.0.2.0/24",
+	"192.88.99.0/24",
+	"192.168.0.0/16",
+	"198.18.0.0/15",
+	"198.51.100.0/24",
+	"203.0.113.0/24",
+	"224.0.0.0/4",
+	"240.0.0.0/4",
+	"::/127",
+	"::ffff:0:0/96",
+	"64:ff9b::/96",
+	"64:ff9b:1::/48",
+	"100::/64",
+	"2001::/23",
+	"2001:db8::/32",
+	"2002::/16",
+	"3fff::/20",
+	"5f00::/16",
+	"fc00::/7",
+	"fe80::/10",
+	"ff00::/8"
+].map(IpNetwork.fromStringUnsafe);
+/** Whether `address` is globally reachable, in no special-purpose range. */
+const isGlobal = (address) => !notGlobal.some((network) => IpNetwork.contains(network, address));
+/**
+* Checks the host of `url`, failing unless every address it names is globally reachable: a
+* literal address is checked as it is, a name through `dns`, or passed where there is none, and a
+* scoped IPv6 literal refused.
+*/
+const checkedHost = (url, dns) => {
+	const host = Result.getOrUndefined(Host.hostFromString(url.hostname.replace(/^\[(?<address>.*)\]$/u, "$<address>")));
+	if (!NetAddress.isIpAddress(host) && !Host.isDomainName(host)) return Effect.fail(void 0);
+	const addresses = NetAddress.isIpAddress(host) ? Effect.succeed([host]) : dns?.lookup(host) ?? Effect.succeed([]);
+	return Effect.flatMap(Effect.mapError(addresses, Function.constUndefined), (resolved) => resolved.every(isGlobal) ? Effect.void : Effect.fail(void 0));
+};
+export { checkedHost };

package/dist/webhook/attempt.mjs

@@ -0,0 +1,65 @@
+import { signature } from "./signing.mjs";
+import { Clock, Data, Duration, Effect, Option, Schema, Stream } from "effect";
+import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
+// src/webhook/attempt.ts
+/**
+* One attempt of a delivery that failed: `category` is SEP-3415's for it, and `final` says a
+* retry would not help, as for a `410 Gone` or a `413 Payload Too Large`.
+*/
+var AttemptFailed = class extends Data.TaggedError("AttemptFailed") {};
+const timeout = Duration.seconds(5);
+const statusCategory = (status) => status >= 500 ? "http_5xx" : "http_4xx";
+const outbound = (effect) => Effect.flatMap(Effect.serviceOption(FetchHttpClient.RequestInit), (init) => effect.pipe(Effect.provideService(FetchHttpClient.RequestInit, {
+	...Option.getOrUndefined(init),
+	redirect: "manual"
+}), Effect.provideService(HttpClient.TracerPropagationEnabled, false)));
+const sent = ({ url, subscriptionId, webhookId, body, keys }, checked, answer) => Effect.gen(function* () {
+	const unreached = new AttemptFailed({
+		category: "connection_refused",
+		final: false
+	});
+	const timestamp = Math.floor((yield* Clock.currentTimeMillis) / 1e3);
+	const signed = yield* signature(keys, webhookId, timestamp, body);
+	const client = HttpClient.withScope(yield* HttpClient.HttpClient);
+	const request = HttpClientRequest.post(url).pipe(HttpClientRequest.setHeaders({
+		"webhook-id": webhookId,
+		"webhook-timestamp": String(timestamp),
+		"webhook-signature": signed,
+		"x-mcp-subscription-id": subscriptionId
+	}), HttpClientRequest.bodyText(body, "application/json"));
+	const answered = Effect.flatMap(Effect.mapError(client.execute(request), () => unreached), (response) => response.status >= 200 && response.status < 300 ? answer(response) : Effect.fail(new AttemptFailed({
+		category: statusCategory(response.status),
+		final: response.status === 410 || response.status === 413
+	})));
+	return yield* Effect.andThen(Effect.mapError(checked, () => unreached), outbound(answered)).pipe(Effect.timeoutOrElse({
+		duration: timeout,
+		orElse: () => Effect.fail(new AttemptFailed({
+			category: "timeout",
+			final: false
+		}))
+	}), Effect.scoped);
+});
+/**
+* POSTs `body` to the callback, signed with a fresh timestamp, once `checked`, its address check,
+* passes, and succeeds at a 2xx without reading its body. The timeout bounds the check and the
+* POST together.
+*/
+const attempt = (posting, checked) => sent(posting, checked, () => Effect.void);
+const Challenged = Schema.fromJsonString(Schema.Struct({ challenge: Schema.String }));
+const answerLimit = 4096;
+const textOf = (response) => Effect.suspend(() => {
+	const decoder = new TextDecoder();
+	return response.stream.pipe(Stream.scan(() => ({
+		bytes: 0,
+		text: ""
+	}), ({ bytes, text }, chunk) => ({
+		bytes: bytes + chunk.length,
+		text: text + decoder.decode(chunk, { stream: true })
+	})), Stream.takeUntil(({ bytes }) => bytes > answerLimit), Stream.runLast, Effect.map((last) => Option.map(Option.filter(last, ({ bytes }) => bytes <= answerLimit), ({ text }) => text + decoder.decode())), Effect.orElseSucceed(() => Option.none()));
+});
+/**
+* `attempt` of a verification: the challenge its 2xx answer echoes, where its first 4 KiB hold
+* one.
+*/
+const challenged = (posting, checked) => sent(posting, checked, (response) => Effect.map(textOf(response), (text) => Option.getOrUndefined(Option.map(Option.flatMap(text, Schema.decodeUnknownOption(Challenged)), ({ challenge }) => challenge))));
+export { AttemptFailed, attempt, challenged };

