@effected/github-actions 0.13.0 → 0.13.1

package/DetachedProcess.js

@@ -1,4 +1,5 @@
-import { Effect, Schema } from "effect";
+import { unstubbed } from "./internal/unstubbed.js";
+import { Effect, Schedule, Schema } from "effect";
 import { HttpClient } from "effect/unstable/http";
 import { ChildProcessSpawner } from "effect/unstable/process";
 import { spawn } from "node:child_process";
@@ -116,9 +117,7 @@ const ProcessId = Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => N
 /** Whether a thrown value is a Node errno error with the given code. */
 const isErrno = (cause, code) => typeof cause === "object" && cause !== null && cause.code === code;
 /** See {@link DetachedProcess.makeTestOps}: an unstubbed member dies naming itself. */
-const unimplemented = (member) => {
-	throw new Error(`DetachedProcess.makeTestOps: ${member}() was called but not stubbed — pass a \`${member}\` override.`);
-};
+const dies = unstubbed("DetachedProcess.makeTestOps");
 /**
 * A long-lived child that outlives the phase that started it.
 *
@@ -213,14 +212,11 @@ var DetachedProcess = class DetachedProcess {
 	* timeout six seconds later with nothing to show for it.
 	*/
 	static awaitReady = Effect.fn("DetachedProcess.awaitReady")(function* (probe, options) {
-		const interval = options?.interval ?? "150 millis";
-		const attempts = options?.attempts ?? 40;
-		const poll = (remaining) => Effect.flatMap(probe, (ready) => {
-			if (ready) return Effect.void;
-			if (remaining <= 0) return Effect.fail(new DetachedNotReadyError({}));
-			return Effect.flatMap(Effect.sleep(interval), () => poll(remaining - 1));
-		});
-		return yield* poll(attempts);
+		if (!(yield* Effect.repeat(probe, {
+			schedule: Schedule.spaced(options?.interval ?? "150 millis"),
+			times: options?.attempts ?? 40,
+			until: (answer) => answer
+		}))) return yield* Effect.fail(new DetachedNotReadyError({}));
 	});
 	/**
 	* A readiness probe over HTTP: `true` when a `GET` answers 2xx.
@@ -310,9 +306,9 @@ var DetachedProcess = class DetachedProcess {
 	* production form signals a real pid.
 	*/
 	static makeTestOps = (overrides = {}) => ({
-		spawn: () => Effect.sync(() => unimplemented("spawn")),
-		awaitReady: () => Effect.sync(() => unimplemented("awaitReady")),
-		reap: () => Effect.sync(() => unimplemented("reap")),
+		spawn: () => dies("spawn"),
+		awaitReady: () => dies("awaitReady"),
+		reap: () => dies("reap"),
 		...overrides
 	});
 };

package/DryRun.js

@@ -32,15 +32,6 @@ const make = (enabled) => ({
 * @public
 */
 var DryRun = class DryRun extends Context.Service()("@effected/github-actions/DryRun") {
-	/**
-	* Driven by the `dry-run` action input, defaulting to a real run.
-	*
-	* @remarks
-	* Fails with a `ConfigError` when the input is present but is not a YAML 1.2
-	* core-schema boolean — a workflow that writes `dry-run: yes` should stop,
-	* not quietly perform the mutations it meant to rehearse.
-	*/
-	static layer = Layer.effect(this, Effect.map(ActionInput.boolean(DEFAULT_INPUT).pipe(Config.withDefault(false)), make));
 	/**
 	* Driven by a named input.
 	*
@@ -50,6 +41,15 @@ var DryRun = class DryRun extends Context.Service()("@effected/github-actions/Dr
 	* composition site.
 	*/
 	static layerFromInput = (name) => Layer.effect(DryRun, Effect.map(ActionInput.boolean(name).pipe(Config.withDefault(false)), make));
+	/**
+	* Driven by the `dry-run` action input, defaulting to a real run.
+	*
+	* @remarks
+	* Fails with a `ConfigError` when the input is present but is not a YAML 1.2
+	* core-schema boolean — a workflow that writes `dry-run: yes` should stop,
+	* not quietly perform the mutations it meant to rehearse.
+	*/
+	static layer = DryRun.layerFromInput(DEFAULT_INPUT);
 	/** Driven by an explicit decision the caller has already made. */
 	static layerFrom = (enabled) => Layer.succeed(DryRun, make(enabled));
 	/**

