@effected/github-actions 0.23.1 → 0.25.0

package/index.d.ts

@@ -1,12 +1,12 @@
 import { AnnotationProperties, AnnotationProperties as AnnotationProperties$1, WorkflowCommand } from "@effected/github-commands";
 import { NodeServices } from "@effect/platform-node";
-import { Cause, Config, ConfigProvider, Context, Duration, Effect, FileSystem, Layer, Logger, Option, Path, Redacted, Result, Schema } from "effect";
+import { Cause, Config, ConfigProvider, Context, Crypto, Duration, Effect, FileSystem, Layer, Logger, Option, Path, Redacted, Result, Schema } from "effect";
 import { HttpClient } from "effect/http";
 import { ChildProcessSpawner } from "effect/process";
-import { IdentityToken, SlsaProvenance } from "@effected/sbom";
-import { BotIdentity, GitHubApp, GitHubClient, InstallationToken, PermissionLevel, RetryPolicy } from "@effected/github";
+import { IdentityToken } from "@effected/oidc";
+import { ActionsOidcClaims, BotIdentity, GitHubApp, GitHubClient, InstallationToken, PermissionLevel, RetryPolicy } from "@effected/github";
+import { SlsaProvenance } from "@effected/sbom";
 import { IntegrityHashBrand, PackageManagerPin } from "@effected/npm";
-//#region src/ActionEnvironment.d.ts
 declare const ActionEnvironmentError_base: Schema.Class<ActionEnvironmentError, Schema.TaggedStruct<"ActionEnvironmentError", {
   /** `missing` — absent or empty; `malformed` — present but unusable. */
   readonly reason: Schema.Literals<readonly ["missing", "malformed"]>;
@@ -259,8 +259,6 @@ export declare class ActionEnvironment extends ActionEnvironment_base {
    */
   static readonly layerTest: (overrides?: Readonly<Record<string, string>>, payload?: unknown) => Layer.Layer<ActionEnvironment>;
 }
-//#endregion
-//#region src/ActionLogger.d.ts
 /**
  * Options for {@link ActionLoggerShape.withBuffer}.
  *
@@ -453,8 +451,6 @@ export declare class ActionLogger extends ActionLogger_base {
    */
   static readonly layerSilent: Layer.Layer<ActionLogger>;
 }
-//#endregion
-//#region src/ActionOutputs.d.ts
 declare const RunnerFileUnavailableError_base: Schema.Class<RunnerFileUnavailableError, Schema.TaggedStruct<"RunnerFileUnavailableError", {
   /** The runner file involved, by environment variable name. */
   readonly file: Schema.String;
@@ -735,8 +731,6 @@ export declare class ActionOutputs extends ActionOutputs_base {
    */
   static readonly recording: () => RecordingOutputs;
 }
-//#endregion
-//#region src/ActionState.d.ts
 declare const ActionStateError_base: Schema.Class<ActionStateError, Schema.TaggedStruct<"ActionStateError", {
   /**
    * `missing` — no value was saved under this key in an earlier phase.
@@ -848,8 +842,6 @@ export declare class ActionState extends ActionState_base {
   /** {@link ActionState.makeTest} behind `Layer.succeed`. */
   static readonly layerTest: (overrides?: Partial<ActionStateShape>) => Layer.Layer<ActionState>;
 }
-//#endregion
-//#region src/Action.d.ts
 /**
  * Everything {@link ActionRuntime.layer} provides.
  *
@@ -999,8 +991,6 @@ export declare class Action {
    */
   static readonly run: <E, R = never>(program: Effect.Effect<void, E, ActionServices | R>, options?: ActionRunOptions<R>) => Promise<void>;
 }
-//#endregion
-//#region src/BlobTransfer.d.ts
 declare const BlobTransferError_base: Schema.Class<BlobTransferError, Schema.TaggedStruct<"BlobTransferError", {
   /** Which direction failed. */
   readonly reason: Schema.Literals<readonly ["uploadFailed", "downloadFailed"]>;
@@ -1058,8 +1048,6 @@ interface DataBlobTransfer {
   /** Download the url's contents. */
   readonly downloadToBuffer: (url: string) => Effect.Effect<Uint8Array, BlobTransferError>;
 }
-//#endregion
-//#region src/CacheKey.d.ts
 declare const CacheKeyReadError_base: Schema.Class<CacheKeyReadError, Schema.TaggedStruct<"CacheKeyReadError", {
   /** The path being read when it went wrong. */
   readonly path: Schema.String;
@@ -1410,8 +1398,6 @@ export declare class CacheKey extends CacheKey_base {
     readonly patterns: ReadonlyArray<string>;
   }) => Effect.Effect<Option.Option<string>, CacheKeyBadPatternError | CacheKeyReadError, FileSystem.FileSystem | Path.Path>;
 }
-//#endregion
-//#region src/ActionCache.d.ts
 declare const ActionCacheError_base: Schema.Class<ActionCacheError, Schema.TaggedStruct<"ActionCacheError", {
   /**
    * `misconfigured` — the results backend is not reachable from here (see
@@ -1550,8 +1536,6 @@ export declare class ActionCache extends ActionCache_base {
   /** {@link ActionCache.makeTest} behind `Layer.succeed`. */
   static readonly layerTest: (overrides?: Partial<ActionCacheShape>) => Layer.Layer<ActionCache>;
 }
-//#endregion
-//#region src/ActionInput.d.ts
 /**
  * Options for {@link ActionInput.pairs}.
