effect 4.0.3 → 4.0.5

package/src/http/HttpMiddleware.ts

@@ -11,6 +11,7 @@
  * @stability unstable
  * @since 4.0.0
  */
+import * as ByteSize from "../ByteSize.ts"
 import * as Cause from "../Cause.ts"
 import { Clock } from "../Clock.ts"
 import * as Context from "../Context.ts"
@@ -26,6 +27,7 @@ import type { Predicate } from "../Predicate.ts"
 import type { ReadonlyRecord } from "../Record.ts"
 import { nativeTracer, ParentSpan, Tracer } from "../Tracer.ts"
 import * as Headers from "./Headers.ts"
+import { hasBody } from "./HttpMethod.ts"
 import type { CompressionAlgorithm } from "./HttpPlatform.ts"
 import { HttpPlatform } from "./HttpPlatform.ts"
 import { causeResponseStripped, ClientAbort, HttpServerError, ResponseError } from "./HttpServerError.ts"
@@ -35,9 +37,11 @@ import * as Response from "./HttpServerResponse.ts"
 import type { HttpServerResponse } from "./HttpServerResponse.ts"
 import * as TraceContext from "./HttpTraceContext.ts"
 import * as compressionInternal from "./internal/compression.ts"
+import * as decompressionInternal from "./internal/decompression.ts"
 import * as bodyInternal from "./internal/httpBody.ts"
 import { appendPreResponseHandlerUnsafe } from "./internal/preResponseHandler.ts"
 import * as tracing from "./internal/tracing.ts"
+import * as UrlParams from "./UrlParams.ts"
 
 /**
  * Middleware that transforms an HTTP server app effect into another HTTP server app effect.
@@ -268,42 +272,37 @@ export const tracer: <E, R>(
       }
       const redactedHeaderNames = fiber.getRef(Headers.CurrentRedactedNames)
       const headerFilter = fiber.getRef(TracerHeaderFilter)
-      fiber.currentDispatcher.scheduleTask(() => {
-        let response: HttpServerResponse
-        let spanExit: Exit.Exit<HttpServerResponse, unknown>
-        if (Exit.isFailure(exit)) {
-          const [failureResponse, cause] = causeResponseStripped(exit.cause)
-          response = failureResponse
-          // OpenTelemetry only treats 5xx responses as server span errors; interrupts still fail the span.
-          spanExit = Option.isSome(cause) && (response.status >= 500 || Cause.hasInterrupts(cause.value))
-            ? Exit.failCause(cause.value)
-            : responseSpanExit(request, response)
-        } else {
-          response = exit.value
-          spanExit = responseSpanExit(request, response)
+      // Complete the span before the request fiber exits so shutdown can flush it.
+      let response: HttpServerResponse
+      let spanExit: Exit.Exit<HttpServerResponse, unknown>
+      if (Exit.isFailure(exit)) {
+        const [failureResponse, cause] = causeResponseStripped(exit.cause)
+        response = failureResponse
+        // OpenTelemetry only treats 5xx responses as server span errors; interrupts still fail the span.
+        spanExit = Option.isSome(cause) && (response.status >= 500 || Cause.hasInterrupts(cause.value))
+          ? Exit.failCause(cause.value)
+          : responseSpanExit(request, response)
+      } else {
+        response = exit.value
+        spanExit = responseSpanExit(request, response)
+      }
+      if (span.sampled) {
+        span.attribute("http.request.method", request.method)
+        const url = Request.toURL(request)
+        if (Option.isSome(url)) {
+          tracing.addUrlAttributes(span, url.value, fiber.getRef(UrlParams.CurrentRedactedNames))
+        }
+        if (request.headers["user-agent"] !== undefined) {
+          span.attribute("user_agent.original", request.headers["user-agent"])
         }
-        if (span.sampled) {
-          span.attribute("http.request.method", request.method)
-          const url = Request.toURL(request)
-          if (Option.isSome(url)) {
-            if (!request.url.startsWith("/") && (url.value.username !== "" || url.value.password !== "")) {
-              url.value.username = "REDACTED"
-              url.value.password = "REDACTED"
-            }
-            tracing.addUrlAttributes(span, url.value)
-          }
-          if (request.headers["user-agent"] !== undefined) {
-            span.attribute("user_agent.original", request.headers["user-agent"])
-          }
-          tracing.addHeaderAttributes(span, "request", request.headers, headerFilter, redactedHeaderNames)
-          if (Option.isSome(request.remoteAddress)) {
-            span.attribute("client.address", request.remoteAddress.value)
-          }
-          span.attribute("http.response.status_code", response.status)
-          tracing.addHeaderAttributes(span, "response", response.headers, headerFilter, redactedHeaderNames)
+        tracing.addHeaderAttributes(span, "request", request.headers, headerFilter, redactedHeaderNames)
+        if (Option.isSome(request.remoteAddress)) {
+          span.attribute("client.address", request.remoteAddress.value)
         }
-        span.end(endTime, spanExit)
-      }, 0)
+        span.attribute("http.response.status_code", response.status)
+        tracing.addHeaderAttributes(span, "response", response.headers, headerFilter, redactedHeaderNames)
+      }
+      span.end(endTime, spanExit)
       return undefined
     })
     return httpApp
@@ -627,6 +626,86 @@ export const compression = (
     })
 }
 
