@effected/github 0.26.0 → 0.27.0

package/ActionsOidc.js

@@ -143,7 +143,8 @@ const testClaims = (overrides = {}) => ({
 * @remarks
 * {@link ActionsOidc.verify} is `@effected/oidc`'s `Oidc.verify` pinned to the
 * Actions issuer: it checks the signature against GitHub's published JWKS
-* (through `@effected/jwt`'s `JwksResolver`, which caches it), then `iss`,
+* (through `@effected/jwt`'s `JwksResolver`, which caches it; the signature
+* itself runs on core `effect/jose` and needs core's `Signature` service), then `iss`,
 * `aud`, `exp`, `nbf` and `iat`, then decodes the payload into
 * {@link ActionsOidcClaims}. Every failure is a `JwtError`; route on its
 * `reason` (`wrongAudience`, `expired`, `claims`, ...), never on its message.
@@ -168,7 +169,8 @@ const testClaims = (overrides = {}) => ({
 * ```ts
 * import { JwksResolver } from "@effected/jwt";
 * import { ActionsOidc } from "@effected/github";
-* import { Data, Effect } from "effect";
+* import { Data, Effect, Layer } from "effect";
+* import { SecureRandom, Signature } from "effect/crypto";
 *
 * class Forbidden extends Data.TaggedError("Forbidden")<{ readonly repositoryId: number }> {}
 *
@@ -186,7 +188,8 @@ const testClaims = (overrides = {}) => ({
 *   });
 *
 * // JwksResolver.layer needs an HttpClient and a JwksStore, provided once at the edge.
-* export const program = authorize("eyJ...").pipe(Effect.provide(JwksResolver.layer));
+* const CryptoLive = Signature.layerWebCrypto.pipe(Layer.provide(SecureRandom.layerWebCrypto));
+* export const program = authorize("eyJ...").pipe(Effect.provide(Layer.merge(JwksResolver.layer, CryptoLive)));
 * ```
 *
 * @public
@@ -195,7 +198,7 @@ var ActionsOidc = class {
 	constructor() {}
 	/** The Actions OIDC issuer, `https://token.actions.githubusercontent.com`. */
 	static issuer = ISSUER;
-	/** Verify a runner-issued OIDC token: signature against GitHub's JWKS, iss, aud, exp/nbf, then typed claims. */
+	/** Verify a runner-issued OIDC token: signature against GitHub's JWKS, iss, aud, exp/nbf, then typed claims; requires `JwksResolver` and core `Signature`. */
 	static verify = verify;
 	/**
 	* A valid claims payload for tests, overridable field by field.

package/GitHubApp.js

@@ -7,6 +7,7 @@ import { numericId } from "./internal/ids.js";
 import { InstallationTokenStore } from "./InstallationTokenStore.js";
 import { Cause, Clock, Context, DateTime, Deferred, Duration, Effect, Layer, Option, Redacted, Ref, Schema, Semaphore, Stream } from "effect";
 import { Jwt, JwtKey } from "@effected/jwt";
+import { Signature } from "effect/crypto";
 
 // src/GitHubApp.ts
 /**
@@ -355,7 +356,7 @@ var GitHubApp = class GitHubApp extends Context.Service()("@effected/github/GitH
 	* Effect.runPromise(Effect.provide(sweep, layer));
 	* ```
 	*/
-	static appClientLayer = (credentials, options = {}) => Layer.effect(GitHubClient, makeRotatingClient(mintJwt(credentials), () => Effect.void, options, "GitHubApp.appClientLayer"));
+	static appClientLayer = (credentials, options = {}) => Layer.effect(GitHubClient, Effect.flatMap(Effect.service(Signature.Signature), (signature) => makeRotatingClient(Effect.provideService(mintJwt(credentials), Signature.Signature, signature), () => Effect.void, options, "GitHubApp.appClientLayer")));
 	/**
 	* An installation token, reused from an {@link InstallationTokenStore}
 	* while it has `margin` (five minutes by default) left to live.
