@shivaedev/github 0.8.6 → 0.10.0

package/dist/requests.js.map

@@ -1 +1 @@
-{"version":3,"file":"requests.js","sourceRoot":"","sources":["../src/requests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAmB,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAuB,aAAa,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,UAAU,QAAQ,CACvB,MAA6B,EAC7B,KAA6B,EAC7B,KAAiB,EACjB,OAAO,GAAgC,SAAS;IAEhD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAA0C,EAAE,KAAa;QACtG,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACvF,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CACtI,CAAC;QACF,MAAM,KAAK,GAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC;QACtE,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"requests.js","sourceRoot":"","sources":["../src/requests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAuB,aAAa,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGnD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,MAAM,UAAU,QAAQ,CACvB,MAA6B,EAC7B,KAA6B,EAC7B,KAAiB,EACjB,OAAO,GAAgC,SAAS;IAEhD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,EAAE,KAA0C,EAAE,KAAa;QACtG,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IAAI,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACrE,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,GAAG,iBAAiB,CAAC,SAAS,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACvF,IAAI,WAAW,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,KAAK,EAAE,CAAC;gBACrC,OAAO,KAAK,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACpD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,CACzD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CACtI,CAAC;QACF,MAAM,KAAK,GAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;QACnG,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;AACnB,CAAC"}

package/dist/status.d.ts

@@ -3,5 +3,5 @@ import { type HttpClientResponse } from "effect/http";
 import { GitHubConversationLocked, GitHubPermissionDenied, GitHubRateLimited } from "#errors.ts";
 export declare function isUnauthorized(response: HttpClientResponse.HttpClientResponse): boolean;
 export declare function isUnchanged(response: HttpClientResponse.HttpClientResponse): boolean;
-export declare const checkStatus: (response: HttpClientResponse.HttpClientResponse, resource: string, failures?: any) => Effect.Effect<HttpClientResponse.HttpClientResponse, GitHubConversationLocked | GitHubPermissionDenied | GitHubRateLimited | import("effect/http/HttpClientError").HttpClientError | import("@shivaedev/http/errors.ts").ResponseBodyTooLarge | import("@shivaedev/http/errors.ts").RemoteStatusError, never>;
+export declare const checkStatus: (response: HttpClientResponse.HttpClientResponse, resource: string, failures?: any) => Effect.Effect<HttpClientResponse.HttpClientResponse, GitHubConversationLocked | GitHubPermissionDenied | GitHubRateLimited | import("effect/http/HttpClientError").HttpClientError | import("@shivaedev/http/errors.ts").InvalidBodyLimit | import("@shivaedev/http/errors.ts").ResponseBodyTooLarge | import("@shivaedev/http/errors.ts").RemoteStatusError, never>;
 //# sourceMappingURL=status.d.ts.map

package/dist/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,MAAM,EAAkB,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAKlE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEjG,wBAAgB,cAAc,CAAC,QAAQ,EAAE,kBAAkB,CAAC,kBAAkB,WAE7E;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,kBAAkB,CAAC,kBAAkB,WAE1E;AAED,eAAO,MAAM,WAAW,sYAgBtB,CAAC"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,MAAM,EAAkB,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAKlE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEjG,wBAAgB,cAAc,CAAC,QAAQ,EAAE,kBAAkB,CAAC,kBAAkB,WAE7E;AAED,wBAAgB,WAAW,CAAC,QAAQ,EAAE,kBAAkB,CAAC,kBAAkB,WAE1E;AAED,eAAO,MAAM,WAAW,6bAgBtB,CAAC"}