+/**
+ * Middleware that decompresses request bodies sent with a `Content-Encoding`
+ * of `gzip` or `deflate`.
+ *
+ * **Details**
+ *
+ * The request service is replaced with a view whose body accessors (`stream`,
+ * `text`, `json`, `arrayBuffer`, `urlParamsBody`, `multipart`) yield the
+ * decompressed body, and whose headers no longer include `Content-Encoding`
+ * or `Content-Length`. Decompression is lazy and only happens when the body
+ * is read. Stacked codings such as `deflate, gzip` are undone in reverse
+ * order, and `identity` members are ignored.
+ *
+ * Requests whose `Content-Encoding` includes any other coding are rejected
+ * with `415 Unsupported Media Type` and `Accept-Encoding: gzip, deflate`,
+ * without running the app. Malformed compressed data fails the body read
+ * with a `RequestParseError`, or a `MultipartError` with reason `Parse` when
+ * reading multipart data.
+ *
+ * The decompressed size is limited to `maxDecompressedSize`, falling back to
+ * the `MaxBodySize` reference and then to 10 MiB. Exceeding it fails the body
+ * read with a `RequestParseError`, or a `MultipartError` with reason
+ * `BodyTooLarge` when reading multipart data. The limit applies to every body
+ * accessor, including `stream`.
+ *
+ * Decompression uses the global `DecompressionStream`. `deflate` means the
+ * zlib format (RFC 1950); raw deflate data is rejected.
+ *
+ * **Gotchas**
+ *
+ * `request.source` is still the original, compressed request.
+ * `HttpServerRequest.toWeb` returns that compressed request only when the
+ * source is a Web `Request`. On other platforms, such as Node, it builds a new
+ * `Request` from the decompressed body and the stripped headers.
+ *
+ * @stability unstable
+ * @category compression
+ * @since 4.0.0
+ */
+export const decompression = (
+  options?: {
+    /**
+     * Maximum number of decompressed body bytes. Defaults to the
+     * `MaxBodySize` reference, or 10 MiB when that is unset.
+     */
+    readonly maxDecompressedSize?: ByteSize.Input | undefined
+  } | undefined
+): <E, R>(
+  httpApp: Effect.Effect<HttpServerResponse, E, R>
+) => Effect.Effect<HttpServerResponse, E, R | HttpServerRequest> => {
+  const maxDecompressedSize = options?.maxDecompressedSize === undefined
+    ? undefined
+    : ByteSize.fromInputUnsafe(options.maxDecompressedSize)
+  return <E, R>(
+    httpApp: Effect.Effect<HttpServerResponse, E, R>
+  ): Effect.Effect<HttpServerResponse, E, R | HttpServerRequest> =>
+    Effect.withFiber((fiber) => {
+      const request = Context.getUnsafe(fiber.context, HttpServerRequest)
+      const contentEncoding = request.headers["content-encoding"]
+      if (contentEncoding === undefined || !hasBody(request.method)) {
+        return httpApp
+      }
+      const codings = decompressionInternal.parseContentEncoding(contentEncoding)
+      if (codings === undefined) {
+        return Effect.succeed(Response.empty({
+          status: 415,
+          headers: { "accept-encoding": "gzip, deflate" }
+        }))
+      }
+      if (codings.length === 0) {
+        return httpApp
+      }
+      return Effect.provideService(
+        httpApp,
+        HttpServerRequest,
+        new decompressionInternal.DecompressedRequest(request, codings, maxDecompressedSize)
+      )
+    })
+}
+
 const withVary = (response: HttpServerResponse): HttpServerResponse => {
   const vary = compressionInternal.varyWith(response.headers, "Accept-Encoding")
   return Response.setHeader(response, "vary", vary)

