@effected/github-actions 0.12.0 → 0.13.1

package/BlobStore.js

@@ -1,3 +1,4 @@
+import { unstubbed } from "./internal/unstubbed.js";
 import { BlobEnvelope } from "./BlobEnvelope.js";
 import { sign } from "./internal/sigv4.js";
 import { Secret } from "./Secret.js";
@@ -85,9 +86,9 @@ var BlobStore = class BlobStore extends Context.Service()("@effected/github-acti
 	static layerS3 = (config) => Layer.effect(BlobStore, makeS3(config));
 	/** A test double. Unstubbed members die rather than reporting a miss. */
 	static makeTest = (overrides = {}) => ({
-		get: () => Effect.sync(() => unimplemented("get")),
-		put: () => Effect.sync(() => unimplemented("put")),
-		has: () => Effect.sync(() => unimplemented("has")),
+		get: () => dies("get"),
+		put: () => dies("put"),
+		has: () => dies("has"),
 		...overrides
 	});
 	/** {@link BlobStore.makeTest} behind `Layer.succeed`. */
@@ -115,9 +116,7 @@ var BlobStore = class BlobStore extends Context.Service()("@effected/github-acti
 		};
 	});
 };
-const unimplemented = (member) => {
-	throw new Error(`BlobStore.makeTest: ${member}() was called but not stubbed — pass a \`${member}\` override.`);
-};
+const dies = unstubbed("BlobStore.makeTest");
 const makeS3 = (config) => Effect.gen(function* () {
 	const http = yield* HttpClient.HttpClient;
 	let endpoint = config.endpoint ?? `https://s3.${config.region}.amazonaws.com`;
@@ -161,15 +160,17 @@ const makeS3 = (config) => Effect.gen(function* () {
 			cause
 		})));
 	});
+	/** Anything outside 2xx is the store refusing; a caller reads `404` first where a miss is an answer. */
+	const accepted = (key, status) => status < 200 || status >= 300 ? Effect.fail(new BlobStoreError({
+		reason: "refused",
+		key,
+		status
+	})) : Effect.void;
 	return {
 		get: (key, schema) => Effect.gen(function* () {
 			const response = yield* send("GET", key, /* @__PURE__ */ new Uint8Array(0));
 			if (response.status === 404) return Option.none();
-			if (response.status < 200 || response.status >= 300) return yield* Effect.fail(new BlobStoreError({
-				reason: "refused",
-				key,
-				status: response.status
-			}));
+			yield* accepted(key, response.status);
 			const buffer = yield* response.arrayBuffer.pipe(Effect.mapError((cause) => new BlobStoreError({
 				reason: "unreachable",
 				key,
@@ -180,20 +181,12 @@ const makeS3 = (config) => Effect.gen(function* () {
 		put: (key, blob, schema) => Effect.gen(function* () {
 			const framed = yield* Effect.fromResult(BlobEnvelope.encodeResult(blob.metadata, blob.body, schema));
 			const response = yield* send("PUT", key, framed);
-			if (response.status < 200 || response.status >= 300) return yield* Effect.fail(new BlobStoreError({
-				reason: "refused",
-				key,
-				status: response.status
-			}));
+			yield* accepted(key, response.status);
 		}),
 		has: (key) => Effect.gen(function* () {
 			const response = yield* send("HEAD", key, /* @__PURE__ */ new Uint8Array(0));
 			if (response.status === 404) return false;
-			if (response.status < 200 || response.status >= 300) return yield* Effect.fail(new BlobStoreError({
-				reason: "refused",
-				key,
-				status: response.status
-			}));
+			yield* accepted(key, response.status);
 			return true;
 		})
 	};

package/CacheKey.js

@@ -1,6 +1,7 @@
+import { sha256, sha256Hex } from "./internal/digest.js";
 import { Effect, FileSystem, Option, Path, Schema } from "effect";
-import { createHash } from "node:crypto";
 import { GlobSet } from "@effected/glob";
+import { descend } from "@effected/walker";
 