package/dist/webhook/receiver.mjs

@@ -0,0 +1,67 @@
+import { watchParameter } from "../contract/receiving.mjs";
+import { makeRecent } from "../contract/recent.mjs";
+import { constantTimeEqual, signature } from "./signing.mjs";
+import { Clock, Effect, Option, Predicate, Schema } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+import { Base64, Base64Url } from "effect/encoding";
+// src/webhook/receiver.ts
+/** How old a delivery's `webhook-timestamp` may be, or how far ahead, before it is refused. */
+const tolerance = 300;
+const dedupeWindow = 1e3;
+const Body = Schema.fromJsonString(Schema.Record(Schema.String, Schema.Json));
+const decodeBody = Schema.decodeUnknownOption(Body);
+const gone = HttpServerResponse.empty({ status: 410 });
+const unauthorized = HttpServerResponse.empty({ status: 401 });
+/**
+* The receiver of one `Webhook.layerReceiver` at `path`: `receiving`, where each watch keeps its
+* place under an id and a secret of its own, and `handler`, which verifies a POST against the
+* secret of the watch its URL names and hands its body to that watch.
+*/
+const makeReceiver = (path) => Effect.sync(() => {
+	const places = /* @__PURE__ */ new Map();
+	const register = (deliver) => Effect.acquireRelease(Effect.sync(() => {
+		const id = Base64Url.encode(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16)));
+		const key = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+		places.set(id, {
+			key,
+			deliver,
+			seen: makeRecent(dedupeWindow)
+		});
+		return {
+			id,
+			secret: {
+				text: `whsec_${Base64.encode(key)}`,
+				key
+			}
+		};
+	}), ({ id }) => Effect.sync(() => places.delete(id)));
+	const handler = Effect.gen(function* () {
+		const request = yield* HttpServerRequest.HttpServerRequest;
+		const named = (yield* HttpServerRequest.ParsedSearchParams)[watchParameter];
+		const place = Predicate.isString(named) ? places.get(named) : void 0;
+		if (place === void 0) return gone;
+		const id = request.headers["webhook-id"];
+		const timestamp = Number(request.headers["webhook-timestamp"]);
+		const signatures = (request.headers["webhook-signature"] ?? "").split(" ");
+		const now = Math.floor((yield* Clock.currentTimeMillis) / 1e3);
+		if (id === void 0 || !Number.isInteger(timestamp) || Math.abs(now - timestamp) > tolerance) return unauthorized;
+		const text = yield* Effect.orElseSucceed(request.text, () => "");
+		const expected = yield* signature([place.key], id, timestamp, text);
+		if (!signatures.some((each) => constantTimeEqual(each, expected))) return unauthorized;
+		const body = decodeBody(text);
+		if (Option.isNone(body)) return HttpServerResponse.empty({ status: 400 });
+		if (body.value["type"] === "verification") return HttpServerResponse.jsonUnsafe({ challenge: body.value["challenge"] });
+		if (place.seen.has(id)) return HttpServerResponse.empty();
+		if (!place.deliver(body.value)) return HttpServerResponse.empty({ status: 503 });
+		place.seen.add(id);
+		return HttpServerResponse.empty();
+	});
+	return {
+		receiving: {
+			path,
+			register
+		},
+		handler
+	};
+});
+export { makeReceiver };