package/src/http/HttpRouter.ts

@@ -24,6 +24,7 @@ import * as Scope from "../Scope.ts"
 import * as Tracer from "../Tracer.ts"
 import type * as Types from "../Types.ts"
 import * as FindMyWay from "./FindMyWay.ts"
+import { getClosingParenthensePosition } from "./FindMyWay/internal/router.ts"
 import * as HttpEffect from "./HttpEffect.ts"
 import * as HttpIncomingMessage from "./HttpIncomingMessage.ts"
 import type * as HttpMethod from "./HttpMethod.ts"
@@ -123,7 +124,12 @@ export const HttpRouter: Context.Service<HttpRouter, HttpRouter> = Context.Servi
  * @since 4.0.0
  */
 export const make = Effect.gen(function*() {
-  const router = FindMyWay.make<Route<any, never>>(yield* RouterConfig)
+  const config = yield* RouterConfig
+  const ignoreDuplicateSlashes = config.ignoreDuplicateSlashes ?? true
+  const router = FindMyWay.make<{
+    readonly route: Route<any, never>
+    readonly prefixSegments: number | undefined
+  }>(config)
   const middleware = new Set<middleware.Fn>()
 
   const addAll = <const Routes extends ReadonlyArray<Route<any, any>>>(
@@ -147,19 +153,25 @@ export const make = Effect.gen(function*() {
           ...routes[i],
           handler: applyMiddleware(routes[i].handler as Effect.Effect<HttpServerResponse.HttpServerResponse>)
         })
+        const handler = {
+          route: route as Route<any, never>,
+          prefixSegments: Option.isSome(route.prefix)
+            ? countSegments(route.prefix.value, ignoreDuplicateSlashes)
+            : undefined
+        }
         if (route.method === "*") {
           if (route.path.endsWith("/*")) {
-            router.all(route.path, route as any)
-            router.all(route.path.slice(0, -2) as any, route as any)
+            router.all(route.path, handler)
+            router.all(route.path.slice(0, -2) as any, handler)
           } else {
-            router.all(route.path, route as any)
+            router.all(route.path, handler)
           }
         } else {
           if (route.path.endsWith("/*")) {
-            router.on(route.method, route.path, route as any)
-            router.on(route.method, route.path.slice(0, -2) as any, route as any)
+            router.on(route.method, route.path, handler)
+            router.on(route.method, route.path.slice(0, -2) as any, handler)
           } else {
-            router.on(route.method, route.path, route as any)
+            router.on(route.method, route.path, handler)
           }
         }
       }
@@ -211,12 +223,12 @@ export const make = Effect.gen(function*() {
             })
           )
         }
-        const route = result.handler
-        if (Option.isSome(route.prefix)) {
+        const { route, prefixSegments } = result.handler
+        if (prefixSegments !== undefined) {
           context = Context.add(
             context,
             HttpServerRequest.HttpServerRequest,
-            sliceRequestUrl(request, route.prefix.value)
+            sliceRequestUrl(request, prefixSegments, ignoreDuplicateSlashes)
           )
         }
         context = Context.add(context, HttpServerRequest.ParsedSearchParams, result.searchParams)
@@ -251,9 +263,44 @@ export const make = Effect.gen(function*() {
   })
 })
 
-function sliceRequestUrl(request: HttpServerRequest.HttpServerRequest, prefix: string) {
-  const prefexLen = prefix.length
-  return request.modify({ url: request.url.length <= prefexLen ? "/" : request.url.slice(prefexLen) })
+function sliceRequestUrl(
+  request: HttpServerRequest.HttpServerRequest,
+  prefixSegments: number,
+  ignoreDuplicateSlashes: boolean
+) {
+  const url = request.url
+  let index = 0
+  for (let segments = prefixSegments; segments > 0; segments--) {
+    if (ignoreDuplicateSlashes) {
+      while (url[index] === "/") index++
+    } else if (url[index] === "/") {
+      index++
+    }
+    while (index < url.length && !"/?;#".includes(url[index])) index++
+  }
+  return request.modify({ url: index < url.length ? url.slice(index) : "/" })
+}
+
+function countSegments(prefix: string, ignoreDuplicateSlashes: boolean) {
+  let count = 0
+  let inParamName = false
+  for (let i = 0; i < prefix.length; i++) {
+    const char = prefix[i]
+    if (char === "/") {
+      if (!ignoreDuplicateSlashes || prefix[i - 1] !== "/") count++
+      inParamName = false
+    } else if (char === ":") {
+      if (prefix[i + 1] === ":") i++
+      else inParamName = true
+    } else if (char === "-" || char === ".") {
+      inParamName = false
+    } else if (char === "(" && inParamName) {
+      // Slashes inside parameter regexes are not segment boundaries.
+      i = getClosingParenthensePosition(prefix, i)
+      inParamName = false
+    }
+  }
+  return count
 }
 