 //#region src/CacheKey.ts
 /**
@@ -257,9 +258,11 @@ var CacheKey = class CacheKey extends Schema.Class("CacheKey")(Schema.Struct({
 	* state.
 	*/
 	static forBranch(options) {
-		const segments = [];
-		if (options.os !== void 0) segments.push(options.os);
-		segments.push(options.scope, options.branch);
+		const segments = options.os === void 0 ? [options.scope, options.branch] : [
+			options.os,
+			options.scope,
+			options.branch
+		];
 		if (options.hash !== void 0) segments.push(options.hash);
 		return CacheKey.make({ segments });
 	}
@@ -302,7 +305,7 @@ var CacheKey = class CacheKey extends Schema.Class("CacheKey")(Schema.Struct({
 	*/
 	static digest(input, length = 8) {
 		if (!Number.isInteger(length) || length < 1 || length > 64) throw new RangeError(`A digest length must be an integer between 1 and 64, got ${length}`);
-		return createHash("sha256").update(input).digest("hex").slice(0, length);
+		return sha256Hex(input).slice(0, length);
 	}
 	/**
 	* Hash a set of files into a single digest.
@@ -330,30 +333,38 @@ var CacheKey = class CacheKey extends Schema.Class("CacheKey")(Schema.Struct({
 		const digests = yield* Effect.all(ordered.map((path) => fs.readFile(path).pipe(Effect.mapError((cause) => new CacheKeyReadError({
 			path,
 			cause
-		})), Effect.map((bytes) => createHash("sha256").update(bytes).digest()))), { concurrency: 8 });
-		const accumulator = createHash("sha256");
-		for (const digest of digests) accumulator.update(digest);
-		return Option.some(accumulator.digest("hex"));
+		})), Effect.map(sha256))), { concurrency: 8 });
+		return Option.some(sha256Hex(Uint8Array.from(digests.flatMap((digest) => [...digest]))));
 	});
 	/**
 	* Every file under `workspace` that the pattern set matches.
 	*
 	* @remarks
 	* Discovery and matching are **two different jobs**, and separating them is
-	* what makes this testable and correct. The walk is core
-	* `FileSystem.readDirectory(recursive)`; the matching is `@effected/glob`'s
-	* full minimatch dialect — the same dialect `@actions/glob` uses, so a workflow
-	* author's `!**\/node_modules/**` behaves here exactly as it does in every
-	* other cache step in the same workflow. `node:fs.globSync` would have welded
-	* the two together behind one non-stubbable call *and* changed the dialect,
-	* and a dialect divergence surfaces as a silent cache-key difference — the
-	* worst failure mode a cache key has.
-	*
-	* Candidates are matched by their path **relative to the workspace**, which
-	* is what makes "never hash a file outside the workspace" structural rather
-	* than a rule someone has to remember. Directories are excluded: a directory
+	* what makes this testable and correct. The walk is `@effected/walker`'s
+	* `descend`, run once per include from that include's own literal prefix
+	* (a literal include is one `stat`, never a walk) with nothing pruned
+	* implicitly; the matching is `@effected/glob`'s full minimatch dialect —
+	* the same dialect `@actions/glob` uses, so a workflow author's
+	* `!**\/node_modules/**` behaves here exactly as it does in every other
+	* cache step in the same workflow. `node:fs.globSync` would have welded the
+	* two together behind one non-stubbable call *and* changed the dialect, and
+	* a dialect divergence surfaces as a silent cache-key difference — the worst
+	* failure mode a cache key has.