package/GitHubMarkdown.js

@@ -159,12 +159,12 @@ var GitHubMarkdown = class GitHubMarkdown {
 		const columns = Object.keys(schema.fields).map((key) => {
 			const field = schema.fields[key];
 			const column = overrides[key];
-			const format = column?.format;
-			const encode = format === void 0 ? Schema.encodeSync(field) : void 0;
+			const encode = Schema.encodeSync(field);
+			const project = column?.format ?? ((value) => encode(value) ?? "");
 			return {
 				key,
 				header: column?.header ?? SchemaAST.resolveTitle(field.ast) ?? key,
-				cell: (value) => value === void 0 ? "" : format !== void 0 ? format(value) : encode?.(value) ?? ""
+				cell: (value) => value === void 0 ? "" : project(value)
 			};
 		});
 		const headers = columns.map((column) => column.header);

package/GitHubToken.js

@@ -160,7 +160,7 @@ var GitHubToken = class GitHubToken {
 	static read = Effect.fn("GitHubToken.read")(function* (options = {}) {
 		const token = yield* (yield* ActionState).get(options.stateKey ?? DEFAULT_KEY, InstallationToken);
 		const now = yield* DateTime.now;
-		if (options.skew === void 0 ? token.isExpired(DateTime.toEpochMillis(now)) : token.isExpired(DateTime.toEpochMillis(now), options.skew)) return yield* Effect.fail(new GitHubTokenError({
+		if (token.isExpired(DateTime.toEpochMillis(now), options.skew)) return yield* Effect.fail(new GitHubTokenError({
 			reason: "expired",
 			expiresAt: DateTime.formatIso(token.expiresAt)
 		}));

