@gjermundgaraba/effect-actions 0.20.0 → 0.21.0

package/examples/kitchen-sink/src/routes.ts

@@ -1,45 +1,65 @@
-import { Effect, Layer } from "effect";
-import { HttpRouter, HttpServerResponse } from "effect/http";
-import { HttpApiSwagger, OpenApi } from "effect/http-api";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
 import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
 import * as ActionMcp from "@gjermundgaraba/effect-actions/ActionMcp";
 import * as ActionRpc from "@gjermundgaraba/effect-actions/ActionRpc";
+import * as Webhook from "@gjermundgaraba/effect-actions/Webhook";
+import { Effect, Layer } from "effect";
+import { HttpRouter, HttpServerResponse } from "effect/http";
+import { HttpApiSwagger, OpenApi } from "effect/http-api";
+
 import { MemberActions, Tools } from "./Actions.js";
 import { authenticateOperator } from "./admin/authenticate.js";
-import { assistant } from "./assistant/handlers.js";
 import { admin } from "./admin/handlers.js";
 import { AdminHttp, Http } from "./Api.js";
+import { assistant } from "./assistant/handlers.js";
 import { download } from "./attachments/download.js";
 import { attachments } from "./attachments/handlers.js";
 import { allowedOrigins } from "./config.js";
-import { authenticateBearer, authenticateSession } from "./identity/authenticate.js";
+import {
+  authenticateBearer,
+  authenticateSession,
+} from "./identity/authenticate.js";
 import { identity } from "./identity/handlers.js";
 import { Login } from "./identity/Identity.js";
 import { HttpQuota, quota, RpcQuota } from "./identity/quota.js";
 import { layer as assistantTools } from "./issues/assistant.js";
+import { issueEvents } from "./issues/events.js";
+import { exports } from "./issues/export.js";
 import { features } from "./issues/guide.js";
 import { issues } from "./issues/handlers.js";
+import { IssueChanged } from "./issues/Issues.js";
 import { cors, requestPolicy } from "./request-policy.js";
 import { Rpc } from "./Rpc.js";
 import { status } from "./workspaces/handlers.js";
 import { resolveTenant } from "./workspaces/tenant.js";
 import { GetStatus } from "./workspaces/Workspaces.js";
 
-// Every domain's implementation of the public port's actions, once. Each surface below takes
-// this one list and serves the actions its binding or its `actions` names.
-const implementations = [status, identity, issues, attachments, assistant];
+// Every domain's implementation of the public port's actions and events, once. Each surface
+// below takes this one list and serves what its binding or its `actions` names.
+const implementations = [
+  status,
+  identity,
+  issues,
+  issueEvents,
+  exports,
+  attachments,
+  assistant,
+];
 
-// JSON routes at `/api/v1/<action>`, in two layers of one binding, each naming its `actions`.
-// The quota requires the caller, and a public route has none, so `getStatus` is served by a
-// layer without it.
+// JSON routes at `/api/v1/<action>`, in two layers of one binding, each naming its `actions`,
+// an event among them: a layer given `actions` serves exactly what it names. The quota requires
+// the caller, and a public route has none, so `getStatus` is served by a layer without it.
 const api = Layer.mergeAll(
   ActionHttp.layer(Http, implementations, { actions: [GetStatus] }),
-  ActionHttp.layer(Http, implementations, { actions: MemberActions, middleware: [HttpQuota] }),
+  ActionHttp.layer(Http, implementations, {
+    actions: [...MemberActions, IssueChanged],
+    middleware: [HttpQuota],
+  })
 );
 
 // The same actions as MCP tools at `/mcp`: a mixed endpoint, serving the public `getStatus`
-// beside the members' tools.
+// beside the members' tools, and `issue.changed` as an MCP event, polled, streamed or
+// delivered by webhook.
 const mcp = Layer.unwrap(
   Effect.map(allowedOrigins, (origins) =>
     ActionMcp.layerHttp(implementations, {
@@ -47,24 +67,24 @@ const mcp = Layer.unwrap(
       version: "1.0.0",
       instructions: "Read an issue before commenting on it or closing it.",
       authentication: Login,
-      actions: Tools,
+      actions: [...Tools, IssueChanged],
       features,
       // The endpoint's own Origin allowlist, narrower than the request policy, which has
       // already refused a foreign Origin: that policy also lets through a page of any name
       // this host answers to, such as http://127.0.0.1:3000. Not listed here, such a page gets
       // a 403 from the endpoint.
       allowedOrigins: origins,
-    }),
-  ),
+    })
+  )
 );
 