package/dist/stickyComments.d.ts

@@ -41,6 +41,6 @@ export declare function stickyComments(client: Representations): {
             readonly login: string;
             readonly type?: string | undefined;
         } | null;
-    }, import("./errors.ts").GitHubAppError | import("./errors.ts").GitHubConversationLocked | import("./errors.ts").GitHubPermissionDenied | import("./errors.ts").GitHubRateLimited | import("./errors.ts").GitHubTransportError | import("effect/http/HttpBody").HttpBodyError | import("effect/Cause").NoSuchElementError | import("@shivaedev/http/errors.ts").PaginationLinkError | import("@shivaedev/http/errors.ts").ResponseBodyTooLarge | Schema.SchemaError | import("@shivaedev/errors/taxonomy.ts").ServiceUnavailable | import("@shivaedev/http/errors.ts").RemoteStatusError, never>;
+    }, import("./errors.ts").GitHubAppError | import("./errors.ts").GitHubConversationLocked | import("./errors.ts").GitHubPermissionDenied | import("./errors.ts").GitHubRateLimited | import("./errors.ts").GitHubTransportError | import("effect/http/HttpBody").HttpBodyError | import("@shivaedev/http/errors.ts").InvalidBodyLimit | import("effect/Cause").NoSuchElementError | import("@shivaedev/http/errors.ts").PaginationLinkError | import("@shivaedev/http/errors.ts").ResponseBodyTooLarge | Schema.SchemaError | import("@shivaedev/errors/taxonomy.ts").ServiceUnavailable | import("@shivaedev/http/errors.ts").RemoteStatusError, never>;
 };
 //# sourceMappingURL=stickyComments.d.ts.map

package/dist/viewerRepositoryAccess.d.ts

@@ -0,0 +1,46 @@
+import { Cache, Effect, Schema } from "effect";
+import type { Representations } from "#representations.ts";
+export declare const InstalledRepository: Schema.encodeKeys<Schema.Struct<{
+    readonly htmlUrl: Schema.String;
+    readonly id: Schema.Number;
+    readonly name: Schema.String;
+    readonly owner: Schema.Struct<{
+        readonly login: Schema.String;
+    }>;
+    readonly private: Schema.Boolean;
+}>, {
+    readonly htmlUrl: "html_url";
+}>;
+export interface ViewerRepositoryAccess {
+    readonly administrable: readonly (typeof InstalledRepository.Type & {
+        readonly installationId: number;
+    })[];
+    readonly readable: readonly (typeof InstalledRepository.Type & {
+        readonly installationId: number;
+    })[];
+}
+export declare function viewerRepositoryAccess(app: Representations, installation: (id: number) => Effect.Effect<Representations>): Effect.Effect<Cache.Cache<string, {
+    administrable: ({
+        readonly htmlUrl: string;
+        readonly id: number;
+        readonly name: string;
+        readonly owner: {
+            readonly login: string;
+        };
+        readonly private: boolean;
+    } & {
+        readonly installationId: number;
+    })[];
+    readable: ({
+        readonly htmlUrl: string;
+        readonly id: number;
+        readonly name: string;
+        readonly owner: {
+            readonly login: string;
+        };
+        readonly private: boolean;
+    } & {
+        readonly installationId: number;
+    })[];
+}, import("./errors.ts").GitHubAppError | import("./errors.ts").GitHubConversationLocked | import("./errors.ts").GitHubPermissionDenied | import("./errors.ts").GitHubRateLimited | import("./errors.ts").GitHubTransportError | import("@shivaedev/http/errors.ts").InvalidBodyLimit | import("effect/Cause").NoSuchElementError | import("@shivaedev/http/errors.ts").PaginationLinkError | import("@shivaedev/http/errors.ts").ResponseBodyTooLarge | Schema.SchemaError | import("@shivaedev/errors/taxonomy.ts").ServiceUnavailable | import("@shivaedev/http/errors.ts").RemoteStatusError, never>, never, never>;
+//# sourceMappingURL=viewerRepositoryAccess.d.ts.map

package/dist/viewerRepositoryAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewerRepositoryAccess.d.ts","sourceRoot":"","sources":["../src/viewerRepositoryAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAQ,MAAM,EAAU,MAAM,QAAQ,CAAC;AAE7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAE3D,eAAO,MAAM,mBAAmB;;;;;;;;;;EAMmB,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC,OAAO,mBAAmB,CAAC,IAAI,GAAG;QAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;IAC3G,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,mBAAmB,CAAC,IAAI,GAAG;QAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAC;CACtG;AA6BD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;;;;;;;;;;iCA/BzB,MAAM;;;;;;;;;;;iCACX,MAAM;;wlBAmDhG"}