package/ManagedDocument.js

@@ -83,6 +83,12 @@ const STRUCTURAL_KIND = {
 	overlappingSections: "overlappingRegions",
 	duplicateSection: "duplicateRegion"
 };
+/** A structurally corrupt region layout, in this surface's vocabulary. */
+const structural = (failure) => new ManagedDocumentError({
+	kind: STRUCTURAL_KIND[failure.reason],
+	line: failure.line,
+	...failure.key === void 0 ? {} : { key: failure.key }
+});
 /**
 * A marker-delimited document: named regions a tool owns, inside text a human
 * may also edit.
@@ -145,21 +151,12 @@ var ManagedDocument = class ManagedDocument extends Schema.Class("ManagedDocumen
 	* a silent choice would destroy content a human wrote.
 	*/
 	static parseResult(source) {
-		const text = source.text ?? "";
-		const scanned = SectionDocument.parseResult(text, REGION_DIALECT);
-		if (Result.isFailure(scanned)) {
-			const failure = scanned.failure;
-			return Result.fail(new ManagedDocumentError({
-				kind: STRUCTURAL_KIND[failure.reason],
-				line: failure.line,
-				...failure.key === void 0 ? {} : { key: failure.key }
-			}));
-		}
-		return Result.succeed(ManagedDocument.make({
+		const document = ManagedDocument.make({
 			namespace: source.namespace,
 			key: source.key,
-			text
-		}));
+			text: source.text ?? ""
+		});
+		return Result.map(Result.mapError(document.scan(), structural), () => document);
 	}
 	/**
 	* Read a document out of existing text, in `Effect`.
@@ -179,8 +176,7 @@ var ManagedDocument = class ManagedDocument extends Schema.Class("ManagedDocumen
 	}
 	/** The content of one region, if the document carries it. */
 	region(key) {
-		const found = this.ownRegions().find((entry) => entry.key === key);
-		return found === void 0 ? Option.none() : Option.some(found.content);
+		return Option.map(this.entry(key), (found) => found.content);
 	}
 	/**
 	* One region's content and metadata together, if the document carries it.
@@ -235,15 +231,8 @@ var ManagedDocument = class ManagedDocument extends Schema.Class("ManagedDocumen
 	* surfacing in the typed channel.
 	*/
 	withRegionsResult(entries) {
-		const parsed = SectionDocument.parseResult(this.text, REGION_DIALECT);
-		if (Result.isFailure(parsed)) {
-			const failure = parsed.failure;
-			return Result.fail(new ManagedDocumentError({
-				kind: STRUCTURAL_KIND[failure.reason],
-				line: failure.line,
-				...failure.key === void 0 ? {} : { key: failure.key }
-			}));
-		}
+		const parsed = this.scan();
+		if (Result.isFailure(parsed)) return Result.fail(structural(parsed.failure));
 		const declared = entries.map(([key, content, meta]) => SectionId.make({
 			key: this.wireKey(key),
 			commentStyle: CommentStyle.html
@@ -275,14 +264,22 @@ var ManagedDocument = class ManagedDocument extends Schema.Class("ManagedDocumen
 	withRegions(entries) {
 		return Effect.fromResult(this.withRegionsResult(entries));
 	}
+	#scanned;
+	scan() {
+		this.#scanned ??= SectionDocument.parseResult(this.text, REGION_DIALECT);
+		return this.#scanned;
+	}
+	/** What every wire key of this document's regions begins with. */
+	get wirePrefix() {
+		return `${this.namespace}.${this.key}.`;
+	}
 	/** The marker key a region is written under: `namespace.key.region`. */
 	wireKey(region) {
-		return `${this.namespace}.${this.key}.${region}`;
+		return `${this.wirePrefix}${region}`;
 	}
 	/** The region key back out of a wire key, for error reporting. */
 	regionKeyOf(wireKey) {
-		const prefix = `${this.namespace}.${this.key}.`;
-		return wireKey.startsWith(prefix) ? wireKey.slice(prefix.length) : wireKey;
+		return wireKey.startsWith(this.wirePrefix) ? wireKey.slice(this.wirePrefix.length) : wireKey;
 	}
 	/**
 	* This document's own regions, in document order.
@@ -296,9 +293,9 @@ var ManagedDocument = class ManagedDocument extends Schema.Class("ManagedDocumen
 	* never reported.
 	*/
 	ownRegions() {
-		const parsed = SectionDocument.parseResult(this.text, REGION_DIALECT);
+		const parsed = this.scan();
 		if (Result.isFailure(parsed)) return [];
-		const prefix = `${this.namespace}.${this.key}.`;
+		const prefix = this.wirePrefix;
 		return parsed.success.sections.filter((placed) => placed.section.key.startsWith(prefix)).map((placed) => ({
 			key: placed.section.key.slice(prefix.length),
 			content: placed.section.content,

package/OidcTokenIssuer.js

@@ -1,6 +1,8 @@
 import { ActionEnvironment } from "./ActionEnvironment.js";
+import { unstubbed } from "./internal/unstubbed.js";
+import { payloadOf, unsignedJwt } from "./internal/jwt.js";
 import { Context, Effect, Layer, Redacted, Schema } from "effect";
-import { HttpClient } from "effect/unstable/http";
+import { HttpClient, HttpClientRequest } from "effect/unstable/http";
 import * as HttpClientResponse from "effect/unstable/http/HttpClientResponse";
 