 // The members' actions as Effect RPC, for the web app, behind its session cookie and the same
 // quota as native RPC middleware. It still requires its protocol and serialization, chosen by
 // whoever serves it: server.ts gives it a WebSocket, and a test Effect's HTTP protocol, which
 // answers in memory.
-export const rpc = ActionRpc.layer(Rpc, implementations, { middleware: [RpcQuota] }).pipe(
-  Layer.provide([authenticateSession, quota, assistantTools]),
-);
+export const rpc = ActionRpc.layer(Rpc, implementations, {
+  middleware: [RpcQuota],
+}).pipe(Layer.provide([authenticateSession, quota, assistantTools]));
 
 // Effect's own tools read the binding's native `HttpApi`: the OpenAPI document and a Swagger
 // UI, each showing the bearer scheme on every route but `getStatus`.
@@ -72,9 +92,9 @@ const documentation = Layer.mergeAll(
   HttpRouter.add(
     "GET",
     `${Http.prefix}/openapi.json`,
-    HttpServerResponse.jsonUnsafe(OpenApi.fromApi(Http.api)),
+    HttpServerResponse.jsonUnsafe(OpenApi.fromApi(Http.api))
   ),
-  HttpApiSwagger.layer(Http.api, { path: "/docs" }),
+  HttpApiSwagger.layer(Http.api, { path: "/docs" })
 );
 
 const health = HttpRouter.add("GET", "/healthz", HttpServerResponse.text("ok"));
@@ -94,12 +114,25 @@ const health = HttpRouter.add("GET", "/healthz", HttpServerResponse.text("ok"));
 // The assistant's builder yields its tools, so their handlers are provided to the layers
 // serving it, here and on `rpc`: one Layer, built once in the layer graph serving both, where
 // the tools run the issue implementation the routes serve, with no second build of it.
-export const publicRoutes = Layer.mergeAll(api, mcp, download, documentation, health).pipe(
+//
+// Webhook delivery serves MCP's `events/subscribe` and HTTP's
+// `POST /api/v1/events/issue.changed/subscribe`: a member names a callback URL and a secret,
+// and each change it may see is POSTed there, signed. One layer holds the subscriptions of
+// both. It POSTs with an `HttpClient` and checks where each callback resolves with `Dns`, which
+// server.ts provides.
+export const publicRoutes = Layer.mergeAll(
+  api,
+  mcp,
+  download,
+  documentation,
+  health
+).pipe(
+  Layer.provide(Webhook.layer()),
   Layer.provide(assistantTools),
   Layer.provide([authenticateBearer, authenticateSession, quota]),
   Layer.provide(resolveTenant.layer),
   Layer.provide(cors),
-  Layer.provide(requestPolicy),
+  Layer.provide(requestPolicy)
 );
 
 // The admin port: what operators reach, and nothing else. It is a router of its own, with its
@@ -107,12 +140,19 @@ export const publicRoutes = Layer.mergeAll(api, mcp, download, documentation, he
 // serves one implementation the public port serves too, `status`.
 export const adminRoutes = Layer.mergeAll(
   ActionHttp.layer(AdminHttp, [status, admin]),
-  health,
+  health
 ).pipe(Layer.provide(authenticateOperator), Layer.provide(requestPolicy));
 
