@effected/github 0.21.0 → 0.23.0

package/ActionsOidc.js

@@ -1,7 +1,7 @@
-import { JwksResolver, Jwt, JwtError } from "@effected/jwt";
+import { Oidc } from "@effected/oidc";
 import { Effect, Schema, SchemaTransformation } from "effect";
 
-//#region src/ActionsOidc.ts
+// src/ActionsOidc.ts
 /** The issuer of every GitHub Actions OIDC token on github.com. */
 const ISSUER = "https://token.actions.githubusercontent.com";
 /**
@@ -23,6 +23,10 @@ const IdFromString = Schema.String.check(Schema.isPattern(/^\d+$/)).pipe(Schema.
 *
 * Claims GitHub adds that are not modelled here are dropped on decode.
 *
+* To decode a payload as it arrives in the token (snake_case keys, string
+* ids), use {@link ActionsOidcClaimsFromWire}; this class itself decodes the
+* camelCase form.
+*
 * @public
 */
 var ActionsOidcClaims = class extends Schema.Class("ActionsOidcClaims")({
@@ -71,8 +75,28 @@ var ActionsOidcClaims = class extends Schema.Class("ActionsOidcClaims")({
 	/** `github-hosted` or `self-hosted` (wire key `runner_environment`). */
 	runnerEnvironment: Schema.String
 }) {};
-/** The claims as they arrive in the token: snake_case keys, decoding to {@link ActionsOidcClaims}. */
-const ClaimsFromWire = ActionsOidcClaims.pipe(Schema.encodeKeys({
+/**
+* {@link ActionsOidcClaims} as the claims arrive in the token: snake_case
+* keys and string ids, decoding to the class and encoding back to the wire.
+*
+* @remarks
+* The codec {@link ActionsOidc.verify} decodes a verified payload with.
+* Exported for reading a token this process already trusts, such as one the
+* runner's own token service just issued, and for building one: encoding an
+* instance yields the exact payload GitHub would sign.
+*
+* @example
+* ```ts
+* import { ActionsOidcClaimsFromWire } from "@effected/github";
+* import { Oidc } from "@effected/oidc";
+*
+* // Unverified: only for a token handed over by a trusted runtime.
+* const read = (token: string) => Oidc.decodeUnverified(token, ActionsOidcClaimsFromWire);
+* ```
+*
+* @public
+*/
+const ActionsOidcClaimsFromWire = ActionsOidcClaims.pipe(Schema.encodeKeys({
 	repositoryId: "repository_id",
 	repositoryOwner: "repository_owner",
 	repositoryOwnerId: "repository_owner_id",
@@ -85,16 +109,11 @@ const ClaimsFromWire = ActionsOidcClaims.pipe(Schema.encodeKeys({
 	runnerEnvironment: "runner_environment"
 }));
 const verify = Effect.fn("ActionsOidc.verify")(function* (token, options) {
-	if (options.audience.length === 0) return yield* new JwtError({
-		reason: "wrongAudience",
-		detail: "no audience was given; an Actions OIDC token is never verified without one"
-	});
-	return yield* Jwt.verify(token, {
-		key: JwksResolver.forIssuer(ISSUER),
-		claims: ClaimsFromWire,
+	return yield* Oidc.verify(token, {
 		issuer: ISSUER,
 		audience: options.audience,
-		...options.clockTolerance !== void 0 ? { clockTolerance: options.clockTolerance } : {}
+		claims: ActionsOidcClaimsFromWire,
+		clockTolerance: options.clockTolerance
 	});
 });
 const testClaims = (overrides = {}) => ({
@@ -122,8 +141,9 @@ const testClaims = (overrides = {}) => ({
 * repository, workflow and run it is.
 *
 * @remarks
-* {@link ActionsOidc.verify} checks the signature against GitHub's published
-* JWKS (through `@effected/jwt`'s `JwksResolver`, which caches it), then `iss`,
+* {@link ActionsOidc.verify} is `@effected/oidc`'s `Oidc.verify` pinned to the
+* Actions issuer: it checks the signature against GitHub's published JWKS
+* (through `@effected/jwt`'s `JwksResolver`, which caches it), then `iss`,
 * `aud`, `exp`, `nbf` and `iat`, then decodes the payload into
 * {@link ActionsOidcClaims}. Every failure is a `JwtError`; route on its
 * `reason` (`wrongAudience`, `expired`, `claims`, ...), never on its message.
@@ -141,7 +161,8 @@ const testClaims = (overrides = {}) => ({
 * are refused as `wrongIssuer`.
 *
 * This module does not reach octokit: a service that only verifies tokens
-* links `@effected/jwt` and nothing else from this package.
+* links `@effected/oidc` and `@effected/jwt` and nothing else from this
+* package.
 *
 * @example
 * ```ts
@@ -176,5 +197,4 @@ const ActionsOidc = {
 	testClaims
 };
 
-//#endregion
-export { ActionsOidc, ActionsOidcClaims };
+export { ActionsOidc, ActionsOidcClaims, ActionsOidcClaimsFromWire };

package/ArtifactMetadata.js

@@ -2,7 +2,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer, Schema } from "effect";
 
-//#region src/ArtifactMetadata.ts
+// src/ArtifactMetadata.ts
 /**
 * What to record about a published artifact.
 *
@@ -62,5 +62,4 @@ const make = (client) => ({ createStorageRecord: Effect.fn("ArtifactMetadata.cre
 	})).storage_records ?? []).flatMap((record) => typeof record.id === "number" ? [record.id] : []);
 }) });
 
-//#endregion
 export { ArtifactMetadata, StorageRecordInput };

package/Attestation.js

@@ -2,7 +2,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer, Schema } from "effect";
 
-//#region src/Attestation.ts
+// src/Attestation.ts
 /**
 * The api-version this surface pins.
 *
@@ -108,5 +108,4 @@ const make = (client) => ({
 	})
 });
 
-//#endregion
 export { Attestation, AttestationListEntry, AttestationRecord };

package/AuthenticatedApp.js

@@ -3,7 +3,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { numericId } from "./internal/ids.js";
 import { Context, Effect, Layer, Schema, Stream } from "effect";
 
-//#region src/AuthenticatedApp.ts
+// src/AuthenticatedApp.ts
 /**
 * The GitHub App itself, as `GET /app` reports it.
 *
@@ -179,5 +179,4 @@ const make = (client) => ({
 	})
 });
 
-//#endregion
 export { AppInfo, AuthenticatedApp, DeliveryAttempt };

package/CheckRun.js

@@ -4,7 +4,7 @@ import { Repo } from "./Repo.js";
 import { numericId } from "./internal/ids.js";
 import { Cause, Context, DateTime, Effect, Exit, Layer, Option, Ref, Schema } from "effect";
 
-//#region src/CheckRun.ts
+// src/CheckRun.ts
 /** How a check run finished. @public */
 const CheckConclusion = Schema.Literals([
 	"success",