package/dist/webhook/signing.mjs

@@ -0,0 +1,28 @@
+import { sha256Hex } from "../contract/digest.mjs";
+import { Effect } from "effect";
+import { Base64, Hex } from "effect/encoding";
+// src/webhook/signing.ts
+const encoder = new TextEncoder();
+const hmac = (key, content) => Effect.promise(async () => {
+	const imported = await crypto.subtle.importKey("raw", Uint8Array.from(key), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return new Uint8Array(await crypto.subtle.sign("HMAC", imported, encoder.encode(content)));
+});
+/**
+* A delivery's `webhook-signature`: Standard Webhooks' `v1,` HMAC-SHA256 of `id.timestamp.body`
+* under each key, space apart, so a receiver mid-rotation verifies under either.
+*/
+const signature = (keys, id, timestamp, body) => Effect.map(Effect.forEach(keys, (key) => hmac(key, `${id}.${timestamp}.${body}`)), (signed) => signed.map((bytes) => `v1,${Base64.encode(bytes)}`).join(" "));
+/** `sub_` and the first 16 bytes of the SHA-256 of `key`, in hex: a subscription's id. */
+const subscriptionId = (key) => Effect.map(sha256Hex(key), (hex) => `sub_${hex.slice(0, 32)}`);
+/** 16 random bytes in hex, for a challenge or an envelope's `webhook-id`. */
+const randomToken = Effect.sync(() => Hex.encode(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16))));
+/** Whether `a` and `b` are equal, in a time that does not depend on where they differ. */
+const constantTimeEqual = (a, b) => {
+	const left = encoder.encode(a);
+	const right = encoder.encode(b);
+	return left.length === right.length && left.reduce((differs, byte, index) => differs | byte ^ (right[index] ?? 0), 0) === 0;
+};
+export { constantTimeEqual, randomToken, signature, subscriptionId };

package/dist/webhook/stored.mjs

@@ -0,0 +1,57 @@
+import { reported } from "../contract/reported.mjs";
+import { CallbackUrl, WebhookSecret } from "../contract/callback.mjs";
+import { DeliveryStatus } from "../contract/subscribe.mjs";
+import { Duration, Effect, Option, Queue, Schema, Semaphore } from "effect";
+import { KeyValueStore } from "effect/persistence";
+// src/webhook/stored.ts
+/**
+* A webhook subscription as `persist` keeps it, enough to start delivering again after a
+* restart: its callback, event, encoded input and identity, secret, expiry, watermark and
+* status. Its callback and secret are decoded again as it is read, as a request's are, and its
+* subscriber's principal is derived again from the identity.
+*/
+const Stored = Schema.Struct({
+	url: CallbackUrl,
+	event: Schema.String,
+	input: Schema.Json,
+	identity: Schema.Json,
+	secret: WebhookSecret,
+	expiresAt: Schema.Finite,
+	watermark: Schema.NullOr(Schema.String),
+	status: DeliveryStatus
+});
+const prefix = "effect-actions/webhook";
+const Index = Schema.Array(Schema.String);
+const flushTimeout = Duration.seconds(5);
+/**
+* A storage over `store`. Its writes run on a fiber of their own, never in the request or the
+* delivery that marked them, so a slow or failing store holds up neither: a failure is reported,
+* and written again with the next mark or as the layer closes.
+* A store whose index cannot be read fails the layer as it builds.
+*/
+const makeStorage = (store) => Effect.gen(function* () {
+	const records = KeyValueStore.toSchemaStore(KeyValueStore.prefix(store, `${prefix}/`), Stored);
+	const index = KeyValueStore.toSchemaStore(store, Index);
+	let indexed = new Set(yield* Effect.orDie(Effect.map(index.get(prefix), Option.getOrElse(() => []))));
+	const pending = /* @__PURE__ */ new Map();
+	const marked = yield* Queue.sliding(1);
+	const writing = Semaphore.makeUnsafe(1);
+	const listed = (next) => Effect.andThen(index.set(prefix, [...next]), Effect.sync(() => {
+		indexed = next;
+	}));
+	const written = (id, record) => record === void 0 ? Effect.andThen(records.remove(id), Effect.suspend(() => indexed.has(id) ? listed(new Set([...indexed].filter((each) => each !== id))) : Effect.void)) : Effect.andThen(Effect.suspend(() => indexed.has(id) ? Effect.void : listed(/* @__PURE__ */ new Set([...indexed, id]))), records.set(id, record));
+	const flushed = writing.withPermits(1)(Effect.suspend(() => Effect.forEach([...pending], ([id, record]) => written(id, record).pipe(Effect.andThen(Effect.sync(() => {
+		if (pending.get(id) === record) pending.delete(id);
+	})), Effect.catchCause(reported)), { discard: true })));
+	yield* Effect.forkScoped(Effect.forever(Effect.andThen(Queue.take(marked), flushed)));
+	yield* Effect.addFinalizer(() => flushed.pipe(Effect.timeout(flushTimeout), Effect.ignore));
+	return {
+		mark: (id, record) => {
+			pending.set(id, record);
+			Queue.offerUnsafe(marked, void 0);
+		},
+		ids: () => [.../* @__PURE__ */ new Set([...indexed, ...pending.keys()])],
+		get: (id) => pending.has(id) ? Effect.succeed(Option.fromUndefinedOr(pending.get(id))) : records.get(id)
+	};
+});
+export { Stored, makeStorage };