@effected/github-actions 0.1.0

package/ActionEnvironment.js

@@ -0,0 +1,255 @@
+import { Context, Effect, FileSystem, Layer, Option, Schema } from "effect";
+
+//#region src/ActionEnvironment.ts
+/**
+* Raised when the runner environment does not say what an action needs.
+*
+* @remarks
+* Two reasons, and the distinction is actionable: `missing` means the variable
+* is absent or empty (the workflow did not grant something, or the action is
+* running outside Actions); `malformed` means it is present but unusable (a
+* non-numeric run id, an unparseable event payload). The first is usually a
+* workflow fix, the second usually a bug report.
+*
+* @public
+*/
+var ActionEnvironmentError = class extends Schema.TaggedErrorClass()("ActionEnvironmentError", {
+	reason: Schema.Literals(["missing", "malformed"]),
+	/** The environment variable involved. */
+	name: Schema.String,
+	/** What was wrong, when the reason is `malformed`. */
+	detail: Schema.optionalKey(Schema.String)
+}) {
+	get message() {
+		return this.reason === "missing" ? `Required environment variable "${this.name}" is not set` : `Environment variable "${this.name}" is malformed${this.detail === void 0 ? "" : `: ${this.detail}`}`;
+	}
+};
+/**
+* The workflow's GitHub context, projected from the `GITHUB_*` variables.
+*
+* @public
+*/
+var GitHubContext = class extends Schema.Class("GitHubContext")({
+	/** `owner/repo`. */
+	repository: Schema.String,
+	repositoryOwner: Schema.String,
+	/** The full ref, e.g. `refs/heads/main`. */
+	ref: Schema.String,
+	/** The short ref, e.g. `main`. */
+	refName: Schema.String,
+	sha: Schema.String,
+	workflow: Schema.String,
+	job: Schema.String,
+	runId: Schema.Number,
+	runAttempt: Schema.Number,
+	eventName: Schema.String,
+	actor: Schema.String,
+	serverUrl: Schema.String,
+	apiUrl: Schema.String,
+	graphqlUrl: Schema.String,
+	workspace: Schema.String
+}) {};
+/**
+* The runner's own context, projected from the `RUNNER_*` variables.
+*
+* @public
+*/
+var RunnerContext = class extends Schema.Class("RunnerContext")({
+	os: Schema.String,
+	arch: Schema.String,
+	name: Schema.String,
+	/** A scratch directory emptied between jobs. */
+	temp: Schema.String,
+	/** Where `ToolInstaller` caches toolchains. */
+	toolCache: Schema.String
+}) {};
+/**
+* Environment overrides layered on top of the seeded snapshot.
+*
+* @remarks
+* A `Context.Reference` rather than a mutable global: overrides are
+* **fiber-local**, so two concurrent fibers can override the same variable
+* without seeing each other, and nothing needs restoring afterwards. This is
+* what makes {@link ActionEnvironmentShape.withEnv} parallel-safe — the
+* property the hand-rolled set/restore version it replaces could not have.
+*
+* @internal
+*/
+const EnvOverrides = Context.Reference("@effected/github-actions/EnvOverrides", { defaultValue: () => ({}) });
+const numeric = (name, raw) => {
+	const parsed = Number(raw);
+	return Number.isFinite(parsed) ? Effect.succeed(parsed) : Effect.fail(new ActionEnvironmentError({
+		reason: "malformed",
+		name,
+		detail: `expected a number, got "${raw}"`
+	}));
+};
+const make = (base) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const lookup = (name) => Effect.map(EnvOverrides, (overrides) => {
+		const value = overrides[name] ?? base[name];
+		return value === void 0 || value === "" ? Option.none() : Option.some(value);
+	});
+	const get = (name) => Effect.flatMap(lookup(name), (found) => Option.isSome(found) ? Effect.succeed(found.value) : Effect.fail(new ActionEnvironmentError({