@@ -526,5 +526,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { Annotation, AnnotationLevel, CheckConclusion, CheckRun, CheckRunOutput, CheckRunRef, CheckRunStatus, ReportedCheckConclusion, ReportedCheckRunOutput };

package/CodeScanning.js

@@ -2,7 +2,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer } from "effect";
 
-//#region src/CodeScanning.ts
+// src/CodeScanning.ts
 /**
 * Configure CodeQL default setup and read the languages GitHub detects in a
 * repository.
@@ -83,5 +83,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { CodeScanning };

package/DeploymentEnvironment.js

@@ -2,7 +2,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer } from "effect";
 
-//#region src/DeploymentEnvironment.ts
+// src/DeploymentEnvironment.ts
 /**
 * Create or update, list and delete a repository's deployment environments.
 *
@@ -89,5 +89,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { DeploymentEnvironment };

package/GitBranch.js

@@ -4,7 +4,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer, Option, Schema } from "effect";
 
-//#region src/GitBranch.ts
+// src/GitBranch.ts
 const CreateLinkedBranch = GraphQLDocument.make({
 	name: "createLinkedBranch",
 	document: `mutation ($issueId: ID!, $name: String!, $oid: GitObjectID!, $repositoryId: ID!) {
@@ -186,5 +186,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { GitBranch };

package/GitCommit.js

@@ -2,7 +2,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer, Schema } from "effect";
 
-//#region src/GitCommit.ts
+// src/GitCommit.ts
 /**
 * A blob's file mode, as the Git Database API spells it.
 *
@@ -199,5 +199,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { CommitRef, FileChange, FileContent, FileDeletion, FileMode, GitCommit };

package/GitHubApp.js

@@ -3,10 +3,10 @@ import { GitHubGraphQLError } from "./GraphQL.js";
 import { GitHubClient, makeClientShape } from "./GitHubClient.js";
 import { numericId } from "./internal/ids.js";
 import { InstallationTokenStore } from "./InstallationTokenStore.js";
-import { Jwt, JwtKey } from "@effected/jwt";
 import { Cause, Clock, Context, DateTime, Deferred, Duration, Effect, Layer, Option, Redacted, Ref, Schema, Semaphore, Stream } from "effect";
+import { Jwt, JwtKey } from "@effected/jwt";
 
-//#region src/GitHubApp.ts
+// src/GitHubApp.ts
 /**
 * A GitHub App call failed.
 *
@@ -683,5 +683,4 @@ const makeRotatingClient = (mint, release, options, operation) => Effect.gen(fun
 	};
 });
 
-//#endregion
 export { AppIdentity, BotIdentity, BotUser, GitHubApp, GitHubAppError, Installation, InstallationToken };

package/GitHubClient.js

@@ -5,7 +5,7 @@ import { makeTransport } from "./internal/octokit.js";
 import { fromArray, paginate } from "./internal/paginate.js";
 import { Clock, Config, Context, Effect, Layer, Option, Schema, Stream } from "effect";
 
-//#region src/GitHubClient.ts
+// src/GitHubClient.ts
 /** GitHub's own maximum page size, and the default this package requests. */
 const DEFAULT_PER_PAGE = 100;
 /**
@@ -276,5 +276,4 @@ const makeFixture = (fixtures) => {
 	};
 };
 
-//#endregion
 export { GitHubClient, GitHubFixtures, RawFailure, makeClientShape };

package/GitHubCommit.js

@@ -3,7 +3,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer, Option, Schema, Stream } from "effect";
 
-//#region src/GitHubCommit.ts
+// src/GitHubCommit.ts
 /**
 * A commit, projected to what callers read.
 *
@@ -227,5 +227,4 @@ const make = (client) => ({
 	})
 });
 
-//#endregion
 export { CommitComparison, CommitFile, CommitSummary, FileStatus, GitHubCommit, fileOf };

package/GitHubContent.js

@@ -4,7 +4,7 @@ import { Repo } from "./Repo.js";
 import { Context, Effect, Layer, Option, Result } from "effect";
 import * as Base64 from "effect/encoding/Base64";
 
-//#region src/GitHubContent.ts
+// src/GitHubContent.ts
 /**
 * Non-fatal, matching `Buffer`'s lenient decode of a non-UTF-8 file; `ignoreBOM`
 * keeps a leading BOM, since it is the file's content rather than framing.
@@ -76,5 +76,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { GitHubContent };

package/GitHubError.js

@@ -1,7 +1,7 @@
 import { headerNumber, retryAfterMillisFrom } from "./internal/headers.js";
 import { Schema } from "effect";
 
-//#region src/GitHubError.ts
+// src/GitHubError.ts
 /**
 * Why a GitHub call failed, as a value you can branch on.
 *
@@ -371,5 +371,4 @@ const readRateLimitHeaders = (headers) => {
 	};
 };
 
-//#endregion
 export { GitHubError, GitHubErrorKind, GitHubValidationCode, GitHubValidationEntry, readRateLimitHeaders };

package/GitHubIssue.js

@@ -5,7 +5,7 @@ import { numericId } from "./internal/ids.js";
 import { CommentRecord } from "./PullRequestComment.js";
 import { Context, Effect, Layer, Schema } from "effect";
 
-//#region src/GitHubIssue.ts
+// src/GitHubIssue.ts
 /**
 * An issue, projected to what callers read.
 *
@@ -314,5 +314,4 @@ const make = (client) => ({
 	})
 });
 
-//#endregion
 export { CommentOnceResult, GitHubIssue, IssueInfo, LinkedIssue };

package/GitHubRelease.js

@@ -3,7 +3,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer, Option, Schema } from "effect";
 
-//#region src/GitHubRelease.ts
+// src/GitHubRelease.ts
 /**
 * A release, projected to the fields callers read.
 *
@@ -203,5 +203,4 @@ const make = (client) => {
 /** Release assets do not go to the API host. */
 const UPLOADS_BASE_URL = "https://uploads.github.com";
 
-//#endregion
 export { GitHubRelease, ReleaseAsset, ReleaseInfo };

package/GitHubRepository.js

@@ -3,7 +3,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer, Schema } from "effect";
 
-//#region src/GitHubRepository.ts
+// src/GitHubRepository.ts
 /**
 * A {@link RepositoryPatch} from a draft, dropping every explicitly-`undefined`
 * field.
@@ -288,5 +288,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { GRAPHQL_ONLY_SETTINGS, GitHubRepository, SECURITY_ANALYSIS_STATUS_FIELDS, repositoryPatch, transformSecurityAndAnalysis };

package/GitTag.js

@@ -4,7 +4,7 @@ import { Repo } from "./Repo.js";
 import { Context, Effect, Layer, Option, Result, Schema, Stream } from "effect";
 import { SemVer } from "@effected/semver";
 
-//#region src/GitTag.ts
+// src/GitTag.ts