package/dist/viewerRepositoryAccess.js

@@ -0,0 +1,54 @@
+import { Cache, Effect, Exit, Schema, Stream } from "effect";
+import { decodedPages } from "#pagedLists.ts";
+export const InstalledRepository = Schema.Struct({
+    htmlUrl: Schema.String,
+    id: Schema.Number,
+    name: Schema.String,
+    owner: Schema.Struct({ login: Schema.String }),
+    private: Schema.Boolean,
+}).pipe(Schema.encodeKeys({ htmlUrl: "html_url" }));
+const Account = Schema.Struct({ login: Schema.String });
+const Installation = Schema.Struct({ id: Schema.Number });
+const Permission = Schema.Struct({ permission: Schema.String });
+const installationAccess = Effect.fnUntraced(function* (client, installationId, login) {
+    const pages = yield* decodedPages(client, "/installation/repositories?per_page=100", InstalledRepository, {
+        arrayKey: "repositories",
+    }).pipe(Stream.runCollect);
+    const readable = [];
+    const administrable = [];
+    for (const repository of pages.flatMap((page) => page.items)) {
+        const permissionPath = `/repos/${encodeURIComponent(repository.owner.login)}/${encodeURIComponent(repository.name)}/collaborators/${encodeURIComponent(login)}/permission`;
+        const permission = yield* Effect.flatMap(client.read(permissionPath), (response) => response.decode(Permission)).pipe(Effect.map((grant) => grant.permission), Effect.catchTag("RemoteNotFound", () => Effect.succeed("none")));
+        const installed = { ...repository, installationId };
+        if (!repository.private || ["read", "triage", "write", "maintain", "admin"].includes(permission)) {
+            readable.push(installed);
+        }
+        if (permission === "admin") {
+            administrable.push(installed);
+        }
+    }
+    return { administrable, readable };
+});
+export function viewerRepositoryAccess(app, installation) {
+    const lookup = Effect.fnUntraced(function* (account) {
+        const path = account.startsWith("id:") ? `/user/${account.slice(3)}` : `/users/${encodeURIComponent(account.slice(6))}`;
+        const installations = yield* decodedPages(app, "/app/installations?per_page=100", Installation).pipe(Stream.runCollect);
+        const first = installations.flatMap((page) => page.items)[0];
+        if (first === undefined) {
+            return { administrable: [], readable: [] };
+        }
+        const resolver = yield* installation(first.id);
+        const { login } = yield* Effect.flatMap(resolver.read(path), (response) => response.decode(Account));
+        const readable = [];
+        const administrable = [];
+        for (const { id } of installations.flatMap((page) => page.items)) {
+            const client = yield* installation(id);
+            const access = yield* installationAccess(client, id, login);
+            readable.push(...access.readable);
+            administrable.push(...access.administrable);
+        }
+        return { administrable, readable };
+    });
+    return Cache.makeWith(lookup, { capacity: 100, timeToLive: (exit) => (Exit.isSuccess(exit) ? "60 seconds" : 0) });
+}
+//# sourceMappingURL=viewerRepositoryAccess.js.map

package/dist/viewerRepositoryAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewerRepositoryAccess.js","sourceRoot":"","sources":["../src/viewerRepositoryAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,OAAO,EAAE,MAAM,CAAC,MAAM;IACtB,EAAE,EAAE,MAAM,CAAC,MAAM;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;CACvB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;AAOpD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACxD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAEhE,MAAM,kBAAkB,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAuB,EAAE,cAAsB,EAAE,KAAa;IACrH,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,yCAAyC,EAAE,mBAAmB,EAAE;QACzG,QAAQ,EAAE,cAAc;KACxB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAiD,EAAE,CAAC;IAClE,MAAM,aAAa,GAAsD,EAAE,CAAC;IAC5E,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,cAAc,GAAG,UAAU,kBAAkB,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;QAC3K,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CACpH,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EACvC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAC/D,CAAC;QACF,MAAM,SAAS,GAAG,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAClG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;YAC5B,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;IACF,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAmC,CAAC;AACrE,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,YAA4D;IACxH,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAe;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxH,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,iCAAiC,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACxH,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAmC,CAAC;QAC7E,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACrG,MAAM,QAAQ,GAAiD,EAAE,CAAC;QAClE,MAAM,aAAa,GAAsD,EAAE,CAAC;QAC5E,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAC5D,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;YAClC,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAmC,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/github",
-  "version": "0.8.6",
+  "version": "0.10.0",
   "description": "Typed GitHub REST requests, conditional reads and resource budgets for Effect applications",
   "keywords": [
     "effect"
@@ -43,25 +43,32 @@
     "README.md"
   ],
   "dependencies": {
-    "@shivaedev/errors": "0.4.1",
-    "@shivaedev/http": "0.3.1",
-    "@shivaedev/service": "0.6.0"
+    "@shivaedev/errors": "0.5.0",
+    "@shivaedev/http": "0.4.0",
+    "@shivaedev/service": "0.6.1"
   },
   "devDependencies": {
     "@effect/platform-node": "4.0.6",
     "@effect/platform-node-shared": "4.0.6",
     "@effect/vitest": "4.0.6",
-    "@shivaedev/quality": "0.54.0",
-    "@shivaedev/test": "0.12.0",
-    "@shivaedev/test-story": "0.32.0",
+    "@shivaedev/quality": "0.56.0",
+    "@shivaedev/test": "0.13.0",
+    "@shivaedev/test-story": "0.34.0",
     "@types/node": "24.19.2",
+    "@zip.js/zip.js": "2.24.0",
     "effect": "4.0.6",
     "typescript": "7.0.2",
     "vitest": "5.0.5"
   },
   "peerDependencies": {
+    "@zip.js/zip.js": "2.24.0",
     "effect": "4.0.6"
   },
+  "peerDependenciesMeta": {
+    "@zip.js/zip.js": {
+      "optional": true
+    }
+  },
   "engines": {
     "node": ">=24"
   },