@@ -534,7 +535,7 @@ const mintJwt = (credentials) => Effect.gen(function* () {
 	};
 }).pipe(Effect.catchTag("JwtError", (error) => Effect.fail(GitHubAppError.of("jwt", error.detail, error))));
 /** A client speaking as the app itself. */
-const asApp = (credentials, options) => Effect.flatMap(mintJwt(credentials), ({ token }) => makeClientShape({
+const appClientOf = (credentials, options) => Effect.flatMap(mintJwt(credentials), ({ token }) => makeClientShape({
 	...options,
 	token
 }));
@@ -545,75 +546,77 @@ const asBearer = (token, options) => makeClientShape({
 });
 const appFailure = (kind) => (error) => Effect.fail(GitHubAppError.of(kind, error.reason, error));
 function makeApp(options) {
-	return Effect.map(resolveApiVersion(options.apiVersion), () => {
-		const installations = Effect.fn("GitHubApp.installations")(function* (credentials) {
-			return (yield* (yield* asApp(credentials, options)).paginate("GET /app/installations", {}).pipe(Effect.catch(appFailure("installation")))).map((entry) => {
-				const account = entry.account ?? void 0;
-				return Installation.make({
-					id: numericId(entry.id),
-					...account !== void 0 && typeof account.login === "string" ? { account: account.login } : {},
-					...readField("accountType", Schema.String, account?.type),
-					...readField("accountId", Schema.Int, typeof account?.id === "bigint" ? numericId(account.id) : account?.id),
-					...readField("suspendedAt", SuspendedAt, entry.suspended_at),
-					...readField("updatedAt", Schema.DateTimeUtcFromString, entry.updated_at)
-				});
+	return Effect.flatMap(Effect.service(Signature.Signature), (signature) => Effect.map(resolveApiVersion(options.apiVersion), () => makeAppWith(options, signature)));
+}
+function makeAppWith(options, signature) {
+	const asApp = (credentials, clientOptions) => Effect.provideService(appClientOf(credentials, clientOptions), Signature.Signature, signature);
+	const installations = Effect.fn("GitHubApp.installations")(function* (credentials) {
+		return (yield* (yield* asApp(credentials, options)).paginate("GET /app/installations", {}).pipe(Effect.catch(appFailure("installation")))).map((entry) => {
+			const account = entry.account ?? void 0;
+			return Installation.make({
+				id: numericId(entry.id),
+				...account !== void 0 && typeof account.login === "string" ? { account: account.login } : {},
+				...readField("accountType", Schema.String, account?.type),
+				...readField("accountId", Schema.Int, typeof account?.id === "bigint" ? numericId(account.id) : account?.id),
+				...readField("suspendedAt", SuspendedAt, entry.suspended_at),
+				...readField("updatedAt", Schema.DateTimeUtcFromString, entry.updated_at)
 			});
 		});
-		const resolveInstallationId = (request) => request.installationId !== void 0 ? Effect.succeed(request.installationId) : Effect.gen(function* () {
-			const all = yield* installations(request);
-			if (request.owner !== void 0) {
-				const wanted = request.owner.toLowerCase();
-				const match = all.find((entry) => entry.account?.toLowerCase() === wanted);
-				if (match !== void 0) return match.id;
-				return yield* Effect.fail(GitHubAppError.of("installation", `the app is not installed on ${request.owner} (installed on: ${all.map((entry) => entry.account ?? entry.id).join(", ") || "nothing"})`));
-			}
-			const only = all[0];
-			if (all.length === 1 && only !== void 0) return only.id;
-			return yield* Effect.fail(GitHubAppError.of("installation", all.length === 0 ? "the app has no installations" : `the app has ${all.length} installations; pass installationId or owner`));
-		});
-		const token = Effect.fn("GitHubApp.token")(function* (request) {
-			const installationId = yield* resolveInstallationId(request);
-			const minted = yield* (yield* asApp(request, options)).request("POST /app/installations/{installation_id}/access_tokens", { installation_id: installationId }).pipe(Effect.catch(appFailure("token")));
-			return yield* Schema.decodeUnknownEffect(InstallationToken)({
-				token: minted.token,
-				expiresAt: minted.expires_at,
-				installationId,
-				permissions: normalizePermissions(minted.permissions)
