@effected/github-actions 0.24.0 → 0.25.0

package/ActionEnvironment.js

@@ -1,3 +1,4 @@
+import { decodeJson } from "./internal/json.js";
 import { Context, Effect, FileSystem, Layer, Option, Schema } from "effect";
 
 // src/ActionEnvironment.ts
@@ -176,14 +177,11 @@ const make = (base) => Effect.gen(function* () {
 				name: "GITHUB_EVENT_PATH",
 				detail: `could not read "${path}": ${String(cause)}`
 			})));
-			return yield* Effect.try({
-				try: () => JSON.parse(raw),
-				catch: (cause) => new ActionEnvironmentError({
-					reason: "malformed",
-					name: "GITHUB_EVENT_PATH",
-					detail: `not valid JSON: ${String(cause)}`
-				})
-			});
+			return yield* decodeJson(raw).pipe(Effect.mapError((cause) => new ActionEnvironmentError({
+				reason: "malformed",
+				name: "GITHUB_EVENT_PATH",
+				detail: `not valid JSON: ${cause.message}`
+			})));
 		}),
 		withEnv: (overrides, effect) => Effect.flatMap(EnvOverrides, (current) => Effect.provideService(effect, EnvOverrides, {
 			...current,

package/ActionInput.js

@@ -1,3 +1,4 @@
+import { decodeJson } from "./internal/json.js";
 import { Config, ConfigProvider, Context, Effect, Schema, SchemaIssue } from "effect";
 
 // src/ActionInput.ts
@@ -29,7 +30,17 @@ const inputVariable = (name) => `INPUT_${name.replaceAll(" ", "_").toUpperCase()
 * mutations the author meant to rehearse. `actual` carries the offending value
 * so the rendered error names it.
 */
-const configError = (message, actual) => new Config.ConfigError(new Schema.SchemaError(new SchemaIssue.InvalidValue({ message }, actual)));
+/**
+* A `ConfigError` carrying `message` as its first issue and, when a decode
+* failed, that decode's own issue beside it, so the cause is structured
+* rather than flattened into the message.
+*/
+const configError = (message, actual, cause) => {
+	const stated = new SchemaIssue.InvalidValue({ message }, actual);
+	return new Config.ConfigError(new Schema.SchemaError(cause === void 0 ? stated : new SchemaIssue.Composite(Schema.Unknown.ast, [stated, cause.issue], actual)));
+};
+/** The JSON-array form of {@link ActionInput.list}. */
+const decodeStringArray = Schema.decodeUnknownEffect(Schema.Array(Schema.String));
 /** YAML 1.2 core-schema booleans, which is what the runner documents. */
 const TRUE = /* @__PURE__ */ new Set([
 	"true",
@@ -267,13 +278,7 @@ var ActionInput = class ActionInput {
 		return Config.String(inputVariable(name)).pipe(Config.mapEffect((raw) => {
 			const trimmed = raw.trim();
 			if (trimmed === "") return Effect.succeed([]);
-			if (trimmed.startsWith("[")) try {
-				const parsed = JSON.parse(trimmed);
-				if (Array.isArray(parsed) && parsed.every((item) => typeof item === "string")) return Effect.succeed(parsed);
-				return Effect.fail(configError(`Input "${name}" is a JSON array but not an array of strings`, raw));
-			} catch {
-				return Effect.fail(configError(`Input "${name}" looks like JSON but could not be parsed`, raw));
-			}
+			if (trimmed.startsWith("[")) return decodeJson(trimmed).pipe(Effect.mapError((cause) => configError(`Input "${name}" looks like JSON but could not be parsed`, raw, cause)), Effect.flatMap((parsed) => decodeStringArray(parsed).pipe(Effect.mapError((cause) => configError(`Input "${name}" is a JSON array but not an array of strings`, raw, cause)))));
 			const entries = trimmed.split(/[\n,]/).map((item) => item.trim()).filter((item) => !item.startsWith("#")).map((item) => item.startsWith("- ") || item.startsWith("* ") ? item.slice(2).trim() : item).filter((item) => item !== "");
 			return Effect.succeed(entries);
 		}));
@@ -332,15 +337,7 @@ var ActionInput = class ActionInput {
 	* which is exactly the missing-versus-malformed split above.
 	*/
 	static schema(name, schema) {
-		return Config.String(inputVariable(name)).pipe(Config.mapEffect((raw) => {
-			let parsed;
-			try {
-				parsed = JSON.parse(raw);
-			} catch {
-				return Effect.fail(configError(`Input "${name}" is not valid JSON`, raw));
-			}
-			return Schema.decodeUnknownEffect(schema)(parsed).pipe(Effect.mapError(() => configError(`Input "${name}" did not satisfy its schema`, parsed)));
-		}));
+		return Config.String(inputVariable(name)).pipe(Config.mapEffect((raw) => decodeJson(raw).pipe(Effect.mapError((cause) => configError(`Input "${name}" is not valid JSON`, raw, cause)), Effect.flatMap((parsed) => Schema.decodeUnknownEffect(schema)(parsed).pipe(Effect.mapError((cause) => configError(`Input "${name}" did not satisfy its schema`, parsed, cause)))))));
 	}
 	/**
 	* A `ConfigProvider` over a record of runner variables **or input names**.

package/ActionsIdentityToken.js

@@ -1,16 +1,16 @@
 import { OidcTokenIssuer } from "./OidcTokenIssuer.js";
 import { Effect, Layer } from "effect";
-import { IdentityToken, IdentityTokenError } from "@effected/sbom";
+import { IdentityToken, IdentityTokenError } from "@effected/oidc";
 
 // src/ActionsIdentityToken.ts
 /**
-* Serves `@effected/sbom`'s `IdentityToken` contract from the runner's own OIDC
+* Serves `@effected/oidc`'s `IdentityToken` contract from the runner's own OIDC
 * token service, so signing an SBOM inside a workflow needs no further wiring.
 *
 * @remarks
-* `@effected/sbom` declares `IdentityToken` — one method, one audience,
-* one redacted token — precisely so that signing does not drag the Actions
-* runtime into every consumer that only wants to emit an SBOM. This is the
+* `@effected/oidc` declares `IdentityToken` — one method, one audience,
+* one redacted token — precisely so that a consumer of a token, such as
+* `@effected/sbom`'s signer, does not drag the Actions runtime in. This is the
 * layer that closes the inversion from the other side: it serves that contract
 * from the runner's own OIDC token service ({@link OidcTokenIssuer}), the same
 * arrangement as `@effected/workspaces` implementing `@effected/commands`'