 // Every builder as one layer. The two ports are two layer graphs, and each would run the
 // builder of an implementation it serves: `status`, which both serve, twice, each port then
 // reporting an `instance` of its own. Provided above both, with the services, each builder
-// runs once for every surface of both ports. The assistant's is left out: the public port
-// alone serves it, and builds it once for its routes and its rpcs.
-export const builders = Action.layer([status, identity, issues, attachments, admin]);
+// runs once for every surface of both ports. The assistant's, the export's and the event's are
+// left out: the public port alone serves them, and builds each once for its routes and its
+// rpcs.
+export const builders = Action.layer([
+  status,
+  identity,
+  issues,
+  attachments,
+  admin,
+]);

package/examples/kitchen-sink/src/sdk.ts

@@ -1,6 +1,7 @@
-import { Effect, flow } from "effect";
-import { HttpClient, HttpClientRequest } from "effect/http";
 import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
+import { Effect, flow, Stream } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
+
 import { Http } from "./Api.js";
 import type { Issue } from "./issues/Issues.js";
 
@@ -19,28 +20,37 @@ export const connect = (options: {
     transformClient: HttpClient.mapRequest(
       flow(
         HttpClientRequest.bearerToken(options.token),
-        HttpClientRequest.setHeader("x-workspace", options.workspace),
-      ),
+        HttpClientRequest.setHeader("x-workspace", options.workspace)
+      )
     ),
   });
 
   return {
     // A method takes the action's decoded input, so a field with a decoding default is given
     // here; only a call without any argument sends `{}` and gets the defaults.
-    openIssues: (limit = 20) =>
-      Effect.runPromise(
-        Effect.map(api.listIssues({ status: "open", limit }), ({ issues }) => issues),
+    openIssues: async (limit = 20) =>
+      await Effect.runPromise(
+        Effect.map(
+          api.listIssues({ status: "open", limit }),
+          ({ issues }) => issues
+        )
       ),
 
     // A declared error is a typed failure, handled by its tag: a missing issue is `undefined`.
-    issue: (id: string): Promise<Issue | undefined> =>
-      api.getIssue({ id }).pipe(
-        Effect.catchTag("IssueNotFound", () => Effect.succeed(undefined)),
-        Effect.runPromise,
+    issue: async (id: string): Promise<Issue | undefined> =>
+      await api.getIssue({ id }).pipe(
+        Effect.catchTag("IssueNotFound", () => Effect.undefined),
+        Effect.runPromise
       ),
 
     // Left unhandled, a declared error rejects the promise as its decoded value, so a caller's
     // `catch` may test `error instanceof RateLimited`.
-    file: (title: string, body: string) => Effect.runPromise(api.createIssue({ title, body })),
+    file: async (title: string, body: string) =>
+      await Effect.runPromise(api.createIssue({ title, body })),
+
+    // A stream action's method returns a `Stream`; as an async iterable, `for await` reads each
+    // issue as the server sends it.
+    exportAll: (): AsyncIterable<Issue> =>
+      Stream.toAsyncIterable(api.exportIssues({})),
   };
 };

package/examples/kitchen-sink/src/seed.ts

@@ -1,8 +1,10 @@
 import { Buffer } from "node:buffer";
+
 import { NodeRuntime } from "@effect/platform-node";
+import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
 import { Config, Console, Effect, flow } from "effect";
 import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/http";
-import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
+
 import { Http } from "./Api.js";
 
 // Entrypoint: `node --import tsx examples/kitchen-sink/src/seed.ts`, with the server running.
@@ -13,12 +15,12 @@ import { Http } from "./Api.js";
 // A one-pixel PNG stands in for a screenshot.
 const screenshot = Buffer.from(
   "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=",
-  "base64",
+  "base64"
 );
 
 const seed = Effect.gen(function* () {
   const baseUrl = yield* Config.String("TRACKER_URL").pipe(
-    Config.withDefault("http://127.0.0.1:3000"),
+    Config.withDefault("http://127.0.0.1:3000")
   );
 
   const tracker = yield* ActionHttp.client(Http, {
@@ -27,8 +29,8 @@ const seed = Effect.gen(function* () {
     transformClient: HttpClient.mapRequest(
       flow(
         HttpClientRequest.bearerToken("ada"),
-        HttpClientRequest.setHeader("x-workspace", "acme"),
-      ),
+        HttpClientRequest.setHeader("x-workspace", "acme")
+      )
     ),
   });
 