-			}).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubAppError.of("token", "GitHub returned an unexpected token payload", error))));
-		});
-		const revoke = Effect.fn("GitHubApp.revoke")(function* (value) {
-			yield* (yield* asBearer(value, options)).request("DELETE /installation/token", {}).pipe(Effect.catch(appFailure("revoke")));
-		});
-		const scopedToken = (request) => Effect.acquireRelease(token(request), (minted) => Effect.ignore(revoke(minted.token)));
-		return {
-			token,
-			scopedToken,
-			revoke,
-			identity: Effect.fn("GitHubApp.identity")(function* (request) {
-				const app = yield* (yield* asApp(request, options)).request("GET /app", {}).pipe(Effect.catch(appFailure("identity")));
-				if (app === null) return yield* Effect.fail(GitHubAppError.of("identity", "GET /app returned no app"));
-				const slug = app.slug ?? "";
-				const name = app.name;
-				const user = yield* (yield* asBearer(request.installationToken, options)).request("GET /users/{username}", { username: `${slug}[bot]` }).pipe(Effect.option);
-				return AppIdentity.make({
-					slug,
-					name,
-					...Option.isSome(user) ? { userId: numericId(user.value.id) } : {}
-				});
-			}),
-			botUser: Effect.fn("GitHubApp.botUser")(function* (request) {
-				yield* Effect.annotateCurrentSpan({ slug: request.slug });
-				const user = yield* (yield* asBearer(request.installationToken, options)).request("GET /users/{username}", { username: `${request.slug}[bot]` }).pipe(Effect.catch(appFailure("identity")));
-				const raw = user;
-				return yield* Schema.decodeUnknownEffect(BotUser)(typeof raw === "object" && raw !== null ? {
-					id: numericId(user.id),
-					login: user.login
-				} : raw).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubAppError.of("identity", "GitHub returned an unexpected bot user", error))));
-			}),
-			installations,
-			cachedToken: makeCachedToken(token)
-		};
 	});
+	const resolveInstallationId = (request) => request.installationId !== void 0 ? Effect.succeed(request.installationId) : Effect.gen(function* () {
+		const all = yield* installations(request);
+		if (request.owner !== void 0) {
+			const wanted = request.owner.toLowerCase();
+			const match = all.find((entry) => entry.account?.toLowerCase() === wanted);
+			if (match !== void 0) return match.id;
+			return yield* Effect.fail(GitHubAppError.of("installation", `the app is not installed on ${request.owner} (installed on: ${all.map((entry) => entry.account ?? entry.id).join(", ") || "nothing"})`));
+		}
+		const only = all[0];
+		if (all.length === 1 && only !== void 0) return only.id;
+		return yield* Effect.fail(GitHubAppError.of("installation", all.length === 0 ? "the app has no installations" : `the app has ${all.length} installations; pass installationId or owner`));
+	});
+	const token = Effect.fn("GitHubApp.token")(function* (request) {
+		const installationId = yield* resolveInstallationId(request);
+		const minted = yield* (yield* asApp(request, options)).request("POST /app/installations/{installation_id}/access_tokens", { installation_id: installationId }).pipe(Effect.catch(appFailure("token")));
+		return yield* Schema.decodeUnknownEffect(InstallationToken)({
+			token: minted.token,
+			expiresAt: minted.expires_at,
+			installationId,
+			permissions: normalizePermissions(minted.permissions)
+		}).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubAppError.of("token", "GitHub returned an unexpected token payload", error))));
+	});
+	const revoke = Effect.fn("GitHubApp.revoke")(function* (value) {
+		yield* (yield* asBearer(value, options)).request("DELETE /installation/token", {}).pipe(Effect.catch(appFailure("revoke")));
+	});
+	const scopedToken = (request) => Effect.acquireRelease(token(request), (minted) => Effect.ignore(revoke(minted.token)));
+	return {
+		token,
+		scopedToken,
+		revoke,
+		identity: Effect.fn("GitHubApp.identity")(function* (request) {
+			const app = yield* (yield* asApp(request, options)).request("GET /app", {}).pipe(Effect.catch(appFailure("identity")));
+			if (app === null) return yield* Effect.fail(GitHubAppError.of("identity", "GET /app returned no app"));
+			const slug = app.slug ?? "";
+			const name = app.name;
