@effected/github-actions 0.23.1 → 0.25.0

package/Action.js

@@ -8,7 +8,7 @@ import { NodeServices } from "@effect/platform-node";
 import { Cause, Effect, Exit, Layer, LogLevel, Option, References, Result } from "effect";
 import { FetchHttpClient } from "effect/http";
 
-//#region src/Action.ts
+// src/Action.ts
 /**
 * The default runtime an action executes inside.
 *
@@ -152,5 +152,4 @@ var Action = class {
 	};
 };
 
-//#endregion
 export { Action, ActionRuntime, describeCause };

package/ActionCache.js

@@ -13,7 +13,7 @@ import { BlobClient, BlockBlobClient } from "@azure/storage-blob";
 import { GlobPattern, GlobSet } from "@effected/glob";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 
-//#region src/ActionCache.ts
+// src/ActionCache.ts
 /**
 * Raised when the runner's cache cannot be read or written.
 *
@@ -379,5 +379,4 @@ var ActionCache = class ActionCache extends Context.Service()("@effected/github-
 	static layerTest = (overrides = {}) => Layer.succeed(ActionCache, ActionCache.makeTest(overrides));
 };
 
-//#endregion
 export { ActionCache, ActionCacheError };

package/ActionEnvironment.js

@@ -1,6 +1,7 @@
+import { decodeJson } from "./internal/json.js";
 import { Context, Effect, FileSystem, Layer, Option, Schema } from "effect";
 
-//#region src/ActionEnvironment.ts
+// src/ActionEnvironment.ts
 /**
 * Raised when the runner environment does not say what an action needs.
 *
@@ -176,14 +177,11 @@ const make = (base) => Effect.gen(function* () {
 				name: "GITHUB_EVENT_PATH",
 				detail: `could not read "${path}": ${String(cause)}`
 			})));
-			return yield* Effect.try({
-				try: () => JSON.parse(raw),
-				catch: (cause) => new ActionEnvironmentError({
-					reason: "malformed",
-					name: "GITHUB_EVENT_PATH",
-					detail: `not valid JSON: ${String(cause)}`
-				})
-			});
+			return yield* decodeJson(raw).pipe(Effect.mapError((cause) => new ActionEnvironmentError({
+				reason: "malformed",
+				name: "GITHUB_EVENT_PATH",
+				detail: `not valid JSON: ${cause.message}`
+			})));
 		}),
 		withEnv: (overrides, effect) => Effect.flatMap(EnvOverrides, (current) => Effect.provideService(effect, EnvOverrides, {
 			...current,
@@ -324,5 +322,4 @@ var ActionEnvironment = class ActionEnvironment extends Context.Service()("@effe
 	static layerTest = (overrides = {}, payload) => Layer.effect(ActionEnvironment, ActionEnvironment.makeTest(overrides, payload)).pipe(Layer.provide(FileSystem.layerNoop({})));
 };
 
-//#endregion
 export { ActionEnvironment, ActionEnvironmentError, GitHubContext, RunnerContext };

package/ActionInput.js

@@ -1,6 +1,7 @@
+import { decodeJson } from "./internal/json.js";
 import { Config, ConfigProvider, Context, Effect, Schema, SchemaIssue } from "effect";
 