+	*
+	* Candidates are matched by their path **relative to the workspace**, and a
+	* literal that climbs above it (`../lockfile`) is dropped, which is what
+	* makes "never hash a file outside the workspace" structural rather than a
+	* rule someone has to remember. Directories are excluded: a directory
 	* called `notes.txt` matches `**\/*.txt` and is not a file, and hashing it
-	* would fail rather than being ignored.
+	* would fail rather than being ignored. An absent literal is a miss; any
+	* other failure to read one is a typed `CacheKeyReadError`, because a key
+	* derived from an incomplete file set is wrong in a way nothing reports.
+	*
+	* **One knowing divergence from the runner's `hashFiles()`:** `descend`
+	* never enters a symlinked directory (cycle safety), where `@actions/glob`
+	* follows links by default. A file reachable only through a symlinked
+	* directory does not contribute to the key.
 	*
 	* The answer is sorted, so a caller cannot make its key depend on the order
 	* the filesystem happened to report.
@@ -361,24 +372,38 @@ var CacheKey = class CacheKey extends Schema.Class("CacheKey")(Schema.Struct({
 	static matchingFiles = Effect.fn("CacheKey.matchingFiles")(function* (options) {
 		const fs = yield* FileSystem.FileSystem;
 		const path = yield* Path.Path;
+		const { workspace } = options;
 		const set = yield* GlobSet.compile(options.patterns).pipe(Effect.mapError((cause) => new CacheKeyBadPatternError({
 			pattern: cause.pattern,
 			cause
 		})));
-		const entries = yield* fs.readDirectory(options.workspace, { recursive: true }).pipe(Effect.mapError((cause) => new CacheKeyReadError({
-			path: options.workspace,
+		yield* fs.stat(workspace).pipe(Effect.mapError((cause) => new CacheKeyReadError({
+			path: workspace,
 			cause
 		})));
-		const matched = [];
-		for (const entry of entries) {
-			if (!set.matches(entry.replaceAll("\\", "/"))) continue;
-			const absolute = path.join(options.workspace, entry);
-			if ((yield* fs.stat(absolute).pipe(Effect.mapError((cause) => new CacheKeyReadError({
-				path: absolute,
+		const candidates = /* @__PURE__ */ new Set();
+		for (const literal of set.literals) {
+			const target = path.join(workspace, literal);
+			const relative = path.relative(workspace, target);
+			if (relative === "" || relative.startsWith("..") || path.isAbsolute(relative)) continue;
+			const info = yield* fs.stat(target).pipe(Effect.map(Option.some), Effect.catchIf((error) => error.reason._tag === "NotFound", () => Effect.succeedNone), Effect.mapError((cause) => new CacheKeyReadError({
+				path: target,
+				cause
+			})));
+			if (Option.isSome(info) && info.value.type === "File") candidates.add(literal);
+		}
+		for (const wildcard of set.wildcards) {
+			if (wildcard.negated) continue;
+			const found = yield* descend(wildcard, {
+				cwd: workspace,
+				prune: []
+			}).pipe(Effect.mapError((cause) => new CacheKeyReadError({
+				path: path.join(workspace, cause.path),
 				cause
-			})))).type === "File") matched.push(absolute);
+			})));
+			for (const match of found) candidates.add(match);
 		}
-		return matched.sort();
+		return [...candidates].filter((candidate) => set.matches(candidate)).sort().map((candidate) => path.join(workspace, candidate));
 	});
 	/**
 	* Hash every file under `workspace` that the pattern set matches.