package/ActionsProvenance.js

@@ -20,12 +20,14 @@ const DEFAULT_SERVER_URL = "https://github.com";
 *
 * @remarks
 * `SlsaProvenance.forGitHubWorkflow` is total and does the real work, but it
-* takes a camelCase input record — and the only input anyone inside a workflow
-* actually holds is the runner's own OIDC claims, spelled in GitHub's
-* snake_case claim names. The rename between the two is eleven all-string
-* fields, so transposing `repository_id` and `repository_owner_id` compiles,
-* passes every type check, and produces a validly signed attestation asserting
-* the **wrong** provenance. This module owns that rename once, on the same
+* takes an all-string input record — and the only input anyone inside a
+* workflow actually holds is the runner's own OIDC claims, decoded as
+* `@effected/github`'s `ActionsOidcClaims` with integer ids. The projection
+* between the two is eleven close-cousin fields, so transposing `repositoryId`
+* and `repositoryOwnerId` compiles, passes every type check, and produces a
+* validly signed attestation asserting the **wrong** provenance. This module
+* owns that projection once, rendering the ids back to the decimal strings the
+* token carried, on the same
 * `github-actions` ↔ `sbom` seam as {@link ActionsIdentityToken}: `sbom` must
 * not depend on the Actions runtime, so the adapter lives here, beside the
 * services it reads.
@@ -55,7 +57,7 @@ var ActionsProvenance = class {
 	*
 	* @remarks
 	* Every field `GitHubWorkflowProvenance` declares is populated from
-	* {@link OidcClaims}, except `serverUrl`, which is read from
+	* the runner's `ActionsOidcClaims`, except `serverUrl`, which is read from
 	* `GITHUB_SERVER_URL` through {@link ActionEnvironment}'s `getOptional`
 	* with `https://github.com` as the default — **not** through the
 	* `GitHubContext` projection. The projection fails typed when a `GITHUB_*`
@@ -88,14 +90,14 @@ var ActionsProvenance = class {
 			repository: claims.repository,
 			ref: claims.ref,
 			sha: claims.sha,
-			eventName: claims.event_name,
-			workflowRef: claims.workflow_ref,
-			jobWorkflowRef: claims.job_workflow_ref,
-			repositoryId: claims.repository_id,
-			repositoryOwnerId: claims.repository_owner_id,
-			runnerEnvironment: claims.runner_environment,
-			runId: claims.run_id,
-			runAttempt: claims.run_attempt
+			eventName: claims.eventName,
+			workflowRef: claims.workflowRef,
+			jobWorkflowRef: claims.jobWorkflowRef,
+			repositoryId: String(claims.repositoryId),
+			repositoryOwnerId: String(claims.repositoryOwnerId),
+			runnerEnvironment: claims.runnerEnvironment,
+			runId: String(claims.runId),
+			runAttempt: String(claims.runAttempt)
 		});
 	});
 };

package/Artifact.js

@@ -7,7 +7,7 @@ import { digestFileHex } from "./internal/digest.js";
 import { isWindowsRunner } from "./internal/runner.js";
 import { spawnOnce } from "./internal/spawn.js";
 import { unzipCommand, zipCommand, zipManifest } from "./internal/archiveCommands.js";
-import { Context, Effect, FileSystem, Layer, Option, Path, Result, Schema } from "effect";
+import { Context, DateTime, Duration, Effect, FileSystem, Layer, Option, Path, Result, Schema } from "effect";
 import { HttpClient } from "effect/http";
 import { BlobClient, BlockBlobClient } from "@azure/storage-blob";
 import { ChildProcessSpawner } from "effect/process";
@@ -263,11 +263,12 @@ const make = (transfer) => Effect.gen(function* () {
 					cause
 				})));
 				const digest = yield* digestOf(packed, name);
+				const expiresAt = options?.retentionDays === void 0 ? void 0 : DateTime.formatIso(DateTime.addDuration(yield* DateTime.now, Duration.days(options.retentionDays)));
 				const finalized = yield* call("FinalizeArtifact", () => ({
 					name,
 					size: String(size.size),
 					hash: `sha256:${digest}`,
-					...options?.retentionDays === void 0 ? {} : { expiresAt: new Date(Date.now() + options.retentionDays * 864e5).toISOString() }
+					...expiresAt === void 0 ? {} : { expiresAt }
 				}), name);
 				if (finalized === CONFLICT || !isOk(finalized)) return yield* Effect.fail(new ArtifactError({
 					reason: "refused",

package/BlobStore.js

@@ -1,9 +1,9 @@
 import { unstubbed } from "./internal/unstubbed.js";
 import { BlobEnvelope } from "./BlobEnvelope.js";
-import { sign } from "./internal/sigv4.js";
 import { Secret } from "./Secret.js";
-import { Context, Effect, Layer, Option, Schema } from "effect";
+import { Context, Crypto, DateTime, Effect, Layer, Option, Schema } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/http";
+import { SigV4 } from "@effected/crypto";
 
 // src/BlobStore.ts
 /**
@@ -15,12 +15,17 @@ var BlobStoreError = class extends Schema.TaggedError()("BlobStoreError", {
 	/**
 	* `unreachable` — the store could not be contacted. `refused` — it answered,
 	* unhappily; `status` says how. `misconfigured` — the layer was built with
-	* settings the store cannot use.
+	* settings the store cannot use, or a request could not be signed with them
+	* (no WebCrypto in the runtime, or key material it refuses). `invalidKey` —
+	* the caller's key cannot be stored at all, whatever the settings: on S3, a
+	* key with a `.` or `..` path segment, which no URL carries as signed.
+	* Nothing is sent.
 	*/
 	reason: Schema.Literals([
 		"unreachable",
 		"refused",
-		"misconfigured"
+		"misconfigured",
+		"invalidKey"
 	]),
 	/** The key involved. A stable identifier, never a value. */
 	key: Schema.optionalKey(Schema.String),
@@ -35,6 +40,7 @@ var BlobStoreError = class extends Schema.TaggedError()("BlobStoreError", {
 		switch (this.reason) {
 			case "unreachable": return `The blob store could not be reached${this.key === void 0 ? "" : ` for "${this.key}"`}`;
 			case "refused": return `The blob store refused "${this.key}"${this.status === void 0 ? "" : ` with status ${this.status}`}${this.detail === void 0 ? "" : `: ${this.detail}`}`;
+			case "invalidKey": return `The blob store cannot hold the key "${this.key}"${this.detail === void 0 ? "" : `: ${this.detail}`}`;
 			default: return `The blob store is misconfigured${this.detail === void 0 ? "" : `: ${this.detail}`}`;
 		}
 	}
@@ -75,10 +81,17 @@ var BlobStore = class BlobStore extends Context.Service()("@effected/github-acti
 	* An S3-compatible backend, signed with SigV4.
 	*
 	* @remarks
-	* No `@aws-sdk/*` dependency: signing is a specified algorithm over strings
-	* and HMACs, and this package already has `node:crypto`. The SDK's weight is
-	* in credential management, retries and a service catalogue none of which
-	* this needs.
+	* No `@aws-sdk/*` dependency: signing is `@effected/crypto`'s `SigV4`, a
+	* specified algorithm over strings and HMACs. The SDK's weight is in
+	* credential management, retries and a service catalogue none of which this
+	* needs.
+	*
+	* Requires core `Crypto` for the SHA-256 digests signing takes, resolved
+	* once when the layer is built; `NodeServices.layer` supplies it. A request
+	* that cannot be signed fails as {@link BlobStoreError} `misconfigured`. A
+	* key with a `.` or `..` path segment fails as `invalidKey` before anything
+	* is signed or sent: every URL parser collapses such a segment, so the store
+	* would receive another path than the one signed.
 	*
 	* A parameterized layer factory mints a fresh layer per call and layers
 	* memoize by reference — bind it to a `const` rather than calling it at each
@@ -119,43 +132,60 @@ var BlobStore = class BlobStore extends Context.Service()("@effected/github-acti
 };
 const dies = unstubbed("BlobStore.makeTest");
 const makeS3 = (config) => Effect.gen(function* () {
-	const http = yield* HttpClient.HttpClient;
+	const http = HttpClient.transform(yield* HttpClient.HttpClient, (effect) => Effect.provideService(effect, HttpClient.TracerPropagationEnabled, false));
+	const crypto = yield* Crypto.Crypto;
 	let endpoint = config.endpoint ?? `https://s3.${config.region}.amazonaws.com`;
 	while (endpoint.endsWith("/")) endpoint = endpoint.slice(0, -1);
 	const host = new URL(endpoint).host;
-	const secretAccessKey = yield* Secret.forSigning(config.secretAccessKey);
-	const sessionToken = config.sessionToken === void 0 ? void 0 : yield* Secret.forSigning(config.sessionToken);
+	yield* Secret.mask(config.secretAccessKey);
+	if (config.sessionToken !== void 0) yield* Secret.mask(config.sessionToken);
+	const credentials = {
+		accessKeyId: config.accessKeyId,
+		secretAccessKey: config.secretAccessKey,
+		...config.sessionToken === void 0 ? {} : { sessionToken: config.sessionToken },
+		region: config.region,
+		service: "s3"
+	};
 	const objectPath = (key) => [
 		config.bucket,
 		...config.prefix === void 0 ? [] : [config.prefix],
 		key
 	].join("/").replaceAll(/\/{2,}/g, "/");
-	const request = (method, key, body) => {
+	const unsignable = (key, cause) => new BlobStoreError({
+		reason: "misconfigured",
+		key,
+		detail: "the request could not be signed",
+		cause
+	});
+	const request = (method, key, body) => Effect.gen(function* () {
 		const path = objectPath(key);
-		const headers = sign({
+		const now = yield* DateTime.now;
+		const signed = yield* SigV4.sign({
 			method,
 			path,
 			host,
-			headers: {},
 			body,
-			now: /* @__PURE__ */ new Date()
-		}, {
-			accessKeyId: config.accessKeyId,
-			secretAccessKey,
-			...sessionToken === void 0 ? {} : { sessionToken },
-			region: config.region,
-			service: "s3"
-		});
+			now
+		}, credentials).pipe(Effect.provideService(Crypto.Crypto, crypto), Effect.catchTags({
+			SigV4PathError: (cause) => Effect.fail(new BlobStoreError({
+				reason: "invalidKey",
+				key,
+				detail: `the path has a "${cause.segment}" segment, which a URL collapses, so it cannot be sent as signed`,
+				cause
+			})),
+			CryptoError: (cause) => Effect.fail(unsignable(key, cause)),
+			PlatformError: (cause) => Effect.fail(unsignable(key, cause))
+		}));
 		return {
-			url: `${endpoint}/${path}`,
-			headers
+			url: `${endpoint}${signed.path}${signed.query === "" ? "" : `?${signed.query}`}`,
+			headers: signed.headers
 		};
-	};
-	const send = (method, key, body) => Effect.suspend(() => {
-		const { url, headers } = request(method, key, body);
+	});
+	const send = (method, key, body) => Effect.gen(function* () {
+		const { url, headers } = yield* request(method, key, body);
 		const base = HttpClientRequest.make(method)(url, { headers });
 		const built = body.length === 0 ? base : HttpClientRequest.bodyUint8Array(base, body);
-		return http.execute(built).pipe(Effect.mapError((cause) => new BlobStoreError({
+		return yield* http.execute(built).pipe(Effect.mapError((cause) => new BlobStoreError({
 			reason: "unreachable",
 			key,
 			cause