 /**
@@ -1410,6 +1457,41 @@ export const serve = <A, E, R, HE, HR = Request.Only<"Requires", R> | Request.On
  * request arrives, in which case that request waits for the build to finish.
  * If the build fails, every request rejects with the build error.
  *
+ * **Gotchas**
+ *
+ * On Cloudflare Workers, build the handler at module scope: fibers started
+ * inside `fetch` capture that request's async context. Layer construction
+ * must not require request-time I/O; bindings are available from
+ * `cloudflare:workers` via its `env` export.
+ * Prefer request-local work or a Durable Object's supported lifecycle APIs,
+ * not indefinite background execution. For shared fibers, provide a sync
+ * scheduler to both layers and requests as below; see `Scheduler.MixedScheduler`
+ * for its limitations. Bound waits for shared work with request-local timeouts.
+ *
+ * **Example** (Opting in to the sync scheduler on Workers)
+ *
+ * ```ts
+ * import { Effect, Layer, Scheduler } from "effect"
+ * import { HttpRouter, HttpServer, HttpServerResponse } from "effect/http"
+ *
+ * const SyncScheduler = Layer.succeed(
+ *   Scheduler.Scheduler,
+ *   new Scheduler.MixedScheduler("sync")
+ * )
+ * const AppLive = HttpRouter.add(
+ *   "GET",
+ *   "/ping",
+ *   Effect.succeed(HttpServerResponse.text("pong"))
+ * ).pipe(Layer.provide(HttpServer.layerServices))
+ *
+ * // Build once at module scope. The scheduler is also retained for requests.
+ * const app = HttpRouter.toWebHandler(
+ *   AppLive.pipe(Layer.provideMerge(SyncScheduler))
+ * )
+ *
+ * export default { fetch: (request: Request) => app.handler(request) }
+ * ```
+ *
  * @stability unstable
  * @category converting
  * @since 4.0.0

package/src/http/HttpServerError.ts

@@ -23,6 +23,7 @@ import { hasProperty } from "../Predicate.ts"
 import type * as Request from "./HttpServerRequest.ts"
 import * as Respondable from "./HttpServerRespondable.ts"
 import * as Response from "./HttpServerResponse.ts"
+import * as UrlParams from "./UrlParams.ts"
 
 const TypeId = "~effect/http/HttpServerError"
 
@@ -107,7 +108,7 @@ export class RequestParseError extends Data.TaggedError("RequestParseError")<{
   }
 
   get methodAndUrl() {
-    return `${this.request.method} ${this.request.url}`
+    return formatMethodAndUrl(this.request)
   }
 
   override get message() {
@@ -139,7 +140,7 @@ export class RouteNotFound extends Data.TaggedError("RouteNotFound")<{
   override readonly [ErrorReporter.ignore] = true
 
   get methodAndUrl() {
-    return `${this.request.method} ${this.request.url}`
+    return formatMethodAndUrl(this.request)
   }
 
   override get message() {
@@ -174,7 +175,7 @@ export class InternalError extends Data.TaggedError("InternalError")<{
   }
 
   get methodAndUrl() {
-    return `${this.request.method} ${this.request.url}`
+    return formatMethodAndUrl(this.request)
   }
 
   override get message() {
@@ -214,7 +215,7 @@ export class ResponseError extends Data.TaggedError("ResponseError")<{
   }
 
   get methodAndUrl() {
-    return `${this.request.method} ${this.request.url}`
+    return formatMethodAndUrl(this.request)
   }
 
   override get message() {
@@ -275,6 +276,9 @@ export class ClientAbort extends Context.Service<ClientAbort, true>()("effect/ht
   )
 }
 
