@effected/github 0.25.1 → 0.27.0

package/ActionsOidc.js

@@ -143,7 +143,8 @@ const testClaims = (overrides = {}) => ({
 * @remarks
 * {@link ActionsOidc.verify} is `@effected/oidc`'s `Oidc.verify` pinned to the
 * Actions issuer: it checks the signature against GitHub's published JWKS
-* (through `@effected/jwt`'s `JwksResolver`, which caches it), then `iss`,
+* (through `@effected/jwt`'s `JwksResolver`, which caches it; the signature
+* itself runs on core `effect/jose` and needs core's `Signature` service), then `iss`,
 * `aud`, `exp`, `nbf` and `iat`, then decodes the payload into
 * {@link ActionsOidcClaims}. Every failure is a `JwtError`; route on its
 * `reason` (`wrongAudience`, `expired`, `claims`, ...), never on its message.
@@ -168,7 +169,8 @@ const testClaims = (overrides = {}) => ({
 * ```ts
 * import { JwksResolver } from "@effected/jwt";
 * import { ActionsOidc } from "@effected/github";
-* import { Data, Effect } from "effect";
+* import { Data, Effect, Layer } from "effect";
+* import { SecureRandom, Signature } from "effect/crypto";
 *
 * class Forbidden extends Data.TaggedError("Forbidden")<{ readonly repositoryId: number }> {}
 *
@@ -186,7 +188,8 @@ const testClaims = (overrides = {}) => ({
 *   });
 *
 * // JwksResolver.layer needs an HttpClient and a JwksStore, provided once at the edge.
-* export const program = authorize("eyJ...").pipe(Effect.provide(JwksResolver.layer));
+* const CryptoLive = Signature.layerWebCrypto.pipe(Layer.provide(SecureRandom.layerWebCrypto));
+* export const program = authorize("eyJ...").pipe(Effect.provide(Layer.merge(JwksResolver.layer, CryptoLive)));
 * ```
 *
 * @public
@@ -195,7 +198,7 @@ var ActionsOidc = class {
 	constructor() {}
 	/** The Actions OIDC issuer, `https://token.actions.githubusercontent.com`. */
 	static issuer = ISSUER;
-	/** Verify a runner-issued OIDC token: signature against GitHub's JWKS, iss, aud, exp/nbf, then typed claims. */
+	/** Verify a runner-issued OIDC token: signature against GitHub's JWKS, iss, aud, exp/nbf, then typed claims; requires `JwksResolver` and core `Signature`. */
 	static verify = verify;
 	/**
 	* A valid claims payload for tests, overridable field by field.

package/DeploymentEnvironment.js

@@ -1,3 +1,4 @@
+import { ENVIRONMENT_PUT_ROUTE_PARAMS, reservedBodyKey } from "./internal/requestOptions.js";
 import { unstubbed } from "./internal/unstubbed.js";
 import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
@@ -54,11 +55,15 @@ const make = (client) => {
 				repo,
 				environment: name
 			});
+			for (const key of Object.keys(config)) {
+				const reason = reservedBodyKey(key, ENVIRONMENT_PUT_ROUTE_PARAMS, "an environment setting");
+				if (reason !== void 0) return yield* Effect.die(/* @__PURE__ */ new RangeError(`DeploymentEnvironment.upsert: "${key}" ${reason}`));
+			}
 			yield* client.request("PUT /repos/{owner}/{repo}/environments/{environment_name}", {
-				...config,
 				owner,
 				repo,
-				environment_name: name
+				environment_name: name,
+				data: { ...config }
 			});
 		}),
 		list: Effect.fn("DeploymentEnvironment.list")(function* () {

package/GitHubApp.js

@@ -1,11 +1,13 @@
 import { GitHubError } from "./GitHubError.js";
 import { GitHubGraphQLError } from "./GraphQL.js";
+import { uploadChannelOf, withUploadChannel } from "./internal/uploads.js";
 import { unstubbed } from "./internal/unstubbed.js";
 import { GitHubClient, makeClientShape, resolveApiVersion } from "./GitHubClient.js";
 import { numericId } from "./internal/ids.js";
 import { InstallationTokenStore } from "./InstallationTokenStore.js";
 import { Cause, Clock, Context, DateTime, Deferred, Duration, Effect, Layer, Option, Redacted, Ref, Schema, Semaphore, Stream } from "effect";
 import { Jwt, JwtKey } from "@effected/jwt";
+import { Signature } from "effect/crypto";
 
 // src/GitHubApp.ts
 /**
@@ -354,7 +356,7 @@ var GitHubApp = class GitHubApp extends Context.Service()("@effected/github/GitH
 	* Effect.runPromise(Effect.provide(sweep, layer));
 	* ```
 	*/
-	static appClientLayer = (credentials, options = {}) => Layer.effect(GitHubClient, makeRotatingClient(mintJwt(credentials), () => Effect.void, options, "GitHubApp.appClientLayer"));
+	static appClientLayer = (credentials, options = {}) => Layer.effect(GitHubClient, Effect.flatMap(Effect.service(Signature.Signature), (signature) => makeRotatingClient(Effect.provideService(mintJwt(credentials), Signature.Signature, signature), () => Effect.void, options, "GitHubApp.appClientLayer")));
 	/**
 	* An installation token, reused from an {@link InstallationTokenStore}
 	* while it has `margin` (five minutes by default) left to live.