  *
@@ -1944,8 +1928,6 @@ export declare class ActionInput {
    */
   static readonly layerDefault: Layer.Layer<never>;
 }
-//#endregion
-//#region src/OidcTokenIssuer.d.ts
 declare const OidcTokenError_base: Schema.Class<OidcTokenError, Schema.TaggedStruct<"OidcTokenError", {
   /**
    * `unavailable` — the runner did not publish the token-service variables,
@@ -1972,45 +1954,6 @@ declare const OidcTokenError_base: Schema.Class<OidcTokenError, Schema.TaggedStr
 export declare class OidcTokenError extends OidcTokenError_base {
   get message(): string;
 }
-declare const OidcClaims_base: Schema.Class<OidcClaims, Schema.Struct<{
-  /** The issuer, e.g. `https://token.actions.githubusercontent.com`. */
-  readonly iss: Schema.String;
-  /** The full ref the workflow ran on. */
-  readonly ref: Schema.String;
-  /** The commit. */
-  readonly sha: Schema.String;
-  /** `owner/repo`. */
-  readonly repository: Schema.String;
-  /** The event that triggered the run. */
-  readonly event_name: Schema.String;
-  /** The reusable-workflow ref, which is what a verifier pins against. */
-  readonly job_workflow_ref: Schema.String;
-  /** The calling workflow's ref. */
-  readonly workflow_ref: Schema.String;
-  /** The numeric repository id, as a string. */
-  readonly repository_id: Schema.String;
-  /** The numeric owner id, as a string. */
-  readonly repository_owner_id: Schema.String;
-  /** `github-hosted` or `self-hosted`. */
-  readonly runner_environment: Schema.String;
-  /** The run id, as a string. */
-  readonly run_id: Schema.String;
-  /** The run attempt, as a string. */
-  readonly run_attempt: Schema.String;
-}>, {}>;
-/**
- * The claims a GitHub Actions OIDC token carries about the workflow that ran.
- *
- * @remarks
- * The field names are GitHub's own JWT claim names, kept verbatim rather than
- * translated to the kit's casing. They are an **external vocabulary** — the
- * same strings that appear in a SLSA provenance predicate and in every
- * published example of an Actions OIDC policy — and renaming them would put a
- * translation layer between a consumer and the specification they are reading.
- *
- * @public
- */
-export declare class OidcClaims extends OidcClaims_base {}
 /**
  * The members of the {@link OidcTokenIssuer} service: request an ID `token`
  * and read its decoded `claims`, both failing with {@link OidcTokenError}.
@@ -2028,7 +1971,8 @@ interface OidcTokenIssuerShape {
    */
   readonly token: (audience?: string) => Effect.Effect<Redacted.Redacted<string>, OidcTokenError>;
   /**
-   * The token's claims, decoded.
+   * The token's claims, decoded into `@effected/github`'s `ActionsOidcClaims`,
+   * the same class `ActionsOidc.verify` returns.
    *
    * @remarks
    * **The signature is deliberately not verified**, for three reasons that are
@@ -2053,7 +1997,7 @@ interface OidcTokenIssuerShape {
    * a test cannot silently skip the path under test because the double
    * returned a token that is not a JWT.
    */
-  readonly claims: (audience?: string) => Effect.Effect<OidcClaims, OidcTokenError>;
+  readonly claims: (audience?: string) => Effect.Effect<ActionsOidcClaims, OidcTokenError>;
 }
 declare const OidcTokenIssuer_base: Context.ServiceClass<OidcTokenIssuer, "@effected/github-actions/OidcTokenIssuer", OidcTokenIssuerShape>;
 /**
@@ -2073,7 +2017,7 @@ declare const OidcTokenIssuer_base: Context.ServiceClass<OidcTokenIssuer, "@effe
  * const program = Effect.gen(function* () {
  *   const issuer = yield* OidcTokenIssuer;
  *   const claims = yield* issuer.claims("sigstore");
- *   return claims.job_workflow_ref;
+ *   return claims.jobWorkflowRef;
  * });
  * ```
  *
@@ -2097,7 +2041,7 @@ export declare class OidcTokenIssuer extends OidcTokenIssuer_base {
    * double returning a synthetic non-JWT would make the provenance path
    * structurally unreachable in a test.
    */
-  static readonly unsignedTokenFor: (claims: OidcClaims) => Redacted.Redacted<string>;
+  static readonly unsignedTokenFor: (claims: ActionsOidcClaims) => Redacted.Redacted<string>;
   /** A test double. Unstubbed members die rather than answering with a non-token. */
   static readonly makeTest: (overrides?: Partial<OidcTokenIssuerShape>) => OidcTokenIssuerShape;
   /** {@link OidcTokenIssuer.makeTest} behind `Layer.succeed`. */
@@ -2112,18 +2056,16 @@ export declare class OidcTokenIssuer extends OidcTokenIssuer_base {
    * members can disagree is how a test proves a path works while production
    * takes the other one.