+			const user = yield* (yield* asBearer(request.installationToken, options)).request("GET /users/{username}", { username: `${slug}[bot]` }).pipe(Effect.option);
+			return AppIdentity.make({
+				slug,
+				name,
+				...Option.isSome(user) ? { userId: numericId(user.value.id) } : {}
+			});
+		}),
+		botUser: Effect.fn("GitHubApp.botUser")(function* (request) {
+			yield* Effect.annotateCurrentSpan({ slug: request.slug });
+			const user = yield* (yield* asBearer(request.installationToken, options)).request("GET /users/{username}", { username: `${request.slug}[bot]` }).pipe(Effect.catch(appFailure("identity")));
+			const raw = user;
+			return yield* Schema.decodeUnknownEffect(BotUser)(typeof raw === "object" && raw !== null ? {
+				id: numericId(user.id),
+				login: user.login
+			} : raw).pipe(Effect.catchTag("SchemaError", (error) => Effect.fail(GitHubAppError.of("identity", "GitHub returned an unexpected bot user", error))));
+		}),
+		installations,
+		cachedToken: makeCachedToken(token)
+	};
 }
 /** GitHub's permission values are strings; anything else is not a permission. */
 const normalizePermissions = (raw) => {

package/README.md

@@ -8,10 +8,10 @@
 Typed GitHub REST and GraphQL for [Effect](https://effect.website) v4. `client.request("GET /repos/{owner}/{repo}", { owner, repo })` types both the parameters and the returned `data` from the route literal alone — no `operation: string`, no callback, no cast. One `GitHubError` covers every REST failure with a `kind` you branch on instead of grepping a message, one pagination engine backs every paginating route and `client.request`'s `Stream` form, and a set of resource services (`GitBranch`, `GitTag`, `CheckRun`, `PullRequest`, `PullRequestComment`, `GitHubRelease`, `Attestation`) turn multi-call dances — "does this branch already exist?", "conclude this check run no matter how the program exits" — into one call. A second tier writes the configuration half: secrets, variables, rulesets, deployment environments, the security toggles and CodeQL default setup. `GitHubApp` mints and revokes installation tokens for App auth.
 
 > **Pre-`1.0.0`.** This package is part of the `@effected/*` kit, built on stable
-> Effect v4 (`effect` `^4.0.0`) and still in `0.x` development. Stable Effect
+> Effect v4 (`effect` `~4.1.0`) and still in `0.x` development. Stable Effect
 > makes a kit `1.0.0` possible, not automatic. To keep your `effect` and
 > `@effect/*` versions on the line the kit is built and tested against, install
-> [`@effected/pnpm-plugin-effect`](https://www.npmjs.com/package/@effected/pnpm-plugin-effect).
+> [`@effected/pnpm-plugin-effected`](https://www.npmjs.com/package/@effected/pnpm-plugin-effected).
 >
 > **Stability: unstable.** This package's API surface is not yet considered
 > complete and may change across `0.x` releases. Pin an exact version — even a
@@ -25,7 +25,7 @@ Hand-rolled octokit wrappers tend to converge on the same shape: a `rest<T>(oper
 
 The error model gets the same treatment. `GitHubError.kind` is a literal union (`notFound`, `alreadyExists`, `rejected`, `unauthorized`, `rateLimited`, `transport`, `decode`) produced by one classification step, `GitHubError.fromOctokit`, instead of one hand-written mapper per resource. `kind: "alreadyExists"` is what makes `GitBranch.upsert` and `GitTag.upsert` a single round trip in the common case, rather than a create-then-catch-then-check-then-reset dance repeated at every call site that needs it.
 
-This package also owns the octokit runtime so nothing downstream has to. `@octokit/rest` and `@octokit/auth-app` are deliberately absent — the rest wrapper is a request-logging plugin plus 1.4 MB of duplicate endpoint types, and `auth-app` drags in `createOAuthUserAuth`, roughly 492 KB of OAuth machinery this package never calls. GitHub App JWTs are signed by the kit's own `@effected/jwt` instead: WebCrypto RS256 with no runtime dependencies, so App auth runs on Cloudflare Workers as well as Node. A consumer that only authenticates with a token it already holds never links the JWT signer at all: the App-authenticated layer lives in its own module (`GitHubApp`), and nothing here is gathered into a namespace object that would defeat that split.