+const formatMethodAndUrl = (request: Request.HttpServerRequest) =>
+  `${request.method} ${UrlParams.redactUrl(request.url)}`
+
 const formatRequestMessage = (reason: string, description: string | undefined, info: string) => {
   const prefix = `${reason} (${info})`
   return description ? `${prefix}: ${description}` : prefix

package/src/http/HttpServerRequest.ts

@@ -512,7 +512,7 @@ class ServerRequestImpl extends Inspectable.Class implements HttpServerRequest {
     return HttpIncomingMessage.inspect(this, {
       _id: "HttpServerRequest",
       method: this.method,
-      url: this.originalUrl
+      url: UrlParams.redactUrl(this.originalUrl)
     })
   }
   modify(
@@ -711,7 +711,7 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
     return HttpIncomingMessage.inspect(this, {
       _id: "HttpServerRequest",
       method: this.method,
-      url: this.originalUrl
+      url: UrlParams.redactUrl(this.originalUrl)
     })
   }
 

package/src/http/HttpServerResponse.ts

@@ -1346,23 +1346,35 @@ export const setStatus: {
 export const omitsBody = (response: HttpServerResponse, withoutBody = false): boolean =>
   withoutBody || response.status === 204 || response.status === 205 || response.status === 304
 
+const mergeHeaders = (target: globalThis.Headers, headers: globalThis.Headers): globalThis.Headers => {
+  for (const [key, value] of headers as any) {
+    if (key === "set-cookie") {
+      target.append(key, value)
+    } else {
+      target.set(key, value)
+    }
+  }
+  return target
+}
+
 /**
  * Converts an `HttpServerResponse` to a Web `Response`.
  *
  * **Details**
  *
  * Cookies are appended as `Set-Cookie` headers. Stream bodies are converted using
- * the supplied context.
+ * the supplied context, and are interrupted when `signal` aborts.
  *
  * Bodies are omitted for statuses 204, 205, and 304, or when `withoutBody` is true
  * (for example, for HEAD responses). Omitted raw `ReadableStream` bodies are
  * cancelled without awaiting completion, and cancellation errors are ignored.
  *
- * A raw `Response` body is returned as-is after the outer headers are merged
- * into it: outer headers replace native ones, and cookies are appended. When
- * its body is omitted, the bodyless `Response` keeps those merged headers and
- * uses the outer status for 204, 205 and 304, or the raw `Response` status
- * otherwise.
+ * A raw `Response` is returned as-is when there are no outer headers or cookies
+ * to merge. Otherwise, they are merged into a copy without modifying the raw
+ * response: outer headers replace native ones, and cookies are appended. When
+ * its body is omitted, the bodyless `Response` keeps those merged
+ * headers and uses the outer status for 204, 205 and 304, or the raw `Response`
+ * status otherwise.
  *
  * @stability unstable
  * @category converting
@@ -1373,6 +1385,7 @@ export const toWeb = (
   options?: {
     readonly withoutBody?: boolean | undefined
     readonly context?: Context.Context<never> | undefined
+    readonly signal?: AbortSignal | undefined
   }
 ): Response => {
   const headers = new globalThis.Headers(response.headers)
@@ -1387,15 +1400,13 @@ export const toWeb = (
   const withoutBody = outerOmitsBody || options?.withoutBody === true
   if (body._tag === "Raw" && body.body instanceof Response) {
     const raw = body.body
-    for (const [key, value] of headers as any) {
-      if (key === "set-cookie") {
-        raw.headers.append(key, value)
-      } else {
-        raw.headers.set(key, value)
-      }
-    }
     if (!withoutBody) {
-      return raw
+      if (headers.keys().next().done) {
+        return raw
+      }
+      const copy = new Response(raw.body, raw)
+      mergeHeaders(copy.headers, headers)
+      return copy
     }
     // A bodyless outer status is what the caller chose to send; otherwise the
     // body is only omitted for HEAD and the raw Response describes the resource.
@@ -1403,7 +1414,7 @@ export const toWeb = (
     return new Response(undefined, {
       status: source.status,
       statusText: source.statusText as string,
-      headers: raw.headers
+      headers: mergeHeaders(new globalThis.Headers(raw.headers), headers)
     })
   }
   if (withoutBody) {
@@ -1449,7 +1460,8 @@ export const toWeb = (
       return new Response(
         Stream.toReadableStreamWith(
           body.stream,
-          options?.context ?? Context.empty()
+          options?.context ?? Context.empty(),
+          { signal: options?.signal }
         ),
         {
           status: response.status,