    */
-  static readonly layerFor: (claims: OidcClaims) => Layer.Layer<OidcTokenIssuer>;
+  static readonly layerFor: (claims: ActionsOidcClaims) => Layer.Layer<OidcTokenIssuer>;
 }
-//#endregion
-//#region src/ActionsIdentityToken.d.ts
 /**
- * Serves `@effected/sbom`'s `IdentityToken` contract from the runner's own OIDC
+ * Serves `@effected/oidc`'s `IdentityToken` contract from the runner's own OIDC
  * token service, so signing an SBOM inside a workflow needs no further wiring.
  *
  * @remarks
- * `@effected/sbom` declares `IdentityToken` — one method, one audience,
- * one redacted token — precisely so that signing does not drag the Actions
- * runtime into every consumer that only wants to emit an SBOM. This is the
+ * `@effected/oidc` declares `IdentityToken` — one method, one audience,
+ * one redacted token — precisely so that a consumer of a token, such as
+ * `@effected/sbom`'s signer, does not drag the Actions runtime in. This is the
  * layer that closes the inversion from the other side: it serves that contract
  * from the runner's own OIDC token service ({@link OidcTokenIssuer}), the same
  * arrangement as `@effected/workspaces` implementing `@effected/commands`'
@@ -2167,20 +2109,20 @@ export declare class ActionsIdentityToken {
    */
   static readonly layer: Layer.Layer<IdentityToken, never, OidcTokenIssuer>;
 }
-//#endregion
-//#region src/ActionsProvenance.d.ts
 /**
  * Builds the current run's SLSA provenance from the runner's OIDC claims: the
  * Actions side of `@effected/sbom`'s `SlsaProvenance.forGitHubWorkflow`.
  *
  * @remarks
  * `SlsaProvenance.forGitHubWorkflow` is total and does the real work, but it
- * takes a camelCase input record — and the only input anyone inside a workflow
- * actually holds is the runner's own OIDC claims, spelled in GitHub's
- * snake_case claim names. The rename between the two is eleven all-string
- * fields, so transposing `repository_id` and `repository_owner_id` compiles,
- * passes every type check, and produces a validly signed attestation asserting
- * the **wrong** provenance. This module owns that rename once, on the same
+ * takes an all-string input record — and the only input anyone inside a
+ * workflow actually holds is the runner's own OIDC claims, decoded as
+ * `@effected/github`'s `ActionsOidcClaims` with integer ids. The projection
+ * between the two is eleven close-cousin fields, so transposing `repositoryId`
+ * and `repositoryOwnerId` compiles, passes every type check, and produces a
+ * validly signed attestation asserting the **wrong** provenance. This module
+ * owns that projection once, rendering the ids back to the decimal strings the
+ * token carried, on the same
  * `github-actions` ↔ `sbom` seam as {@link ActionsIdentityToken}: `sbom` must
  * not depend on the Actions runtime, so the adapter lives here, beside the
  * services it reads.
@@ -2210,7 +2152,7 @@ export declare class ActionsProvenance {
    *
    * @remarks
    * Every field `GitHubWorkflowProvenance` declares is populated from
-   * {@link OidcClaims}, except `serverUrl`, which is read from
+   * the runner's `ActionsOidcClaims`, except `serverUrl`, which is read from
    * `GITHUB_SERVER_URL` through {@link ActionEnvironment}'s `getOptional`
    * with `https://github.com` as the default — **not** through the
    * `GitHubContext` projection. The projection fails typed when a `GITHUB_*`
@@ -2235,8 +2177,6 @@ export declare class ActionsProvenance {
    */
   static readonly capture: (audience?: string) => Effect.Effect<SlsaProvenance, OidcTokenError, OidcTokenIssuer | ActionEnvironment>;
 }
-//#endregion
-//#region src/Artifact.d.ts
 declare const ArtifactError_base: Schema.Class<ArtifactError, Schema.TaggedStruct<"ArtifactError", {
   /**
    * `misconfigured` — the results backend is not reachable from here (see
@@ -2427,8 +2367,6 @@ export declare class Artifact extends Artifact_base {
   /** {@link Artifact.makeTest} behind `Layer.succeed`. */
   static readonly layerTest: (overrides?: Partial<ArtifactShape>) => Layer.Layer<Artifact>;
 }
-//#endregion
-//#region src/BlobEnvelope.d.ts
 declare const NotABlobEnvelopeError_base: Schema.Class<NotABlobEnvelopeError, Schema.TaggedStruct<"NotABlobEnvelopeError", {
   /** The underlying failure, preserved structurally. */
   readonly cause: Schema.optionalKey<Schema.Defect>;
@@ -2571,15 +2509,17 @@ export declare class BlobEnvelope {
     readonly body: Uint8Array;
   }, BlobEnvelopeError>;
 }
-//#endregion
-//#region src/BlobStore.d.ts
 declare const BlobStoreError_base: Schema.Class<BlobStoreError, Schema.TaggedStruct<"BlobStoreError", {
   /**
    * `unreachable` — the store could not be contacted. `refused` — it answered,
    * unhappily; `status` says how. `misconfigured` — the layer was built with
-   * settings the store cannot use.