package/src/GitHub.ts

@@ -5,7 +5,9 @@ import { artifacts } from "#artifacts.ts";
 import { checkRuns } from "#checkRuns.ts";
 import { GitHubConfig } from "#GitHubConfig.ts";
 import { GitHubToken } from "#GitHubToken.ts";
+import { decodedPages, type ListOptions } from "#pagedLists.ts";
 import { rateLimits } from "#rateLimits.ts";
+import { repositoryReads } from "#repositoryReads.ts";
 import { representations } from "#representations.ts";
 import { requests } from "#requests.ts";
 import { stickyComments } from "#stickyComments.ts";
@@ -21,7 +23,7 @@ export const GitHub = defineService({
 		const refresh = yield* TokenRefresh;
 		return {
 			apiUrl: config.apiUrl,
-			archive: artifacts(config.apiUrl, client, token, rates, refresh),
+			archive: yield* artifacts(config.apiUrl, rates),
 			rates,
 			request: requests(client, token, rates, refresh),
 			responseByteLimit: config.responseByteLimit,
@@ -35,6 +37,7 @@ export const GitHub = defineService({
 			...archive,
 			...stickyComments(client),
 			...checkRuns(client),
+			...repositoryReads(client),
 			observations: () => Effect.sync(() => [...rates.observations.values()]),
 			resource: (path: string) => Effect.sync(() => rates.resource(new URL(path, apiUrl).pathname)),
 			text: (path: string, accept: string, limit: number) =>
@@ -48,24 +51,42 @@ export function read<TSchema extends Schema.Constraint>(path: string, schema: TS
 	return Effect.flatMap(GitHub, (github) => Effect.flatMap(github.read(path, responseByteLimit), (response) => response.decode(schema)));
 }
 
-export function list<TSchema extends Schema.Constraint>(path: string, schema: TSchema, responseByteLimit?: number) {
-	return Stream.unwrap(Effect.flatMap(GitHub, (github) => github.list(path, undefined, responseByteLimit))).pipe(
-		Stream.mapEffect((response) => response.decode(Schema.Array(schema))),
-		Stream.flatMap(Stream.fromIterable),
-	);
+export function listPages<TSchema extends Schema.Constraint>(path: string, schema: TSchema, options?: ListOptions | number) {
+	return Stream.unwrap(Effect.map(GitHub, (github) => decodedPages(github, path, schema, options)));
+}
+
+export function list<TSchema extends Schema.Constraint>(path: string, schema: TSchema, options?: ListOptions | number) {
+	return listPages(path, schema, options).pipe(Stream.flatMap((page) => Stream.fromIterable(page.items)));
 }
 