package/CheckDocument.js

@@ -1,3 +1,4 @@
+import { unstubbed } from "./internal/unstubbed.js";
 import { CheckState } from "./CheckState.js";
 import { ManagedDocument } from "./ManagedDocument.js";
 import { Clock, Context, Duration, Effect, Latch, Layer, Ref, Schema, Semaphore } from "effect";
@@ -28,6 +29,12 @@ var CheckReport = class extends Schema.Class("CheckReport")({
 	/** Where the check's name should link. */
 	url: Schema.optionalKey(Schema.String)
 }) {};
+/** What each {@link CheckDocumentError} kind reads as. */
+const KIND_PROSE = {
+	render: "The check document could not be regenerated from the reported state",
+	read: "Reading the check document's current text failed",
+	sink: "Writing the check document failed"
+};
 /**
 * Raised when the check document cannot be regenerated, read back or written.
 *
@@ -53,7 +60,7 @@ var CheckDocumentError = class extends Schema.TaggedError()("CheckDocumentError"
 	cause: Schema.optionalKey(Schema.Defect())
 }) {
 	get message() {
-		return this.kind === "render" ? "The check document could not be regenerated from the reported state" : this.kind === "read" ? "Reading the check document's current text failed" : "Writing the check document failed";
+		return KIND_PROSE[this.kind];
 	}
 };
 /**
@@ -90,12 +97,13 @@ var CheckDocumentStamp = class extends Schema.Class("CheckDocumentStamp")({
 		return compareRunId(incoming.runId, existing.runId) >= 0;
 	}
 };
+/** A total order over two comparable values. */
+const order = (left, right) => left === right ? 0 : left < right ? -1 : 1;
 /** Epoch order when both sides parse as dates, lexical otherwise. */
 const compareAt = (left, right) => {
 	const leftEpoch = Date.parse(left);
 	const rightEpoch = Date.parse(right);
-	if (!Number.isNaN(leftEpoch) && !Number.isNaN(rightEpoch)) return leftEpoch === rightEpoch ? 0 : leftEpoch < rightEpoch ? -1 : 1;
-	return left === right ? 0 : left < right ? -1 : 1;
+	return Number.isNaN(leftEpoch) || Number.isNaN(rightEpoch) ? order(left, right) : order(leftEpoch, rightEpoch);
 };
 /**
 * Numeric order when both sides are non-blank finite numbers, lexical
@@ -112,9 +120,9 @@ const compareRunId = (left, right) => {
 	if (left.trim() !== "" && right.trim() !== "") {
 		const leftNumber = Number(left);
 		const rightNumber = Number(right);
-		if (Number.isFinite(leftNumber) && Number.isFinite(rightNumber)) return leftNumber === rightNumber ? 0 : leftNumber < rightNumber ? -1 : 1;
+		if (Number.isFinite(leftNumber) && Number.isFinite(rightNumber)) return order(leftNumber, rightNumber);
 	}
-	return left === right ? 0 : left < right ? -1 : 1;
+	return order(left, right);
 };
 /** The stamp a document's own regions carry, when they carry one. */
 const stampOf = (meta) => {
@@ -293,16 +301,15 @@ var CheckDocument = class CheckDocument extends Context.Service()("@effected/git
 	}
 	/** An inert double; unstubbed members die naming themselves. */
 	static makeTest = (overrides = {}) => ({
-		report: overrides.report ?? (() => Effect.sync(() => unstubbed("report"))),
-		checks: overrides.checks ?? Effect.sync(() => unstubbed("checks")),
-		flush: overrides.flush ?? Effect.sync(() => unstubbed("flush"))
+		report: () => dies("report"),
+		checks: dies("checks"),
+		flush: dies("flush"),
+		...overrides
 	});
 	/** {@link CheckDocument.makeTest} behind a `Layer`. */
 	static layerTest = (overrides = {}) => Layer.succeed(CheckDocument, CheckDocument.makeTest(overrides));
 };
-const unstubbed = (member) => {
-	throw new Error(`CheckDocument.makeTest: ${member}() was called but not stubbed — pass an override.`);
-};
+const dies = unstubbed("CheckDocument.makeTest");
 