 /** How many annotated-tag dereferences to follow before giving up. */
 const MAX_TAG_PEEL = 5;
 /**
@@ -205,5 +205,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { GitTag, SemverTag, TagRef, versionFromTag };

package/GraphQL.js

@@ -1,7 +1,7 @@
 import { retryAfterMillisFrom } from "./internal/headers.js";
 import { Schema } from "effect";
 
-//#region src/GraphQL.ts
+// src/GraphQL.ts
 /**
 * One entry from a GraphQL response's `errors` array.
 *
@@ -182,5 +182,4 @@ var GraphQLDocument = class GraphQLDocument {
 	}
 };
 
-//#endregion
 export { GitHubGraphQLError, GraphQLDocument, GraphQLErrorEntry };

package/InstallationTokenStore.js

@@ -1,6 +1,6 @@
 import { Clock, Context, Duration, Effect, Layer, Option, Ref } from "effect";
 
-//#region src/InstallationTokenStore.ts
+// src/InstallationTokenStore.ts
 /**
 * Where `GitHubApp.cachedToken` keeps installation tokens between request
 * scopes.
@@ -47,5 +47,4 @@ var InstallationTokenStore = class InstallationTokenStore extends Context.Servic
 	static layerTest = (overrides = {}) => Layer.succeed(InstallationTokenStore, InstallationTokenStore.makeTest(overrides));
 };
 
-//#endregion
 export { InstallationTokenStore };

package/PullRequest.js

@@ -6,7 +6,7 @@ import { fileOf } from "./GitHubCommit.js";
 import { PageOptions } from "./Rest.js";
 import { Context, DateTime, Effect, Layer, Option, Schema } from "effect";
 
-//#region src/PullRequest.ts
+// src/PullRequest.ts
 /** How a pull request is merged. @public */
 const MergeMethod = Schema.Literals([
 	"merge",
@@ -332,5 +332,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { MergeMethod, PullRequest, PullRequestInfo };

package/PullRequestComment.js

@@ -3,7 +3,7 @@ import { Repo } from "./Repo.js";
 import { numericId } from "./internal/ids.js";
 import { Context, Effect, Layer, Option, Schema } from "effect";
 
-//#region src/PullRequestComment.ts
+// src/PullRequestComment.ts
 /**
 * The hidden marker that makes a comment findable again.
 *
@@ -147,5 +147,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { CommentMarker, CommentRecord, PullRequestComment };

package/Repo.js

@@ -1,6 +1,6 @@
 import { Config, Context, Effect, Layer, Result, Schema } from "effect";
 
-//#region src/Repo.ts
+// src/Repo.ts
 /**
 * A repository slug was not `owner/repo`.
 *
@@ -111,5 +111,4 @@ var Repo = class Repo extends Context.Service()("@effected/github/Repo") {
 	static provide = (ref) => (effect) => Effect.provideService(effect, Repo, ref);
 };
 
-//#endregion
 export { InvalidRepoRefError, Repo, RepoRef };

package/RepositorySecret.js

@@ -4,7 +4,7 @@ import { Repo } from "./Repo.js";
 import { encryptSecret } from "./internal/crypto.js";
 import { Context, Effect, Layer, Redacted, Result } from "effect";
 
-//#region src/RepositorySecret.ts
+// src/RepositorySecret.ts
 const ROUTES = {
 	actions: {
 		publicKey: "GET /repos/{owner}/{repo}/actions/secrets/public-key",
@@ -200,5 +200,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { RepositorySecret };

package/RepositorySecurity.js

@@ -2,7 +2,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer } from "effect";
 
-//#region src/RepositorySecurity.ts
+// src/RepositorySecurity.ts
 /**
 * Read and toggle Dependabot alerts, Dependabot security fixes and private
 * vulnerability reporting.
@@ -156,5 +156,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { RepositorySecurity };

package/RepositoryVariable.js

@@ -2,7 +2,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer } from "effect";
 
-//#region src/RepositoryVariable.ts
+// src/RepositoryVariable.ts
 /**
 * Create or update, list and delete Actions variables on a repository and on
 * its environments.
@@ -188,5 +188,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { RepositoryVariable };

package/Resilience.js

@@ -1,6 +1,6 @@
 import { Duration, Effect, Random, Schedule, Schema } from "effect";
 
-//#region src/Resilience.ts
+// src/Resilience.ts
 /**
 * What GitHub's rate-limit headers said on the most recent REST response.
 *
@@ -144,5 +144,4 @@ var RetryPolicy = class RetryPolicy extends Schema.Class("RetryPolicy")({
 	}
 };
 
-//#endregion
 export { RateLimitSnapshot, RetryPolicy };

package/Rest.js

@@ -1,6 +1,6 @@
 import { Schema } from "effect";
 
-//#region src/Rest.ts
+// src/Rest.ts
 /**
 * How far a paginated read should go.
 *
@@ -41,5 +41,4 @@ var PageOptions = class PageOptions extends Schema.Class("PageOptions")({
 	}
 };
 
-//#endregion
 export { PageOptions };

package/Ruleset.js

@@ -3,7 +3,7 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { Context, Effect, Layer } from "effect";
 
-//#region src/Ruleset.ts
+// src/Ruleset.ts
 /**
 * Create or update, list and delete repository rulesets, and look up the team
 * and role ids their bypass actors need.
@@ -160,5 +160,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { Ruleset };

package/TokenPermissions.js

@@ -1,6 +1,6 @@
 import { Effect, Schema } from "effect";
 
-//#region src/TokenPermissions.ts
+// src/TokenPermissions.ts
 /**
 * How much access a permission grants.
 *
@@ -181,5 +181,4 @@ granted: Schema.Record(Schema.String, PermissionLevel) }) {
 	}
 };
 
-//#endregion
 export { ExtraPermission, PermissionGap, PermissionLevel, PermissionResult, TokenPermissionError, TokenPermissions };

package/WorkflowDispatch.js

@@ -3,9 +3,9 @@ import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
 import { numericId } from "./internal/ids.js";
 import { PageOptions } from "./Rest.js";
-import { Clock, Context, Duration, Effect, Layer, Option, Schedule, Schema } from "effect";
+import { Context, DateTime, Duration, Effect, Layer, Option, Schedule, Schema } from "effect";
 
-//#region src/WorkflowDispatch.ts
+// src/WorkflowDispatch.ts
 /**
 * Where a workflow run has got to.
 *
@@ -205,7 +205,7 @@ const make = (client) => {
 				ref,
 				attempts
 			});
-			const dispatchedAt = new Date(yield* Clock.currentTimeMillis).toISOString();
+			const dispatchedAt = yield* Effect.map(DateTime.now, DateTime.formatIso);
 			const dispatched = yield* dispatchWithRun(workflow, ref, options?.inputs);