-//#region src/ActionInput.ts
+// src/ActionInput.ts
 /**
 * The variable name the runner publishes an input under.
 *
@@ -29,7 +30,17 @@ const inputVariable = (name) => `INPUT_${name.replaceAll(" ", "_").toUpperCase()
 * mutations the author meant to rehearse. `actual` carries the offending value
 * so the rendered error names it.
 */
-const configError = (message, actual) => new Config.ConfigError(new Schema.SchemaError(new SchemaIssue.InvalidValue({ message }, actual)));
+/**
+* A `ConfigError` carrying `message` as its first issue and, when a decode
+* failed, that decode's own issue beside it, so the cause is structured
+* rather than flattened into the message.
+*/
+const configError = (message, actual, cause) => {
+	const stated = new SchemaIssue.InvalidValue({ message }, actual);
+	return new Config.ConfigError(new Schema.SchemaError(cause === void 0 ? stated : new SchemaIssue.Composite(Schema.Unknown.ast, [stated, cause.issue], actual)));
+};
+/** The JSON-array form of {@link ActionInput.list}. */
+const decodeStringArray = Schema.decodeUnknownEffect(Schema.Array(Schema.String));
 /** YAML 1.2 core-schema booleans, which is what the runner documents. */
 const TRUE = /* @__PURE__ */ new Set([
 	"true",
@@ -267,13 +278,7 @@ var ActionInput = class ActionInput {
 		return Config.String(inputVariable(name)).pipe(Config.mapEffect((raw) => {
 			const trimmed = raw.trim();
 			if (trimmed === "") return Effect.succeed([]);
-			if (trimmed.startsWith("[")) try {
-				const parsed = JSON.parse(trimmed);
-				if (Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) return Effect.succeed(parsed);
-				return Effect.fail(configError(`Input "${name}" is a JSON array but not an array of strings`, raw));
-			} catch {
-				return Effect.fail(configError(`Input "${name}" looks like JSON but could not be parsed`, raw));
-			}
+			if (trimmed.startsWith("[")) return decodeJson(trimmed).pipe(Effect.mapError((cause) => configError(`Input "${name}" looks like JSON but could not be parsed`, raw, cause)), Effect.flatMap((parsed) => decodeStringArray(parsed).pipe(Effect.mapError((cause) => configError(`Input "${name}" is a JSON array but not an array of strings`, raw, cause)))));
 			const entries = trimmed.split(/[\n,]/).map((item) => item.trim()).filter((item) => !item.startsWith("#")).map((item) => item.startsWith("- ") || item.startsWith("* ") ? item.slice(2).trim() : item).filter((item) => item !== "");
 			return Effect.succeed(entries);
 		}));
@@ -332,15 +337,7 @@ var ActionInput = class ActionInput {
 	* which is exactly the missing-versus-malformed split above.
 	*/
 	static schema(name, schema) {
-		return Config.String(inputVariable(name)).pipe(Config.mapEffect((raw) => {
-			let parsed;
-			try {
-				parsed = JSON.parse(raw);
-			} catch {
-				return Effect.fail(configError(`Input "${name}" is not valid JSON`, raw));
-			}
-			return Schema.decodeUnknownEffect(schema)(parsed).pipe(Effect.mapError(() => configError(`Input "${name}" did not satisfy its schema`, parsed)));
-		}));
+		return Config.String(inputVariable(name)).pipe(Config.mapEffect((raw) => decodeJson(raw).pipe(Effect.mapError((cause) => configError(`Input "${name}" is not valid JSON`, raw, cause)), Effect.flatMap((parsed) => Schema.decodeUnknownEffect(schema)(parsed).pipe(Effect.mapError((cause) => configError(`Input "${name}" did not satisfy its schema`, parsed, cause)))))));
 	}
 	/**
 	* A `ConfigProvider` over a record of runner variables **or input names**.
@@ -512,5 +509,4 @@ var ActionInput = class ActionInput {
 	static layerDefault = ConfigProvider.layer(Effect.map(Effect.context(), (context) => ActionInput.providerOver(Context.getOrUndefined(context, ConfigProvider.ConfigProvider) ?? ConfigProvider.fromEnv())));
 };
 
-//#endregion
 export { ActionInput, inputVariable };

package/ActionLogger.js

@@ -2,7 +2,7 @@ import { ActionEnvironment } from "./ActionEnvironment.js";
 import { CommandNeutralizer, WorkflowCommand } from "@effected/github-commands";
 import { Console, Context, Effect, Exit, Inspectable, Layer, LogLevel, Logger, References } from "effect";
 