 //#endregion
 export { CheckDocument, CheckDocumentError, CheckDocumentStamp, CheckReport };

package/DetachedProcess.js

@@ -1,4 +1,5 @@
-import { Effect, Schema } from "effect";
+import { unstubbed } from "./internal/unstubbed.js";
+import { Effect, Schedule, Schema } from "effect";
 import { HttpClient } from "effect/unstable/http";
 import { ChildProcessSpawner } from "effect/unstable/process";
 import { spawn } from "node:child_process";
@@ -116,9 +117,7 @@ const ProcessId = Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => N
 /** Whether a thrown value is a Node errno error with the given code. */
 const isErrno = (cause, code) => typeof cause === "object" && cause !== null && cause.code === code;
 /** See {@link DetachedProcess.makeTestOps}: an unstubbed member dies naming itself. */
-const unimplemented = (member) => {
-	throw new Error(`DetachedProcess.makeTestOps: ${member}() was called but not stubbed — pass a \`${member}\` override.`);
-};
+const dies = unstubbed("DetachedProcess.makeTestOps");
 /**
 * A long-lived child that outlives the phase that started it.
 *
@@ -213,14 +212,11 @@ var DetachedProcess = class DetachedProcess {
 	* timeout six seconds later with nothing to show for it.
 	*/
 	static awaitReady = Effect.fn("DetachedProcess.awaitReady")(function* (probe, options) {
-		const interval = options?.interval ?? "150 millis";
-		const attempts = options?.attempts ?? 40;
-		const poll = (remaining) => Effect.flatMap(probe, (ready) => {
-			if (ready) return Effect.void;
-			if (remaining <= 0) return Effect.fail(new DetachedNotReadyError({}));
-			return Effect.flatMap(Effect.sleep(interval), () => poll(remaining - 1));
-		});
-		return yield* poll(attempts);
+		if (!(yield* Effect.repeat(probe, {
+			schedule: Schedule.spaced(options?.interval ?? "150 millis"),
+			times: options?.attempts ?? 40,
+			until: (answer) => answer
+		}))) return yield* Effect.fail(new DetachedNotReadyError({}));
 	});
 	/**
 	* A readiness probe over HTTP: `true` when a `GET` answers 2xx.
@@ -310,9 +306,9 @@ var DetachedProcess = class DetachedProcess {
 	* production form signals a real pid.
 	*/
 	static makeTestOps = (overrides = {}) => ({
-		spawn: () => Effect.sync(() => unimplemented("spawn")),
-		awaitReady: () => Effect.sync(() => unimplemented("awaitReady")),
-		reap: () => Effect.sync(() => unimplemented("reap")),
+		spawn: () => dies("spawn"),
+		awaitReady: () => dies("awaitReady"),
+		reap: () => dies("reap"),
 		...overrides
 	});
 };

package/DryRun.js

@@ -32,15 +32,6 @@ const make = (enabled) => ({
 * @public
 */
 var DryRun = class DryRun extends Context.Service()("@effected/github-actions/DryRun") {
-	/**
-	* Driven by the `dry-run` action input, defaulting to a real run.
-	*
-	* @remarks
-	* Fails with a `ConfigError` when the input is present but is not a YAML 1.2
-	* core-schema boolean — a workflow that writes `dry-run: yes` should stop,
-	* not quietly perform the mutations it meant to rehearse.
-	*/
-	static layer = Layer.effect(this, Effect.map(ActionInput.boolean(DEFAULT_INPUT).pipe(Config.withDefault(false)), make));
 	/**
 	* Driven by a named input.
 	*
@@ -50,6 +41,15 @@ var DryRun = class DryRun extends Context.Service()("@effected/github-actions/Dr
 	* composition site.
 	*/
 	static layerFromInput = (name) => Layer.effect(DryRun, Effect.map(ActionInput.boolean(name).pipe(Config.withDefault(false)), make));
+	/**
+	* Driven by the `dry-run` action input, defaulting to a real run.
+	*
+	* @remarks
+	* Fails with a `ConfigError` when the input is present but is not a YAML 1.2
+	* core-schema boolean — a workflow that writes `dry-run: yes` should stop,
+	* not quietly perform the mutations it meant to rehearse.
+	*/
+	static layer = DryRun.layerFromInput(DEFAULT_INPUT);
 	/** Driven by an explicit decision the caller has already made. */
 	static layerFrom = (enabled) => Layer.succeed(DryRun, make(enabled));
 	/**