package/OidcTokenIssuer.js

@@ -1,8 +1,10 @@
 import { ActionEnvironment } from "./ActionEnvironment.js";
 import { unstubbed } from "./internal/unstubbed.js";
-import { payloadOf, unsignedJwt } from "./internal/jwt.js";
 import { Context, Effect, Layer, Redacted, Schema } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/http";
+import { Oidc } from "@effected/oidc";
+import { ActionsOidcClaimsFromWire } from "@effected/github";
+import * as Base64Url from "effect/encoding/Base64Url";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
 
 // src/OidcTokenIssuer.ts
@@ -45,44 +47,6 @@ var OidcTokenError = class extends Schema.TaggedError()("OidcTokenError", {
 		}
 	}
 };
-/**
-* The claims a GitHub Actions OIDC token carries about the workflow that ran.
-*
-* @remarks
-* The field names are GitHub's own JWT claim names, kept verbatim rather than
-* translated to the kit's casing. They are an **external vocabulary** — the
-* same strings that appear in a SLSA provenance predicate and in every
-* published example of an Actions OIDC policy — and renaming them would put a
-* translation layer between a consumer and the specification they are reading.
-*
-* @public
-*/
-var OidcClaims = class extends Schema.Class("OidcClaims")({
-	/** The issuer, e.g. `https://token.actions.githubusercontent.com`. */
-	iss: Schema.String,
-	/** The full ref the workflow ran on. */
-	ref: Schema.String,
-	/** The commit. */
-	sha: Schema.String,
-	/** `owner/repo`. */
-	repository: Schema.String,
-	/** The event that triggered the run. */
-	event_name: Schema.String,
-	/** The reusable-workflow ref, which is what a verifier pins against. */
-	job_workflow_ref: Schema.String,
-	/** The calling workflow's ref. */
-	workflow_ref: Schema.String,
-	/** The numeric repository id, as a string. */
-	repository_id: Schema.String,
-	/** The numeric owner id, as a string. */
-	repository_owner_id: Schema.String,
-	/** `github-hosted` or `self-hosted`. */
-	runner_environment: Schema.String,
-	/** The run id, as a string. */
-	run_id: Schema.String,
-	/** The run attempt, as a string. */
-	run_attempt: Schema.String
-}) {};
 /** The token envelope the runner's token service answers with. */
 const TokenEnvelope = Schema.Struct({
 	value: Schema.String,
@@ -97,16 +61,23 @@ const REQUEST_URL = "ACTIONS_ID_TOKEN_REQUEST_URL";
 * The absence of verification is deliberate and is documented on
 * {@link OidcTokenIssuerShape.claims}; do not "fix" it here.
 */
-const readClaims = (token) => Effect.gen(function* () {
-	const decoded = yield* Effect.fromResult(payloadOf(token)).pipe(Effect.mapError((failure) => new OidcTokenError({
-		reason: "malformedToken",
-		...failure
-	})));
-	return yield* Schema.decodeUnknownEffect(OidcClaims)(decoded).pipe(Effect.mapError((cause) => new OidcTokenError({
-		reason: "missingClaims",
-		cause
-	})));
-});
+const readClaims = (token) => Oidc.decodeUnverified(token, ActionsOidcClaimsFromWire).pipe(Effect.mapError((error) => error.reason === "claims" ? new OidcTokenError({
+	reason: "missingClaims",
+	cause: error.cause ?? error
+}) : new OidcTokenError({
+	reason: "malformedToken",
+	detail: error.detail,
+	cause: error
+})));
+/**
+* An **unsigned** JWT: `header.payload.unsigned`, each JSON segment
+* base64url-encoded. For test doubles only; the signature segment is a
+* placeholder, so the token fails any verifier.
+*/
+const unsignedJwt = (header, payload) => {
+	const segment = (value) => Base64Url.encode(JSON.stringify(value));
+	return `${segment(header)}.${segment(payload)}.unsigned`;
+};
 const make = Effect.gen(function* () {
 	const env = yield* ActionEnvironment;
 	const http = yield* HttpClient.HttpClient;
@@ -166,7 +137,7 @@ const dies = unstubbed("OidcTokenIssuer.makeTest");
 * const program = Effect.gen(function* () {
 *   const issuer = yield* OidcTokenIssuer;
 *   const claims = yield* issuer.claims("sigstore");
-*   return claims.job_workflow_ref;
+*   return claims.jobWorkflowRef;
 * });
 * ```
 *
@@ -193,7 +164,7 @@ var OidcTokenIssuer = class OidcTokenIssuer extends Context.Service()("@effected
 	static unsignedTokenFor = (claims) => Redacted.make(unsignedJwt({
 		alg: "RS256",
 		typ: "JWT"
-	}, Schema.encodeUnknownSync(OidcClaims)(claims)));
+	}, Schema.encodeSync(ActionsOidcClaimsFromWire)(claims)));
 	/** A test double. Unstubbed members die rather than answering with a non-token. */
 	static makeTest = (overrides = {}) => ({
 		token: () => dies("token"),
@@ -218,4 +189,4 @@ var OidcTokenIssuer = class OidcTokenIssuer extends Context.Service()("@effected
 	});
 };
 
-export { OidcClaims, OidcTokenError, OidcTokenIssuer };
+export { OidcTokenError, OidcTokenIssuer };

package/PackageManagerInstaller.js

@@ -1,7 +1,7 @@
 import { ActionEnvironment } from "./ActionEnvironment.js";
 import { unstubbed } from "./internal/unstubbed.js";
 import { digestFileHex } from "./internal/digest.js";
-import { isWindowsRunner } from "./internal/runner.js";
+import { isWindowsRunner, runnerArch } from "./internal/runner.js";
 import { typeAt } from "./internal/fsProbe.js";
 import { PNPM_EXE_PREFIX, detectMusl, isNodeScript, pnpmExeTarget, strongestSri } from "./internal/pnpmExe.js";
 import { cmdShim, gitBashShim, posixShim } from "./internal/shim.js";
@@ -12,6 +12,17 @@ import { CorepackIntegrityHash, DEFAULT_REGISTRY, PackageManagerPin, PackageMana
 
 // src/PackageManagerInstaller.ts
 /**
+* The two `package.json` members the installer reads, as JSON text decoded to
+* an object. Both stay `unknown`: they are attacker-supplied, and their own
+* normalizers decide what survives.
+*/
+const decodeManifest = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({
+	bin: Schema.optionalKey(Schema.Unknown),
+	optionalDependencies: Schema.optionalKey(Schema.Unknown)
+})));
+/** A packument's `dist.integrity`, left `unknown` for `expectedFromSri` to judge. */
+const decodePackument = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ dist: Schema.optionalKey(Schema.Struct({ integrity: Schema.optionalKey(Schema.Unknown) })) })));
+/**
 * Raised when a package manager cannot be provisioned on the runner.
 *
 * @public
@@ -202,11 +213,6 @@ const normalizeBins = (bin, fallbackName) => {
 	}
 	return Object.keys(entries).length === 0 ? Option.none() : Option.some(entries);
 };
-/** Map a `RUNNER_ARCH` value (`X64`, `ARM64`) onto the Node arch spelling. */