 			const findRun = Option.isSome(dispatched) ? Effect.map(runStatus(dispatched.value.runId), Option.some) : Effect.gen(function* () {
 				const match = (yield* client.paginate("GET /repos/{owner}/{repo}/actions/runs", {
@@ -230,5 +230,4 @@ const make = (client) => {
 	};
 };
 
-//#endregion
 export { DispatchedRun, WorkflowDispatch, WorkflowRunStatus };

package/index.d.ts

@@ -4,7 +4,6 @@ import { Cause, Config, Context, Duration, Effect, Layer, Option, Redacted, Resu
 import { PaginatingEndpoints } from "@octokit/plugin-paginate-rest";
 import { Endpoints, RequestHeaders } from "@octokit/types";
 import { SemVer } from "@effected/semver";
-//#region src/ActionsOidc.d.ts
 declare const ActionsOidcClaims_base: Schema.Class<ActionsOidcClaims, Schema.Struct<{
   /** The issuer: always {@link ActionsOidc.issuer} once verified. */
   readonly iss: Schema.String;
@@ -64,9 +63,46 @@ declare const ActionsOidcClaims_base: Schema.Class<ActionsOidcClaims, Schema.Str
  *
  * Claims GitHub adds that are not modelled here are dropped on decode.
  *
+ * To decode a payload as it arrives in the token (snake_case keys, string
+ * ids), use {@link ActionsOidcClaimsFromWire}; this class itself decodes the
+ * camelCase form.
+ *
  * @public
  */
 export declare class ActionsOidcClaims extends ActionsOidcClaims_base {}
+/**
+ * {@link ActionsOidcClaims} as the claims arrive in the token: snake_case
+ * keys and string ids, decoding to the class and encoding back to the wire.
+ *
+ * @remarks
+ * The codec {@link ActionsOidc.verify} decodes a verified payload with.
+ * Exported for reading a token this process already trusts, such as one the
+ * runner's own token service just issued, and for building one: encoding an
+ * instance yields the exact payload GitHub would sign.
+ *
+ * @example
+ * ```ts
+ * import { ActionsOidcClaimsFromWire } from "@effected/github";
+ * import { Oidc } from "@effected/oidc";
+ *
+ * // Unverified: only for a token handed over by a trusted runtime.
+ * const read = (token: string) => Oidc.decodeUnverified(token, ActionsOidcClaimsFromWire);
+ * ```
+ *
+ * @public
+ */
+export declare const ActionsOidcClaimsFromWire: Schema.encodeKeys<typeof ActionsOidcClaims, {
+  readonly repositoryId: "repository_id";
+  readonly repositoryOwner: "repository_owner";
+  readonly repositoryOwnerId: "repository_owner_id";
+  readonly runId: "run_id";
+  readonly runAttempt: "run_attempt";
+  readonly workflowRef: "workflow_ref";
+  readonly jobWorkflowRef: "job_workflow_ref";
+  readonly eventName: "event_name";
+  readonly actorId: "actor_id";
+  readonly runnerEnvironment: "runner_environment";
+}>;
 /**
  * Options for {@link ActionsOidc.verify}.
  *
@@ -88,8 +124,9 @@ interface ActionsOidcVerifyOptions {
  * repository, workflow and run it is.
  *
  * @remarks
- * {@link ActionsOidc.verify} checks the signature against GitHub's published
- * JWKS (through `@effected/jwt`'s `JwksResolver`, which caches it), then `iss`,
+ * {@link ActionsOidc.verify} is `@effected/oidc`'s `Oidc.verify` pinned to the
+ * Actions issuer: it checks the signature against GitHub's published JWKS
+ * (through `@effected/jwt`'s `JwksResolver`, which caches it), then `iss`,
  * `aud`, `exp`, `nbf` and `iat`, then decodes the payload into
  * {@link ActionsOidcClaims}. Every failure is a `JwtError`; route on its
  * `reason` (`wrongAudience`, `expired`, `claims`, ...), never on its message.
@@ -107,7 +144,8 @@ interface ActionsOidcVerifyOptions {
  * are refused as `wrongIssuer`.
  *
  * This module does not reach octokit: a service that only verifies tokens
- * links `@effected/jwt` and nothing else from this package.
+ * links `@effected/oidc` and `@effected/jwt` and nothing else from this
+ * package.
  *
  * @example
  * ```ts
@@ -153,8 +191,6 @@ export declare const ActionsOidc: {
    */
   readonly testClaims: (overrides?: Readonly<Record<string, unknown>>) => Record<string, unknown>;
 };
-//#endregion
-//#region src/GitHubError.d.ts
 /**
  * Why a GitHub call failed, as a value you can branch on.
  *
@@ -342,8 +378,6 @@ export declare class GitHubError extends GitHubError_base {
    */
   static hasValidationCode(...codes: ReadonlyArray<(typeof GitHubValidationCode.literals)[number]>): (error: GitHubError) => boolean;
 }
-//#endregion
-//#region src/GraphQL.d.ts
 declare const GraphQLErrorEntry_base: Schema.Class<GraphQLErrorEntry, Schema.Struct<{
   /** GitHub's prose. */
   readonly message: Schema.String;
@@ -469,8 +503,6 @@ export declare class GraphQLDocument<A, V extends Record<string, unknown>> {
     readonly response: Schema.Codec<A, I>;
   }): <V extends Record<string, unknown>>(encodeVariables?: (variables: V) => Record<string, unknown>) => GraphQLDocument<A, V>;
 }
-//#endregion
-//#region src/Resilience.d.ts
 declare const RateLimitSnapshot_base: Schema.Class<RateLimitSnapshot, Schema.Struct<{
   /** Requests left in the current window. */
   readonly remaining: Schema.Int;
@@ -599,8 +631,6 @@ export declare class RetryPolicy extends RetryPolicy_base {
    */
   schedule<E extends RetryableFailure>(): Schedule.Schedule<number, E>;
 }
-//#endregion
-//#region src/Rest.d.ts
 /**
  * Every REST route GitHub documents, as a `"<METHOD> <path>"` literal — for
  * example `"GET /repos/{owner}/{repo}"`.
@@ -722,8 +752,6 @@ export declare class PageOptions extends PageOptions_base {
    */
   static first(perPage: number): PageOptions;
 }
-//#endregion
-//#region src/GitHubClient.d.ts
 /**
  * The typed GitHub transport: one request, one paginated read, one GraphQL
  * document, and whatever the rate-limit headers last said.
@@ -1067,8 +1095,6 @@ export declare class GitHubClient extends GitHubClient_base {
    */
   static readonly layerFixture: (fixtures: GitHubFixtures) => Layer.Layer<GitHubClient>;
 }
-//#endregion
-//#region src/Repo.d.ts
 declare const InvalidRepoRefError_base: Schema.Class<InvalidRepoRefError, Schema.TaggedStruct<"InvalidRepoRefError", {
   /** What was handed in. */
   readonly input: Schema.String;