@@ -48,7 +50,10 @@ const seed = Effect.gen(function* () {
 
   const { issues } = yield* tracker.listIssues();
 
-  yield* Console.log(`Filed ${issue.id} with attachment ${attachment.id}. Issues:`, issues);
+  yield* Console.log(
+    `Filed ${issue.id} with attachment ${attachment.id}. Issues:`,
+    issues
+  );
 }).pipe(
   // A declared error is a typed failure, the binding's and the verifier's included: each is
   // handled by its tag. Anything else, such as an unreachable server, stays Effect's own.
@@ -57,8 +62,9 @@ const seed = Effect.gen(function* () {
       Console.error(`Write limit reached: retry in ${retryAfterSeconds}s.`),
     QuotaExceeded: ({ retryAfterSeconds }) =>
       Console.error(`Request quota spent: retry in ${retryAfterSeconds}s.`),
-    IssuerUnavailable: () => Console.error("The sign-in service is down: try again later."),
-  }),
+    IssuerUnavailable: () =>
+      Console.error("The sign-in service is down: try again later."),
+  })
 );
 
-seed.pipe(Effect.provide(FetchHttpClient.layer), NodeRuntime.runMain);
+seed.pipe(Effect.provide(FetchHttpClient.layer), NodeRuntime.runMain());

package/examples/kitchen-sink/src/server.ts

@@ -1,8 +1,10 @@
 import { createServer } from "node:http";
-import { NodeHttpServer, NodeRuntime } from "@effect/platform-node";
+
+import { NodeDns, NodeHttpServer, NodeRuntime } from "@effect/platform-node";
 import { ByteSize, Config, Effect, Layer } from "effect";
-import { HttpRouter, HttpServerRequest } from "effect/http";
+import { FetchHttpClient, HttpRouter, HttpServerRequest } from "effect/http";
 import { RpcSerialization, RpcServer } from "effect/rpc";
+
 import { memory } from "./memory.js";
 import { adminRoutes, builders, publicRoutes, rpc } from "./routes.js";
 
@@ -14,15 +16,23 @@ import { adminRoutes, builders, publicRoutes, rpc } from "./routes.js";
 // serves the same layer over Effect's HTTP protocol.
 const socket = rpc.pipe(
   Layer.provide(RpcServer.layerProtocolWebsocket({ path: "/rpc" })),
-  Layer.provide(RpcSerialization.layerJson),
+  Layer.provide(RpcSerialization.layerJson)
 );
 
 const server = Layer.unwrap(
   Effect.gen(function* () {
     // The loopback default serves this machine alone; HOST=0.0.0.0 lets others reach it.
-    const host = yield* Config.String("HOST").pipe(Config.withDefault("127.0.0.1"));
-    const publicPort = yield* Config.Port("PORT").pipe(Config.withDefault(3000));
-    const adminPort = yield* Config.Port("ADMIN_PORT").pipe(Config.withDefault(3001));
+    const host = yield* Config.String("HOST").pipe(
+      Config.withDefault("127.0.0.1")
+    );
+
+    const publicPort = yield* Config.Port("PORT").pipe(
+      Config.withDefault(3000)
+    );
+
+    const adminPort = yield* Config.Port("ADMIN_PORT").pipe(
+      Config.withDefault(3001)
+    );
 
     const limit = ByteSize.mebibytes(1);
 
@@ -42,8 +52,10 @@ const server = Layer.unwrap(
       // it is a route of that router: the request policy, global to the router, refuses a
       // foreign Origin's upgrade as it does a request, and the rpcs spend the quota the routes
       // spend, built once.
-      HttpRouter.serve(Layer.merge(publicRoutes, socket)).pipe(Layer.provide(listen(publicPort))),
-      HttpRouter.serve(adminRoutes).pipe(Layer.provide(listen(adminPort))),
+      HttpRouter.serve(Layer.merge(publicRoutes, socket)).pipe(
+        Layer.provide(listen(publicPort))
+      ),
+      HttpRouter.serve(adminRoutes).pipe(Layer.provide(listen(adminPort)))
     ).pipe(
       // Request bodies have no size limit unless the host sets one. This covers every route
       // that reads its body whole, on both ports, the MCP endpoint included.
@@ -53,9 +65,11 @@ const server = Layer.unwrap(
       // suspends on one port is refused on the other.
       Layer.provide(builders),
       Layer.provide(memory),
+      // Webhook delivery POSTs with fetch, and resolves each callback with the system's resolver.
+      Layer.provide([FetchHttpClient.layer, NodeDns.layer])
     );
-  }),
+  })
 );
 