 //#region src/OidcTokenIssuer.ts
@@ -89,18 +91,6 @@ const TokenEnvelope = Schema.Struct({
 const REQUEST_TOKEN = "ACTIONS_ID_TOKEN_REQUEST_TOKEN";
 const REQUEST_URL = "ACTIONS_ID_TOKEN_REQUEST_URL";
 /**
-* Decode a JWT payload segment.
-*
-* @remarks
-* `base64url` states the intent, though it is not what makes this work: Node's
-* plain `base64` decoder happens to accept the url alphabet and unpadded input
-* too (probed at beta.101), so the two are interchangeable *here*. They are not
-* interchangeable everywhere — `atob` is not forgiving — which is why the
-* declaration is the strict one and there is a test whose payload actually
-* contains `-` and `_`.
-*/
-const decodeSegment = (segment) => JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
-/**
 * Read the claims out of a JWT **without verifying its signature**.
 *
 * @remarks
@@ -108,20 +98,14 @@ const decodeSegment = (segment) => JSON.parse(Buffer.from(segment, "base64url").
 * {@link OidcTokenIssuerShape.claims}; do not "fix" it here.
 */
 const readClaims = (token) => Effect.gen(function* () {
-	const parts = token.split(".");
-	const payload = parts[1];
-	if (parts.length !== 3 || payload === void 0 || payload === "") return yield* Effect.fail(new OidcTokenError({
+	const decoded = yield* Effect.fromResult(payloadOf(token)).pipe(Effect.mapError((failure) => failure.kind === "segments" ? new OidcTokenError({
 		reason: "malformedToken",
-		detail: `expected three segments, got ${parts.length}`
-	}));
-	const decoded = yield* Effect.try({
-		try: () => decodeSegment(payload),
-		catch: (cause) => new OidcTokenError({
-			reason: "malformedToken",
-			detail: "the payload is not base64url JSON",
-			cause
-		})
-	});
+		detail: failure.detail
+	}) : new OidcTokenError({
+		reason: "malformedToken",
+		detail: failure.detail,
+		cause: failure.cause
+	})));
 	return yield* Schema.decodeUnknownEffect(OidcClaims)(decoded).pipe(Effect.mapError((cause) => new OidcTokenError({
 		reason: "missingClaims",
 		cause
@@ -150,10 +134,7 @@ const make = Effect.gen(function* () {
 		const bearer = yield* required(REQUEST_TOKEN);
 		const base = yield* required(REQUEST_URL);
 		const url = audience === void 0 ? base : `${base}&audience=${encodeURIComponent(audience)}`;
-		const response = yield* http.get(url, { headers: {
-			authorization: `Bearer ${bearer}`,
-			accept: "application/json"
-		} }).pipe(Effect.mapError((cause) => new OidcTokenError({
+		const response = yield* http.execute(HttpClientRequest.get(url).pipe(HttpClientRequest.bearerToken(bearer), HttpClientRequest.acceptJson)).pipe(Effect.mapError((cause) => new OidcTokenError({
 			reason: "requestFailed",
 			cause
 		})));
@@ -173,9 +154,7 @@ const make = Effect.gen(function* () {
 		})
 	};
 });
-const unimplemented = (member) => {
-	throw new Error(`OidcTokenIssuer.makeTest: ${member}() was called but not stubbed — pass a \`${member}\` override.`);
-};
+const dies = unstubbed("OidcTokenIssuer.makeTest");
 /**
 * The runner's OIDC token service.
 *
@@ -211,17 +190,14 @@ var OidcTokenIssuer = class OidcTokenIssuer extends Context.Service()("@effected
 	* provenance path structurally unreachable in the source package, drawing
 	* four separate apologetic comments from one consumer.
 	*/
-	static unsignedTokenFor = (claims) => {
-		const segment = (value) => Buffer.from(JSON.stringify(value), "utf8").toString("base64url");
-		return Redacted.make(`${segment({
-			alg: "RS256",
-			typ: "JWT"
-		})}.${segment(Schema.encodeUnknownSync(OidcClaims)(claims))}.unsigned`);
-	};
+	static unsignedTokenFor = (claims) => Redacted.make(unsignedJwt({
+		alg: "RS256",
+		typ: "JWT"
+	}, Schema.encodeUnknownSync(OidcClaims)(claims)));
 	/** A test double. Unstubbed members die rather than answering with a non-token. */
 	static makeTest = (overrides = {}) => ({
-		token: () => Effect.sync(() => unimplemented("token")),
-		claims: () => Effect.sync(() => unimplemented("claims")),
+		token: () => dies("token"),
+		claims: () => dies("claims"),
 		...overrides
 	});
 	/** {@link OidcTokenIssuer.makeTest} behind `Layer.succeed`. */