@@ -1172,8 +1198,6 @@ export declare class Repo extends Repo_base {
   /** Run `effect` against a different repository. */
   static readonly provide: (ref: RepoRef) => <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, Exclude<R, Repo>>;
 }
-//#endregion
-//#region src/ArtifactMetadata.d.ts
 declare const StorageRecordInput_base: Schema.Class<StorageRecordInput, Schema.Struct<{
   /** The artifact's package URL (purl). */
   readonly name: Schema.NonEmptyString;
@@ -1230,8 +1254,6 @@ export declare class ArtifactMetadata extends ArtifactMetadata_base {
   /** {@link ArtifactMetadata.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<ArtifactMetadataShape>) => Layer.Layer<ArtifactMetadata>;
 }
-//#endregion
-//#region src/Attestation.d.ts
 declare const AttestationRecord_base: Schema.Class<AttestationRecord, Schema.Struct<{
   /** GitHub's id for it, when the response carried one. */
   readonly id: Schema.optionalKey<Schema.Int>;
@@ -1300,8 +1322,6 @@ export declare class Attestation extends Attestation_base {
   /** {@link Attestation.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<AttestationShape>) => Layer.Layer<Attestation>;
 }
-//#endregion
-//#region src/AuthenticatedApp.d.ts
 declare const AppInfo_base: Schema.Class<AppInfo, Schema.Struct<{
   /** The app's numeric id. */
   readonly id: Schema.Int;
@@ -1495,8 +1515,6 @@ export declare class AuthenticatedApp extends AuthenticatedApp_base {
   /** {@link AuthenticatedApp.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<AuthenticatedAppShape>) => Layer.Layer<AuthenticatedApp>;
 }
-//#endregion
-//#region src/CheckRun.d.ts
 /** How a check run finished. @public */
 export declare const CheckConclusion: Schema.Literals<readonly ["success", "failure", "neutral", "cancelled", "timed_out", "action_required", "skipped"]>;
 /**
@@ -1902,8 +1920,6 @@ export declare class CheckRun extends CheckRun_base {
   /** {@link CheckRun.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<CheckRunShape>) => Layer.Layer<CheckRun>;
 }
-//#endregion
-//#region src/CodeScanning.d.ts
 /**
  * A CodeQL default-setup configuration.
  *
@@ -1992,8 +2008,6 @@ export declare class CodeScanning extends CodeScanning_base {
   /** {@link CodeScanning.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<CodeScanningShape>) => Layer.Layer<CodeScanning>;
 }
-//#endregion
-//#region src/DeploymentEnvironment.d.ts
 /**
  * A deployment environment, as listing returns it.
  *
@@ -2071,8 +2085,6 @@ export declare class DeploymentEnvironment extends DeploymentEnvironment_base {
   /** {@link DeploymentEnvironment.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<DeploymentEnvironmentShape>) => Layer.Layer<DeploymentEnvironment>;
 }
-//#endregion
-//#region src/GitBranch.d.ts
 /**
  * What {@link GitBranchShape.upsert} did.
  *
@@ -2185,8 +2197,6 @@ export declare class GitBranch extends GitBranch_base {
   /** {@link GitBranch.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<GitBranchShape>) => Layer.Layer<GitBranch>;
 }
-//#endregion
-//#region src/GitCommit.d.ts
 /**
  * A blob's file mode, as the Git Database API spells it.
  *
@@ -2323,8 +2333,6 @@ export declare class GitCommit extends GitCommit_base {
   /** {@link GitCommit.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<GitCommitShape>) => Layer.Layer<GitCommit>;
 }
-//#endregion
-//#region src/InstallationTokenStore.d.ts
 /**
  * The operations of an {@link InstallationTokenStore}.
  *
@@ -2369,8 +2377,6 @@ export declare class InstallationTokenStore extends InstallationTokenStore_base
   /** {@link InstallationTokenStore.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<InstallationTokenStoreShape>) => Layer.Layer<InstallationTokenStore>;
 }
-//#endregion
-//#region src/GitHubApp.d.ts
 declare const GitHubAppError_base: Schema.Class<GitHubAppError, Schema.TaggedStruct<"GitHubAppError", {
   /** Which step failed. */
   readonly kind: Schema.Literals<readonly ["jwt", "token", "revoke", "identity", "installation"]>;
@@ -2942,8 +2948,6 @@ interface GitHubAppShape {
    */
   readonly cachedToken: (request: CachedTokenRequest) => Effect.Effect<CachedToken, GitHubAppError, InstallationTokenStore>;
 }
-//#endregion
-//#region src/GitHubCommit.d.ts
 declare const CommitSummary_base: Schema.Class<CommitSummary, Schema.Struct<{
   /** The commit sha. */
   readonly sha: Schema.String;
@@ -3078,8 +3082,6 @@ export declare class GitHubCommit extends GitHubCommit_base {
   /** {@link GitHubCommit.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<GitHubCommitShape>) => Layer.Layer<GitHubCommit>;
 }
-//#endregion
-//#region src/GitHubContent.d.ts
 /**
  * Read a text file out of a repository at a ref.
  *
@@ -3140,8 +3142,6 @@ export declare class GitHubContent extends GitHubContent_base {
   /** {@link GitHubContent.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<GitHubContentShape>) => Layer.Layer<GitHubContent>;
 }
-//#endregion
-//#region src/PullRequestComment.d.ts
 declare const CommentMarker_base: Schema.Class<CommentMarker, Schema.Struct<{
   /** Whose comments these are, e.g. your action's name. */
   readonly namespace: Schema.NonEmptyString;
@@ -3238,8 +3238,6 @@ export declare class PullRequestComment extends PullRequestComment_base {
   /** {@link PullRequestComment.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<PullRequestCommentShape>) => Layer.Layer<PullRequestComment>;
 }
-//#endregion
-//#region src/GitHubIssue.d.ts
 declare const IssueInfo_base: Schema.Class<IssueInfo, Schema.Struct<{
   readonly number: Schema.Int;
   readonly title: Schema.String;
@@ -3397,8 +3395,6 @@ export declare class GitHubIssue extends GitHubIssue_base {
   /** {@link GitHubIssue.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<GitHubIssueShape>) => Layer.Layer<GitHubIssue>;
 }
-//#endregion
-//#region src/GitHubRelease.d.ts
 declare const ReleaseInfo_base: Schema.Class<ReleaseInfo, Schema.Struct<{
   readonly id: Schema.Int;
   readonly tag: Schema.String;
@@ -3519,8 +3515,6 @@ export declare class GitHubRelease extends GitHubRelease_base {