 // NodeRuntime handles signals: the scoped layers stop both listeners and release the services.
-Layer.launch(server).pipe(NodeRuntime.runMain);
+Layer.launch(server).pipe(NodeRuntime.runMain());

package/examples/kitchen-sink/src/stdio.ts

@@ -1,7 +1,8 @@
 import { NodeRuntime, NodeStdio } from "@effect/platform-node";
-import { Effect } from "effect";
 import * as ActionCli from "@gjermundgaraba/effect-actions/ActionCli";
 import * as ActionMcp from "@gjermundgaraba/effect-actions/ActionMcp";
+import { Effect } from "effect";
+
 import { Tools } from "./Actions.js";
 import { attachments } from "./attachments/handlers.js";
 import { identity } from "./identity/handlers.js";
@@ -29,8 +30,13 @@ ActionMcp.runStdio([status, identity, issues, attachments], {
   // The host names the caller itself, around every call. DEMO ONLY: a real host reads who
   // started it, from its own login or configuration.
   Effect.provideService(CurrentMember, members.ada),
-  Effect.provide([NodeStdio.layer, stores, limiter, WorkspaceRegistry.layerMemory]),
+  Effect.provide([
+    NodeStdio.layer,
+    stores,
+    limiter,
+    WorkspaceRegistry.layerMemory,
+  ]),
   // stdout carries the protocol alone, so logs and failures go to stderr.
   ActionCli.logToStderr,
-  NodeRuntime.runMain,
+  NodeRuntime.runMain()
 );

package/examples/kitchen-sink/src/workspaces/Workspaces.ts

@@ -1,5 +1,5 @@
-import { Schema } from "effect";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
+import { Schema } from "effect";
 
 export const Workspace = Schema.Struct({
   slug: Schema.String,
@@ -9,11 +9,10 @@ export const Workspace = Schema.Struct({
 
 export type Workspace = typeof Workspace.Type;
 
-export class WorkspaceNotFound extends Schema.TaggedError<WorkspaceNotFound>()(
-  "WorkspaceNotFound",
-  { slug: Schema.String },
-  { httpApiStatus: 404 },
-) {}
+export class WorkspaceNotFound extends Schema.TaggedError<
+  WorkspaceNotFound,
+  { readonly brand: unique symbol }
+>()("WorkspaceNotFound", { slug: Schema.String }, { httpApiStatus: 404 }) {}
 
 // Public: `caller: Action.Anyone`. It answers before anyone has signed in, on every surface,
 // so it tells nothing that depends on the caller.
@@ -22,7 +21,11 @@ export const GetStatus = Action.make("getStatus", {
     "Report whether the tracker is up, since which start, and how many workspaces it serves.",
   // `instance` names one start of the process: it changes on a restart, and with it the demo's
   // memory stores are empty again.
-  success: { service: Schema.String, instance: Schema.String, workspaces: Schema.Finite },
+  success: {
+    service: Schema.String,
+    instance: Schema.String,
+    workspaces: Schema.Finite,
+  },
   readOnly: true,
   caller: Action.Anyone,
 });

package/examples/kitchen-sink/src/workspaces/handlers.ts

@@ -1,5 +1,6 @@
-import { Effect } from "effect";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
+import { Effect } from "effect";
+
 import { WorkspaceRegistry } from "./registry.js";
 import { GetStatus } from "./Workspaces.js";
 