package/GitHubMarkdown.js

@@ -159,12 +159,12 @@ var GitHubMarkdown = class GitHubMarkdown {
 		const columns = Object.keys(schema.fields).map((key) => {
 			const field = schema.fields[key];
 			const column = overrides[key];
-			const format = column?.format;
-			const encode = format === void 0 ? Schema.encodeSync(field) : void 0;
+			const encode = Schema.encodeSync(field);
+			const project = column?.format ?? ((value) => encode(value) ?? "");
 			return {
 				key,
 				header: column?.header ?? SchemaAST.resolveTitle(field.ast) ?? key,
-				cell: (value) => value === void 0 ? "" : format !== void 0 ? format(value) : encode?.(value) ?? ""
+				cell: (value) => value === void 0 ? "" : project(value)
 			};
 		});
 		const headers = columns.map((column) => column.header);

package/GitHubToken.js

@@ -160,7 +160,7 @@ var GitHubToken = class GitHubToken {
 	static read = Effect.fn("GitHubToken.read")(function* (options = {}) {
 		const token = yield* (yield* ActionState).get(options.stateKey ?? DEFAULT_KEY, InstallationToken);
 		const now = yield* DateTime.now;
-		if (options.skew === void 0 ? token.isExpired(DateTime.toEpochMillis(now)) : token.isExpired(DateTime.toEpochMillis(now), options.skew)) return yield* Effect.fail(new GitHubTokenError({
+		if (token.isExpired(DateTime.toEpochMillis(now), options.skew)) return yield* Effect.fail(new GitHubTokenError({
 			reason: "expired",
 			expiresAt: DateTime.formatIso(token.expiresAt)
 		}));