-const archFromRunner = (runnerArch) => {
-	const lowered = runnerArch.toLowerCase();
-	return lowered === "x64" || lowered === "arm64" ? lowered : runnerArch;
-};
 const make = Effect.gen(function* () {
 	const env = yield* ActionEnvironment;
 	const fs = yield* FileSystem.FileSystem;
@@ -214,10 +220,7 @@ const make = Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	const installer = yield* ToolInstaller;
 	const runnerOs = yield* Effect.map(env.getOptional("RUNNER_OS"), (found) => Option.getOrElse(found, () => ""));
-	const arch = yield* Effect.map(env.getOptional("RUNNER_ARCH"), (found) => Option.match(found, {
-		onNone: () => process.arch,
-		onSome: archFromRunner
-	}));
+	const arch = yield* runnerArch(env);
 	const windows = yield* isWindowsRunner(env);
 	const musl = detectMusl();
 	const bunBinaryName = windows ? "bun.exe" : "bun";
@@ -305,14 +308,11 @@ const make = Effect.gen(function* () {
 			subject: "no package.json",
 			cause
 		})));
-		const manifest = yield* Effect.try({
-			try: () => JSON.parse(raw),
-			catch: (cause) => errorFor(pin)({
-				reason: "layoutUnexpected",
-				subject: "unparseable package.json",
-				cause
-			})
-		});
+		const manifest = yield* decodeManifest(raw).pipe(Effect.mapError((cause) => errorFor(pin)({
+			reason: "layoutUnexpected",
+			subject: "unparseable package.json",
+			cause
+		})));
 		const bins = Option.getOrUndefined(normalizeBins(manifest.bin, pin.name));
 		if (bins === void 0) return yield* Effect.fail(errorFor(pin)({
 			reason: "layoutUnexpected",
@@ -458,10 +458,7 @@ const make = Effect.gen(function* () {
 			subject: packumentUrl,
 			cause
 		});
-		const packument = yield* fs.readFileString(packumentFile).pipe(Effect.mapError(unverifiable), Effect.flatMap((raw) => Effect.try({
-			try: () => JSON.parse(raw),
-			catch: unverifiable
-		})));
+		const packument = yield* fs.readFileString(packumentFile).pipe(Effect.mapError(unverifiable), Effect.flatMap((raw) => decodePackument(raw).pipe(Effect.mapError(unverifiable))));
 		return yield* expectedFromSri(pin, packument.dist?.integrity, packumentUrl);
 	});
 	/**

package/README.md

@@ -155,7 +155,7 @@ Two decisions make that safe for any segment value, with no prefix reasoning at
 
 `CacheKey.hashFiles` is byte-compatible with `@actions/glob`'s `hashFiles`, and `OidcTokenIssuer.claims` decodes the runner's OIDC token for a SLSA provenance predicate without verifying its signature — the token arrived over TLS from the runner's own token service, so the transport is the trust boundary and nothing here branches on the claims for authorization.
 
-`ActionsProvenance.capture` turns those claims into an `@effected/sbom` `SlsaProvenance` predicate, and `ActionsIdentityToken.layer` serves that package's narrow `IdentityToken` contract from the same issuer — the inversion that keeps the Actions runtime out of every consumer that only wants to emit an SBOM:
+`ActionsProvenance.capture` turns those claims into an `@effected/sbom` `SlsaProvenance` predicate, and `ActionsIdentityToken.layer` serves `@effected/oidc`'s narrow `IdentityToken` contract, which that package's signer consumes, from the same issuer — the inversion that keeps the Actions runtime out of every consumer that only wants to emit an SBOM:
 
 ```ts
 import { ActionsIdentityToken, ActionsProvenance, OidcTokenIssuer } from "@effected/github-actions";
@@ -303,13 +303,13 @@ const TestOutputs = ActionOutputs.layerTest({
 - `ActionCache` / `Artifact` — the runner's cache and artifact protocols over Twirp v2, excluded from the default runtime so a consumer that skips them never links Azure.
 - `CacheKey` — cache keys and their restore-key ladder, `withNamespace(segment)` for a bust token or a shared-runner prefix, plus `hashFiles`/`matchingFiles`/`hashMatching` byte-compatible with `@actions/glob`.
 - `OidcTokenIssuer` — the runner's OIDC token service, with unverified claim decoding for provenance predicates.
-- `ActionsIdentityToken` / `ActionsProvenance` — the `@effected/sbom` seam: `layer` serves that package's `IdentityToken` contract from the runner's issuer, and `capture` builds a `SlsaProvenance` predicate out of the runner's OIDC claims.
+- `ActionsIdentityToken` / `ActionsProvenance` — the `@effected/sbom` seam: `layer` serves `@effected/oidc`'s `IdentityToken` contract from the runner's issuer, and `capture` builds a `SlsaProvenance` predicate out of the runner's OIDC claims.
 - `GitHubMarkdown` — the escaping-safe writer for GitHub surfaces: `table`, `tableFor(schema)`, `heading`, `link`, `code`, `codeBlock`, `list`, `details` and `raw`, and the package's only importer of `@effected/markdown`.
 - `ManagedDocument` — marker-delimited named regions in text a human also edits, for a sticky comment or a managed pull request description; content outside the regions survives byte-for-byte, and each region can carry marker metadata that round-trips through `entry(key)` without ever addressing the region.
 - `CheckState` / `projectCheckState` — the kit's check vocabulary, wider than GitHub's conclusions, and its projection onto the check-run wire form.
 - `CheckDocument` — the debounced check-to-document reconciler: report states as they change, and one write lands carrying the final one. `stamp` plus a readable sink lets two runs share one document, dropping a strictly older run's pass instead of clobbering the newer one; `flush` reports `written`, `unchanged` or `stale`.
 - `ToolInstaller` — download, extract and cache a toolchain in the runner's tool cache, with no `@actions/tool-cache` dependency; `ToolInstallerError` always names its `subject`.
-- `BlobStore` — durable `get`/`put`/`has` over `StoredBlob<A>` values (bytes plus caller-schema metadata; the type was named `Blob<A>` before, which collided with the global), backed by `layerS3` (SigV4-signed, no `@aws-sdk/*` dependency) or `GitHubCacheBlobStore.layer` (the runner's own cache); `layerMemory` runs the real envelope framing for tests.
+- `BlobStore` — durable `get`/`put`/`has` over `StoredBlob<A>` values (bytes plus caller-schema metadata; the type was named `Blob<A>` before, which collided with the global), backed by `layerS3` (SigV4-signed through `@effected/crypto`, so it needs core `Crypto` in `R`; no `@aws-sdk/*` dependency) or `GitHubCacheBlobStore.layer` (the runner's own cache); `layerMemory` runs the real envelope framing for tests.
 