-export function listBounded<TSchema extends Schema.Constraint>(path: string, schema: TSchema, pageCap: number, responseByteLimit?: number) {
-	return Stream.unwrap(Effect.flatMap(GitHub, (github) => github.list(path, undefined, responseByteLimit))).pipe(
+export function listBounded<TSchema extends Schema.Constraint>(path: string, schema: TSchema, pageCap: number, options?: ListOptions | number) {
+	return listPages(path, schema, options).pipe(
 		Stream.take(pageCap),
-		Stream.mapEffect((page) => Effect.map(page.decode(Schema.Array(schema)), (items) => ({ items, truncated: page.hasNext }))),
 		Stream.runCollect,
-		Effect.map((pages) => ({ items: pages.flatMap((page) => page.items), truncated: pages.at(-1)?.truncated ?? false })),
+		Effect.map((pages) => ({
+			items: pages.flatMap((page) => page.items),
+			skipped: pages.reduce((count, page) => count + page.skipped, 0),
+			truncated: pages.at(-1)?.hasNext ?? false,
+		})),
 	);
 }
 
+type WriteMethod = "POST" | "PATCH" | "PUT" | "DELETE";
+
 export function write<TSchema extends Schema.Constraint>(
-	method: "POST" | "PATCH",
+	method: WriteMethod,
+	path: string,
+	body: unknown,
+	schema: TSchema,
+	responseByteLimit?: number,
+): ReturnType<typeof writeDecoded<TSchema>>;
+export function write(method: WriteMethod, path: string, body?: unknown): ReturnType<typeof writeDecoded<typeof Schema.Void>>;
+export function write(method: WriteMethod, path: string, body?: unknown, schema: Schema.Constraint = Schema.Void, responseByteLimit?: number) {
+	return writeDecoded(method, path, body, schema, responseByteLimit);
+}
+
+function writeDecoded<TSchema extends Schema.Constraint>(
+	method: WriteMethod,
 	path: string,
 	body: unknown,
 	schema: TSchema,

package/src/GitHubToken.ts

@@ -1,6 +1,6 @@
 import { Config, Context, Effect, Layer, Option, Redacted, Stream } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
-import { type GitHubAppError, GitHubTokenError } from "./errors.ts";
+import { type GitHubAppError, type GitHubRateLimited, GitHubTokenError } from "#errors.ts";
 
 type Token = Option.Option<Redacted.Redacted<string>>;
 const environmentToken = Config.Redacted("GH_TOKEN").pipe(
@@ -8,7 +8,9 @@ const environmentToken = Config.Redacted("GH_TOKEN").pipe(
 	Config.option,
 );
 
-export class GitHubToken extends Context.Service<GitHubToken, Token | Effect.Effect<Token, GitHubAppError>>()("@shivaedev/github/GitHubToken") {
+export class GitHubToken extends Context.Service<GitHubToken, Token | Effect.Effect<Token, GitHubAppError | GitHubRateLimited>>()(
+	"@shivaedev/github/GitHubToken",
+) {
 	static readonly fromEnv = Layer.effect(GitHubToken)(environmentToken);
 
 	static readonly fromEnvOrCli = Layer.effect(GitHubToken)(

package/src/adapters/resolveApiUrl.ts

@@ -0,0 +1,5 @@
+export function resolveApiUrl(apiUrl: string, path: string) {
+	const base = new URL(apiUrl);
+	base.pathname = `${base.pathname.replace(/\/$/u, "")}/`;
+	return new URL(path.replace(/^\/(?!\/)/u, ""), base).href;
+}