+   * settings the store cannot use, or a request could not be signed with them
+   * (no WebCrypto in the runtime, or key material it refuses). `invalidKey` —
+   * the caller's key cannot be stored at all, whatever the settings: on S3, a
+   * key with a `.` or `..` path segment, which no URL carries as signed.
+   * Nothing is sent.
    */
-  readonly reason: Schema.Literals<readonly ["unreachable", "refused", "misconfigured"]>;
+  readonly reason: Schema.Literals<readonly ["unreachable", "refused", "misconfigured", "invalidKey"]>;
   /** The key involved. A stable identifier, never a value. */
   readonly key: Schema.optionalKey<Schema.String>;
   /** The HTTP status, when the store answered. */
@@ -2694,16 +2634,23 @@ export declare class BlobStore extends BlobStore_base {
    * An S3-compatible backend, signed with SigV4.
    *
    * @remarks
-   * No `@aws-sdk/*` dependency: signing is a specified algorithm over strings
-   * and HMACs, and this package already has `node:crypto`. The SDK's weight is
-   * in credential management, retries and a service catalogue none of which
-   * this needs.
+   * No `@aws-sdk/*` dependency: signing is `@effected/crypto`'s `SigV4`, a
+   * specified algorithm over strings and HMACs. The SDK's weight is in
+   * credential management, retries and a service catalogue none of which this
+   * needs.
+   *
+   * Requires core `Crypto` for the SHA-256 digests signing takes, resolved
+   * once when the layer is built; `NodeServices.layer` supplies it. A request
+   * that cannot be signed fails as {@link BlobStoreError} `misconfigured`. A
+   * key with a `.` or `..` path segment fails as `invalidKey` before anything
+   * is signed or sent: every URL parser collapses such a segment, so the store
+   * would receive another path than the one signed.
    *
    * A parameterized layer factory mints a fresh layer per call and layers
    * memoize by reference — bind it to a `const` rather than calling it at each
    * composition site.
    */
-  static readonly layerS3: (config: S3Config) => Layer.Layer<BlobStore, never, HttpClient.HttpClient | ActionOutputs>;
+  static readonly layerS3: (config: S3Config) => Layer.Layer<BlobStore, never, HttpClient.HttpClient | ActionOutputs | Crypto.Crypto>;
   /** A test double. Unstubbed members die rather than reporting a miss. */
   static readonly makeTest: (overrides?: Partial<BlobStoreShape>) => BlobStoreShape;
   /** {@link BlobStore.makeTest} behind `Layer.succeed`. */
@@ -2719,8 +2666,6 @@ export declare class BlobStore extends BlobStore_base {
    */
   static readonly layerMemory: Layer.Layer<BlobStore>;
 }
-//#endregion
-//#region src/BlobStore.githubCache.d.ts
 /**
  * The {@link BlobStore} backend that stores blobs in the runner's own Actions
  * cache.
@@ -2781,8 +2726,6 @@ export declare class GitHubCacheBlobStore {
    */
   static readonly layerWith: (transfer: DataBlobTransfer) => Layer.Layer<BlobStore, never, HttpClient.HttpClient | ActionEnvironment>;
 }
-//#endregion
-//#region src/CheckDocument.d.ts
 declare const CheckReport_base: Schema.Class<CheckReport, Schema.Struct<{
   /** Where the check is now. The last reported state is the authoritative one. */
   readonly state: Schema.Literals<readonly ["running", "pass", "fail", "warn", "user_interaction_required", "skipped", "timeout"]>;
@@ -3084,8 +3027,6 @@ export declare class CheckDocument extends CheckDocument_base {
   /** {@link CheckDocument.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<CheckDocumentShape>) => Layer.Layer<CheckDocument>;
 }
-//#endregion
-//#region src/CheckState.d.ts
 /**
  * The kit's check-state vocabulary.
  *
@@ -3154,8 +3095,6 @@ type CheckRunProjection = {
  * @public
  */
 export declare const projectCheckState: (state: CheckState) => CheckRunProjection;
-//#endregion
-//#region src/ChildEnv.d.ts
 /**
  * The environment additions {@link ChildEnv.prependPath} builds: exactly one
  * entry, keyed by the spelling of `PATH` the base environment already uses.
@@ -3307,8 +3246,6 @@ export declare class ChildEnv {
    */
   static needsShell(platform: string): boolean;
 }
-//#endregion
-//#region src/DetachedProcess.d.ts
 declare const DetachedLogUnavailableError_base: Schema.Class<DetachedLogUnavailableError, Schema.TaggedStruct<"DetachedLogUnavailableError", {
   /** The log file that could not be opened. */
   readonly path: Schema.String;
@@ -3645,8 +3582,6 @@ export declare class DetachedProcess {
    */
   static readonly makeTestOps: (overrides?: Partial<DetachedProcessOps>) => DetachedProcessOps;
 }
-//#endregion
-//#region src/DryRun.d.ts
 /**
  * The {@link DryRun} service shape.