@@ -533,7 +535,7 @@ const mintJwt = (credentials) => Effect.gen(function* () {
 	};
 }).pipe(Effect.catchTag("JwtError", (error) => Effect.fail(GitHubAppError.of("jwt", error.detail, error))));
 /** A client speaking as the app itself. */
-const asApp = (credentials, options) => Effect.flatMap(mintJwt(credentials), ({ token }) => makeClientShape({
+const appClientOf = (credentials, options) => Effect.flatMap(mintJwt(credentials), ({ token }) => makeClientShape({
 	...options,
 	token
 }));
@@ -544,75 +546,77 @@ const asBearer = (token, options) => makeClientShape({
 });
 const appFailure = (kind) => (error) => Effect.fail(GitHubAppError.of(kind, error.reason, error));
 function makeApp(options) {
-	return Effect.map(resolveApiVersion(options.apiVersion), () => {
-		const installations = Effect.fn("GitHubApp.installations")(function* (credentials) {
-			return (yield* (yield* asApp(credentials, options)).paginate("GET /app/installations", {}).pipe(Effect.catch(appFailure("installation")))).map((entry) => {
-				const account = entry.account ?? void 0;
-				return Installation.make({
-					id: numericId(entry.id),
-					...account !== void 0 && typeof account.login === "string" ? { account: account.login } : {},
-					...readField("accountType", Schema.String, account?.type),
-					...readField("accountId", Schema.Int, typeof account?.id === "bigint" ? numericId(account.id) : account?.id),
-					...readField("suspendedAt", SuspendedAt, entry.suspended_at),
-					...readField("updatedAt", Schema.DateTimeUtcFromString, entry.updated_at)
-				});
+	return Effect.flatMap(Effect.service(Signature.Signature), (signature) => Effect.map(resolveApiVersion(options.apiVersion), () => makeAppWith(options, signature)));
+}
+function makeAppWith(options, signature) {
+	const asApp = (credentials, clientOptions) => Effect.provideService(appClientOf(credentials, clientOptions), Signature.Signature, signature);
+	const installations = Effect.fn("GitHubApp.installations")(function* (credentials) {
+		return (yield* (yield* asApp(credentials, options)).paginate("GET /app/installations", {}).pipe(Effect.catch(appFailure("installation")))).map((entry) => {
+			const account = entry.account ?? void 0;
+			return Installation.make({
+				id: numericId(entry.id),
+				...account !== void 0 && typeof account.login === "string" ? { account: account.login } : {},
+				...readField("accountType", Schema.String, account?.type),
+				...readField("accountId", Schema.Int, typeof account?.id === "bigint" ? numericId(account.id) : account?.id),
+				...readField("suspendedAt", SuspendedAt, entry.suspended_at),
+				...readField("updatedAt", Schema.DateTimeUtcFromString, entry.updated_at)
 			});
 		});
-		const resolveInstallationId = (request) => request.installationId !== void 0 ? Effect.succeed(request.installationId) : Effect.gen(function* () {
-			const all = yield* installations(request);
-			if (request.owner !== void 0) {
-				const wanted = request.owner.toLowerCase();
-				const match = all.find((entry) => entry.account?.toLowerCase() === wanted);
-				if (match !== void 0) return match.id;
-				return yield* Effect.fail(GitHubAppError.of("installation", `the app is not installed on ${request.owner} (installed on: ${all.map((entry) => entry.account ?? entry.id).join(", ") || "nothing"})`));
-			}
-			const only = all[0];
-			if (all.length === 1 && only !== void 0) return only.id;
-			return yield* Effect.fail(GitHubAppError.of("installation", all.length === 0 ? "the app has no installations" : `the app has ${all.length} installations; pass installationId or owner`));
-		});
-		const token = Effect.fn("GitHubApp.token")(function* (request) {
-			const installationId = yield* resolveInstallationId(request);