package/PackageManagerInstaller.js

@@ -1,9 +1,12 @@
 import { ActionEnvironment } from "./ActionEnvironment.js";
+import { unstubbed } from "./internal/unstubbed.js";
+import { digestFileHex } from "./internal/digest.js";
+import { isWindowsRunner, toolCacheRoot } from "./internal/runner.js";
+import { typeAt } from "./internal/fsProbe.js";
 import { ToolInstaller } from "./ToolInstaller.js";
-import { Context, Effect, FileSystem, Layer, Option, Path, Schema, Stream } from "effect";
-import { createHash } from "node:crypto";
+import { Context, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
-import { PackageManagerPinName } from "@effected/npm";
+import { DEFAULT_REGISTRY, PackageManagerPinName } from "@effected/npm";
 
 //#region src/PackageManagerInstaller.ts
 /**
@@ -130,7 +133,6 @@ var CachedPackageManager = class extends Schema.Class("CachedPackageManager")({
 * @public
 */
 const InstalledPackageManager = Schema.Union([AmbientPackageManager, CachedPackageManager]);
-const DEFAULT_REGISTRY = "https://registry.npmjs.org";
 /** The shim directory name inside a cached npm-registry-manager entry. */
 const SHIM_DIR = ".bin";
 /**
@@ -149,9 +151,18 @@ const cmdShim = (target) => `@echo off\r\nnode "${target}" %*\r\n`;
 * bun's spelling (`macOS` → `darwin`) and the Node arch spelling to bun's
 * (`arm64` → `aarch64`).
 */
+const BUN_OS = {
+	linux: "linux",
+	macos: "darwin",
+	windows: "windows"
+};
+const BUN_CPU = {
+	x64: "x64",
+	arm64: "aarch64"
+};
 const bunTarget = (runnerOs, arch) => {
-	const os = runnerOs.toLowerCase() === "linux" ? "linux" : runnerOs.toLowerCase() === "macos" ? "darwin" : runnerOs.toLowerCase() === "windows" ? "windows" : void 0;
-	const cpu = arch === "x64" ? "x64" : arch === "arm64" ? "aarch64" : void 0;
+	const os = BUN_OS[runnerOs.toLowerCase()];
+	const cpu = BUN_CPU[arch];
 	return os === void 0 || cpu === void 0 ? Option.none() : Option.some(`bun-${os}-${cpu}`);
 };
 /**
@@ -174,7 +185,10 @@ const normalizeBins = (bin, fallbackName) => {
 	return Object.keys(entries).length === 0 ? Option.none() : Option.some(entries);
 };
 /** Map a `RUNNER_ARCH` value (`X64`, `ARM64`) onto the Node arch spelling. */
-const archFromRunner = (runnerArch) => runnerArch.toLowerCase() === "x64" ? "x64" : runnerArch.toLowerCase() === "arm64" ? "arm64" : runnerArch;
+const archFromRunner = (runnerArch) => {
+	const lowered = runnerArch.toLowerCase();
+	return lowered === "x64" || lowered === "arm64" ? lowered : runnerArch;
+};
 const make = Effect.gen(function* () {
 	const env = yield* ActionEnvironment;
 	const fs = yield* FileSystem.FileSystem;
@@ -186,11 +200,11 @@ const make = Effect.gen(function* () {
 		onNone: () => process.arch,
 		onSome: archFromRunner
 	}));
-	const windows = runnerOs.toLowerCase() === "windows";
+	const windows = yield* isWindowsRunner(env);
 	const bunBinaryName = windows ? "bun.exe" : "bun";
 	const shimFileName = (name) => windows ? `${name}.cmd` : name;
 	const shimBody = windows ? cmdShim : posixShim;
-	const cacheRoot = yield* Effect.map(env.getOptional("RUNNER_TOOL_CACHE"), (found) => Option.getOrElse(found, () => path.join("/tmp", "runner-tool-cache")));
+	const cacheRoot = yield* toolCacheRoot(env, path);
 	const finalCachePath = (tool, version) => ToolInstaller.cachePath({
 		root: cacheRoot,
 		tool,
@@ -209,16 +223,11 @@ const make = Effect.gen(function* () {
 		cause
 	});
 	/** The hex digest of a file's bytes, streamed rather than buffered. */