+		reason: "missing",
+		name
+	})));
+	return {
+		get,
+		getOptional: lookup,
+		isDebug: Effect.map(lookup("RUNNER_DEBUG"), (value) => Option.isSome(value) && value.value === "1"),
+		github: Effect.gen(function* () {
+			const [repository, repositoryOwner, ref, refName, sha, workflow, job] = yield* Effect.all([
+				get("GITHUB_REPOSITORY"),
+				get("GITHUB_REPOSITORY_OWNER"),
+				get("GITHUB_REF"),
+				get("GITHUB_REF_NAME"),
+				get("GITHUB_SHA"),
+				get("GITHUB_WORKFLOW"),
+				get("GITHUB_JOB")
+			]);
+			const runId = yield* Effect.flatMap(get("GITHUB_RUN_ID"), (raw) => numeric("GITHUB_RUN_ID", raw));
+			const runAttempt = yield* Effect.flatMap(get("GITHUB_RUN_ATTEMPT"), (raw) => numeric("GITHUB_RUN_ATTEMPT", raw));
+			const [eventName, actor, serverUrl, apiUrl, graphqlUrl, workspace] = yield* Effect.all([
+				get("GITHUB_EVENT_NAME"),
+				get("GITHUB_ACTOR"),
+				get("GITHUB_SERVER_URL"),
+				get("GITHUB_API_URL"),
+				get("GITHUB_GRAPHQL_URL"),
+				get("GITHUB_WORKSPACE")
+			]);
+			return GitHubContext.make({
+				repository,
+				repositoryOwner,
+				ref,
+				refName,
+				sha,
+				workflow,
+				job,
+				runId,
+				runAttempt,
+				eventName,
+				actor,
+				serverUrl,
+				apiUrl,
+				graphqlUrl,
+				workspace
+			});
+		}),
+		runner: Effect.gen(function* () {
+			const [os, arch, name, temp, toolCache] = yield* Effect.all([
+				get("RUNNER_OS"),
+				get("RUNNER_ARCH"),
+				get("RUNNER_NAME"),
+				get("RUNNER_TEMP"),
+				get("RUNNER_TOOL_CACHE")
+			]);
+			return RunnerContext.make({
+				os,
+				arch,
+				name,
+				temp,
+				toolCache
+			});
+		}),
+		payload: Effect.gen(function* () {
+			const path = yield* get("GITHUB_EVENT_PATH");
+			const raw = yield* fs.readFileString(path).pipe(Effect.mapError((cause) => new ActionEnvironmentError({
+				reason: "malformed",
+				name: "GITHUB_EVENT_PATH",
+				detail: `could not read "${path}": ${String(cause)}`
+			})));
+			return yield* Effect.try({
+				try: () => JSON.parse(raw),
+				catch: (cause) => new ActionEnvironmentError({
+					reason: "malformed",
+					name: "GITHUB_EVENT_PATH",
+					detail: `not valid JSON: ${String(cause)}`
+				})
+			});
+		}),
+		withEnv: (overrides, effect) => Effect.flatMap(EnvOverrides, (current) => Effect.provideService(effect, EnvOverrides, {
+			...current,
+			...overrides
+		}))
+	};
+});
+/** The `GITHUB_*` / `RUNNER_*` block a test double seeds so suites do not restate it. */
+const TEST_DEFAULTS = {
+	GITHUB_REPOSITORY: "acme/example",
+	GITHUB_REPOSITORY_OWNER: "acme",
+	GITHUB_REF: "refs/heads/main",
+	GITHUB_REF_NAME: "main",
+	GITHUB_SHA: "0000000000000000000000000000000000000000",
+	GITHUB_WORKFLOW: "test",
+	GITHUB_JOB: "test",
+	GITHUB_RUN_ID: "1",
+	GITHUB_RUN_ATTEMPT: "1",
+	GITHUB_EVENT_NAME: "push",
+	GITHUB_ACTOR: "tester",
+	GITHUB_SERVER_URL: "https://github.com",
+	GITHUB_API_URL: "https://api.github.com",
+	GITHUB_GRAPHQL_URL: "https://api.github.com/graphql",
+	GITHUB_WORKSPACE: "/workspace",
+	RUNNER_OS: "Linux",
+	RUNNER_ARCH: "X64",
+	RUNNER_NAME: "test-runner",
+	RUNNER_TEMP: "/tmp",
+	RUNNER_TOOL_CACHE: "/opt/hostedtoolcache"
+};
+/**
+* The runner environment an action is executing inside.
+*
+* @remarks
+* The single reader of `process.env` in this package. Everything else — inputs,
+* outputs, state, the token bridge — goes through a service rather than
+* reaching for a global, which is what makes them all testable without
+* mutating the test process.