  *
@@ -3728,8 +3663,6 @@ export declare class DryRun extends DryRun_base {
   /** {@link DryRun.makeTest} behind `Layer.succeed`. */
   static readonly layerTest: (overrides?: Partial<DryRunShape>) => Layer.Layer<DryRun>;
 }
-//#endregion
-//#region src/GitHubMarkdown.d.ts
 /**
  * A heading level GitHub renders, `1` through `6`.
  *
@@ -3980,8 +3913,6 @@ export declare class GitHubMarkdown {
    */
   static raw(markdown: string): string;
 }
-//#endregion
-//#region src/GitHubToken.d.ts
 declare const GitHubTokenError_base: Schema.Class<GitHubTokenError, Schema.TaggedStruct<"GitHubTokenError", {
   /**
    * One reason, deliberately: everything else that can go wrong here already
@@ -4169,8 +4100,6 @@ export declare class GitHubToken {
    */
   static readonly dispose: (options?: ReadOptions | undefined) => Effect.Effect<void, ActionStateError | import("@effected/github").GitHubAppError, ActionState | GitHubApp>;
 }
-//#endregion
-//#region src/ManagedDocument.d.ts
 declare const ManagedDocumentError_base: Schema.Class<ManagedDocumentError, Schema.TaggedStruct<"ManagedDocumentError", {
   /** Which ambiguity or refusal was found. */
   readonly kind: Schema.Literals<readonly ["unterminatedRegion", "orphanedEnd", "overlappingRegions", "duplicateRegion", "markerInContent", "duplicateDeclaration", "invalidAttribute"]>;
@@ -4387,8 +4316,6 @@ export declare class ManagedDocument extends ManagedDocument_base {
    */
   private ensureSentinel;
 }
-//#endregion
-//#region src/ToolInstaller.d.ts
 declare const ToolInstallerError_base: Schema.Class<ToolInstallerError, Schema.TaggedStruct<"ToolInstallerError", {
   /**
    * `downloadFailed` — the archive could not be fetched. `extractFailed` — the
@@ -4657,8 +4584,6 @@ export declare class ToolInstaller extends ToolInstaller_base {
   /** {@link ToolInstaller.makeTest} behind `Layer.succeed`. */
   static readonly layerTest: (overrides?: Partial<ToolInstallerShape>) => Layer.Layer<ToolInstaller>;
 }
-//#endregion
-//#region src/PackageManagerInstaller.d.ts
 declare const PackageManagerInstallerError_base: Schema.Class<PackageManagerInstallerError, Schema.TaggedStruct<"PackageManagerInstallerError", {
   /**
    * `downloadFailed`, `extractFailed` and `cacheFailed` mirror the
@@ -4961,8 +4886,6 @@ export declare class PackageManagerInstaller extends PackageManagerInstaller_bas
   /** {@link PackageManagerInstaller.makeTest} behind `Layer.succeed`. */
   static readonly layerTest: (overrides?: Partial<PackageManagerInstallerShape>) => Layer.Layer<PackageManagerInstaller>;
 }
-//#endregion
-//#region src/Secret.d.ts
 /**
  * The declassification seam: the **only** place in this package where a
  * `Redacted` value becomes a plain string.
@@ -5041,9 +4964,13 @@ export declare class Secret {
    * Declassify one secret for an in-process use that needs the raw bytes.
    *
    * @remarks
-   * Request signing is the case this exists for: an HMAC cannot be computed
-   * over a `Redacted`, so a signing key has to become a string somewhere, and
-   * the point of this module is that "somewhere" is here and nowhere else.
+   * For a consumer that must hand the raw key to code taking a plain string,
+   * such as a third-party signing library. A signer that takes a `Redacted`
+   * needs no declassification at all: `@effected/crypto`'s `SigV4` and `Hmac`
+   * unwrap the key only where they compute, so a caller of those (this
+   * package's own S3 `BlobStore` is one) registers the value with
+   * {@link Secret.mask} and passes the `Redacted` on. No module in this
+   * package calls this member any more.
    *
    * Signing named the member; it does not gate it. **Any in-process use that
    * needs the raw value without writing it to a runner file is this
@@ -5068,9 +4995,9 @@ export declare class Secret {
    * `::add-mask::` command only masks when the runner parses this process's
    * stdout; a detached worker's stdout is a log file no runner parses, so
    * there the command masks nothing *and* spells the plaintext into the log.
-   * A worker that signs (an S3-style `BlobStore` is the canonical case) must compose
-   * `ActionOutputs.layerDetached`, under which this member still returns the
-   * raw key for the HMAC but the mask is a documented no-op; the masking
+   * A worker that signs must compose `ActionOutputs.layerDetached`, under
+   * which this member still returns the raw key but the mask is a
+   * documented no-op; the masking
    * itself is the **parent's** job, done before the spawn via
    * {@link Secret.forChildEnv} under the real layer.