-	const hashFile = (pin, file, algorithm) => Effect.suspend(() => {
-		const digest = createHash(algorithm);
-		return fs.stream(file).pipe(Stream.runForEach((chunk) => Effect.sync(() => {
-			digest.update(chunk);
-		})), Effect.map(() => digest.digest("hex")), Effect.mapError((cause) => errorFor(pin)({
-			reason: "integrityMismatch",
-			subject: file,
-			cause
-		})));
-	});
+	const hashFile = (pin, file, algorithm) => digestFileHex(fs, file, algorithm).pipe(Effect.mapError((cause) => errorFor(pin)({
+		reason: "integrityMismatch",
+		subject: file,
+		cause
+	})));
 	/**
 	* Verify a downloaded artifact against the pin's integrity, fail-closed.
 	*
@@ -250,8 +259,7 @@ const make = Effect.gen(function* () {
 	*/
 	const ambientNpmVersion = Effect.map(Effect.result(spawner.string(ChildProcess.make("npm", ["--version"]))), (result) => result._tag === "Success" ? Option.some(result.success.trim()) : Option.none());
 	const assertFile = (pin, file, subject) => Effect.gen(function* () {
-		const stat = yield* Effect.result(fs.stat(file));
-		if (stat._tag !== "Success" || stat.success.type !== "File") return yield* Effect.fail(errorFor(pin)({
+		if ((yield* typeAt(fs, file)) !== "File") return yield* Effect.fail(errorFor(pin)({
 			reason: "layoutUnexpected",
 			subject
 		}));
@@ -319,8 +327,7 @@ const make = Effect.gen(function* () {
 		for (const [name, relative] of Object.entries(bins)) {
 			const shim = path.join(shimDir, shimFileName(name));
 			if (options.skipExisting) {
-				const present = yield* Effect.result(fs.stat(shim));
-				if (present._tag === "Success" && present.success.type === "File") continue;
+				if ((yield* typeAt(fs, shim)) === "File") continue;
 			}
 			yield* fs.writeFileString(shim, shimBody(path.join(finalDirectory, relative))).pipe(Effect.mapError(cacheError(shim)));
 			if (!windows) yield* fs.chmod(shim, 493).pipe(Effect.mapError(cacheError(shim)));
@@ -386,8 +393,7 @@ const make = Effect.gen(function* () {
 		if (!berry) yield* verifyIntegrity(pin, archive);
 		const extracted = yield* installer.extractTar(archive).pipe(Effect.mapError(fromInstaller(pin)));
 		const packageDir = path.join(extracted, "package");
-		const stat = yield* Effect.result(fs.stat(packageDir));
-		if (stat._tag !== "Success" || stat.success.type !== "Directory") return yield* Effect.fail(errorFor(pin)({
+		if ((yield* typeAt(fs, packageDir)) !== "Directory") return yield* Effect.fail(errorFor(pin)({
 			reason: "layoutUnexpected",
 			subject: "tarball has no package/ root"
 		}));
@@ -437,9 +443,7 @@ const make = Effect.gen(function* () {
 		return yield* installFromRegistry(pin, pin.name, registry);
 	}) };
 });
-const unimplemented = (member) => {
-	throw new Error(`PackageManagerInstaller.makeTest: ${member}() was called but not stubbed — pass a \`${member}\` override.`);
-};
+const dies = unstubbed("PackageManagerInstaller.makeTest");
 /**
 * First-class exact-version package-manager provisioning on a GitHub runner.
 *
@@ -483,7 +487,7 @@ var PackageManagerInstaller = class PackageManagerInstaller extends Context.Serv
 	static layer = Layer.effect(this, make);
 	/** A test double. The unstubbed member dies rather than reporting an install that did not happen. */
 	static makeTest = (overrides = {}) => ({
-		install: () => Effect.sync(() => unimplemented("install")),
+		install: () => dies("install"),
 		...overrides
 	});
 	/** {@link PackageManagerInstaller.makeTest} behind `Layer.succeed`. */