-//#region src/ActionLogger.ts
+// src/ActionLogger.ts
 /**
 * Render a log message, which arrives as an array of the values passed to
 * `Effect.log*`.
@@ -223,5 +223,4 @@ var ActionLogger = class ActionLogger extends Context.Service()("@effected/githu
 	static layerSilent = Layer.mergeAll(ActionLogger.layerTest(), Logger.layer([]));
 };
 
-//#endregion
 export { ActionLogger };

package/ActionOutputs.js

@@ -4,7 +4,7 @@ import { unstubbed } from "./internal/unstubbed.js";
 import { CommandNeutralizer, WorkflowCommand } from "@effected/github-commands";
 import { Console, Context, Effect, FileSystem, Layer, Schema } from "effect";
 
-//#region src/ActionOutputs.ts
+// src/ActionOutputs.ts
 /**
 * Raised when an action cannot publish an output.
 *
@@ -337,5 +337,4 @@ var ActionOutputs = class ActionOutputs extends Context.Service()("@effected/git
 	};
 };
 
-//#endregion
 export { ActionOutputs, DetachedOutputError, InvalidOutputNameError, OutputEncodeError, RecordedOutput, RunnerFileUnavailableError, RunnerFileWriteError };

package/ActionState.js

@@ -4,7 +4,7 @@ import { unstubbed } from "./internal/unstubbed.js";
 import { ActionOutputs } from "./ActionOutputs.js";
 import { Context, Effect, FileSystem, Layer, Option, Schema } from "effect";
 
-//#region src/ActionState.ts
+// src/ActionState.ts
 /**
 * Raised when action state cannot be saved, read or decoded across the phase
 * boundary.
@@ -157,5 +157,4 @@ var ActionState = class ActionState extends Context.Service()("@effected/github-
 	static layerTest = (overrides = {}) => Layer.succeed(ActionState, ActionState.makeTest(overrides));
 };
 
-//#endregion
 export { ActionState, ActionStateError };

package/ActionsIdentityToken.js

@@ -1,16 +1,16 @@
 import { OidcTokenIssuer } from "./OidcTokenIssuer.js";
 import { Effect, Layer } from "effect";
-import { IdentityToken, IdentityTokenError } from "@effected/sbom";
+import { IdentityToken, IdentityTokenError } from "@effected/oidc";
 
-//#region src/ActionsIdentityToken.ts
+// src/ActionsIdentityToken.ts
 /**
-* Serves `@effected/sbom`'s `IdentityToken` contract from the runner's own OIDC
+* Serves `@effected/oidc`'s `IdentityToken` contract from the runner's own OIDC
 * token service, so signing an SBOM inside a workflow needs no further wiring.
 *
 * @remarks
-* `@effected/sbom` declares `IdentityToken` — one method, one audience,
-* one redacted token — precisely so that signing does not drag the Actions
-* runtime into every consumer that only wants to emit an SBOM. This is the
+* `@effected/oidc` declares `IdentityToken` — one method, one audience,
+* one redacted token — precisely so that a consumer of a token, such as
+* `@effected/sbom`'s signer, does not drag the Actions runtime in. This is the
 * layer that closes the inversion from the other side: it serves that contract
 * from the runner's own OIDC token service ({@link OidcTokenIssuer}), the same
 * arrangement as `@effected/workspaces` implementing `@effected/commands`'
@@ -58,5 +58,4 @@ var ActionsIdentityToken = class {
 	}))) })));
 };
 
-//#endregion
 export { ActionsIdentityToken };

package/ActionsProvenance.js

@@ -3,7 +3,7 @@ import { OidcTokenIssuer } from "./OidcTokenIssuer.js";
 import { Effect, Option } from "effect";
 import { SlsaProvenance } from "@effected/sbom";
 