-			const minted = yield* (yield* asApp(request, options)).request("POST /app/installations/{installation_id}/access_tokens", { installation_id: installationId }).pipe(Effect.catch(appFailure("token")));
-			return yield* Schema.decodeUnknownEffect(InstallationToken)({
-				token: minted.token,
-				expiresAt: minted.expires_at,
-				installationId,
-				permissions: normalizePermissions(minted.permissions)
-			}).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubAppError.of("token", "GitHub returned an unexpected token payload", error))));
-		});
-		const revoke = Effect.fn("GitHubApp.revoke")(function* (value) {
-			yield* (yield* asBearer(value, options)).request("DELETE /installation/token", {}).pipe(Effect.catch(appFailure("revoke")));
-		});
-		const scopedToken = (request) => Effect.acquireRelease(token(request), (minted) => Effect.ignore(revoke(minted.token)));
-		return {
-			token,
-			scopedToken,
-			revoke,
-			identity: Effect.fn("GitHubApp.identity")(function* (request) {
-				const app = yield* (yield* asApp(request, options)).request("GET /app", {}).pipe(Effect.catch(appFailure("identity")));
-				if (app === null) return yield* Effect.fail(GitHubAppError.of("identity", "GET /app returned no app"));
-				const slug = app.slug ?? "";
-				const name = app.name;
-				const user = yield* (yield* asBearer(request.installationToken, options)).request("GET /users/{username}", { username: `${slug}[bot]` }).pipe(Effect.option);
-				return AppIdentity.make({
-					slug,
-					name,
-					...Option.isSome(user) ? { userId: numericId(user.value.id) } : {}
-				});
-			}),
-			botUser: Effect.fn("GitHubApp.botUser")(function* (request) {
-				yield* Effect.annotateCurrentSpan({ slug: request.slug });
-				const user = yield* (yield* asBearer(request.installationToken, options)).request("GET /users/{username}", { username: `${request.slug}[bot]` }).pipe(Effect.catch(appFailure("identity")));
-				const raw = user;
-				return yield* Schema.decodeUnknownEffect(BotUser)(typeof raw === "object" && raw !== null ? {
-					id: numericId(user.id),
-					login: user.login
-				} : raw).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubAppError.of("identity", "GitHub returned an unexpected bot user", error))));
-			}),
-			installations,
-			cachedToken: makeCachedToken(token)
-		};
 	});
+	const resolveInstallationId = (request) => request.installationId !== void 0 ? Effect.succeed(request.installationId) : Effect.gen(function* () {
+		const all = yield* installations(request);
+		if (request.owner !== void 0) {
+			const wanted = request.owner.toLowerCase();
+			const match = all.find((entry) => entry.account?.toLowerCase() === wanted);
+			if (match !== void 0) return match.id;
+			return yield* Effect.fail(GitHubAppError.of("installation", `the app is not installed on ${request.owner} (installed on: ${all.map((entry) => entry.account ?? entry.id).join(", ") || "nothing"})`));
+		}
+		const only = all[0];
+		if (all.length === 1 && only !== void 0) return only.id;
+		return yield* Effect.fail(GitHubAppError.of("installation", all.length === 0 ? "the app has no installations" : `the app has ${all.length} installations; pass installationId or owner`));
+	});
+	const token = Effect.fn("GitHubApp.token")(function* (request) {
+		const installationId = yield* resolveInstallationId(request);
+		const minted = yield* (yield* asApp(request, options)).request("POST /app/installations/{installation_id}/access_tokens", { installation_id: installationId }).pipe(Effect.catch(appFailure("token")));
+		return yield* Schema.decodeUnknownEffect(InstallationToken)({
+			token: minted.token,
+			expiresAt: minted.expires_at,
+			installationId,
+			permissions: normalizePermissions(minted.permissions)