package/ToolInstaller.js

@@ -1,4 +1,8 @@
 import { ActionEnvironment } from "./ActionEnvironment.js";
+import { unstubbed } from "./internal/unstubbed.js";
+import { isWindowsRunner, toolCacheRoot } from "./internal/runner.js";
+import { spawnOnce } from "./internal/spawn.js";
+import { typeAt } from "./internal/fsProbe.js";
 import { Context, Effect, FileSystem, Layer, Option, Path, Schedule, Schema, Stream } from "effect";
 import { HttpClient } from "effect/unstable/http";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
@@ -61,11 +65,8 @@ const make = Effect.gen(function* () {
 	const path = yield* Path.Path;
 	const http = yield* HttpClient.HttpClient;
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
-	const root = yield* Effect.map(env.getOptional("RUNNER_TOOL_CACHE"), (found) => Option.getOrElse(found, () => path.join("/tmp", "runner-tool-cache")));
-	const windows = yield* Effect.map(env.getOptional("RUNNER_OS"), (found) => Option.match(found, {
-		onNone: () => false,
-		onSome: (os) => os.toLowerCase() === "windows"
-	}));
+	const root = yield* toolCacheRoot(env, path);
+	const windows = yield* isWindowsRunner(env);
 	const cachePath = (tool, version) => ToolInstaller.cachePath({
 		root,
 		tool,
@@ -93,30 +94,22 @@ const make = Effect.gen(function* () {
 	* the difference between "this is not a gzip archive" and "tar is not
 	* installed". Discarding it is what makes an extraction failure unactionable.
 	*
-	* **One spawn, not two — load-bearing.** The spawner's convenience members
-	* each spawn independently: `string` collects output without inspecting the
-	* exit code, and `exitCode` runs the command AGAIN (core's
-	* `ChildProcessSpawner.make` derives both from `spawn`). Calling them
-	* back-to-back double-executed every extraction — harmless for idempotent
-	* `tar`/`unzip -o`, but .NET's `ZipFile.ExtractToDirectory` refuses to
-	* overwrite, so the second run failed 5/5 on real Windows runners while the
-	* captured "complaint" was the FIRST run's silent success. Output and exit
-	* code must come from the same `spawn` handle.
+	* **One spawn, not two — load-bearing**, and why is spelled once in
+	* `internal/spawn.ts`: the double run failed 5/5 on real Windows runners
+	* because .NET's `ZipFile.ExtractToDirectory` refuses to overwrite.
 	*/
-	const extractWith = (command, archive) => Effect.scoped(Effect.gen(function* () {
-		const extractError = (cause) => new ToolInstallerError({
+	const extractWith = (command, archive) => Effect.gen(function* () {
+		const { output, code } = yield* spawnOnce(spawner, command).pipe(Effect.mapError((cause) => new ToolInstallerError({
 			reason: "extractFailed",
 			subject: archive,
 			cause
-		});
-		const handle = yield* spawner.spawn(command).pipe(Effect.mapError(extractError));
-		const output = yield* Stream.mkString(Stream.decodeText(handle.all)).pipe(Effect.mapError(extractError));
-		if ((yield* handle.exitCode.pipe(Effect.mapError(extractError))) !== 0) return yield* Effect.fail(new ToolInstallerError({