+*
+* @example
+* ```ts
+* import { ActionEnvironment } from "@effected/github-actions";
+* import { Effect } from "effect";
+*
+* const program = Effect.gen(function* () {
+*   const env = yield* ActionEnvironment;
+*   const { repository, runId } = yield* env.github;
+*   return `${repository}#${runId}`;
+* });
+* ```
+*
+* @public
+*/
+var ActionEnvironment = class ActionEnvironment extends Context.Service()("@effected/github-actions/ActionEnvironment") {
+	/** Seeded from `process.env`, once, at layer construction. */
+	static layer = Layer.effect(this, Effect.flatMap(Effect.sync(() => ({ ...process.env })), make));
+	/**
+	* Seeded from an explicit record.
+	*
+	* @remarks
+	* A parameterized layer factory mints a fresh reference per call and layers
+	* memoize by reference — bind it to a `const` rather than calling it at each
+	* composition site.
+	*/
+	static layerFrom = (env) => Layer.effect(ActionEnvironment, make(env));
+	/**
+	* A test double seeded with a complete `GITHUB_*` / `RUNNER_*` block.
+	*
+	* @remarks
+	* **A recorded exception to the die-on-unstubbed rule.** Every other service
+	* in this package dies when a suite calls something it did not stub, because
+	* a plausible default hides a real gap. Here the opposite is true: the twelve
+	* context variables have one obviously-correct shape, and requiring each
+	* suite to restate them produced a byte-identical block duplicated six times
+	* across the consumers. Overrides merge on top.
+	*/
+	static makeTest = (overrides = {}) => make({
+		...TEST_DEFAULTS,
+		...overrides
+	});
+	/** {@link ActionEnvironment.makeTest} behind a layer, with `FileSystem` stubbed out. */
+	static layerTest = (overrides = {}) => Layer.effect(ActionEnvironment, ActionEnvironment.makeTest(overrides)).pipe(Layer.provide(FileSystem.layerNoop({})));
+};
+
+//#endregion
+export { ActionEnvironment, ActionEnvironmentError, GitHubContext, RunnerContext };

package/ActionInput.js

@@ -0,0 +1,346 @@
+import { Config, ConfigProvider, Context, Effect, Option, Schema, SchemaIssue } from "effect";
+
+//#region src/ActionInput.ts
+/**
+* The variable name the runner publishes an input under.
+*
+* @remarks
+* GitHub uppercases the input name and replaces **spaces** with underscores —
+* and leaves every other character, **dashes included**, alone. So the input
+* `sbom-config` arrives as `INPUT_SBOM-CONFIG`, not `INPUT_SBOM_CONFIG`.
+*
+* That distinction is not academic: a consumer read `process.env["INPUT_SBOM_CONFIG"]`
+* directly, silently got nothing, and shipped it. Every accessor in this module
+* goes through this function so no caller ever spells the variable name, which
+* makes that class of bug unrepresentable rather than merely documented.
+*
+* @internal
+*/
+const inputVariable = (name) => `INPUT_${name.replaceAll(" ", "_").toUpperCase()}`;
+/**
+* A validation failure for an input that is present but unusable.
+*
+* @remarks
+* `actual` carries the offending value, and that is load-bearing rather than
+* decorative: `Config.withDefault` and `Config.option` fall back only for
+* *missing data*, and their `isMissingDataOnly` check reads an `InvalidValue`
+* whose `actual` is `None` as missing (`Config.ts:304`). An error built without
+* it would therefore be **swallowed by a default** — so `dry-run: yes` would
+* quietly become `false` and the action would perform the mutations the author
+* meant to rehearse.
+*/
+const configError = (message, actual) => new Config.ConfigError(new Schema.SchemaError(new SchemaIssue.InvalidValue(Option.some(actual), { message })));
+/** YAML 1.2 core-schema booleans, which is what the runner documents. */
+const TRUE = /* @__PURE__ */ new Set([
+	"true",
+	"True",
+	"TRUE"
+]);
+const FALSE = /* @__PURE__ */ new Set([
+	"false",
+	"False",
+	"FALSE"
+]);
+/** Strip a trailing `#` comment and surrounding whitespace from one line. */
+const stripComment = (line) => {
+	const hash = line.indexOf("#");
+	return (hash === -1 ? line : line.slice(0, hash)).trim();
+};
+/**
+* Action inputs, read as `Config` values.
+*
+* @remarks
+* Inputs are **never** read from `process.env` directly. Every accessor names
+* the input the way the workflow author wrote it and lets this module derive
+* the runner's variable name — see `inputVariable` for why that matters. (A
+* `{@link}` cannot reach it: it is internal, so it is not exported from the
+* entrypoint and the reference would not resolve.)