   /** {@link GitHubRelease.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<GitHubReleaseShape>) => Layer.Layer<GitHubRelease>;
 }
-//#endregion
-//#region src/GitHubRepository.d.ts
 /**
  * Everything GitHub reports about a repository.
  *
@@ -3761,8 +3755,6 @@ export declare class GitHubRepository extends GitHubRepository_base {
   /** {@link GitHubRepository.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<GitHubRepositoryShape>) => Layer.Layer<GitHubRepository>;
 }
-//#endregion
-//#region src/GitTag.d.ts
 declare const TagRef_base: Schema.Class<TagRef, Schema.Struct<{
   /** The tag name, without `refs/tags/`. */
   readonly tag: Schema.NonEmptyString;
@@ -3893,8 +3885,6 @@ export declare class GitTag extends GitTag_base {
   /** {@link GitTag.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<GitTagShape>) => Layer.Layer<GitTag>;
 }
-//#endregion
-//#region src/PullRequest.d.ts
 /** How a pull request is merged. @public */
 export declare const MergeMethod: Schema.Literals<readonly ["merge", "squash", "rebase"]>;
 declare const PullRequestInfo_base: Schema.Class<PullRequestInfo, Schema.Struct<{
@@ -4094,8 +4084,6 @@ export declare class PullRequest extends PullRequest_base {
   /** {@link PullRequest.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<PullRequestShape>) => Layer.Layer<PullRequest>;
 }
-//#endregion
-//#region src/RepositorySecret.d.ts
 /**
  * Which secret store an operation acts on.
  *
@@ -4192,8 +4180,6 @@ export declare class RepositorySecret extends RepositorySecret_base {
   /** {@link RepositorySecret.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<RepositorySecretShape>) => Layer.Layer<RepositorySecret>;
 }
-//#endregion
-//#region src/RepositorySecurity.d.ts
 /**
  * Read and toggle the three repository security features that have their own
  * endpoints: Dependabot alerts, Dependabot security fixes and private
@@ -4274,8 +4260,6 @@ export declare class RepositorySecurity extends RepositorySecurity_base {
   /** {@link RepositorySecurity.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<RepositorySecurityShape>) => Layer.Layer<RepositorySecurity>;
 }
-//#endregion
-//#region src/RepositoryVariable.d.ts
 /**
  * A variable's name and value, as listing returns it.
  *
@@ -4381,8 +4365,6 @@ export declare class RepositoryVariable extends RepositoryVariable_base {
   /** {@link RepositoryVariable.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<RepositoryVariableShape>) => Layer.Layer<RepositoryVariable>;
 }
-//#endregion
-//#region src/Ruleset.d.ts
 /**
  * A ruleset, as listing returns it.
  *
@@ -4513,8 +4495,6 @@ export declare class Ruleset extends Ruleset_base {
   /** {@link Ruleset.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<RulesetShape>) => Layer.Layer<Ruleset>;
 }
-//#endregion
-//#region src/TokenPermissions.d.ts
 /**
  * How much access a permission grants.
  *
@@ -4635,8 +4615,6 @@ export declare class TokenPermissions extends TokenPermissions_base {
    */
   assertExact(required: Readonly<Record<string, PermissionLevel>>): Effect.Effect<void, TokenPermissionError>;
 }
-//#endregion
-//#region src/WorkflowDispatch.d.ts
 declare const WorkflowRunStatus_base: Schema.Class<WorkflowRunStatus, Schema.Struct<{
   /** The run's numeric id. */
   readonly id: Schema.Int;
@@ -4828,6 +4806,5 @@ export declare class WorkflowDispatch extends WorkflowDispatch_base {
   /** {@link WorkflowDispatch.makeTest} behind a `Layer`. */
   static readonly layerTest: (overrides?: Partial<WorkflowDispatchShape>) => Layer.Layer<WorkflowDispatch>;
 }
-//#endregion
 export { type ActionsOidcVerifyOptions, type AppCredentials, type AppliedSettings, type ArtifactMetadataShape, type AttestationShape, type AuthenticatedAppShape, type BareLineReference, type BotUserRequest, type BranchOutcome, CLOSING_KEYWORDS, type CachedToken, type CachedTokenRequest, type CheckRunShape, type ClosingKeyword, type CodeScanningSetup, type CodeScanningShape, type CompleteCheckRunOptions, type ConcludeCheckRun, type CreateCheckRunOptions, type DeliveriesOptions, type DeploymentEnvironmentInfo, type DeploymentEnvironmentShape, type GitBranchShape, type GitCommitShape, type GitHubAppOptions, type GitHubAppShape, type GitHubClientOptions, type GitHubClientShape, type GitHubCommitShape, type GitHubContentShape, type GitHubIssueShape, type GitHubReleaseShape, type GitHubRepositoryShape, type GitTagShape, type InstallationTokenStoreShape, type IssueReference, type LatestSemverOptions, type ListCheckRunsOptions, type OwnerType, type PollOptions, type PullRequestCommentShape, type PullRequestShape, type RecordedCall, type RepositoryPatch, type RepositoryPatchDraft, type RepositorySecretShape, type RepositorySecurityShape, type RepositorySettings, type RepositoryVariableShape, type Data as RestData, type RequestExtras as RestExtras, type Item as RestItem, type PaginatingRoute as RestPaginatingRoute, type Params as RestParams, type Response as RestResponse, type Route as RestRoute, type RetryableFailure, type RulesetInfo, type RulesetPayload, type RulesetShape, type SecretInfo, type SecretScope, type TokenRequest, type UpdateCheckRunOptions, type UpsertedPullRequest, type VariableInfo, type VersionFromTag, type WorkflowDispatchShape, type WorkflowInfo, harvestIssueReferences, parseBareLineReference };
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -1,4 +1,4 @@
-import { ActionsOidc, ActionsOidcClaims } from "./ActionsOidc.js";
+import { ActionsOidc, ActionsOidcClaims, ActionsOidcClaimsFromWire } from "./ActionsOidc.js";
 import { GitHubError, GitHubErrorKind, GitHubValidationCode, GitHubValidationEntry } from "./GitHubError.js";
 import { GitHubGraphQLError, GraphQLDocument, GraphQLErrorEntry } from "./GraphQL.js";
 import { RateLimitSnapshot, RetryPolicy } from "./Resilience.js";
@@ -31,4 +31,4 @@ import { ExtraPermission, PermissionGap, PermissionLevel, PermissionResult, Toke
 import { DispatchedRun, WorkflowDispatch, WorkflowRunStatus } from "./WorkflowDispatch.js";
 import { CLOSING_KEYWORDS, harvestIssueReferences, parseBareLineReference } from "@effected/github-references";
 