@@ -19,5 +20,5 @@ export const status = Action.implement(
         instance,
         workspaces: workspaces.length,
       }));
-  }),
+  })
 );

package/examples/kitchen-sink/src/workspaces/registry.ts

@@ -1,5 +1,7 @@
 import { Context, Effect, Layer } from "effect";
-import { type Workspace, WorkspaceNotFound } from "./Workspaces.js";
+
+import { WorkspaceNotFound } from "./Workspaces.js";
+import type { Workspace } from "./Workspaces.js";
 
 /**
  * The tenants. Operators list and suspend them on the admin port; authentication reads the
@@ -8,11 +10,11 @@ import { type Workspace, WorkspaceNotFound } from "./Workspaces.js";
 export class WorkspaceRegistry extends Context.Service<
   WorkspaceRegistry,
   {
-    readonly list: Effect.Effect<ReadonlyArray<Workspace>>;
+    readonly list: Effect.Effect<readonly Workspace[]>;
     readonly get: (slug: string) => Effect.Effect<Workspace, WorkspaceNotFound>;
     readonly setSuspended: (
       slug: string,
-      suspended: boolean,
+      suspended: boolean
     ) => Effect.Effect<Workspace, WorkspaceNotFound>;
   }
 >()("tracker/WorkspaceRegistry") {
@@ -26,21 +28,25 @@ export class WorkspaceRegistry extends Context.Service<
     const get = Effect.fn("WorkspaceRegistry.get")(function* (slug: string) {
       const workspace = workspaces.get(slug);
 
-      if (workspace === undefined) return yield* new WorkspaceNotFound({ slug });
+      if (workspace === undefined) {
+        return yield* new WorkspaceNotFound({ slug });
+      }
 
       return workspace;
     });
 
     return WorkspaceRegistry.of({
-      list: Effect.sync(() => Array.from(workspaces.values())),
+      list: Effect.sync(() => [...workspaces.values()]),
       get,
-      setSuspended: Effect.fn("WorkspaceRegistry.setSuspended")(function* (slug, suspended) {
-        const workspace = { ...(yield* get(slug)), suspended };
+      setSuspended: Effect.fn("WorkspaceRegistry.setSuspended")(
+        function* (slug, suspended) {
+          const workspace = { ...(yield* get(slug)), suspended };
 
-        workspaces.set(slug, workspace);
+          workspaces.set(slug, workspace);
 
-        return workspace;
-      }),
+          return workspace;
+        }
+      ),
     });
   });
 }

package/examples/kitchen-sink/src/workspaces/tenant.ts

@@ -6,14 +6,21 @@ import { HttpRouter, HttpServerRequest } from "effect/http";
  * an identity: the verifier reads it to decide which of an account's memberships the caller
  * acts in. Handlers never read it; they read the workspace of the authenticated member.
  */
-export class Tenant extends Context.Service<Tenant, Option.Option<string>>()("tracker/Tenant") {}
+export class Tenant extends Context.Service<Tenant, Option.Option<string>>()(
+  "tracker/Tenant"
+) {}
 
 // Native router middleware. It provides `Tenant` to whatever it is provided to, per request:
 // to the verifier too, when it is provided after the authentication, in a `Layer.provide` of
 // its own: in one array with the authentication it would leave `Tenant` owed, since an array's
 // layers provide to the routes, not to one another.
-export const resolveTenant = HttpRouter.middleware<{ provides: Tenant }>()((route) =>
-  Effect.flatMap(HttpServerRequest.HttpServerRequest, (request) =>
-    Effect.provideService(route, Tenant, Option.fromNullishOr(request.headers["x-workspace"])),
-  ),
+export const resolveTenant = HttpRouter.middleware<{ provides: Tenant }>()(
+  (route) =>
+    Effect.flatMap(HttpServerRequest.HttpServerRequest, (request) =>
+      Effect.provideService(
+        route,
+        Tenant,
+        Option.fromNullishOr(request.headers["x-workspace"])
+      )
+    )
 );