-//#region src/ActionsProvenance.ts
+// src/ActionsProvenance.ts
 /**
 * The server URL a workflow on github.com runs against.
 *
@@ -20,12 +20,14 @@ const DEFAULT_SERVER_URL = "https://github.com";
 *
 * @remarks
 * `SlsaProvenance.forGitHubWorkflow` is total and does the real work, but it
-* takes a camelCase input record — and the only input anyone inside a workflow
-* actually holds is the runner's own OIDC claims, spelled in GitHub's
-* snake_case claim names. The rename between the two is eleven all-string
-* fields, so transposing `repository_id` and `repository_owner_id` compiles,
-* passes every type check, and produces a validly signed attestation asserting
-* the **wrong** provenance. This module owns that rename once, on the same
+* takes an all-string input record — and the only input anyone inside a
+* workflow actually holds is the runner's own OIDC claims, decoded as
+* `@effected/github`'s `ActionsOidcClaims` with integer ids. The projection
+* between the two is eleven close-cousin fields, so transposing `repositoryId`
+* and `repositoryOwnerId` compiles, passes every type check, and produces a
+* validly signed attestation asserting the **wrong** provenance. This module
+* owns that projection once, rendering the ids back to the decimal strings the
+* token carried, on the same
 * `github-actions` ↔ `sbom` seam as {@link ActionsIdentityToken}: `sbom` must
 * not depend on the Actions runtime, so the adapter lives here, beside the
 * services it reads.
@@ -55,7 +57,7 @@ var ActionsProvenance = class {
 	*
 	* @remarks
 	* Every field `GitHubWorkflowProvenance` declares is populated from
-	* {@link OidcClaims}, except `serverUrl`, which is read from
+	* the runner's `ActionsOidcClaims`, except `serverUrl`, which is read from
 	* `GITHUB_SERVER_URL` through {@link ActionEnvironment}'s `getOptional`
 	* with `https://github.com` as the default — **not** through the
 	* `GitHubContext` projection. The projection fails typed when a `GITHUB_*`
@@ -88,17 +90,16 @@ var ActionsProvenance = class {
 			repository: claims.repository,
 			ref: claims.ref,
 			sha: claims.sha,
-			eventName: claims.event_name,
-			workflowRef: claims.workflow_ref,
-			jobWorkflowRef: claims.job_workflow_ref,
-			repositoryId: claims.repository_id,
-			repositoryOwnerId: claims.repository_owner_id,
-			runnerEnvironment: claims.runner_environment,
-			runId: claims.run_id,
-			runAttempt: claims.run_attempt
+			eventName: claims.eventName,
+			workflowRef: claims.workflowRef,
+			jobWorkflowRef: claims.jobWorkflowRef,
+			repositoryId: String(claims.repositoryId),
+			repositoryOwnerId: String(claims.repositoryOwnerId),
+			runnerEnvironment: claims.runnerEnvironment,
+			runId: String(claims.runId),
+			runAttempt: String(claims.runAttempt)
 		});
 	});
 };
 
-//#endregion
 export { ActionsProvenance };

package/Artifact.js

@@ -7,12 +7,12 @@ import { digestFileHex } from "./internal/digest.js";
 import { isWindowsRunner } from "./internal/runner.js";
 import { spawnOnce } from "./internal/spawn.js";
 import { unzipCommand, zipCommand, zipManifest } from "./internal/archiveCommands.js";
-import { Context, Effect, FileSystem, Layer, Option, Path, Result, Schema } from "effect";
+import { Context, DateTime, Duration, Effect, FileSystem, Layer, Option, Path, Result, Schema } from "effect";
 import { HttpClient } from "effect/http";
 import { BlobClient, BlockBlobClient } from "@azure/storage-blob";
 import { ChildProcessSpawner } from "effect/process";
 