+This package also owns the octokit runtime so nothing downstream has to. `@octokit/rest` and `@octokit/auth-app` are deliberately absent — the rest wrapper is a request-logging plugin plus 1.4 MB of duplicate endpoint types, and `auth-app` drags in `createOAuthUserAuth`, roughly 492 KB of OAuth machinery this package never calls. GitHub App JWTs are signed by the kit's own `@effected/jwt` instead, over core `effect/jose`: RS256 with no extra runtime dependencies, so App auth runs on Cloudflare Workers as well as Node. The App layers (`GitHubApp.layer`, `layerWith`, `clientLayer`, `appClientLayer`) require core's `Signature` service; provide `Signature.layerWebCrypto.pipe(Layer.provide(SecureRandom.layerWebCrypto))` from `effect/crypto` once at the edge. A consumer that only authenticates with a token it already holds never links the JWT signer at all: the App-authenticated layer lives in its own module (`GitHubApp`), and nothing here is gathered into a namespace object that would defeat that split.
 
 ## Install
 

package/index.d.ts

@@ -1,6 +1,7 @@
 import { BareLineReference, CLOSING_KEYWORDS, ClosingKeyword, IssueReference, harvestIssueReferences, parseBareLineReference } from "@effected/github-references";
 import { JwksResolver, JwtError } from "@effected/jwt";
 import { Cause, Config, Context, Duration, Effect, Layer, Option, Redacted, Result, Schedule, Schema, Scope, Stream } from "effect";
+import { Signature } from "effect/crypto";
 import { PaginatingEndpoints } from "@octokit/plugin-paginate-rest";
 import { Endpoints, RequestHeaders } from "@octokit/types";
 import { SemVer } from "@effected/semver";
@@ -126,7 +127,8 @@ interface ActionsOidcVerifyOptions {
  * @remarks
  * {@link ActionsOidc.verify} is `@effected/oidc`'s `Oidc.verify` pinned to the
  * Actions issuer: it checks the signature against GitHub's published JWKS
- * (through `@effected/jwt`'s `JwksResolver`, which caches it), then `iss`,
+ * (through `@effected/jwt`'s `JwksResolver`, which caches it; the signature
+ * itself runs on core `effect/jose` and needs core's `Signature` service), then `iss`,
  * `aud`, `exp`, `nbf` and `iat`, then decodes the payload into
  * {@link ActionsOidcClaims}. Every failure is a `JwtError`; route on its
  * `reason` (`wrongAudience`, `expired`, `claims`, ...), never on its message.
@@ -151,7 +153,8 @@ interface ActionsOidcVerifyOptions {
  * ```ts
  * import { JwksResolver } from "@effected/jwt";
  * import { ActionsOidc } from "@effected/github";
- * import { Data, Effect } from "effect";
+ * import { Data, Effect, Layer } from "effect";
+ * import { SecureRandom, Signature } from "effect/crypto";
  *
  * class Forbidden extends Data.TaggedError("Forbidden")<{ readonly repositoryId: number }> {}
  *
@@ -169,7 +172,8 @@ interface ActionsOidcVerifyOptions {
  *   });
  *
  * // JwksResolver.layer needs an HttpClient and a JwksStore, provided once at the edge.
- * export const program = authorize("eyJ...").pipe(Effect.provide(JwksResolver.layer));
+ * const CryptoLive = Signature.layerWebCrypto.pipe(Layer.provide(SecureRandom.layerWebCrypto));
+ * export const program = authorize("eyJ...").pipe(Effect.provide(Layer.merge(JwksResolver.layer, CryptoLive)));
  * ```
  *
  * @public
@@ -178,8 +182,8 @@ export declare class ActionsOidc {
   private constructor();
   /** The Actions OIDC issuer, `https://token.actions.githubusercontent.com`. */
   static readonly issuer: "https://token.actions.githubusercontent.com";
-  /** Verify a runner-issued OIDC token: signature against GitHub's JWKS, iss, aud, exp/nbf, then typed claims. */
-  static readonly verify: (token: string, options: ActionsOidcVerifyOptions) => Effect.Effect<ActionsOidcClaims, JwtError, JwksResolver>;
+  /** Verify a runner-issued OIDC token: signature against GitHub's JWKS, iss, aud, exp/nbf, then typed claims; requires `JwksResolver` and core `Signature`. */
+  static readonly verify: (token: string, options: ActionsOidcVerifyOptions) => Effect.Effect<ActionsOidcClaims, JwtError, JwksResolver | Signature.Signature>;
   /**
    * A valid claims payload for tests, overridable field by field.