package/src/http/HttpStaticServer.ts

@@ -13,6 +13,7 @@
 import * as Effect from "../Effect.ts"
 import * as FileSystem from "../FileSystem.ts"
 import * as Layer from "../Layer.ts"
+import * as Option from "../Option.ts"
 import * as Path from "../Path.ts"
 import type { PlatformError } from "../PlatformError.ts"
 import * as HttpPlatform from "./HttpPlatform.ts"
@@ -398,16 +399,9 @@ const resolveFilePath = (path: Path.Path, root: string, url: string): string | u
   if (decodedPath.includes("\u0000")) {
     return undefined
   }
-  const normalizedPath = path.normalize(decodedPath.startsWith("/") ? decodedPath.slice(1) : decodedPath)
-  if (normalizedPath === ".." || normalizedPath.startsWith(`..${path.sep}`)) {
-    return undefined
-  }
-  const resolvedPath = path.join(root, normalizedPath)
-  const rootPrefix = root.endsWith(path.sep) ? root : `${root}${path.sep}`
-  if (resolvedPath !== root && !resolvedPath.startsWith(rootPrefix)) {
-    return undefined
-  }
-  return resolvedPath
+  // every leading separator is part of the URL, not a filesystem root
+  const relativePath = decodedPath.replace(path.sep === "\\" ? /^[/\\]+/ : /^\/+/, "")
+  return Option.getOrUndefined(path.resolveWithin(root, relativePath))
 }
 
 const toRouteNotFoundError = (request: HttpServerRequest.HttpServerRequest) =>

package/src/http/HttpTraceContext.ts

@@ -49,7 +49,7 @@ export const toHeaders = (span: Tracer.Span): Headers.Headers =>
         onSome: (parent) => `-${parent.spanId}`
       })
     }`,
-    traceparent: `00-${span.traceId}-${span.spanId}-${span.sampled ? "01" : "00"}`
+    traceparent: `00-${span.traceId.padStart(32, "0")}-${span.spanId}-${span.sampled ? "01" : "00"}`
   })
 
 /**

package/src/http/Multipart.ts

@@ -689,6 +689,22 @@ const defaultWriteFile = (path: string, file: File) =>
     (fs) => Effect.mapError(Stream.run(file.content, fs.sink(path)), toMultipartError)
   )
 
+const maxPersistedFileNameBytes = 128
+const fileNameEncoder = new TextEncoder()
+
+// Keeps the trailing 128 UTF-8 bytes without splitting code points. Empty and dot names fall back to "file".
+const persistedFileName = (baseName: string): string => {
+  const codePoints = Array.from(baseName)
+  let fileName = ""
+  let bytes = 0
+  for (let i = codePoints.length - 1; i >= 0; i--) {
+    bytes += fileNameEncoder.encode(codePoints[i]).length
+    if (bytes > maxPersistedFileNameBytes) break
+    fileName = codePoints[i] + fileName
+  }
+  return fileName === "" || fileName === "." || fileName === ".." ? "file" : fileName
+}
+
 /**
  * Runs a channel of byte chunks and collects all output into a single
  * `Uint8Array`.
@@ -748,7 +764,7 @@ export const toPersisted = (
         return Effect.void
       }
       const file = part
-      const fileName = path_.basename(file.name).slice(-128)
+      const fileName = persistedFileName(path_.basename(file.name))
       let path = path_.join(dir, fileName)
       while (usedPaths.has(path)) {
         path = path_.join(dir, `${fileIndex++}-${fileName}`)

package/src/http/Url.ts

@@ -14,6 +14,7 @@ import * as Data from "../Data.ts"
 import { dual } from "../Function.ts"
 import * as Redacted from "../Redacted.ts"
 import * as Result from "../Result.ts"
+import * as internal from "./internal/urlParams.ts"
 import * as UrlParams from "./UrlParams.ts"
 
 /**
@@ -49,7 +50,7 @@ export const make = (
       for (let i = 0; i < params.params.length; i++) {
         const [key, value] = params.params[i]
         if (value !== undefined) {
-          urlInstance.searchParams.append(key, value)
+          urlInstance.searchParams.append(key, internal.unwrap(value))
         }
       }
       if (hash !== undefined) {