-//#region src/Artifact.ts
+// src/Artifact.ts
 /**
 * Raised when an artifact cannot be uploaded, listed, downloaded or deleted.
 *
@@ -263,11 +263,12 @@ const make = (transfer) => Effect.gen(function* () {
 					cause
 				})));
 				const digest = yield* digestOf(packed, name);
+				const expiresAt = options?.retentionDays === void 0 ? void 0 : DateTime.formatIso(DateTime.addDuration(yield* DateTime.now, Duration.days(options.retentionDays)));
 				const finalized = yield* call("FinalizeArtifact", () => ({
 					name,
 					size: String(size.size),
 					hash: `sha256:${digest}`,
-					...options?.retentionDays === void 0 ? {} : { expiresAt: new Date(Date.now() + options.retentionDays * 864e5).toISOString() }
+					...expiresAt === void 0 ? {} : { expiresAt }
 				}), name);
 				if (finalized === CONFLICT || !isOk(finalized)) return yield* Effect.fail(new ArtifactError({
 					reason: "refused",
@@ -399,5 +400,4 @@ var Artifact = class Artifact extends Context.Service()("@effected/github-action
 	static layerTest = (overrides = {}) => Layer.succeed(Artifact, Artifact.makeTest(overrides));
 };
 
-//#endregion
 export { Artifact, ArtifactError };

package/BlobEnvelope.js

@@ -1,6 +1,6 @@
 import { Result, Schema } from "effect";
 
-//#region src/BlobEnvelope.ts
+// src/BlobEnvelope.ts
 /**
 * Raised when bytes cannot be read as an envelope.
 *
@@ -166,5 +166,4 @@ var BlobEnvelope = class {
 	}
 };
 
-//#endregion
 export { BlobEnvelope, BlobMetadataDecodeError, BlobMetadataEncodeError, NotABlobEnvelopeError, TruncatedBlobEnvelopeError, UnsupportedBlobEnvelopeVersionError };

package/BlobStore.githubCache.js

@@ -10,7 +10,7 @@ import { Effect, Layer, Option } from "effect";
 import { HttpClient } from "effect/http";
 import { BlobClient, BlockBlobClient } from "@azure/storage-blob";
 
-//#region src/BlobStore.githubCache.ts
+// src/BlobStore.githubCache.ts
 /**
 * The `version` every entry is filed under.
 *
@@ -166,5 +166,4 @@ var GitHubCacheBlobStore = class {
 	static layerWith = (transfer) => Layer.effect(BlobStore, make(transfer));
 };
 
-//#endregion
 export { GitHubCacheBlobStore };

package/BlobStore.js

@@ -1,11 +1,11 @@
 import { unstubbed } from "./internal/unstubbed.js";
 import { BlobEnvelope } from "./BlobEnvelope.js";
-import { sign } from "./internal/sigv4.js";
 import { Secret } from "./Secret.js";
-import { Context, Effect, Layer, Option, Schema } from "effect";
+import { Context, Crypto, DateTime, Effect, Layer, Option, Schema } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/http";
+import { SigV4 } from "@effected/crypto";
 