package/src/adapters/zipEntries.ts

@@ -0,0 +1,69 @@
+import type { Entry } from "@zip.js/zip.js";
+import { Effect, Stream } from "effect";
+import { GitHubArtifactCompressionRatio, GitHubArtifactExtractedTooLarge, GitHubArtifactExtractionError } from "#artifactErrors.ts";
+
+interface ReadLimits {
+	readonly compressionRatioLimit: number;
+	readonly remaining: number;
+	readonly totalSizeLimit: number;
+}
+
+function invalidArchive() {
+	return new GitHubArtifactExtractionError({ reason: "invalid-archive" });
+}
+
+function readEntry(entry: Entry, limits: ReadLimits) {
+	return Effect.tryPromise({
+		catch: (error) =>
+			error instanceof GitHubArtifactExtractedTooLarge || error instanceof GitHubArtifactCompressionRatio ? error : invalidArchive(),
+		try: async (signal) => {
+			let size = 0;
+			const chunks: Uint8Array[] = [];
+			const output = new WritableStream<Uint8Array>({
+				write(chunk) {
+					size += chunk.byteLength;
+					if (size > limits.remaining) {
+						throw new GitHubArtifactExtractedTooLarge({ limit: limits.totalSizeLimit });
+					}
+					if (size > entry.compressedSize * limits.compressionRatioLimit) {
+						throw new GitHubArtifactCompressionRatio({ limit: limits.compressionRatioLimit, path: entry.filename });
+					}
+					chunks.push(chunk);
+				},
+			});
+			if (!entry.directory) {
+				await entry.getData(output, { signal });
+			}
+			const result = new Uint8Array(size);
+			let offset = 0;
+			for (const chunk of chunks) {
+				result.set(chunk, offset);
+				offset += chunk.byteLength;
+			}
+			return result;
+		},
+	});
+}
+
+export const zipEntries = Effect.fn("GitHub.zipEntries")(function* (bytes: Uint8Array) {
+	const { ZipReader, Uint8ArrayReader } = yield* Effect.tryPromise({
+		catch: () => new GitHubArtifactExtractionError({ reason: "reader-unavailable" }),
+		try: () => import("@zip.js/zip.js"),
+	});
+	const reader = new ZipReader(new Uint8ArrayReader(bytes), {
+		checkCrc32: true,
+		// Core validates paths so refusals retain their dedicated typed error.
+		filenameValidation: "tolerant",
+		useWebWorkers: false,
+	});
+	return Stream.fromAsyncIterable(reader.getEntriesGenerator(), invalidArchive).pipe(
+		Stream.map((entry) => ({
+			compressedSize: entry.compressedSize,
+			directory: entry.directory,
+			path: entry.filename,
+			read: (limits: ReadLimits) => readEntry(entry, limits),
+			symlink: entry.symlink,
+			uncompressedSize: entry.uncompressedSize,
+		})),
+	);
+});