 ## License
 

package/Secret.js

@@ -94,9 +94,13 @@ var Secret = class Secret {
 	* Declassify one secret for an in-process use that needs the raw bytes.
 	*
 	* @remarks
-	* Request signing is the case this exists for: an HMAC cannot be computed
-	* over a `Redacted`, so a signing key has to become a string somewhere, and
-	* the point of this module is that "somewhere" is here and nowhere else.
+	* For a consumer that must hand the raw key to code taking a plain string,
+	* such as a third-party signing library. A signer that takes a `Redacted`
+	* needs no declassification at all: `@effected/crypto`'s `SigV4` and `Hmac`
+	* unwrap the key only where they compute, so a caller of those (this
+	* package's own S3 `BlobStore` is one) registers the value with
+	* {@link Secret.mask} and passes the `Redacted` on. No module in this
+	* package calls this member any more.
 	*
 	* Signing named the member; it does not gate it. **Any in-process use that
 	* needs the raw value without writing it to a runner file is this
@@ -121,9 +125,9 @@ var Secret = class Secret {
 	* `::add-mask::` command only masks when the runner parses this process's
 	* stdout; a detached worker's stdout is a log file no runner parses, so
 	* there the command masks nothing *and* spells the plaintext into the log.
-	* A worker that signs (an S3-style `BlobStore` is the canonical case) must compose
-	* `ActionOutputs.layerDetached`, under which this member still returns the
-	* raw key for the HMAC but the mask is a documented no-op; the masking
+	* A worker that signs must compose `ActionOutputs.layerDetached`, under
+	* which this member still returns the raw key but the mask is a
+	* documented no-op; the masking
 	* itself is the **parent's** job, done before the spawn via
 	* {@link Secret.forChildEnv} under the real layer.
 	*/

package/ToolInstaller.js

@@ -1,6 +1,6 @@
 import { ActionEnvironment } from "./ActionEnvironment.js";
 import { unstubbed } from "./internal/unstubbed.js";
-import { isWindowsRunner, toolCacheRoot } from "./internal/runner.js";
+import { isWindowsRunner, runnerArch, toolCacheRoot } from "./internal/runner.js";
 import { spawnOnce } from "./internal/spawn.js";
 import { tarExtractCommand, unzipCommand } from "./internal/archiveCommands.js";
 import { isErrno, typeAt } from "./internal/fsProbe.js";
@@ -68,11 +68,12 @@ const make = Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	const root = yield* toolCacheRoot(env, path);
 	const windows = yield* isWindowsRunner(env);
+	const arch = yield* runnerArch(env);
 	const cachePath = (tool, version) => ToolInstaller.cachePath({
 		root,
 		tool,
 		version,
-		arch: process.arch
+		arch
 	});
 	const destinationFor = (options) => {
 		const requested = options?.destination;