+*
+* `lines`, `list` and `pairs` exist because the `@actions/core`-faithful
+* newline split was not enough for real consumers: two of them reinvented
+* richer parsing independently, one parsing JSON arrays and bullet lists, the
+* other stripping comments and reading `key=value` pairs. Those are now one
+* implementation with one set of tests instead of two divergent ones with
+* none.
+*
+* These are grouped statics over one concept reaching nothing but `Config` —
+* not a namespace object over engines.
+*
+* **The absence contract, shared by every accessor:** the runner writes `""`
+* for an input the workflow left out, and the provider reads an empty string
+* as absent — so *unset* and *empty* are the same case, **missing data**, and
+* the read fails rather than yielding an empty value. `Config.withDefault`
+* falls back for exactly that class, which makes
+* `.pipe(Config.withDefault(…))` the idiom for every optional input. What a
+* default never swallows is a *present but malformed* value — see
+* {@link ActionInput.boolean}.
+*
+* @example
+* ```ts
+* import { ActionInput } from "@effected/github-actions";
+* import { Effect } from "effect";
+*
+* const program = Effect.gen(function* () {
+*   const dryRun = yield* ActionInput.boolean("dry-run");
+*   const globs = yield* ActionInput.list("paths");
+* });
+* ```
+*
+* @public
+*/
+var ActionInput = class ActionInput {
+	constructor() {}
+	/**
+	* A required string input.
+	*
+	* @remarks
+	* Fails as *missing data* when the input is absent **or set to the empty
+	* string** — the runner writes `""` for an unsupplied input, and both the
+	* runtime's provider and {@link ActionInput.provider} read that as absent.
+	* Every accessor on this class shares the rule, so an **optional** input
+	* needs `Config.withDefault` (or `Config.option`) at the call site or the
+	* read fails outright.
+	*/
+	static string(name) {
+		return Config.string(inputVariable(name));
+	}
+	/**
+	* A boolean input, per the runner's documented YAML 1.2 core schema.
+	*
+	* @remarks
+	* Absent or `""` is **missing data** — wrap with `Config.withDefault` for
+	* an optional flag. A **present but malformed** value (`yes`, `on`, `1`) is
+	* a different class: it fails carrying its `actual`, deliberately, so a
+	* default does NOT swallow it — the shipped defect this guards against was
+	* a malformed `dry-run` quietly reading as `false`.
+	*/
+	static boolean(name) {
+		return Config.string(inputVariable(name)).pipe(Config.mapOrFail((raw) => {
+			const value = raw.trim();
+			if (TRUE.has(value)) return Effect.succeed(true);
+			if (FALSE.has(value)) return Effect.succeed(false);
+			return Effect.fail(configError(`Input "${name}" does not meet the YAML 1.2 core schema for booleans. Supported: true | True | TRUE | false | False | FALSE`, raw));
+		}));
+	}
+	/**
+	* An integer input.
+	*
+	* @remarks
+	* Unset and `""` both fail as **missing data**; for an optional input,
+	* `.pipe(Config.withDefault(n))`.
+	*/
+	static integer(name) {
+		return Config.int(inputVariable(name));
+	}
+	/**
+	* A secret input, kept redacted.
+	*
+	* @remarks
+	* Unset and `""` both fail as **missing data**; `Config.option` is the
+	* usual shape for an optional secret, since there is rarely a meaningful
+	* default to redact.
+	*/
+	static redacted(name) {
+		return Config.redacted(inputVariable(name));
+	}
+	/**
+	* A multiline input, split on newlines.
+	*
+	* @remarks
+	* The `@actions/core`-faithful shape: blank lines are dropped and each entry
+	* is trimmed, because a YAML block scalar carries the workflow's own
+	* indentation.
+	*
+	* Absent or `""` fails as missing data (see {@link ActionInput.string}) —
+	* `Config.withDefault([])` is load-bearing for an optional multiline input.
+	*/
+	static lines(name) {
+		return Config.string(inputVariable(name)).pipe(Config.map((raw) => raw.split("\n").map((line) => line.trim()).filter((line) => line !== "")));
+	}
+	/**
+	* A list input, accepting the shapes workflow authors actually write.
+	*
+	* @remarks
+	* A JSON array (`["a","b"]`), a bullet list (`- a` or `* a`), or comma- and
+	* newline-separated values, with full-line `#` comments dropped — any
+	* combination of these in the same input. Each shape was reinvented
+	* independently by a consumer (one a bullet-list-and-JSON parser, the other
+	* comment-stripping); accepting the union means a workflow author's first
+	* guess works and nothing either prior consumer relied on regresses.