package/src/appTokens.ts

@@ -0,0 +1,93 @@
+import { Cache, Clock, Context, Effect, Exit, Layer, Option, type Redacted, Schema } from "effect";
+import { HttpClient, HttpClientRequest } from "effect/http";
+import { readBoundedJson } from "@shivaedev/http/body.ts";
+import { resolveApiUrl } from "#adapters/resolveApiUrl.ts";
+import { appJwt } from "#appJwt.ts";
+import { authenticatedRequest } from "#authenticatedRequest.ts";
+import { GitHubAppError } from "#errors.ts";
+import { GitHubConfig } from "#GitHubConfig.ts";
+import { GitHubToken } from "#GitHubToken.ts";
+import type { GitHubAppOptions } from "#githubApp.ts";
+import { rateLimits } from "#rateLimits.ts";
+import { TokenRefresh } from "#TokenRefresh.ts";
+
+const Installation = Schema.Struct({ id: Schema.Number });
+const AccessToken = Schema.Struct({ expiresAt: Schema.DateFromString, token: Schema.RedactedFromValue(Schema.String) }).pipe(
+	Schema.encodeKeys({ expiresAt: "expires_at" }),
+);
+
+export function appTokens(options: GitHubAppOptions) {
+	return Layer.effectContext(
+		Effect.gen(function* () {
+			if (!("installationId" in options || "owner" in options)) {
+				return Context.make(GitHubToken, Effect.map(appJwt(options), Option.some)).pipe(Context.add(TokenRefresh, undefined));
+			}
+			const client = yield* HttpClient.HttpClient;
+			const { apiUrl } = yield* GitHubConfig;
+			let installationId = "installationId" in options ? options.installationId : undefined;
+			const request = appRequests(client, apiUrl);
+			const exchange = Effect.gen(function* () {
+				const jwt = yield* appJwt(options);
+				if (installationId === undefined && "owner" in options && options.owner !== undefined) {
+					const path = `/repos/${encodeURIComponent(options.owner)}/${encodeURIComponent(options.repository)}/installation`;
+					installationId = (yield* request("GET", path, jwt, Installation)).id;
+				}
+				const access = yield* request("POST", `/app/installations/${installationId}/access_tokens`, jwt, AccessToken, {
+					permissions: options.scope?.permissions,
+					repositories: options.scope?.repositories,
+					"repository_ids": options.scope?.repositoryIds,
+				});
+				const now = yield* Clock.currentTimeMillis;
+				return { ...access, timeToLive: Math.max(0, access.expiresAt.getTime() - now - 300_000) };
+			});
+			const cache = yield* Cache.makeWith((_: undefined) => exchange, {
+				capacity: 1,
+				timeToLive: (exit) => (Exit.isSuccess(exit) ? exit.value.timeToLive : 0),
+			});
+			return Context.make(
+				GitHubToken,
+				Effect.map(Cache.get(cache, undefined), ({ token }) => Option.some(token)),
+			).pipe(
+				Context.add(TokenRefresh, (rejected) =>
+					Cache.invalidateWhen(cache, undefined, ({ token }) => Option.isSome(rejected) && token === rejected.value),
+				),
+			);
+		}),
+	);
+}
+
+function appRequests(client: HttpClient.HttpClient, apiUrl: string) {
+	const scoped = HttpClient.withScope(client);
+	const rates = rateLimits();
+	return Effect.fnUntraced(function* <TSchema extends Schema.Constraint>(
+		method: "GET" | "POST",
+		path: string,
+		jwt: Redacted.Redacted<string>,
+		schema: TSchema,
+		body?: unknown,
+	) {
+		let input = HttpClientRequest.make(method)(resolveApiUrl(apiUrl, path), {
+			headers: { Accept: "application/vnd.github+json" },
+		});
+		if (body !== undefined) {
+			input = yield* HttpClientRequest.bodyJson(input, body).pipe(Effect.mapError((cause) => new GitHubAppError({ reason: "encode" }, { cause })));
+		}
+		const response = yield* authenticatedRequest(
+			scoped,
+			Option.some(jwt),
+			rates,
+		)(input).pipe(
+			Effect.mapError((cause) => {
+				if (cause._tag === "GitHubRateLimited") {
+					return cause;
+				}
+				return cause._tag === "GitHubTransportError"
+					? new GitHubAppError({ reason: "transport" }, { cause: cause.cause })
+					: new GitHubAppError({ reason: "status", status: "status" in cause ? cause.status : 403 });
+			}),
+		);
+		return yield* readBoundedJson(response, 64 * 1024, schema).pipe(
+			Effect.mapError((cause) => new GitHubAppError({ reason: cause._tag === "HttpClientError" ? "transport" : "response" }, { cause })),
+		);
+	}, Effect.scoped);
+}

package/src/artifactErrors.ts

@@ -0,0 +1,26 @@
+import { Schema } from "effect";
+
+export class GitHubArtifactPathTraversal extends Schema.TaggedError<GitHubArtifactPathTraversal>()("GitHubArtifactPathTraversal", {
+	path: Schema.String,
+}) {}
+
+export class GitHubArtifactSymlink extends Schema.TaggedError<GitHubArtifactSymlink>()("GitHubArtifactSymlink", {
+	path: Schema.String,
+}) {}
+
+export class GitHubArtifactDuplicateEntry extends Schema.TaggedError<GitHubArtifactDuplicateEntry>()("GitHubArtifactDuplicateEntry", {
+	path: Schema.String,
+}) {}
+
+export class GitHubArtifactCompressionRatio extends Schema.TaggedError<GitHubArtifactCompressionRatio>()("GitHubArtifactCompressionRatio", {
+	limit: Schema.Number,
+	path: Schema.String,
+}) {}
+
+export class GitHubArtifactExtractedTooLarge extends Schema.TaggedError<GitHubArtifactExtractedTooLarge>()("GitHubArtifactExtractedTooLarge", {
+	limit: Schema.Number,
+}) {}
+
+export class GitHubArtifactExtractionError extends Schema.TaggedError<GitHubArtifactExtractionError>()("GitHubArtifactExtractionError", {
+	reason: Schema.Literals(["reader-unavailable", "invalid-archive", "invalid-limits"]),
+}) {}