+		}).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubAppError.of("token", "GitHub returned an unexpected token payload", error))));
+	});
+	const revoke = Effect.fn("GitHubApp.revoke")(function* (value) {
+		yield* (yield* asBearer(value, options)).request("DELETE /installation/token", {}).pipe(Effect.catch(appFailure("revoke")));
+	});
+	const scopedToken = (request) => Effect.acquireRelease(token(request), (minted) => Effect.ignore(revoke(minted.token)));
+	return {
+		token,
+		scopedToken,
+		revoke,
+		identity: Effect.fn("GitHubApp.identity")(function* (request) {
+			const app = yield* (yield* asApp(request, options)).request("GET /app", {}).pipe(Effect.catch(appFailure("identity")));
+			if (app === null) return yield* Effect.fail(GitHubAppError.of("identity", "GET /app returned no app"));
+			const slug = app.slug ?? "";
+			const name = app.name;
+			const user = yield* (yield* asBearer(request.installationToken, options)).request("GET /users/{username}", { username: `${slug}[bot]` }).pipe(Effect.option);
+			return AppIdentity.make({
+				slug,
+				name,
+				...Option.isSome(user) ? { userId: numericId(user.value.id) } : {}
+			});
+		}),
+		botUser: Effect.fn("GitHubApp.botUser")(function* (request) {
+			yield* Effect.annotateCurrentSpan({ slug: request.slug });
+			const user = yield* (yield* asBearer(request.installationToken, options)).request("GET /users/{username}", { username: `${request.slug}[bot]` }).pipe(Effect.catch(appFailure("identity")));
+			const raw = user;
+			return yield* Schema.decodeUnknownEffect(BotUser)(typeof raw === "object" && raw !== null ? {
+				id: numericId(user.id),
+				login: user.login
+			} : raw).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubAppError.of("identity", "GitHub returned an unexpected bot user", error))));
+		}),
+		installations,
+		cachedToken: makeCachedToken(token)
+	};
 }
 /** GitHub's permission values are strings; anything else is not a permission. */
 const normalizePermissions = (raw) => {
@@ -673,7 +677,11 @@ const makeRotatingClient = (mint, release, options, operation) => Effect.gen(fun
 		errors: [],
 		cause: error
 	}))));
-	return {
+	const upload = (route, params, schema) => Effect.flatMap(current, (client) => {
+		const channel = uploadChannelOf(client);
+		return channel === void 0 ? Effect.die(/* @__PURE__ */ new Error(`${operation}: the inner client carries no upload channel`)) : channel.upload(route, params, schema);
+	});
+	const shape = {
 		request: (route, params) => Effect.flatMap(current, (client) => client.request(route, params)),
 		requestDecoded: (route, params, schema) => Effect.flatMap(current, (client) => client.requestDecoded(route, params, schema)),
 		paginate: (route, params, pageOptions) => Effect.flatMap(current, (client) => client.paginate(route, params, pageOptions)),
@@ -682,6 +690,10 @@ const makeRotatingClient = (mint, release, options, operation) => Effect.gen(fun
 		rateLimit: Effect.flatMap(Ref.get(held), (state) => Option.isSome(state) ? state.value.client.rateLimit : Effect.succeed(Option.none())),
 		apiVersion
 	};
+	return withUploadChannel(shape, {
+		baseUrl: options.baseUrl,
+		upload
+	});
 });
 
 export { AppIdentity, BotIdentity, BotUser, GitHubApp, GitHubAppError, Installation, InstallationToken };

package/GitHubClient.js

@@ -1,7 +1,9 @@
 import { GitHubError } from "./GitHubError.js";
 import { GitHubGraphQLError } from "./GraphQL.js";
+import { DOTCOM_API_BASE_URL, originOf, uploadsBaseUrlFor, withUploadChannel } from "./internal/uploads.js";
+import { rawRequestRefusal, refusedRequest } from "./internal/confinement.js";
 import { RetryPolicy } from "./Resilience.js";
-import { DEFAULT_API_VERSION, makeTransport } from "./internal/octokit.js";