-//#region src/BlobStore.ts
+// src/BlobStore.ts
 /**
 * Raised when a blob cannot be stored or retrieved.
 *
@@ -15,12 +15,17 @@ var BlobStoreError = class extends Schema.TaggedError()("BlobStoreError", {
 	/**
 	* `unreachable` — the store could not be contacted. `refused` — it answered,
 	* unhappily; `status` says how. `misconfigured` — the layer was built with
-	* settings the store cannot use.
+	* settings the store cannot use, or a request could not be signed with them
+	* (no WebCrypto in the runtime, or key material it refuses). `invalidKey` —
+	* the caller's key cannot be stored at all, whatever the settings: on S3, a
+	* key with a `.` or `..` path segment, which no URL carries as signed.
+	* Nothing is sent.
 	*/
 	reason: Schema.Literals([
 		"unreachable",
 		"refused",
-		"misconfigured"
+		"misconfigured",
+		"invalidKey"
 	]),
 	/** The key involved. A stable identifier, never a value. */
 	key: Schema.optionalKey(Schema.String),
@@ -35,6 +40,7 @@ var BlobStoreError = class extends Schema.TaggedError()("BlobStoreError", {
 		switch (this.reason) {
 			case "unreachable": return `The blob store could not be reached${this.key === void 0 ? "" : ` for "${this.key}"`}`;
 			case "refused": return `The blob store refused "${this.key}"${this.status === void 0 ? "" : ` with status ${this.status}`}${this.detail === void 0 ? "" : `: ${this.detail}`}`;
+			case "invalidKey": return `The blob store cannot hold the key "${this.key}"${this.detail === void 0 ? "" : `: ${this.detail}`}`;
 			default: return `The blob store is misconfigured${this.detail === void 0 ? "" : `: ${this.detail}`}`;
 		}
 	}
@@ -75,10 +81,17 @@ var BlobStore = class BlobStore extends Context.Service()("@effected/github-acti
 	* An S3-compatible backend, signed with SigV4.
 	*
 	* @remarks
-	* No `@aws-sdk/*` dependency: signing is a specified algorithm over strings
-	* and HMACs, and this package already has `node:crypto`. The SDK's weight is
-	* in credential management, retries and a service catalogue none of which
-	* this needs.
+	* No `@aws-sdk/*` dependency: signing is `@effected/crypto`'s `SigV4`, a
+	* specified algorithm over strings and HMACs. The SDK's weight is in
+	* credential management, retries and a service catalogue none of which this
+	* needs.
+	*
+	* Requires core `Crypto` for the SHA-256 digests signing takes, resolved
+	* once when the layer is built; `NodeServices.layer` supplies it. A request
+	* that cannot be signed fails as {@link BlobStoreError} `misconfigured`. A
+	* key with a `.` or `..` path segment fails as `invalidKey` before anything
+	* is signed or sent: every URL parser collapses such a segment, so the store
+	* would receive another path than the one signed.
 	*
 	* A parameterized layer factory mints a fresh layer per call and layers
 	* memoize by reference — bind it to a `const` rather than calling it at each
@@ -119,43 +132,60 @@ var BlobStore = class BlobStore extends Context.Service()("@effected/github-acti
 };
 const dies = unstubbed("BlobStore.makeTest");
 const makeS3 = (config) => Effect.gen(function* () {
-	const http = yield* HttpClient.HttpClient;
+	const http = HttpClient.transform(yield* HttpClient.HttpClient, (effect) => Effect.provideService(effect, HttpClient.TracerPropagationEnabled, false));
+	const crypto = yield* Crypto.Crypto;
 	let endpoint = config.endpoint ?? `https://s3.${config.region}.amazonaws.com`;
 	while (endpoint.endsWith("/")) endpoint = endpoint.slice(0, -1);
 	const host = new URL(endpoint).host;
-	const secretAccessKey = yield* Secret.forSigning(config.secretAccessKey);
-	const sessionToken = config.sessionToken === void 0 ? void 0 : yield* Secret.forSigning(config.sessionToken);
+	yield* Secret.mask(config.secretAccessKey);
+	if (config.sessionToken !== void 0) yield* Secret.mask(config.sessionToken);
+	const credentials = {
+		accessKeyId: config.accessKeyId,
+		secretAccessKey: config.secretAccessKey,
+		...config.sessionToken === void 0 ? {} : { sessionToken: config.sessionToken },
+		region: config.region,
+		service: "s3"
+	};
 	const objectPath = (key) => [
 		config.bucket,
 		...config.prefix === void 0 ? [] : [config.prefix],
 		key
 	].join("/").replaceAll(/\/{2,}/g, "/");
-	const request = (method, key, body) => {
+	const unsignable = (key, cause) => new BlobStoreError({
+		reason: "misconfigured",
+		key,
+		detail: "the request could not be signed",
+		cause
+	});
+	const request = (method, key, body) => Effect.gen(function* () {
 		const path = objectPath(key);
-		const headers = sign({
+		const now = yield* DateTime.now;
+		const signed = yield* SigV4.sign({
 			method,
 			path,
 			host,
-			headers: {},
 			body,
-			now: /* @__PURE__ */ new Date()
-		}, {
-			accessKeyId: config.accessKeyId,
-			secretAccessKey,
-			...sessionToken === void 0 ? {} : { sessionToken },
-			region: config.region,
-			service: "s3"
-		});
+			now
+		}, credentials).pipe(Effect.provideService(Crypto.Crypto, crypto), Effect.catchTags({
+			SigV4PathError: (cause) => Effect.fail(new BlobStoreError({
+				reason: "invalidKey",
+				key,
+				detail: `the path has a "${cause.segment}" segment, which a URL collapses, so it cannot be sent as signed`,
+				cause
+			})),
+			CryptoError: (cause) => Effect.fail(unsignable(key, cause)),
+			PlatformError: (cause) => Effect.fail(unsignable(key, cause))
+		}));
 		return {
-			url: `${endpoint}/${path}`,
-			headers
+			url: `${endpoint}${signed.path}${signed.query === "" ? "" : `?${signed.query}`}`,
+			headers: signed.headers
 		};
-	};
-	const send = (method, key, body) => Effect.suspend(() => {
-		const { url, headers } = request(method, key, body);
+	});
+	const send = (method, key, body) => Effect.gen(function* () {
+		const { url, headers } = yield* request(method, key, body);
 		const base = HttpClientRequest.make(method)(url, { headers });
 		const built = body.length === 0 ? base : HttpClientRequest.bodyUint8Array(base, body);
-		return http.execute(built).pipe(Effect.mapError((cause) => new BlobStoreError({
+		return yield* http.execute(built).pipe(Effect.mapError((cause) => new BlobStoreError({
 			reason: "unreachable",
 			key,
 			cause
@@ -193,5 +223,4 @@ const makeS3 = (config) => Effect.gen(function* () {
 	};
 });
 