package/index.d.ts

@@ -1,10 +1,11 @@
 import { AnnotationProperties, AnnotationProperties as AnnotationProperties$1, WorkflowCommand } from "@effected/github-commands";
 import { NodeServices } from "@effect/platform-node";
-import { Cause, Config, ConfigProvider, Context, Duration, Effect, FileSystem, Layer, Logger, Option, Path, Redacted, Result, Schema } from "effect";
+import { Cause, Config, ConfigProvider, Context, Crypto, Duration, Effect, FileSystem, Layer, Logger, Option, Path, Redacted, Result, Schema } from "effect";
 import { HttpClient } from "effect/http";
 import { ChildProcessSpawner } from "effect/process";
-import { IdentityToken, SlsaProvenance } from "@effected/sbom";
-import { BotIdentity, GitHubApp, GitHubClient, InstallationToken, PermissionLevel, RetryPolicy } from "@effected/github";
+import { IdentityToken } from "@effected/oidc";
+import { ActionsOidcClaims, BotIdentity, GitHubApp, GitHubClient, InstallationToken, PermissionLevel, RetryPolicy } from "@effected/github";
+import { SlsaProvenance } from "@effected/sbom";
 import { IntegrityHashBrand, PackageManagerPin } from "@effected/npm";
 declare const ActionEnvironmentError_base: Schema.Class<ActionEnvironmentError, Schema.TaggedStruct<"ActionEnvironmentError", {
   /** `missing` — absent or empty; `malformed` — present but unusable. */
@@ -1953,45 +1954,6 @@ declare const OidcTokenError_base: Schema.Class<OidcTokenError, Schema.TaggedStr
 export declare class OidcTokenError extends OidcTokenError_base {
   get message(): string;
 }
-declare const OidcClaims_base: Schema.Class<OidcClaims, Schema.Struct<{
-  /** The issuer, e.g. `https://token.actions.githubusercontent.com`. */
-  readonly iss: Schema.String;
-  /** The full ref the workflow ran on. */
-  readonly ref: Schema.String;
-  /** The commit. */
-  readonly sha: Schema.String;
-  /** `owner/repo`. */
-  readonly repository: Schema.String;
-  /** The event that triggered the run. */
-  readonly event_name: Schema.String;
-  /** The reusable-workflow ref, which is what a verifier pins against. */
-  readonly job_workflow_ref: Schema.String;
-  /** The calling workflow's ref. */
-  readonly workflow_ref: Schema.String;
-  /** The numeric repository id, as a string. */
-  readonly repository_id: Schema.String;
-  /** The numeric owner id, as a string. */
-  readonly repository_owner_id: Schema.String;
-  /** `github-hosted` or `self-hosted`. */
-  readonly runner_environment: Schema.String;
-  /** The run id, as a string. */
-  readonly run_id: Schema.String;
-  /** The run attempt, as a string. */
-  readonly run_attempt: Schema.String;
-}>, {}>;
-/**
- * The claims a GitHub Actions OIDC token carries about the workflow that ran.
- *
- * @remarks
- * The field names are GitHub's own JWT claim names, kept verbatim rather than
- * translated to the kit's casing. They are an **external vocabulary** — the
- * same strings that appear in a SLSA provenance predicate and in every
- * published example of an Actions OIDC policy — and renaming them would put a
- * translation layer between a consumer and the specification they are reading.
- *
- * @public
- */
-export declare class OidcClaims extends OidcClaims_base {}
 /**
  * The members of the {@link OidcTokenIssuer} service: request an ID `token`
  * and read its decoded `claims`, both failing with {@link OidcTokenError}.
@@ -2009,7 +1971,8 @@ interface OidcTokenIssuerShape {
    */
   readonly token: (audience?: string) => Effect.Effect<Redacted.Redacted<string>, OidcTokenError>;
   /**
-   * The token's claims, decoded.
+   * The token's claims, decoded into `@effected/github`'s `ActionsOidcClaims`,
+   * the same class `ActionsOidc.verify` returns.
    *
    * @remarks
    * **The signature is deliberately not verified**, for three reasons that are
@@ -2034,7 +1997,7 @@ interface OidcTokenIssuerShape {
    * a test cannot silently skip the path under test because the double
    * returned a token that is not a JWT.
    */
-  readonly claims: (audience?: string) => Effect.Effect<OidcClaims, OidcTokenError>;
+  readonly claims: (audience?: string) => Effect.Effect<ActionsOidcClaims, OidcTokenError>;
 }
 declare const OidcTokenIssuer_base: Context.ServiceClass<OidcTokenIssuer, "@effected/github-actions/OidcTokenIssuer", OidcTokenIssuerShape>;
 /**
@@ -2054,7 +2017,7 @@ declare const OidcTokenIssuer_base: Context.ServiceClass<OidcTokenIssuer, "@effe
  * const program = Effect.gen(function* () {
  *   const issuer = yield* OidcTokenIssuer;
  *   const claims = yield* issuer.claims("sigstore");
- *   return claims.job_workflow_ref;
+ *   return claims.jobWorkflowRef;
  * });
  * ```
  *
@@ -2078,7 +2041,7 @@ export declare class OidcTokenIssuer extends OidcTokenIssuer_base {
    * double returning a synthetic non-JWT would make the provenance path
    * structurally unreachable in a test.
    */
-  static readonly unsignedTokenFor: (claims: OidcClaims) => Redacted.Redacted<string>;
+  static readonly unsignedTokenFor: (claims: ActionsOidcClaims) => Redacted.Redacted<string>;
   /** A test double. Unstubbed members die rather than answering with a non-token. */
   static readonly makeTest: (overrides?: Partial<OidcTokenIssuerShape>) => OidcTokenIssuerShape;
   /** {@link OidcTokenIssuer.makeTest} behind `Layer.succeed`. */
@@ -2093,16 +2056,16 @@ export declare class OidcTokenIssuer extends OidcTokenIssuer_base {
    * members can disagree is how a test proves a path works while production
    * takes the other one.
    */
-  static readonly layerFor: (claims: OidcClaims) => Layer.Layer<OidcTokenIssuer>;
+  static readonly layerFor: (claims: ActionsOidcClaims) => Layer.Layer<OidcTokenIssuer>;
 }
 /**
- * Serves `@effected/sbom`'s `IdentityToken` contract from the runner's own OIDC
+ * Serves `@effected/oidc`'s `IdentityToken` contract from the runner's own OIDC
  * token service, so signing an SBOM inside a workflow needs no further wiring.
  *
  * @remarks
- * `@effected/sbom` declares `IdentityToken` — one method, one audience,
- * one redacted token — precisely so that signing does not drag the Actions
- * runtime into every consumer that only wants to emit an SBOM. This is the
+ * `@effected/oidc` declares `IdentityToken` — one method, one audience,
+ * one redacted token — precisely so that a consumer of a token, such as
+ * `@effected/sbom`'s signer, does not drag the Actions runtime in. This is the
  * layer that closes the inversion from the other side: it serves that contract
  * from the runner's own OIDC token service ({@link OidcTokenIssuer}), the same
  * arrangement as `@effected/workspaces` implementing `@effected/commands`'
@@ -2152,12 +2115,14 @@ export declare class ActionsIdentityToken {
  *
  * @remarks
  * `SlsaProvenance.forGitHubWorkflow` is total and does the real work, but it
- * takes a camelCase input record — and the only input anyone inside a workflow
- * actually holds is the runner's own OIDC claims, spelled in GitHub's
- * snake_case claim names. The rename between the two is eleven all-string
- * fields, so transposing `repository_id` and `repository_owner_id` compiles,
- * passes every type check, and produces a validly signed attestation asserting
- * the **wrong** provenance. This module owns that rename once, on the same
+ * takes an all-string input record — and the only input anyone inside a
+ * workflow actually holds is the runner's own OIDC claims, decoded as
+ * `@effected/github`'s `ActionsOidcClaims` with integer ids. The projection
+ * between the two is eleven close-cousin fields, so transposing `repositoryId`
+ * and `repositoryOwnerId` compiles, passes every type check, and produces a
+ * validly signed attestation asserting the **wrong** provenance. This module
+ * owns that projection once, rendering the ids back to the decimal strings the
+ * token carried, on the same
  * `github-actions` ↔ `sbom` seam as {@link ActionsIdentityToken}: `sbom` must
  * not depend on the Actions runtime, so the adapter lives here, beside the
  * services it reads.
@@ -2187,7 +2152,7 @@ export declare class ActionsProvenance {
    *
    * @remarks
    * Every field `GitHubWorkflowProvenance` declares is populated from
-   * {@link OidcClaims}, except `serverUrl`, which is read from
+   * the runner's `ActionsOidcClaims`, except `serverUrl`, which is read from
    * `GITHUB_SERVER_URL` through {@link ActionEnvironment}'s `getOptional`
    * with `https://github.com` as the default — **not** through the
    * `GitHubContext` projection. The projection fails typed when a `GITHUB_*`
@@ -2548,9 +2513,13 @@ declare const BlobStoreError_base: Schema.Class<BlobStoreError, Schema.TaggedStr
   /**
    * `unreachable` — the store could not be contacted. `refused` — it answered,