+import { DEFAULT_API_VERSION, expandOnDotcom, makeTransport } from "./internal/octokit.js";
 import { fromArray, paginate } from "./internal/paginate.js";
 import { unstubbed } from "./internal/unstubbed.js";
 import { Clock, Config, Context, Effect, Layer, Option, Schema, Stream } from "effect";
@@ -82,6 +84,34 @@ var GitHubFixtures = class {
 const resolvePolicy = (retry) => retry === void 0 ? RetryPolicy.default : retry === "off" ? RetryPolicy.none : retry;
 const perPageOf = (options) => options?.perPage ?? DEFAULT_PER_PAGE;
 const dies = unstubbed("GitHubClient.makeTest", "pass an override, or use GitHubClient.layerFixture for recorded responses.");
+const DOTCOM_API_ORIGIN = originOf(DOTCOM_API_BASE_URL);
+const doubleRefusal = (route, params) => rawRequestRefusal(expandOnDotcom, route, typeof params === "object" && params !== null ? params : {}, DOTCOM_API_ORIGIN);
+/**
+* `shape` with the live client's token-confinement refusals applied in front of
+* its four raw members, so a suite on a double sees the `rejected` failure
+* production would raise. A refused call never reaches the double's handler,
+* stub, fixture or `requested` log, as a refused live call never reaches the
+* wire.
+*/
+const confineDouble = (shape) => ({
+	...shape,
+	request: (route, params) => Effect.suspend(() => {
+		const reason = doubleRefusal(route, params);
+		return reason !== void 0 ? Effect.fail(refusedRequest(route, reason)) : shape.request(route, params);
+	}),
+	requestDecoded: (route, params, schema) => Effect.suspend(() => {
+		const reason = doubleRefusal(route, params);
+		return reason !== void 0 ? Effect.fail(refusedRequest(route, reason)) : shape.requestDecoded(route, params, schema);
+	}),
+	paginate: (route, params, options) => Effect.suspend(() => {
+		const reason = doubleRefusal(route, params);
+		return reason !== void 0 ? Effect.fail(refusedRequest(route, reason)) : shape.paginate(route, params, options);
+	}),
+	paginateStream: (route, params, options) => Stream.suspend(() => {
+		const reason = doubleRefusal(route, params);
+		return reason !== void 0 ? Stream.fail(refusedRequest(route, reason)) : shape.paginateStream(route, params, options);
+	})
+});
 /**
 * The typed GitHub API client.
 *
@@ -157,10 +187,16 @@ var GitHubClient = class GitHubClient extends Context.Service()("@effected/githu
 	* `rateLimit` answers `Option.none()` and `apiVersion` the live default,
 	* because a real client legitimately answers both without a request.
 	*
+	* It refuses what the live client refuses, before any override runs: a
+	* `baseUrl`, `url`, `request` or `method` parameter (a body field called
+	* `url` goes inside `data`), or a route that resolves off github.com's REST
+	* root, fails `kind: "rejected"` with no status. A double has no
+	* configured base, so an absolute-URL route must name `api.github.com`.
+	*
 	* For recorded responses that page for real, use
 	* {@link GitHubClient.layerFixture}.
 	*/
-	static makeTest = (overrides = {}) => ({
+	static makeTest = (overrides = {}) => confineDouble({
 		request: overrides.request ?? (() => dies("request")),
 		requestDecoded: overrides.requestDecoded ?? (() => dies("requestDecoded")),
 		paginate: overrides.paginate ?? (() => dies("paginate")),
@@ -189,8 +225,13 @@ var GitHubClient = class GitHubClient extends Context.Service()("@effected/githu
 	* one fixture both records the calls and classifies a raw failure the way
 	* the live client would; there is no need to classify by hand inside a
 	* {@link GitHubClient.layerTest} handler.
+	*
+	* It refuses what the live client refuses, exactly as
+	* {@link GitHubClient.makeTest} does. A refused call fails
+	* `kind: "rejected"` and is **not** recorded in `requested`: it is never
+	* served, as a refused live call never reaches the wire.