-export { ActionsOidc, ActionsOidcClaims, Annotation, AnnotationLevel, AppIdentity, AppInfo, ArtifactMetadata, Attestation, AttestationListEntry, AttestationRecord, AuthenticatedApp, BotIdentity, BotUser, CLOSING_KEYWORDS, CheckConclusion, CheckRun, CheckRunOutput, CheckRunRef, CheckRunStatus, CodeScanning, CommentMarker, CommentOnceResult, CommentRecord, CommitComparison, CommitFile, CommitRef, CommitSummary, DeliveryAttempt, DeploymentEnvironment, DispatchedRun, ExtraPermission, FileChange, FileContent, FileDeletion, FileMode, FileStatus, GRAPHQL_ONLY_SETTINGS, GitBranch, GitCommit, GitHubApp, GitHubAppError, GitHubClient, GitHubCommit, GitHubContent, GitHubError, GitHubErrorKind, GitHubFixtures, GitHubGraphQLError, GitHubIssue, GitHubRelease, GitHubRepository, GitHubValidationCode, GitHubValidationEntry, GitTag, GraphQLDocument, GraphQLErrorEntry, Installation, InstallationToken, InstallationTokenStore, InvalidRepoRefError, IssueInfo, LinkedIssue, MergeMethod, PageOptions, PermissionGap, PermissionLevel, PermissionResult, PullRequest, PullRequestComment, PullRequestInfo, RateLimitSnapshot, RawFailure, ReleaseAsset, ReleaseInfo, Repo, RepoRef, ReportedCheckConclusion, ReportedCheckRunOutput, RepositorySecret, RepositorySecurity, RepositoryVariable, RetryPolicy, Ruleset, SECURITY_ANALYSIS_STATUS_FIELDS, SemverTag, StorageRecordInput, TagRef, TokenPermissionError, TokenPermissions, WorkflowDispatch, WorkflowRunStatus, harvestIssueReferences, parseBareLineReference, repositoryPatch, transformSecurityAndAnalysis, versionFromTag };
+export { ActionsOidc, ActionsOidcClaims, ActionsOidcClaimsFromWire, Annotation, AnnotationLevel, AppIdentity, AppInfo, ArtifactMetadata, Attestation, AttestationListEntry, AttestationRecord, AuthenticatedApp, BotIdentity, BotUser, CLOSING_KEYWORDS, CheckConclusion, CheckRun, CheckRunOutput, CheckRunRef, CheckRunStatus, CodeScanning, CommentMarker, CommentOnceResult, CommentRecord, CommitComparison, CommitFile, CommitRef, CommitSummary, DeliveryAttempt, DeploymentEnvironment, DispatchedRun, ExtraPermission, FileChange, FileContent, FileDeletion, FileMode, FileStatus, GRAPHQL_ONLY_SETTINGS, GitBranch, GitCommit, GitHubApp, GitHubAppError, GitHubClient, GitHubCommit, GitHubContent, GitHubError, GitHubErrorKind, GitHubFixtures, GitHubGraphQLError, GitHubIssue, GitHubRelease, GitHubRepository, GitHubValidationCode, GitHubValidationEntry, GitTag, GraphQLDocument, GraphQLErrorEntry, Installation, InstallationToken, InstallationTokenStore, InvalidRepoRefError, IssueInfo, LinkedIssue, MergeMethod, PageOptions, PermissionGap, PermissionLevel, PermissionResult, PullRequest, PullRequestComment, PullRequestInfo, RateLimitSnapshot, RawFailure, ReleaseAsset, ReleaseInfo, Repo, RepoRef, ReportedCheckConclusion, ReportedCheckRunOutput, RepositorySecret, RepositorySecurity, RepositoryVariable, RetryPolicy, Ruleset, SECURITY_ANALYSIS_STATUS_FIELDS, SemverTag, StorageRecordInput, TagRef, TokenPermissionError, TokenPermissions, WorkflowDispatch, WorkflowRunStatus, harvestIssueReferences, parseBareLineReference, repositoryPatch, transformSecurityAndAnalysis, versionFromTag };