    * unhappily; `status` says how. `misconfigured` — the layer was built with
-   * settings the store cannot use.
+   * settings the store cannot use, or a request could not be signed with them
+   * (no WebCrypto in the runtime, or key material it refuses). `invalidKey` —
+   * the caller's key cannot be stored at all, whatever the settings: on S3, a
+   * key with a `.` or `..` path segment, which no URL carries as signed.
+   * Nothing is sent.
    */
-  readonly reason: Schema.Literals<readonly ["unreachable", "refused", "misconfigured"]>;
+  readonly reason: Schema.Literals<readonly ["unreachable", "refused", "misconfigured", "invalidKey"]>;
   /** The key involved. A stable identifier, never a value. */
   readonly key: Schema.optionalKey<Schema.String>;
   /** The HTTP status, when the store answered. */
@@ -2665,16 +2634,23 @@ export declare class BlobStore extends BlobStore_base {
    * An S3-compatible backend, signed with SigV4.
    *
    * @remarks
-   * No `@aws-sdk/*` dependency: signing is a specified algorithm over strings
-   * and HMACs, and this package already has `node:crypto`. The SDK's weight is
-   * in credential management, retries and a service catalogue none of which
-   * this needs.
+   * No `@aws-sdk/*` dependency: signing is `@effected/crypto`'s `SigV4`, a
+   * specified algorithm over strings and HMACs. The SDK's weight is in
+   * credential management, retries and a service catalogue none of which this
+   * needs.
+   *
+   * Requires core `Crypto` for the SHA-256 digests signing takes, resolved
+   * once when the layer is built; `NodeServices.layer` supplies it. A request
+   * that cannot be signed fails as {@link BlobStoreError} `misconfigured`. A
+   * key with a `.` or `..` path segment fails as `invalidKey` before anything
+   * is signed or sent: every URL parser collapses such a segment, so the store
+   * would receive another path than the one signed.
    *
    * A parameterized layer factory mints a fresh layer per call and layers
    * memoize by reference — bind it to a `const` rather than calling it at each
    * composition site.
    */
-  static readonly layerS3: (config: S3Config) => Layer.Layer<BlobStore, never, HttpClient.HttpClient | ActionOutputs>;
+  static readonly layerS3: (config: S3Config) => Layer.Layer<BlobStore, never, HttpClient.HttpClient | ActionOutputs | Crypto.Crypto>;
   /** A test double. Unstubbed members die rather than reporting a miss. */
   static readonly makeTest: (overrides?: Partial<BlobStoreShape>) => BlobStoreShape;
   /** {@link BlobStore.makeTest} behind `Layer.succeed`. */
@@ -4988,9 +4964,13 @@ export declare class Secret {
    * Declassify one secret for an in-process use that needs the raw bytes.
    *
    * @remarks
-   * Request signing is the case this exists for: an HMAC cannot be computed
-   * over a `Redacted`, so a signing key has to become a string somewhere, and
-   * the point of this module is that "somewhere" is here and nowhere else.
+   * For a consumer that must hand the raw key to code taking a plain string,
+   * such as a third-party signing library. A signer that takes a `Redacted`
+   * needs no declassification at all: `@effected/crypto`'s `SigV4` and `Hmac`
+   * unwrap the key only where they compute, so a caller of those (this
+   * package's own S3 `BlobStore` is one) registers the value with
+   * {@link Secret.mask} and passes the `Redacted` on. No module in this
+   * package calls this member any more.
    *
    * Signing named the member; it does not gate it. **Any in-process use that
    * needs the raw value without writing it to a runner file is this
@@ -5015,9 +4995,9 @@ export declare class Secret {
    * `::add-mask::` command only masks when the runner parses this process's
    * stdout; a detached worker's stdout is a log file no runner parses, so
    * there the command masks nothing *and* spells the plaintext into the log.
-   * A worker that signs (an S3-style `BlobStore` is the canonical case) must compose
-   * `ActionOutputs.layerDetached`, under which this member still returns the
-   * raw key for the HMAC but the mask is a documented no-op; the masking
+   * A worker that signs must compose `ActionOutputs.layerDetached`, under
+   * which this member still returns the raw key but the mask is a
+   * documented no-op; the masking
    * itself is the **parent's** job, done before the spawn via
    * {@link Secret.forChildEnv} under the real layer.
    */

package/index.js

@@ -6,7 +6,7 @@ import { ActionState, ActionStateError } from "./ActionState.js";
 import { Action, ActionRuntime, describeCause } from "./Action.js";
 import { BlobTransferError } from "./BlobTransfer.js";
 import { ActionCache, ActionCacheError } from "./ActionCache.js";
-import { OidcClaims, OidcTokenError, OidcTokenIssuer } from "./OidcTokenIssuer.js";
+import { OidcTokenError, OidcTokenIssuer } from "./OidcTokenIssuer.js";
 import { ActionsIdentityToken } from "./ActionsIdentityToken.js";
 import { ActionsProvenance } from "./ActionsProvenance.js";
 import { Artifact, ArtifactError } from "./Artifact.js";
@@ -27,4 +27,4 @@ import { ToolInstaller, ToolInstallerError } from "./ToolInstaller.js";
 import { AmbientPackageManager, CachedPackageManager, InstalledPackageManager, PackageManagerInstaller, PackageManagerInstallerError } from "./PackageManagerInstaller.js";
 import { WorkflowCommand } from "@effected/github-commands";
 
-export { Action, ActionCache, ActionCacheError, ActionEnvironment, ActionEnvironmentError, ActionInput, ActionLogger, ActionOutputs, ActionRuntime, ActionState, ActionStateError, ActionsIdentityToken, ActionsProvenance, AmbientPackageManager, Artifact, ArtifactError, BlobEnvelope, BlobMetadataDecodeError, BlobMetadataEncodeError, BlobStore, BlobStoreError, BlobTransferError, CacheKey, CacheKeyBadPatternError, CacheKeyReadError, CachedPackageManager, CheckDocument, CheckDocumentError, CheckDocumentStamp, CheckReport, CheckState, ChildEnv, DetachedLogUnavailableError, DetachedNotReadyError, DetachedOutputError, DetachedProcess, DetachedSignalFailedError, DetachedSpawnFailedError, DryRun, GitHubCacheBlobStore, GitHubContext, GitHubMarkdown, GitHubToken, GitHubTokenError, InstalledPackageManager, InvalidOutputNameError, InvalidPidError, ManagedDocument, ManagedDocumentError, NotABlobEnvelopeError, OidcClaims, OidcTokenError, OidcTokenIssuer, OutputEncodeError, PackageManagerInstaller, PackageManagerInstallerError, ProcessId, RecordedOutput, RunnerContext, RunnerFileUnavailableError, RunnerFileWriteError, Secret, ToolInstaller, ToolInstallerError, TruncatedBlobEnvelopeError, UnsupportedBlobEnvelopeVersionError, WorkflowCommand, describeCause, projectCheckState };
+export { Action, ActionCache, ActionCacheError, ActionEnvironment, ActionEnvironmentError, ActionInput, ActionLogger, ActionOutputs, ActionRuntime, ActionState, ActionStateError, ActionsIdentityToken, ActionsProvenance, AmbientPackageManager, Artifact, ArtifactError, BlobEnvelope, BlobMetadataDecodeError, BlobMetadataEncodeError, BlobStore, BlobStoreError, BlobTransferError, CacheKey, CacheKeyBadPatternError, CacheKeyReadError, CachedPackageManager, CheckDocument, CheckDocumentError, CheckDocumentStamp, CheckReport, CheckState, ChildEnv, DetachedLogUnavailableError, DetachedNotReadyError, DetachedOutputError, DetachedProcess, DetachedSignalFailedError, DetachedSpawnFailedError, DryRun, GitHubCacheBlobStore, GitHubContext, GitHubMarkdown, GitHubToken, GitHubTokenError, InstalledPackageManager, InvalidOutputNameError, InvalidPidError, ManagedDocument, ManagedDocumentError, NotABlobEnvelopeError, OidcTokenError, OidcTokenIssuer, OutputEncodeError, PackageManagerInstaller, PackageManagerInstallerError, ProcessId, RecordedOutput, RunnerContext, RunnerFileUnavailableError, RunnerFileWriteError, Secret, ToolInstaller, ToolInstallerError, TruncatedBlobEnvelopeError, UnsupportedBlobEnvelopeVersionError, WorkflowCommand, describeCause, projectCheckState };

package/internal/actionsResults.js

@@ -1,5 +1,5 @@
-import { payloadOf } from "./jwt.js";
 import { Effect, Option, Redacted, Result } from "effect";
+import { Jws } from "@effected/jwt";
 
 // src/internal/actionsResults.ts
 /** The variable naming the backend. Absent outside a `uses:` step. */
@@ -26,9 +26,10 @@ const misconfiguredDetail = (variable, service) => `${variable} is not set — t
 * @internal
 */
 const backendIdsFrom = (token) => {
-	const payload = payloadOf(token);
-	if (Result.isFailure(payload)) return Result.fail(`the runtime token is not a readable JWT: ${payload.failure.detail}`);
-	const scope = payload.success?.scp;
+	const decoded = Jws.decodeUnverified(token);
+	if (Result.isFailure(decoded)) return Result.fail(`the runtime token is not a readable JWT: ${decoded.failure.detail}`);