package/ManagedDocument.js

@@ -83,6 +83,12 @@ const STRUCTURAL_KIND = {
 	overlappingSections: "overlappingRegions",
 	duplicateSection: "duplicateRegion"
 };
+/** A structurally corrupt region layout, in this surface's vocabulary. */
+const structural = (failure) => new ManagedDocumentError({
+	kind: STRUCTURAL_KIND[failure.reason],
+	line: failure.line,
+	...failure.key === void 0 ? {} : { key: failure.key }
+});
 /**
 * A marker-delimited document: named regions a tool owns, inside text a human
 * may also edit.
@@ -145,21 +151,12 @@ var ManagedDocument = class ManagedDocument extends Schema.Class("ManagedDocumen
 	* a silent choice would destroy content a human wrote.
 	*/
 	static parseResult(source) {
-		const text = source.text ?? "";
-		const scanned = SectionDocument.parseResult(text, REGION_DIALECT);
-		if (Result.isFailure(scanned)) {
-			const failure = scanned.failure;
-			return Result.fail(new ManagedDocumentError({
-				kind: STRUCTURAL_KIND[failure.reason],
-				line: failure.line,
-				...failure.key === void 0 ? {} : { key: failure.key }
-			}));
-		}
-		return Result.succeed(ManagedDocument.make({
+		const document = ManagedDocument.make({
 			namespace: source.namespace,
 			key: source.key,
-			text
-		}));
+			text: source.text ?? ""
+		});
+		return Result.map(Result.mapError(document.scan(), structural), () => document);
 	}
 	/**
 	* Read a document out of existing text, in `Effect`.
@@ -179,8 +176,7 @@ var ManagedDocument = class ManagedDocument extends Schema.Class("ManagedDocumen
 	}
 	/** The content of one region, if the document carries it. */
 	region(key) {
-		const found = this.ownRegions().find((entry) => entry.key === key);
-		return found === void 0 ? Option.none() : Option.some(found.content);
+		return Option.map(this.entry(key), (found) => found.content);
 	}
 	/**
 	* One region's content and metadata together, if the document carries it.
@@ -235,15 +231,8 @@ var ManagedDocument = class ManagedDocument extends Schema.Class("ManagedDocumen
 	* surfacing in the typed channel.
 	*/
 	withRegionsResult(entries) {
-		const parsed = SectionDocument.parseResult(this.text, REGION_DIALECT);
-		if (Result.isFailure(parsed)) {
-			const failure = parsed.failure;
-			return Result.fail(new ManagedDocumentError({
-				kind: STRUCTURAL_KIND[failure.reason],
-				line: failure.line,
-				...failure.key === void 0 ? {} : { key: failure.key }
-			}));
-		}
+		const parsed = this.scan();
+		if (Result.isFailure(parsed)) return Result.fail(structural(parsed.failure));
 		const declared = entries.map(([key, content, meta]) => SectionId.make({
 			key: this.wireKey(key),
 			commentStyle: CommentStyle.html
@@ -275,14 +264,22 @@ var ManagedDocument = class ManagedDocument extends Schema.Class("ManagedDocumen
 	withRegions(entries) {
 		return Effect.fromResult(this.withRegionsResult(entries));
 	}
+	#scanned;
+	scan() {
+		this.#scanned ??= SectionDocument.parseResult(this.text, REGION_DIALECT);
+		return this.#scanned;
+	}
+	/** What every wire key of this document's regions begins with. */
+	get wirePrefix() {
+		return `${this.namespace}.${this.key}.`;
+	}
 	/** The marker key a region is written under: `namespace.key.region`. */
 	wireKey(region) {
-		return `${this.namespace}.${this.key}.${region}`;
+		return `${this.wirePrefix}${region}`;
 	}
 	/** The region key back out of a wire key, for error reporting. */
 	regionKeyOf(wireKey) {
-		const prefix = `${this.namespace}.${this.key}.`;
-		return wireKey.startsWith(prefix) ? wireKey.slice(prefix.length) : wireKey;
+		return wireKey.startsWith(this.wirePrefix) ? wireKey.slice(this.wirePrefix.length) : wireKey;
 	}
 	/**
 	* This document's own regions, in document order.
@@ -296,9 +293,9 @@ var ManagedDocument = class ManagedDocument extends Schema.Class("ManagedDocumen
 	* never reported.
 	*/
 	ownRegions() {
-		const parsed = SectionDocument.parseResult(this.text, REGION_DIALECT);
+		const parsed = this.scan();
 		if (Result.isFailure(parsed)) return [];
-		const prefix = `${this.namespace}.${this.key}.`;
+		const prefix = this.wirePrefix;
 		return parsed.success.sections.filter((placed) => placed.section.key.startsWith(prefix)).map((placed) => ({
 			key: placed.section.key.slice(prefix.length),
 			content: placed.section.content,

package/OidcTokenIssuer.js

@@ -1,6 +1,8 @@
 import { ActionEnvironment } from "./ActionEnvironment.js";
+import { unstubbed } from "./internal/unstubbed.js";
+import { payloadOf, unsignedJwt } from "./internal/jwt.js";
 import { Context, Effect, Layer, Redacted, Schema } from "effect";
-import { HttpClient } from "effect/unstable/http";
+import { HttpClient, HttpClientRequest } from "effect/unstable/http";
 import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
 