package/src/artifactExtraction.ts

@@ -0,0 +1,62 @@
+import { Effect, Stream } from "effect";
+import { zipEntries } from "#adapters/zipEntries.ts";
+import {
+	GitHubArtifactCompressionRatio,
+	GitHubArtifactExtractedTooLarge,
+	GitHubArtifactExtractionError,
+	GitHubArtifactSymlink,
+} from "#artifactErrors.ts";
+import { artifactPaths } from "#artifactPaths.ts";
+
+export interface ArtifactExtractionOptions {
+	readonly compressionRatioLimit?: number;
+	readonly totalSizeLimit?: number;
+}
+
+export interface ArtifactFile {
+	readonly bytes: Uint8Array;
+	readonly path: string;
+}
+
+export const extractArtifactArchive = Effect.fn("GitHub.extractArtifactArchive")(function* (bytes: Uint8Array, options: ArtifactExtractionOptions) {
+	const totalSizeLimit = options.totalSizeLimit ?? 100 * 1024 * 1024;
+	const compressionRatioLimit = options.compressionRatioLimit ?? 100;
+	if (!Number.isSafeInteger(totalSizeLimit) || totalSizeLimit < 0 || !Number.isFinite(compressionRatioLimit) || compressionRatioLimit <= 0) {
+		return yield* new GitHubArtifactExtractionError({ reason: "invalid-limits" });
+	}
+	const entries = yield* zipEntries(bytes);
+	const pathOf = artifactPaths();
+	const files: ArtifactFile[] = [];
+	let total = 0;
+	yield* entries.pipe(
+		Stream.runForEach((entry) =>
+			Effect.gen(function* () {
+				const path = yield* pathOf(entry.path, entry.directory);
+				yield* validateEntry(entry, total, { compressionRatioLimit, totalSizeLimit });
+				const content = yield* entry.read({ compressionRatioLimit, remaining: totalSizeLimit - total, totalSizeLimit });
+				total += content.byteLength;
+				if (!entry.directory) {
+					files.push({ bytes: content, path });
+				}
+			}),
+		),
+	);
+	return files;
+});
+
+type ZipEntry = Stream.Success<Effect.Success<ReturnType<typeof zipEntries>>>;
+
+const validateEntry = Effect.fnUntraced(function* (entry: ZipEntry, total: number, options: Required<ArtifactExtractionOptions>) {
+	if (entry.symlink) {
+		return yield* new GitHubArtifactSymlink({ path: entry.path });
+	}
+	if (entry.directory && entry.uncompressedSize !== 0) {
+		return yield* new GitHubArtifactExtractionError({ reason: "invalid-archive" });
+	}
+	if (total + entry.uncompressedSize > options.totalSizeLimit) {
+		return yield* new GitHubArtifactExtractedTooLarge({ limit: options.totalSizeLimit });
+	}
+	if (entry.uncompressedSize > entry.compressedSize * options.compressionRatioLimit) {
+		return yield* new GitHubArtifactCompressionRatio({ limit: options.compressionRatioLimit, path: entry.path });
+	}
+});

package/src/artifactPaths.ts

@@ -0,0 +1,36 @@
+import { Effect } from "effect";
+import { GitHubArtifactDuplicateEntry, GitHubArtifactPathTraversal } from "#artifactErrors.ts";
+
+const safeName = Effect.fnUntraced(function* (path: string, directory: boolean) {
+	const name = directory && path.endsWith("/") ? path.slice(0, -1) : path;
+	const segments = name.split("/");
+	if (/[\\:\0]/u.test(name) || segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
+		return yield* new GitHubArtifactPathTraversal({ path });
+	}
+	return { name, segments };
+});
+
+export function artifactPaths() {
+	const entries = new Set<string>();
+	const files = new Set<string>();
+	const directories = new Set<string>();
+	const registerParents = Effect.fnUntraced(function* (path: string, segments: readonly string[]) {
+		for (let index = 1; index < segments.length; index += 1) {
+			const parent = segments.slice(0, index).join("/");
+			if (files.has(parent)) {
+				return yield* new GitHubArtifactDuplicateEntry({ path });
+			}
+			directories.add(parent);
+		}
+	});
+	return Effect.fnUntraced(function* (path: string, directory: boolean) {
+		const { name, segments } = yield* safeName(path, directory);
+		if (entries.has(name) || (!directory && directories.has(name))) {
+			return yield* new GitHubArtifactDuplicateEntry({ path });
+		}
+		yield* registerParents(path, segments);
+		entries.add(name);
+		(directory ? directories : files).add(name);
+		return name;
+	});
+}