-//#endregion
 export { BlobStore, BlobStoreError };

package/BlobTransfer.js

@@ -1,6 +1,6 @@
 import { Schema } from "effect";
 
-//#region src/BlobTransfer.ts
+// src/BlobTransfer.ts
 /**
 * Raised when bytes could not be moved to or from a signed blob url.
 *
@@ -17,5 +17,4 @@ var BlobTransferError = class extends Schema.TaggedError()("BlobTransferError",
 	}
 };
 
-//#endregion
 export { BlobTransferError };

package/CacheKey.js

@@ -3,7 +3,7 @@ import { Effect, FileSystem, Option, Path, Schema } from "effect";
 import { GlobSet } from "@effected/glob";
 import { descend } from "@effected/walker";
 
-//#region src/CacheKey.ts
+// src/CacheKey.ts
 /**
 * Raised when a file or directory that was going to be hashed could not be
 * read.
@@ -441,5 +441,4 @@ var CacheKey = class CacheKey extends Schema.Class("CacheKey")(Schema.Struct({
 	});
 };
 
-//#endregion
 export { CacheKey, CacheKeyBadPatternError, CacheKeyReadError };

package/CheckDocument.js

@@ -3,7 +3,7 @@ import { CheckState } from "./CheckState.js";
 import { ManagedDocument } from "./ManagedDocument.js";
 import { Clock, Context, Duration, Effect, Latch, Layer, Ref, Schema, Semaphore } from "effect";
 
-//#region src/CheckDocument.ts
+// src/CheckDocument.ts
 /**
 * What a run knows about one of its checks: the authoritative state, and the
 * presentation facts a renderer projects into the document.
@@ -311,5 +311,4 @@ var CheckDocument = class CheckDocument extends Context.Service()("@effected/git
 };
 const dies = unstubbed("CheckDocument.makeTest");
 
-//#endregion
 export { CheckDocument, CheckDocumentError, CheckDocumentStamp, CheckReport };

package/CheckState.js

@@ -1,6 +1,6 @@
 import { Schema } from "effect";
 