 	*/
-	static layerFixture = (fixtures) => Layer.succeed(GitHubClient, makeFixture(fixtures));
+	static layerFixture = (fixtures) => Layer.succeed(GitHubClient, confineDouble(makeFixture(fixtures)));
 };
 /** A calendar api-version: `YYYY-MM-DD`. */
 const API_VERSION_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
@@ -231,35 +272,43 @@ const makeClientShape = (options) => Effect.gen(function* () {
 		yield* Effect.annotateCurrentSpan({ route });
 		return (yield* transport.request(route, route, params)).data;
 	});
+	const decodeWith = (route, schema) => (data) => Schema.decodeUnknownEffect(schema)(data).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubError.decode(route, "response did not match its schema", error))));
 	const requestDecoded = Effect.fn("GitHubClient.requestDecoded")(function* (route, params, schema) {
 		yield* Effect.annotateCurrentSpan({ route });
 		const response = yield* transport.request(route, route, params);
-		return yield* Schema.decodeUnknownEffect(schema)(response.data).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubError.decode(route, "response did not match its schema", error))));
+		return yield* decodeWith(route, schema)(response.data);
 	});
+	const uploadsBaseUrl = uploadsBaseUrlFor(options.baseUrl);
+	const upload = (route, params, schema) => Effect.flatMap(transport.requestAt(route, route, params, uploadsBaseUrl), (response) => decodeWith(route, schema)(response.data));
 	const paginateStream = (route, params, options) => paginate(() => transport.pageSource(route, route, {
 		per_page: perPageOf(options),
 		...params
 	}), options?.maxPages);
-	return {
+	const paginateAll = Effect.fn("GitHubClient.paginate")(function* (route, params, options) {
+		yield* Effect.annotateCurrentSpan({
+			route,
+			perPage: perPageOf(options),
+			maxPages: options?.maxPages ?? -1
+		});
+		return yield* Stream.runCollect(paginateStream(route, params, options));
+	});
+	const graphql = Effect.fn("GitHubClient.graphql")(function* (document, variables) {
+		yield* Effect.annotateCurrentSpan({ document: document.name });
+		const raw = yield* transport.graphql(document.name, document.document, document.encodeVariables(variables));
+		return yield* document.decode(raw).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubGraphQLError.decode(document.name, "response did not match its schema", error))));
+	});
+	return withUploadChannel({
 		request,
 		requestDecoded,
-		paginate: Effect.fn("GitHubClient.paginate")(function* (route, params, options) {
-			yield* Effect.annotateCurrentSpan({
-				route,
-				perPage: perPageOf(options),
-				maxPages: options?.maxPages ?? -1
-			});
-			return yield* Stream.runCollect(paginateStream(route, params, options));
-		}),
+		paginate: paginateAll,
 		paginateStream,
-		graphql: Effect.fn("GitHubClient.graphql")(function* (document, variables) {
-			yield* Effect.annotateCurrentSpan({ document: document.name });
-			const raw = yield* transport.graphql(document.name, document.document, document.encodeVariables(variables));
-			return yield* document.decode(raw).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubGraphQLError.decode(document.name, "response did not match its schema", error))));
-		}),
+		graphql,
 		rateLimit: transport.rateLimit,
 		apiVersion
-	};
+	}, {
+		baseUrl: options.baseUrl,
+		upload
+	});
 });
 const makeFixture = (fixtures) => {
 	const requested = fixtures.requested;

package/GitHubError.js

@@ -1,4 +1,5 @@
 import { headerNumber, retryAfterMillisFrom } from "./internal/headers.js";
+import { scrubThrowable } from "./internal/scrub.js";
 import { Schema } from "effect";
 
 // src/GitHubError.ts
@@ -106,7 +107,7 @@ var GitHubError = class GitHubError extends Schema.TaggedError()("GitHubError",
 	* 422s ("Update is not a fast forward") are prose only.
 	*/
 	validation: Schema.optionalKey(Schema.Array(GitHubValidationEntry)),
-	/** The underlying throwable, when one exists. */
+	/** The underlying throwable, when one exists; an octokit throwable is kept as a credential-free copy. */
 	cause: Schema.optionalKey(Schema.Defect())
 }) {
 	/** `"GitBranch.upsert failed (422): Reference already exists"`. */
@@ -173,9 +174,19 @@ var GitHubError = class GitHubError extends Schema.TaggedError()("GitHubError",
 	* epoch second, and turning it into a delay needs a "now" the caller controls.