+	*
+	* Parsing order, applied per newline/comma-separated item after trimming:
+	*
+	* 1. **Comment lines are dropped first.** A trimmed item whose first
+	*    character is `#` is a full-line comment and is discarded entirely,
+	*    before any bullet marker is considered. This means `- #tag` is a
+	*    value, not a comment: the check runs on the untouched, still-bulleted
+	*    item, and `-` is not `#`.
+	* 2. **Only then is a leading bullet marker stripped** — `- ` or `* `
+	*    (dash-or-asterisk followed by a space), mirroring the indentation a
+	*    YAML block scalar carries in. So `- #tag` becomes the value `#tag`.
+	* 3. Blank results (an empty line, or a comment line) are dropped from the
+	*    final list.
+	*
+	* A `#` that is not the first character of a trimmed item — a trailing or
+	* mid-value `#` — is left alone; unlike {@link ActionInput.pairs}, `list`
+	* has no trailing-comment rule, only a whole-line one.
+	*
+	* Absent or `""` fails as **missing data** (see {@link ActionInput.string}),
+	* so `Config.withDefault([])` is load-bearing at every optional-input call
+	* site — omitting an optional multi-value input otherwise fails the read
+	* outright. A *whitespace-only* value (a block scalar holding only a
+	* newline) is present, and parses to `[]`.
+	*/
+	static list(name) {
+		return Config.string(inputVariable(name)).pipe(Config.mapOrFail((raw) => {
+			const trimmed = raw.trim();
+			if (trimmed === "") return Effect.succeed([]);
+			if (trimmed.startsWith("[")) try {
+				const parsed = JSON.parse(trimmed);
+				if (Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) return Effect.succeed(parsed);
+				return Effect.fail(configError(`Input "${name}" is a JSON array but not an array of strings`, raw));
+			} catch {
+				return Effect.fail(configError(`Input "${name}" looks like JSON but could not be parsed`, raw));
+			}
+			const entries = trimmed.split(/[\n,]/).map((item) => item.trim()).filter((item) => !item.startsWith("#")).map((item) => item.startsWith("- ") || item.startsWith("* ") ? item.slice(2).trim() : item).filter((item) => item !== "");
+			return Effect.succeed(entries);
+		}));
+	}
+	/**
+	* A `key=value` input, one pair per line, with `#` comments stripped.
+	*
+	* @remarks
+	* Only the **first** `=` splits, so a value may contain one.
+	*
+	* Absent or `""` fails as missing data (see {@link ActionInput.string}) —
+	* `Config.withDefault({})` is the idiom for an optional pairs input.
+	*/
+	static pairs(name) {
+		return Config.string(inputVariable(name)).pipe(Config.mapOrFail((raw) => {
+			const result = {};
+			for (const line of raw.split("\n")) {
+				const stripped = stripComment(line);
+				if (stripped === "") continue;
+				const split = stripped.indexOf("=");
+				if (split === -1) return Effect.fail(configError(`Input "${name}" has a line that is not \`key=value\`: "${stripped}"`, raw));
+				result[stripped.slice(0, split).trim()] = stripped.slice(split + 1).trim();
+			}
+			return Effect.succeed(result);
+		}));
+	}
+	/**
+	* A JSON-valued input, decoded through a schema.
+	*
+	* @remarks
+	* Absent or `""` fails as **missing data** before any JSON parsing runs
+	* (see {@link ActionInput.string}) — `Config.withDefault` or
+	* `Config.option` for an optional input. A present value that is not valid
+	* JSON, or does not satisfy the schema, fails carrying its `actual` and is
+	* never swallowed by a default.
+	*/
+	static schema(name, schema) {
+		return Config.string(inputVariable(name)).pipe(Config.mapOrFail((raw) => {
+			let parsed;
+			try {
+				parsed = JSON.parse(raw);
+			} catch {
+				return Effect.fail(configError(`Input "${name}" is not valid JSON`, raw));
+			}
+			return Schema.decodeUnknownEffect(schema)(parsed).pipe(Effect.mapError(() => configError(`Input "${name}" did not satisfy its schema`, parsed)));
+		}));
+	}
+	/**
+	* A `ConfigProvider` over a record of runner variables.
+	*
+	* @remarks
+	* Subsumes the source package's free-standing `ActionsConfigProvider`, whose
+	* three behaviors are preserved exactly: the path is joined with `_`, spaces
+	* become underscores and the whole is uppercased; and an **empty string
+	* reads as absent**, because the runner sets unsupplied inputs to `""` and
+	* treating that as present would make every optional input look supplied.