-//#region src/CheckState.ts
+// src/CheckState.ts
 /**
 * The kit's check-state vocabulary.
 *
@@ -71,5 +71,4 @@ const projectCheckState = (state) => {
 	}
 };
 
-//#endregion
 export { CheckState, projectCheckState };

package/ChildEnv.js

@@ -1,4 +1,4 @@
-//#region src/ChildEnv.ts
+// src/ChildEnv.ts
 /**
 * Child-process environment construction: prepending directories to `PATH`
 * without falling into three cross-platform traps.
@@ -127,5 +127,4 @@ var ChildEnv = class ChildEnv {
 	}
 };
 
-//#endregion
 export { ChildEnv };

package/DetachedProcess.js

@@ -6,7 +6,7 @@ import { ChildProcessSpawner } from "effect/process";
 import { spawn } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
 
-//#region src/DetachedProcess.ts
+// src/DetachedProcess.ts
 /**
 * Raised when the log file for a detached child's output cannot be opened.
 *
@@ -309,5 +309,4 @@ var DetachedProcess = class DetachedProcess {
 	});
 };
 
-//#endregion
 export { DetachedLogUnavailableError, DetachedNotReadyError, DetachedProcess, DetachedSignalFailedError, DetachedSpawnFailedError, InvalidPidError, ProcessId };

package/DryRun.js

@@ -1,7 +1,7 @@
 import { ActionInput } from "./ActionInput.js";
 import { Config, Context, Effect, Layer } from "effect";
 
-//#region src/DryRun.ts
+// src/DryRun.ts
 /** The input a workflow author sets to rehearse a run. */
 const DEFAULT_INPUT = "dry-run";
 const make = (enabled) => ({
@@ -69,5 +69,4 @@ var DryRun = class DryRun extends Context.Service()("@effected/github-actions/Dr
 	static layerTest = (overrides = {}) => Layer.succeed(DryRun, DryRun.makeTest(overrides));
 };
 
-//#endregion
 export { DryRun };

package/GitHubMarkdown.js

@@ -1,7 +1,7 @@
 import { Result, Schema, SchemaAST } from "effect";
 import { Code, Html, InlineCode, Link, List, ListItem, Markdown, Paragraph, Root, Table, TableCell, TableRow } from "@effected/markdown";
 
-//#region src/GitHubMarkdown.ts
+// src/GitHubMarkdown.ts
 /**
 * A block node whose value passes through the serializer verbatim, which is
 * exactly how a pre-rendered markdown fragment must travel: GFM structure
@@ -234,5 +234,4 @@ var GitHubMarkdown = class GitHubMarkdown {
 	}
 };
 
-//#endregion
 export { GitHubMarkdown };

package/GitHubToken.js

@@ -3,7 +3,7 @@ import { Secret } from "./Secret.js";
 import { DateTime, Duration, Effect, Exit, Layer, Option, Result, Schema } from "effect";
 import { GitHubApp, GitHubClient, InstallationToken, TokenPermissions } from "@effected/github";
 
-//#region src/GitHubToken.ts
+// src/GitHubToken.ts
 /**
 * Raised when the token an earlier phase persisted cannot be used.
 *
@@ -220,5 +220,4 @@ var GitHubToken = class GitHubToken {
 	});
 };
 
-//#endregion
 export { GitHubToken, GitHubTokenError };

package/ManagedDocument.js

@@ -1,7 +1,7 @@
 import { Effect, Option, Result, Schema } from "effect";
 import { CommentStyle, SectionDialect, SectionDocument, SectionId } from "@effected/templates";
 
-//#region src/ManagedDocument.ts
+// src/ManagedDocument.ts
 /**
 * The grammar shared by a document's `namespace`, its `key` and every region
 * key.
@@ -316,5 +316,4 @@ var ManagedDocument = class ManagedDocument extends Schema.Class("ManagedDocumen
 	}
 };
 
-//#endregion
 export { ManagedDocument, ManagedDocumentError };