 //#region src/OidcTokenIssuer.ts
@@ -89,18 +91,6 @@ const TokenEnvelope = Schema.Struct({
 const REQUEST_TOKEN = "ACTIONS_ID_TOKEN_REQUEST_TOKEN";
 const REQUEST_URL = "ACTIONS_ID_TOKEN_REQUEST_URL";
 /**
-* Decode a JWT payload segment.
-*
-* @remarks
-* `base64url` states the intent, though it is not what makes this work: Node's
-* plain `base64` decoder happens to accept the url alphabet and unpadded input
-* too (probed at beta.101), so the two are interchangeable *here*. They are not
-* interchangeable everywhere — `atob` is not forgiving — which is why the
-* declaration is the strict one and there is a test whose payload actually
-* contains `-` and `_`.
-*/
-const decodeSegment = (segment) => JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
-/**
 * Read the claims out of a JWT **without verifying its signature**.
 *
 * @remarks
@@ -108,20 +98,14 @@ const decodeSegment = (segment) => JSON.parse(Buffer.from(segment, "base64url").
 * {@link OidcTokenIssuerShape.claims}; do not "fix" it here.
 */
 const readClaims = (token) => Effect.gen(function* () {
-	const parts = token.split(".");
-	const payload = parts[1];
-	if (parts.length !== 3 || payload === void 0 || payload === "") return yield* Effect.fail(new OidcTokenError({
+	const decoded = yield* Effect.fromResult(payloadOf(token)).pipe(Effect.mapError((failure) => failure.kind === "segments" ? new OidcTokenError({
 		reason: "malformedToken",
-		detail: `expected three segments, got ${parts.length}`
-	}));
-	const decoded = yield* Effect.try({
-		try: () => decodeSegment(payload),
-		catch: (cause) => new OidcTokenError({
-			reason: "malformedToken",
-			detail: "the payload is not base64url JSON",
-			cause
-		})
-	});
+		detail: failure.detail
+	}) : new OidcTokenError({
+		reason: "malformedToken",
+		detail: failure.detail,
+		cause: failure.cause
+	})));
 	return yield* Schema.decodeUnknownEffect(OidcClaims)(decoded).pipe(Effect.mapError((cause) => new OidcTokenError({
 		reason: "missingClaims",
 		cause
@@ -150,10 +134,7 @@ const make = Effect.gen(function* () {
 		const bearer = yield* required(REQUEST_TOKEN);
 		const base = yield* required(REQUEST_URL);
 		const url = audience === void 0 ? base : `${base}&audience=${encodeURIComponent(audience)}`;
-		const response = yield* http.get(url, { headers: {
-			authorization: `Bearer ${bearer}`,
-			accept: "application/json"
-		} }).pipe(Effect.mapError((cause) => new OidcTokenError({
+		const response = yield* http.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.bearerToken(bearer), HttpClientRequest.acceptJson)).pipe(Effect.mapError((cause) => new OidcTokenError({
 			reason: "requestFailed",
 			cause
 		})));
@@ -173,9 +154,7 @@ const make = Effect.gen(function* () {
 		})
 	};
 });
-const unimplemented = (member) => {
-	throw new Error(`OidcTokenIssuer.makeTest: ${member}() was called but not stubbed — pass a \`${member}\` override.`);
-};
+const dies = unstubbed("OidcTokenIssuer.makeTest");
 /**
 * The runner's OIDC token service.
 *
@@ -211,17 +190,14 @@ var OidcTokenIssuer = class OidcTokenIssuer extends Context.Service()("@effected
 	* provenance path structurally unreachable in the source package, drawing
 	* four separate apologetic comments from one consumer.
 	*/
-	static unsignedTokenFor = (claims) => {
-		const segment = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
-		return Redacted.make(`${segment({
-			alg: "RS256",
-			typ: "JWT"
-		})}.${segment(Schema.encodeUnknownSync(OidcClaims)(claims))}.unsigned`);
-	};
+	static unsignedTokenFor = (claims) => Redacted.make(unsignedJwt({
+		alg: "RS256",
+		typ: "JWT"
+	}, Schema.encodeUnknownSync(OidcClaims)(claims)));
 	/** A test double. Unstubbed members die rather than answering with a non-token. */
 	static makeTest = (overrides = {}) => ({
-		token: () => Effect.sync(() => unimplemented("token")),
-		claims: () => Effect.sync(() => unimplemented("claims")),
+		token: () => dies("token"),
+		claims: () => dies("claims"),
 		...overrides
 	});
 	/** {@link OidcTokenIssuer.makeTest} behind `Layer.succeed`. */