+	const payload = decoded.success.payload;
+	const scope = typeof payload === "object" && payload !== null ? payload.scp : void 0;
 	if (typeof scope !== "string") return Result.fail("the runtime token carries no `scp` claim");
 	for (const entry of scope.split(" ")) {
 		const parts = entry.split(":");

package/internal/json.js

@@ -0,0 +1,11 @@
+import { Schema } from "effect";
+
+// src/internal/json.ts
+/**
+* Parse JSON text to an unknown value, failing with a `SchemaError` on text that is not JSON.
+*
+* @internal
+*/
+const decodeJson = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown));
+
+export { decodeJson };

package/internal/runner.js

@@ -26,5 +26,25 @@ const isWindowsRunner = (env) => Effect.map(env.getOptional("RUNNER_OS"), (found
 * @internal
 */
 const toolCacheRoot = (env, path) => Effect.map(env.getOptional("RUNNER_TOOL_CACHE"), (found) => Option.getOrElse(found, () => path.join("/tmp", "runner-tool-cache")));
+/** `RUNNER_ARCH`'s spellings (`X86`, `X64`, `ARM`, `ARM64`), lower-cased, in Node's `process.arch` spelling. */
+const NODE_ARCH = /* @__PURE__ */ new Map([
+	["x86", "ia32"],
+	["x64", "x64"],
+	["arm", "arm"],
+	["arm64", "arm64"]
+]);
+/** A `RUNNER_ARCH` value in Node's spelling; anything unrecognised passes through. */
+const archFromRunner = (runnerArch) => NODE_ARCH.get(runnerArch.toLowerCase()) ?? runnerArch;
+/**
+* The host architecture in Node's spelling: `RUNNER_ARCH` mapped through
+* `archFromRunner`, or `process.arch` off a runner, where the variable is
+* absent and the host's own answer is the honest fallback.
+*
+* @internal
+*/
+const runnerArch = (env) => Effect.map(env.getOptional("RUNNER_ARCH"), (found) => Option.match(found, {
+	onNone: () => process.arch,
+	onSome: archFromRunner
+}));
 
-export { isWindowsRunner, toolCacheRoot };
+export { isWindowsRunner, runnerArch, toolCacheRoot };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github-actions",
-	"version": "0.24.0",
+	"version": "0.25.0",
 	"private": false,
 	"description": "The GitHub Actions runtime: env, inputs, outputs, state, logging, cache, artifacts, blob storage, OIDC and the token bridge.",
 	"keywords": [
@@ -39,12 +39,15 @@
 	},
 	"dependencies": {
 		"@azure/storage-blob": "^12.33.0",
-		"@effected/github": "^0.22.0",
+		"@effected/crypto": "^0.1.0",
+		"@effected/github": "^0.23.0",
 		"@effected/github-commands": "^0.6.0",
 		"@effected/glob": "^0.14.0",
+		"@effected/jwt": "^0.5.0",
 		"@effected/markdown": "^0.20.0",
-		"@effected/npm": "^0.24.0",
-		"@effected/sbom": "^0.14.0",
+		"@effected/npm": "^0.25.0",
+		"@effected/oidc": "^0.1.0",
+		"@effected/sbom": "^0.15.0",
 		"@effected/semver": "^0.15.0",
 		"@effected/templates": "^0.14.0",
 		"@effected/walker": "^0.19.0"

package/internal/jwt.js

@@ -1,41 +0,0 @@
-import { Result } from "effect";
-import * as Base64Url from "effect/encoding/Base64Url";
-
-// src/internal/jwt.ts
-/**
-* The decoded payload of `token` — the middle segment, base64url JSON —
-* without any check on the signature.
-*
-* @internal
-*/
-const payloadOf = (token) => {
-	const segments = token.split(".");
-	const payload = segments[1];
-	if (segments.length !== 3 || payload === void 0 || payload === "") return Result.fail({ detail: `expected three segments, got ${segments.length}` });
-	const json = Base64Url.decodeString(payload);
-	if (Result.isFailure(json)) return Result.fail({
-		detail: "the payload is not base64url JSON",
-		cause: json.failure
-	});
-	try {
-		return Result.succeed(JSON.parse(json.success));
-	} catch (cause) {
-		return Result.fail({
-			detail: "the payload is not base64url JSON",
-			cause
-		});
-	}
-};
-/**
-* An **unsigned** JWT: `header.payload.unsigned`, each JSON segment
-* base64url-encoded. For building test doubles and nothing else — the
-* signature segment is a placeholder, so this token fails any verifier.
-*
-* @internal
-*/
-const unsignedJwt = (header, payload) => {
-	const segment = (value) => Base64Url.encode(JSON.stringify(value));
-	return `${segment(header)}.${segment(payload)}.unsigned`;
-};
-
-export { payloadOf, unsignedJwt };

package/internal/sigv4.js

@@ -1,114 +0,0 @@
-import { sha256Hex } from "./digest.js";
-import { createHmac } from "node:crypto";
-
-// src/internal/sigv4.ts
-/**
-* AWS Signature Version 4, for S3-compatible object stores.
-*
-* @remarks
-* **Pure**, and about a hundred lines, which is the whole argument for not
-* taking an `@aws-sdk/*` dependency to obtain it. Signing is a specified
-* algorithm over strings and HMACs; the SDK around it exists to manage
-* credentials, retries and a service catalogue this package does not want.
-*
-* `node:crypto` rather than core `Crypto` because core's `Crypto` offers only
-* one-shot SHA digests over bytes already in memory — no HMAC, no incremental
-* hasher (see `internal/digest.ts`, this package's other `node:crypto`
-* licence). This package is the one place in the kit where a `node:` import
-* is sanctioned, and this is one of the four reasons.
-*
-* @internal
-*/
-const ALGORITHM = "AWS4-HMAC-SHA256";
-const hmac = (key, value) => new Uint8Array(createHmac("sha256", key).update(value).digest());
-/**
-* Percent-encode one path segment the way SigV4 requires.
-*
-* @remarks
-* `encodeURIComponent` leaves `!'()*` alone and AWS does not, so a key
-* containing any of them signs one string and requests another — which fails as
-* an opaque `SignatureDoesNotMatch` rather than as anything that names the
-* character. The unreserved set is exactly `A-Za-z0-9-_.~`.
-*/
-const uriEncode = (value) => encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
-/** `20130524T000000Z` and `20130524`, the two forms the algorithm uses. */
-const timestamps = (now) => {
-	const amzDate = `${now.toISOString().replace(/[:-]|\.\d{3}/g, "").slice(0, 15)}Z`;
-	return {
-		amzDate,
-		dateStamp: amzDate.slice(0, 8)
-	};
-};
-/**
-* Assemble the headers that will be signed, and the canonical request over them.
-*
-* @remarks
-* Exported separately from {@link sign} so a test can pin it against AWS's
-* **own documented** canonical request rather than against this
-* implementation's output.
-*/
-const canonicalize = (request, credentials) => {
-	const { amzDate, dateStamp } = timestamps(request.now);
-	const payloadHash = sha256Hex(request.body);
-	const headers = {
-		...request.headers,
-		host: request.host,
-		"x-amz-date": amzDate,
-		"x-amz-content-sha256": payloadHash,
-		...credentials.sessionToken === void 0 ? {} : { "x-amz-security-token": credentials.sessionToken }
-	};
-	const lowered = new Map(Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value]));
-	const canonicalNames = [...lowered.keys()].sort();
-	const canonicalHeaders = canonicalNames.map((name) => `${name}:${(lowered.get(name) ?? "").trim().replace(/\s+/g, " ")}\n`).join("");
-	const signedHeaders = canonicalNames.join(";");
-	const canonicalPath = `/${request.path.split("/").filter((segment) => segment !== "").map(uriEncode).join("/")}`;
-	return {
-		headers,
-		signedHeaders,
-		amzDate,
-		dateStamp,
-		canonicalRequest: [
-			request.method,
-			canonicalPath,
-			"",
-			canonicalHeaders,
-			signedHeaders,
-			payloadHash
-		].join("\n")
-	};
-};
-/**
-* Derive a signing key.
-*
-* @remarks
-* Four nested HMACs over date, region, service and the literal `aws4_request`.
-* Exported so a test can reproduce AWS's documented derivation example.
-*/
-const signingKey = (secretAccessKey, dateStamp, region, service) => hmac(hmac(hmac(hmac(`AWS4${secretAccessKey}`, dateStamp), region), service), "aws4_request");
-/**
-* Sign a request, returning the headers to send.
-*
-* @remarks
-* The returned record is the caller's headers **plus** everything signing added
-* — `host`, `x-amz-date`, `x-amz-content-sha256`, the optional
-* `x-amz-security-token` and `authorization` — so a caller sends exactly what
-* was signed rather than assembling a second, subtly different set.
-*/
-const sign = (request, credentials) => {
-	const { headers, canonicalRequest, signedHeaders, amzDate, dateStamp } = canonicalize(request, credentials);
-	const scope = `${dateStamp}/${credentials.region}/${credentials.service}/aws4_request`;
-	const stringToSign = [
-		ALGORITHM,
-		amzDate,
-		scope,
-		sha256Hex(canonicalRequest)
-	].join("\n");
-	const key = signingKey(credentials.secretAccessKey, dateStamp, credentials.region, credentials.service);
-	const signature = Buffer.from(hmac(key, stringToSign)).toString("hex");
-	return {
-		...headers,
-		authorization: `${ALGORITHM} Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
-	};
-};
-
-export { canonicalize, sha256Hex as digestHex, sign, signingKey, uriEncode };