 	* The client supplies `Clock.currentTimeMillis`, which is the `TestClock`
 	* under test.
+	*
+	* The kept `cause` is a credential-free copy of the throwable, not the
+	* throwable itself. octokit redacts only the `authorization` credential and
+	* two query values; the copy also drops the request body (a webhook secret,
+	* GraphQL variables), the per-request options and the response body beyond
+	* its top-level `message` and `documentation_url`, drops `set-cookie`, and
+	* reads `REDACTED` for every other credential-bearing header. It keeps the
+	* prototype (so `instanceof` still answers), `name`, `message`, `status`,
+	* the method, the redacted url and the remaining headers. A throwable with
+	* no `request`, `response` or `headers` field is kept as it is.
 	*/
 	static fromOctokit(operation, error, nowMillis) {
-		return fromFacts(operation, readThrowable(error), nowMillis, error);
+		return fromFacts(operation, readThrowable(error), nowMillis, scrubThrowable(error));
 	}
 	/**
 	* Classify a raw HTTP response: a status, its headers and its JSON body.

package/GitHubRelease.js

@@ -1,4 +1,5 @@
 import { GitHubError } from "./GitHubError.js";
+import { originOf, uploadChannelOf, uploadsBaseUrlFor } from "./internal/uploads.js";
 import { unstubbed } from "./internal/unstubbed.js";
 import { GitHubClient } from "./GitHubClient.js";
 import { Repo } from "./Repo.js";
@@ -19,7 +20,15 @@ var ReleaseInfo = class extends Schema.Class("ReleaseInfo")({
 	prerelease: Schema.Boolean,
 	/** The web URL. */
 	url: Schema.String,
-	/** The templated upload endpoint GitHub hands back for assets. */
+	/**
+	* The templated upload endpoint GitHub hands back for assets.
+	*
+	* @remarks
+	* {@link GitHubReleaseShape.uploadAsset} never routes by this value: it is
+	* response data. It only cross-checks that its origin is the upload host
+	* derived from the client's configured base URL, and refuses the upload
+	* when it is not.
+	*/
 	uploadUrl: Schema.String
 }) {};
 /**
@@ -172,16 +181,26 @@ const make = (client) => {
 				release: release.id,
 				asset: asset.name
 			});
-			const raw = yield* client.requestDecoded(asset.label === void 0 ? "POST /repos/{owner}/{repo}/releases/{release_id}/assets{?name}" : "POST /repos/{owner}/{repo}/releases/{release_id}/assets{?name,label}", {
+			const channel = uploadChannelOf(client);
+			const uploadsBaseUrl = uploadsBaseUrlFor(channel?.baseUrl);
+			const expected = originOf(uploadsBaseUrl);
+			const offered = originOf(release.uploadUrl);
+			if (expected === void 0 || offered !== expected) return yield* Effect.fail(new GitHubError({
+				kind: "rejected",
+				operation: "GitHubRelease.uploadAsset",
+				reason: offered === void 0 ? `release ${release.id} has no absolute upload URL; refusing to upload` : `release ${release.id}'s upload URL is on ${offered}, not this client's upload host ${expected ?? uploadsBaseUrl}; refusing to send the token there`
+			}));
+			const route = asset.label === void 0 ? "POST /repos/{owner}/{repo}/releases/{release_id}/assets{?name}" : "POST /repos/{owner}/{repo}/releases/{release_id}/assets{?name,label}";
+			const params = {
 				owner,
 				repo,
 				release_id: release.id,
 				name: asset.name,
 				...asset.label === void 0 ? {} : { label: asset.label },
 				data: asset.data,
-				baseUrl: UPLOADS_BASE_URL,
 				headers: { "content-type": asset.contentType }
-			}, AssetResponse);
+			};
+			const raw = channel === void 0 ? yield* client.requestDecoded(route, params, AssetResponse) : yield* channel.upload(route, params, AssetResponse);
 			return assetOf(raw);
 		}),
 		listAssets: Effect.fn("GitHubRelease.listAssets")(function* (id, options) {
@@ -199,7 +218,5 @@ const make = (client) => {
 		})
 	};
 };
-/** Release assets do not go to the API host. */
-const UPLOADS_BASE_URL = "https://uploads.github.com";
 
 export { GitHubRelease, ReleaseAsset, ReleaseInfo };