+	*
+	* Taking the environment as an argument rather than reading `process.env`
+	* is what makes inputs testable without mutating the test process.
+	*/
+	static provider(env = process.env) {
+		return ConfigProvider.make((path) => {
+			const value = env[path.join("_").replaceAll(" ", "_").toUpperCase()];
+			return Effect.succeed(value === void 0 || value === "" ? void 0 : ConfigProvider.makeValue(value));
+		});
+	}
+	/**
+	* A layer installing {@link ActionInput.provider}.
+	*
+	* @remarks
+	* `ConfigProvider.ConfigProvider` is a `Context.Reference` in v4, so this is
+	* a reference override rather than a service — there is no
+	* `Effect.withConfigProvider`.
+	*
+	* A parameterized layer factory mints a fresh reference per call; bind it to
+	* a `const` rather than calling it at each composition site.
+	*/
+	static layer(env) {
+		return ConfigProvider.layer(ActionInput.provider(env));
+	}
+	/**
+	* Inputs-first resolution layered over an existing provider.
+	*
+	* @remarks
+	* A bare `Config.string("dry-run")` resolves a **flat** name — one string
+	* segment — by first trying the variable the runner would have published for
+	* an input of that name (the `INPUT_` derivation this module owns), and only
+	* then trying the name unchanged through `ambient`. Anything the runner
+	* could not have set as an input — a nested path, a numeric segment — is
+	* passed to `ambient` untouched, so no path semantics are invented that the
+	* runner does not have.
+	*
+	* This exists because a live action shipped a **false green**: every bare
+	* `Config` read fell back to its `withDefault` because the runner exposes
+	* inputs as `INPUT_<MANGLED>` variables and a plain-named lookup finds
+	* nothing. Under this provider a bare read resolves through the same
+	* derivation `ActionInput.string` uses, so side-stepping the typed accessors
+	* degrades to the right answer instead of to the default.
+	*
+	* The documented trade: a workflow input named like an environment variable
+	* **shadows it** for bare reads — and because the derivation uppercases,
+	* any casing of the name sees the input. An unsupplied input does not
+	* shadow: the runner writes `""` for it, and the ambient provider's
+	* empty-is-absent rule (which the attempt resolves through) drops it. The
+	* `ActionInput` accessors themselves are unaffected — they read
+	* `INPUT_<MANGLED>` names, whose re-mangled form (`INPUT_INPUT_…`) never
+	* matches, so they fall through to the ambient lookup they always used.
+	*/
+	static providerOver(ambient) {
+		return ConfigProvider.orElse(ConfigProvider.make((path) => {
+			const name = path.length === 1 ? path[0] : void 0;
+			return typeof name === "string" ? ambient.load([inputVariable(name)]) : Effect.succeed(void 0);
+		}), ambient);
+	}
+	/**
+	* The provider the default action runtime installs: {@link ActionInput.providerOver}
+	* composed over the ambient environment lookup.
+	*
+	* @remarks
+	* Installed by `ActionRuntime.layer`, and therefore by `Action.run` — a bare
+	* `Config` read inside an action resolves through the runner's `INPUT_`
+	* derivation instead of silently missing. A caller-supplied
+	* `ConfigProvider` layer still wins by normal layer precedence.
+	*
+	* The ambient half is whatever provider is **explicitly installed** when the
+	* layer builds — which is how a test injects a deterministic environment by
+	* providing `ConfigProvider.layer(ConfigProvider.fromEnv({ env }))` beneath
+	* the runtime. When none is installed, a **fresh** `ConfigProvider.fromEnv()`
+	* is built rather than reading the reference's default: v4 caches that
+	* default once per process, and a snapshot taken before the runner's
+	* variables are visible would resurrect exactly the missed-input class this
+	* layer exists to kill. An action's environment is fixed before the process
+	* starts, so production cannot tell the difference; a test mutating
+	* `process.env` around `Action.run` can.
+	*
+	* A bound constant rather than a factory: layers memoize by reference.
+	*/
+	static layerDefault = ConfigProvider.layer(Effect.map(Effect.context(), (context) => ActionInput.providerOver(Context.getOrUndefined(context, ConfigProvider.ConfigProvider) ?? ConfigProvider.fromEnv())));
+};
+
+//#endregion
+export { ActionInput, inputVariable };