    *
@@ -2848,7 +2852,7 @@ declare const GitHubApp_base: Context.ServiceClass<GitHubApp, "@effected/github/
  */
 export declare class GitHubApp extends GitHubApp_base {
   /** The default transport. Bind it once; layers are memoized by reference. */
-  static readonly layer: Layer.Layer<GitHubApp>;
+  static readonly layer: Layer.Layer<GitHubApp, never, Signature.Signature>;
   /**
    * A transport with custom settings.
    *
@@ -2857,7 +2861,7 @@ export declare class GitHubApp extends GitHubApp_base {
    * this at two provide sites builds two instances, because layers are
    * memoized by reference.
    */
-  static readonly layerWith: (options: GitHubAppOptions) => Layer.Layer<GitHubApp>;
+  static readonly layerWith: (options: GitHubAppOptions) => Layer.Layer<GitHubApp, never, Signature.Signature>;
   /**
    * A {@link GitHubClient} authenticated as an app installation.
    *
@@ -2876,7 +2880,7 @@ export declare class GitHubApp extends GitHubApp_base {
    * authorization failure, and widening every method's error channel to say so
    * would tax every caller for a case only this layer can produce.
    */
-  static readonly clientLayer: (request: TokenRequest, options?: GitHubAppOptions) => Layer.Layer<GitHubClient, GitHubAppError>;
+  static readonly clientLayer: (request: TokenRequest, options?: GitHubAppOptions) => Layer.Layer<GitHubClient, GitHubAppError, Signature.Signature>;
   /**
    * A {@link GitHubClient} authenticated as the app itself, with an App JWT.
    *
@@ -2929,7 +2933,7 @@ export declare class GitHubApp extends GitHubApp_base {
    * Effect.runPromise(Effect.provide(sweep, layer));
    * ```
    */
-  static readonly appClientLayer: (credentials: AppCredentials, options?: GitHubAppOptions) => Layer.Layer<GitHubClient, GitHubAppError>;
+  static readonly appClientLayer: (credentials: AppCredentials, options?: GitHubAppOptions) => Layer.Layer<GitHubClient, GitHubAppError, Signature.Signature>;
   /**
    * An installation token, reused from an {@link InstallationTokenStore}
    * while it has `margin` (five minutes by default) left to live.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github",
-	"version": "0.26.0",
+	"version": "0.27.0",
 	"private": false,
 	"description": "Typed GitHub REST and GraphQL services over the octokit core request surface, with app auth and resource helpers.",
 	"keywords": [
@@ -38,11 +38,11 @@
 		"./package.json": "./package.json"
 	},
 	"dependencies": {
-		"@effected/crypto": "^0.3.0",
-		"@effected/github-references": "^0.12.0",
-		"@effected/jwt": "^0.7.0",
-		"@effected/oidc": "^0.2.0",
-		"@effected/semver": "^0.19.0",
+		"@effected/crypto": "^0.4.0",
+		"@effected/github-references": "^0.13.0",
+		"@effected/jwt": "^0.8.0",
+		"@effected/oidc": "^0.3.0",
+		"@effected/semver": "^0.20.0",
 		"@octokit/core": "^7.0.6",
 		"@octokit/plugin-paginate-rest": "^16.0.0",
 		"@octokit/types": "^18.0.0",
@@ -50,7 +50,7 @@
 		"tweetnacl": "1.0.3"
 	},
 	"peerDependencies": {
-		"effect": "^4.0.0"
+		"effect": "~4.1.0"
 	},
 	"engines": {
 		"node": ">=24.11.0"

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.59.4"
+      "packageVersion": "7.60.0"
     }
   ]
 }