package/examples/kitchen-sink/test/admin/admin.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Effect, Layer } from "effect";
-import { HttpClient, HttpClientRequest } from "effect/http";
 import * as Action from "@gjermundgaraba/effect-actions/Action";
 import * as ActionHttp from "@gjermundgaraba/effect-actions/ActionHttp";
 import * as Testing from "@gjermundgaraba/effect-actions/Testing";
+import { Effect, Layer } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
+
 import { Operator } from "../../src/admin/Admin.js";
 import { Grants } from "../../src/admin/grants.js";
 import { admin } from "../../src/admin/handlers.js";
@@ -16,7 +17,7 @@ const served = Testing.layer(adminRoutes).pipe(Layer.provide(memory));
 
 const key = (operatorKey: string) => ({
   transformClient: HttpClient.mapRequest(
-    HttpClientRequest.setHeader("x-operator-key", operatorKey),
+    HttpClientRequest.setHeader("x-operator-key", operatorKey)
   ),
 });
 
@@ -28,39 +29,53 @@ describe("the operators", () => {
 
       expect((yield* support.listWorkspaces()).workspaces).toHaveLength(2);
 
-      const refused = yield* Effect.flip(support.suspendWorkspace({ workspace: "acme" }));
+      const refused = yield* Effect.flip(
+        support.suspendWorkspace({ workspace: "acme" })
+      );
 
       expect(refused).toBeInstanceOf(Action.Forbidden);
       expect(refused).not.toHaveProperty("scopes");
       expect(refused.message).toBe("Requires the workspaces:suspend grant.");
-      expect(yield* ops.suspendWorkspace({ workspace: "acme" })).toMatchObject({ suspended: true });
-    }).pipe(Effect.provide(served)),
+      expect(yield* ops.suspendWorkspace({ workspace: "acme" })).toMatchObject({
+        suspended: true,
+      });
+    }).pipe(Effect.provide(served))
   );
 
   it.effect("are not the members: a member's token is no credential here", () =>
     Effect.gen(function* () {
       const member = yield* ActionHttp.client(AdminHttp, {
-        transformClient: HttpClient.mapRequest(HttpClientRequest.bearerToken("ada")),
+        transformClient: HttpClient.mapRequest(
+          HttpClientRequest.bearerToken("ada")
+        ),
       });
 
-      expect(yield* Effect.flip(member.listWorkspaces())).toBeInstanceOf(Action.Unauthenticated);
-    }).pipe(Effect.provide(served)),
+      expect(yield* Effect.flip(member.listWorkspaces())).toBeInstanceOf(
+        Action.Unauthenticated
+      );
+    }).pipe(Effect.provide(served))
   );
 
-  it.effect("include the console's trusted operator, admitted by the same rule in process", () =>
-    Effect.gen(function* () {
-      const client = yield* Action.client(admin);
-      const suspend = client.suspendWorkspace({ workspace: "globex" });
+  it.effect(
+    "include the console's trusted operator, admitted by the same rule in process",
+    () =>
+      Effect.gen(function* () {
+        const client = yield* Action.client(admin);
+        const suspend = client.suspendWorkspace({ workspace: "globex" });
 
-      // No grants are stored for either: only the operator a host supplies is trusted.
-      expect(
-        yield* suspend.pipe(Effect.provideService(Operator, { id: "console", trusted: true })),
-      ).toMatchObject({ suspended: true });
-      expect(
-        yield* Effect.flip(
-          suspend.pipe(Effect.provideService(Operator, { id: "intern", trusted: false })),
-        ),
-      ).toBeInstanceOf(Action.Forbidden);
-    }).pipe(Effect.provide([WorkspaceRegistry.layerMemory, Grants.layerDemo])),
+        // No grants are stored for either: only the operator a host supplies is trusted.
+        expect(
+          yield* suspend.pipe(
+            Effect.provideService(Operator, { id: "console", trusted: true })
+          )
+        ).toMatchObject({ suspended: true });
+        expect(
+          yield* Effect.flip(
+            suspend.pipe(
+              Effect.provideService(Operator, { id: "intern", trusted: false })
+            )
+          )
+        ).toBeInstanceOf(Action.Forbidden);
+      }).pipe(Effect.provide([WorkspaceRegistry.layerMemory, Grants.layerDemo]))
   );
 });