    */
@@ -5144,6 +5071,5 @@ export declare class Secret {
    */
   static readonly adopt: (name: string) => Config.Config<Redacted.Redacted<string>>;
 }
-//#endregion
 export { type ActionCacheShape, type ActionEnvironmentShape, type ActionLoggerShape, type ActionOutputError, type ActionOutputsShape, type ActionRunOptions, type ActionServices, type ActionStateShape, type AnnotationProperties, type ArtifactItem, type ArtifactRef, type ArtifactShape, type BlobEnvelopeError, type BlobStoreShape, type CacheKeyError, type CheckDocumentOptions, type CheckDocumentShape, type CheckDocumentSink, type CheckFlushOutcome, type CheckRunConclusion, type CheckRunProjection, type ClientLayerOptions, type DataBlobTransfer, type DetachedProcessError, type DetachedProcessOps, type DetachedSpawnOptions, type DownloadOptions, type DownloadResult, type DryRunShape, type ExtractOptions, type FileBlobTransfer, type GitHubHeadingDepth, type GitHubListOptions, type GitHubRowSchema, type GitHubSchemaTable, type GitHubSchemaTableColumn, type GitHubSchemaTableColumns, type GitHubSchemaTableFormatRequiredKeys, type GitHubSchemaTableFormattedColumn, type GitHubSchemaTableOptions, type ManagedDocumentSource, type OidcTokenIssuerShape, type PackageManagerInstallOptions, type PackageManagerInstallerShape, type PairsOptions, type PathPrependEnv, type PathPrependOptions, type ProvisionFileOptions, type ProvisionOptions, type ProvisionedFile, type ReadOptions, type ReadinessOptions, type RecordedOutputMember, type RecordingOutputs, type S3Config, type StoredBlob, type ToolDownloadOptions, type ToolInstallerShape, type UploadOptions, type UploadResult, type WithBufferOptions, type WithStepOptions, WorkflowCommand };
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -6,7 +6,7 @@ import { ActionState, ActionStateError } from "./ActionState.js";
 import { Action, ActionRuntime, describeCause } from "./Action.js";
 import { BlobTransferError } from "./BlobTransfer.js";
 import { ActionCache, ActionCacheError } from "./ActionCache.js";
-import { OidcClaims, OidcTokenError, OidcTokenIssuer } from "./OidcTokenIssuer.js";
+import { OidcTokenError, OidcTokenIssuer } from "./OidcTokenIssuer.js";
 import { ActionsIdentityToken } from "./ActionsIdentityToken.js";
 import { ActionsProvenance } from "./ActionsProvenance.js";
 import { Artifact, ArtifactError } from "./Artifact.js";
@@ -27,4 +27,4 @@ import { ToolInstaller, ToolInstallerError } from "./ToolInstaller.js";
 import { AmbientPackageManager, CachedPackageManager, InstalledPackageManager, PackageManagerInstaller, PackageManagerInstallerError } from "./PackageManagerInstaller.js";
 import { WorkflowCommand } from "@effected/github-commands";
 
-export { Action, ActionCache, ActionCacheError, ActionEnvironment, ActionEnvironmentError, ActionInput, ActionLogger, ActionOutputs, ActionRuntime, ActionState, ActionStateError, ActionsIdentityToken, ActionsProvenance, AmbientPackageManager, Artifact, ArtifactError, BlobEnvelope, BlobMetadataDecodeError, BlobMetadataEncodeError, BlobStore, BlobStoreError, BlobTransferError, CacheKey, CacheKeyBadPatternError, CacheKeyReadError, CachedPackageManager, CheckDocument, CheckDocumentError, CheckDocumentStamp, CheckReport, CheckState, ChildEnv, DetachedLogUnavailableError, DetachedNotReadyError, DetachedOutputError, DetachedProcess, DetachedSignalFailedError, DetachedSpawnFailedError, DryRun, GitHubCacheBlobStore, GitHubContext, GitHubMarkdown, GitHubToken, GitHubTokenError, InstalledPackageManager, InvalidOutputNameError, InvalidPidError, ManagedDocument, ManagedDocumentError, NotABlobEnvelopeError, OidcClaims, OidcTokenError, OidcTokenIssuer, OutputEncodeError, PackageManagerInstaller, PackageManagerInstallerError, ProcessId, RecordedOutput, RunnerContext, RunnerFileUnavailableError, RunnerFileWriteError, Secret, ToolInstaller, ToolInstallerError, TruncatedBlobEnvelopeError, UnsupportedBlobEnvelopeVersionError, WorkflowCommand, describeCause, projectCheckState };