package/internal/crypto.js

@@ -3,7 +3,7 @@ import * as Base64 from "effect/encoding/Base64";
 import blakejs from "blakejs";
 import nacl from "tweetnacl";
 
-//#region src/internal/crypto.ts
+// src/internal/crypto.ts
 const { blake2b } = blakejs;
 /** A sealed box opens with the recipient's key; the nonce is derived, not sent. */
 const NONCE_BYTES = 24;
@@ -60,5 +60,4 @@ const encryptSecret = (publicKey, secretValue) => Result.map(Base64.decode(publi
 	return Base64.encode(sealed);
 });
 
-//#endregion
 export { encryptSecret };

package/internal/headers.js

@@ -1,4 +1,4 @@
-//#region src/internal/headers.ts
+// src/internal/headers.ts
 /** A header's value as a string, when it is present and non-empty. */
 const headerString = (headers, name) => {
 	const value = headers?.[name];
@@ -38,5 +38,4 @@ const retryAfterMillisFrom = (headers, nowMillis) => {
 	if (remaining !== void 0 && remaining <= 0 && reset !== void 0) return Math.max(0, reset * 1e3 - nowMillis);
 };
 
-//#endregion
 export { headerNumber, headerString, retryAfterMillisFrom };

package/internal/ids.js

@@ -1,4 +1,4 @@
-//#region src/internal/ids.ts
+// src/internal/ids.ts
 /**
 * Narrows the `number | bigint` resource ids `@octokit/types` v17 declares
 * back to `number`.
@@ -13,5 +13,4 @@
 */
 const numericId = (id) => Number(id);
 
-//#endregion
 export { numericId };

package/internal/octokit.js

@@ -5,7 +5,7 @@ import { Clock, Effect, Option, Redacted, Ref } from "effect";
 import { Octokit } from "@octokit/core";
 import { composePaginateRest } from "@octokit/plugin-paginate-rest";
 
-//#region src/internal/octokit.ts
+// src/internal/octokit.ts
 const SILENT_LOG = {
 	debug: () => {},
 	info: () => {},
@@ -105,5 +105,4 @@ const readThrownHeaders = (error) => {
 	return typeof headers === "object" && headers !== null ? headers : void 0;
 };
 
-//#endregion
 export { makeTransport };

package/internal/paginate.js

@@ -1,6 +1,6 @@
 import { Effect, Option, Stream } from "effect";
 
-//#region src/internal/paginate.ts
+// src/internal/paginate.ts
 /**
 * Walk a {@link PageSource} into a stream of its items.
 *
@@ -47,5 +47,4 @@ const fromArray = (items, perPage) => {
 	}) };
 };
 
-//#endregion
 export { fromArray, paginate };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github",
-	"version": "0.21.0",
+	"version": "0.23.0",
 	"private": false,
 	"description": "Typed GitHub REST and GraphQL services over the octokit core request surface, with app auth and resource helpers.",
 	"keywords": [
@@ -38,9 +38,10 @@
 		"./package.json": "./package.json"
 	},
 	"dependencies": {
-		"@effected/github-references": "^0.10.0",
-		"@effected/jwt": "^0.4.0",
-		"@effected/semver": "^0.14.0",
+		"@effected/github-references": "^0.11.0",
+		"@effected/jwt": "^0.5.0",
+		"@effected/oidc": "^0.1.0",
+		"@effected/semver": "^0.15.0",
 		"@octokit/core": "^7.0.6",
 		"@octokit/plugin-paginate-rest": "^16.0.0",
 		"@octokit/types": "^18.0.0",