+		})));
+		if (code !== 0) return yield* Effect.fail(new ToolInstallerError({
 			reason: "extractFailed",
 			subject: archive,
 			stderr: output.trim()
 		}));
-	}));
+	});
 	/**
 	* Install a staged directory into the tool cache by renaming it into place.
 	*
@@ -191,7 +184,7 @@ const make = Effect.gen(function* () {
 			while: (error) => error.retryable
 		}));
 	});
-	const find = (tool, version) => Effect.map(Effect.result(fs.stat(cachePath(tool, version))), (result) => result._tag === "Success" && result.success.type === "Directory" ? Option.some(cachePath(tool, version)) : Option.none());
+	const find = (tool, version) => Effect.map(typeAt(fs, cachePath(tool, version)), (type) => type === "Directory" ? Option.some(cachePath(tool, version)) : Option.none());
 	const cacheFile = Effect.fn("ToolInstaller.cacheFile")(function* (source, name, tool, version) {
 		yield* Effect.annotateCurrentSpan({
 			tool,
@@ -252,8 +245,7 @@ const make = Effect.gen(function* () {
 			});
 			const cached = yield* find(options.tool, options.version);
 			if (Option.isSome(cached)) {
-				const present = yield* Effect.result(fs.stat(path.join(cached.value, options.binary)));
-				if (present._tag === "Success" && present.success.type === "File") return {
+				if ((yield* typeAt(fs, path.join(cached.value, options.binary))) === "File") return {
 					directory: cached.value,
 					binDir: cached.value
 				};
@@ -272,9 +264,7 @@ const make = Effect.gen(function* () {
 		})
 	};
 });
-const unimplemented = (member) => {
-	throw new Error(`ToolInstaller.makeTest: ${member}() was called but not stubbed — pass a \`${member}\` override.`);
-};
+const dies = unstubbed("ToolInstaller.makeTest");
 /**
 * Download, extract and cache a toolchain in the runner's tool cache.
 *
@@ -323,13 +313,13 @@ var ToolInstaller = class ToolInstaller extends Context.Service()("@effected/git
 	static cachePath = (options) => `${options.root}/${options.tool}/${options.version}/${options.arch}`;
 	/** A test double. Unstubbed members die rather than reporting a tool that is not there. */
 	static makeTest = (overrides = {}) => ({
-		find: () => Effect.sync(() => unimplemented("find")),
-		download: () => Effect.sync(() => unimplemented("download")),
-		extractTar: () => Effect.sync(() => unimplemented("extractTar")),
-		extractZip: () => Effect.sync(() => unimplemented("extractZip")),
-		cacheDir: () => Effect.sync(() => unimplemented("cacheDir")),
-		cacheFile: () => Effect.sync(() => unimplemented("cacheFile")),
-		provisionFile: () => Effect.sync(() => unimplemented("provisionFile")),
+		find: () => dies("find"),
+		download: () => dies("download"),
+		extractTar: () => dies("extractTar"),
+		extractZip: () => dies("extractZip"),
+		cacheDir: () => dies("cacheDir"),
+		cacheFile: () => dies("cacheFile"),
+		provisionFile: () => dies("provisionFile"),
 		...overrides
 	});
 	/** {@link ToolInstaller.makeTest} behind `Layer.succeed`. */