+export { Action, ActionCache, ActionCacheError, ActionEnvironment, ActionEnvironmentError, ActionInput, ActionLogger, ActionOutputs, ActionRuntime, ActionState, ActionStateError, ActionsIdentityToken, ActionsProvenance, AmbientPackageManager, Artifact, ArtifactError, BlobEnvelope, BlobMetadataDecodeError, BlobMetadataEncodeError, BlobStore, BlobStoreError, BlobTransferError, CacheKey, CacheKeyBadPatternError, CacheKeyReadError, CachedPackageManager, CheckDocument, CheckDocumentError, CheckDocumentStamp, CheckReport, CheckState, ChildEnv, DetachedLogUnavailableError, DetachedNotReadyError, DetachedOutputError, DetachedProcess, DetachedSignalFailedError, DetachedSpawnFailedError, DryRun, GitHubCacheBlobStore, GitHubContext, GitHubMarkdown, GitHubToken, GitHubTokenError, InstalledPackageManager, InvalidOutputNameError, InvalidPidError, ManagedDocument, ManagedDocumentError, NotABlobEnvelopeError, OidcTokenError, OidcTokenIssuer, OutputEncodeError, PackageManagerInstaller, PackageManagerInstallerError, ProcessId, RecordedOutput, RunnerContext, RunnerFileUnavailableError, RunnerFileWriteError, Secret, ToolInstaller, ToolInstallerError, TruncatedBlobEnvelopeError, UnsupportedBlobEnvelopeVersionError, WorkflowCommand, describeCause, projectCheckState };

package/internal/actionsResults.js

@@ -1,7 +1,7 @@
-import { payloadOf } from "./jwt.js";
 import { Effect, Option, Redacted, Result } from "effect";
+import { Jws } from "@effected/jwt";
 
-//#region src/internal/actionsResults.ts
+// src/internal/actionsResults.ts
 /** The variable naming the backend. Absent outside a `uses:` step. */
 const RESULTS_URL = "ACTIONS_RESULTS_URL";
 /** The variable holding the run-scoped credential. Absent outside a `uses:` step. */
@@ -26,9 +26,10 @@ const misconfiguredDetail = (variable, service) => `${variable} is not set — t
 * @internal
 */
 const backendIdsFrom = (token) => {
-	const payload = payloadOf(token);
-	if (Result.isFailure(payload)) return Result.fail(`the runtime token is not a readable JWT: ${payload.failure.detail}`);
-	const scope = payload.success?.scp;
+	const decoded = Jws.decodeUnverified(token);
+	if (Result.isFailure(decoded)) return Result.fail(`the runtime token is not a readable JWT: ${decoded.failure.detail}`);
+	const payload = decoded.success.payload;
+	const scope = typeof payload === "object" && payload !== null ? payload.scp : void 0;
 	if (typeof scope !== "string") return Result.fail("the runtime token carries no `scp` claim");
 	for (const entry of scope.split(" ")) {
 		const parts = entry.split(":");
@@ -72,5 +73,4 @@ const resultsBackend = (env) => Effect.gen(function* () {
 	};
 });
 
-//#endregion
 export { RESULTS_URL, RUNTIME_TOKEN, backendIdsFrom, misconfiguredDetail, resultsBackend };

package/internal/archiveCommands.js

@@ -1,6 +1,6 @@
 import { ChildProcess } from "effect/process";
 
-//#region src/internal/archiveCommands.ts
+// src/internal/archiveCommands.ts
 /** A PowerShell single-quoted literal: `'` becomes `''`, nothing else is special. */
 const pwshLiteral = (value) => `'${value.replaceAll("'", "''")}'`;
 /** A non-interactive pwsh invocation of one command line. */
@@ -83,5 +83,4 @@ const tarExtractCommand = (options) => {
 	]);
 };
 
-//#endregion
 export { tarExtractCommand, unzipCommand, zipCommand, zipManifest };

package/internal/cacheService.js

@@ -1,7 +1,7 @@
 import { CONFLICT, isOk, stringField } from "./twirp.js";
 import { Effect, Option } from "effect";
 
-//#region src/internal/cacheService.ts
+// src/internal/cacheService.ts
 /** The Twirp service the Actions cache protocol lives under. @internal */
 const CACHE_SERVICE = "github.actions.results.api.v1.CacheService";
 /**
@@ -50,5 +50,4 @@ const lookupDownload = (client, key, restoreKeys, version) => Effect.map(client.
 	});
 });
 
-//#endregion
 export { CACHE_SERVICE, finalizeUpload, lookupDownload, reserveUpload };

package/internal/digest.js

@@ -2,7 +2,7 @@ import { Effect, Stream } from "effect";
 import { createHash } from "node:crypto";
 import * as Hex from "effect/encoding/Hex";
 
-//#region src/internal/digest.ts
+// src/internal/digest.ts
 /** The raw SHA-256 of a string or byte array held in memory. @internal */
 const sha256 = (value) => new Uint8Array(createHash("sha256").update(value).digest());
 /** The hex SHA-256 of a string or byte array held in memory. @internal */
@@ -27,5 +27,4 @@ const digestFile = (fs, file, algorithm) => Effect.suspend(() => {
 /** {@link digestFile}, as hex. @internal */
 const digestFileHex = (fs, file, algorithm) => Effect.map(digestFile(fs, file, algorithm), Hex.encode);
 
-//#endregion
 export { digestFile, digestFileHex, sha256, sha256Hex };

package/internal/fsProbe.js

@@ -1,6 +1,6 @@
 import { Effect } from "effect";
 
-//#region src/internal/fsProbe.ts
+// src/internal/fsProbe.ts
 /**
 * The entry's type, or `undefined` when nothing readable is there. Absence
 * and unreadability collapse together on purpose: every caller's next move
@@ -18,5 +18,4 @@ const typeAt = (fs, path) => Effect.map(Effect.option(fs.stat(path)), (info) =>
 */
 const isErrno = (cause, code) => typeof cause === "object" && cause !== null && cause.code === code;
 
-//#endregion
 export { isErrno, typeAt };

package/internal/json.js

@@ -0,0 +1,11 @@
+import { Schema } from "effect";
+
+// src/internal/json.ts
+/**
+* Parse JSON text to an unknown value, failing with a `SchemaError` on text that is not JSON.
+*
+* @internal
+*/
+const decodeJson = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown));
+
+export { decodeJson };

package/internal/pnpmExe.js

@@ -2,7 +2,7 @@ import { Option, Result } from "effect";
 import * as Hex from "effect/encoding/Hex";
 import * as Base64 from "effect/encoding/Base64";
 
-//#region src/internal/pnpmExe.ts
+// src/internal/pnpmExe.ts
 /** The prefix every native-binary package name carries. @internal */
 const PNPM_EXE_PREFIX = "@pnpm/exe.";
 /**
@@ -107,5 +107,4 @@ const strongestSri = (integrity) => {
 /** Whether a bin target is a Node script (run with `node`) rather than an executable run directly. @internal */
 const isNodeScript = (target) => /\.[cm]?js$/i.test(target);
 
-//#endregion
 export { PNPM_EXE_PREFIX, detectMusl, isNodeScript, pnpmExeTarget, strongestSri };

package/internal/runner.js

@@ -1,6 +1,6 @@
 import { Effect, Option } from "effect";
 
-//#region src/internal/runner.ts
+// src/internal/runner.ts
 /**
 * Whether `RUNNER_OS` says Windows. `false` when unset — off a runner, the
 * POSIX shape is the honest default.
@@ -26,6 +26,25 @@ const isWindowsRunner = (env) => Effect.map(env.getOptional("RUNNER_OS"), (found
 * @internal
 */
 const toolCacheRoot = (env, path) => Effect.map(env.getOptional("RUNNER_TOOL_CACHE"), (found) => Option.getOrElse(found, () => path.join("/tmp", "runner-tool-cache")));
+/** `RUNNER_ARCH`'s spellings (`X86`, `X64`, `ARM`, `ARM64`), lower-cased, in Node's `process.arch` spelling. */
+const NODE_ARCH = /* @__PURE__ */ new Map([
+	["x86", "ia32"],
+	["x64", "x64"],
+	["arm", "arm"],
+	["arm64", "arm64"]
+]);
+/** A `RUNNER_ARCH` value in Node's spelling; anything unrecognised passes through. */
+const archFromRunner = (runnerArch) => NODE_ARCH.get(runnerArch.toLowerCase()) ?? runnerArch;
+/**
+* The host architecture in Node's spelling: `RUNNER_ARCH` mapped through
+* `archFromRunner`, or `process.arch` off a runner, where the variable is
+* absent and the host's own answer is the honest fallback.
+*
+* @internal
+*/
+const runnerArch = (env) => Effect.map(env.getOptional("RUNNER_ARCH"), (found) => Option.match(found, {
+	onNone: () => process.arch,
+	onSome: archFromRunner
+}));
 
-//#endregion
-export { isWindowsRunner, toolCacheRoot };
+export { isWindowsRunner, runnerArch, toolCacheRoot };

package/internal/runnerFile.js

@@ -1,4 +1,4 @@
-//#region src/internal/runnerFile.ts
+// src/internal/runnerFile.ts
 /** The base delimiter for a heredoc block. */
 const BASE_DELIMITER = "EFFECTED_EOF";
 /** A delimiter guaranteed absent from `value`. @internal */
@@ -44,5 +44,4 @@ const heredocBlock = (name, value) => {
 	return `${name}<<${delimiter}\n${value}\n${delimiter}\n`;
 };
 
-//#endregion
 export { delimiterFor, heredocBlock, isUsableName };

package/internal/shim.js

@@ -1,6 +1,6 @@
 import { isNodeScript } from "./pnpmExe.js";
 
-//#region src/internal/shim.ts
+// src/internal/shim.ts
 /**
 * The POSIX shim body: an `exec` wrapper so the shim's process *becomes* the
 * target, and `"$@"` so arguments survive quoting intact. A Node script
@@ -26,5 +26,4 @@ const cmdShim = (target) => isNodeScript(target) ? `@echo off\r\nnode "${target}
 */
 const gitBashShim = (target) => posixShim(target.replaceAll("\\", "/"));
 
-//#endregion
 export { cmdShim, gitBashShim, posixShim };