@davidvornholt/standards 0.17.3 → 0.18.0

package/README.md

@@ -25,7 +25,7 @@ standards poller --config <path>
 standards poller --print-units --config <path>
 ```
 
-`dependabot --write` regenerates the composed `.github/dependabot.yml` from the canonical `.github/dependabot.base.yml` and the optional repo-owned `.github/dependabot.local.yml`; `init` and `sync` do the same automatically. `dependabot --check` verifies the generated file still matches its sources, and `doctor`/`check` include the same verification. The overlay is deliberately lean and additive only: new update blocks for repo-specific ecosystems, top-level private registry definitions, and `ignore` or `registries` entries appended by repeating a canonical block's normalized target. Matching blocks cannot add labels, groups, cooldowns, pull-request limits, or other policy.
+`dependabot --write` regenerates the composed `.github/dependabot.yml` from the canonical `.github/dependabot.base.yml` and the optional repo-owned `.github/dependabot.local.yml`; `init` and `sync` do the same automatically. `dependabot --check` verifies the generated file still matches its sources, and `doctor`/`check` include the same verification. The overlay is deliberately lean and additive only: new update blocks for repo-specific ecosystems, top-level private registry definitions, and `ignore` or `registries` entries appended by repeating a canonical block's normalized target. Matching blocks cannot add labels, groups, cooldowns, pull-request limits, or other policy. Update blocks for the same ecosystem and target branch must not select intersecting directories after Dependabot's path normalization. A plural `directories` target is expanded as a glob when it contains `*`, `?`, or both `[` and `]`: `*` and bare `**` stay within one path segment, `**/` matches zero or more directory segments, `?` matches one non-separator character, and bracket expressions match character sets or ranges. Singular `directory` values are always literal.
 
 `dev-env` decrypts the SOPS-encrypted `secrets/dev.yaml` — keyed by workspace group and a one-segment kebab-case workspace name (`apps.<name>`, `packages.<name>`), each mapping portable environment variable names to string values — and transactionally writes every declared workspace's `.env.local` with owner-only permissions and a do-not-edit header. Its Bun-specific dotenv codec exactly round-trips every value it accepts without adding helper environment variables; a value the codec cannot encode exactly is gathered as a validation problem instead of being changed silently. Validation gathers all document, containment, destination-type, workspace, and gitignore problems before writing anything. Generation then stages every output in its destination directory and rolls the whole set back if staging or commit fails, preserving prior contents, modes, and absent files; symlink destinations, duplicate resolved destinations, changed parent-directory identities, and symlinked workspace paths are rejected without following the link. Cleanup trouble after a completed commit is reported loudly as a warning rather than falsely reporting generation failure. Parent identities are checked immediately before each path operation; an unavoidable swap in the syscall-sized interval after a check remains outside the non-hostile maintainer threat model. The canonical `justfile` exposes the command as `just dev-env-generate`, and `just dev-refresh` chains a `just secrets edit dev` session into regeneration.
 
@@ -48,6 +48,6 @@ standards poller --print-units --config <path>
 - **`.github/settings.local.json` `"rulesetEnforcement": "unavailable-on-plan"`** (optional) — declares that the repository's GitHub plan cannot enforce rulesets (private repositories on GitHub Free, both personal accounts and organizations). `github --check` and `--apply` then skip rulesets instead of comparing them, because a comparison cannot be trusted there: personal accounts answer ruleset reads with HTTP 403, and free-plan organizations report declared rulesets as active while silently not enforcing them. Plan-gated repository settings that only function alongside branch protection (`allow_auto_merge`) are skipped for the same reason — GitHub accepts a PATCH for them with HTTP 200 and silently keeps the old value. The remaining repository merge settings are still checked and converged, and both commands print an unprotected-branch notice on every run. The only accepted value is `"unavailable-on-plan"` (enforcement is the default; omit the key on paid plans), and combining the opt-out with additional local rulesets is rejected. After upgrading the plan, remove the declaration and run `bun standards github --apply` to restore enforcement.
 - **Poller config file** (required for `poller`, passed via `--config`) — host-level JSON, deliberately not repository state. Required: `"repos"` (1–12 unique `owner/repo` strings), `"model"` and `"reasoningEffort"` (passed to `codex exec`; the model choice is deliberate and has no default). The 12-repository maximum and five-minute acknowledgement cooldown keep supported mixed fix/review queues and persisted review-plan recovery below the 5,000-request/hour GitHub API budget with at least 1,400 requests/hour reserved for pagination, active jobs, writes, and other token users; the compound regression bound covers four acknowledged fixes plus four acknowledged reviews with persisted plans in every repository at no more than 3,312 requests/hour. Existing configs above the repository limit must be reduced or split across pollers with independent GitHub API budgets before upgrading. Optional: `"maxJobsPerTick"` (default 1 — the maximum number of new Codex runs the sequential worker may start in one tick), `"staleClaimHours"` (default 6; must exceed `runTimeoutMinutes` so a sweep can never release the claim of a job that is still running), `"runTimeoutMinutes"` (default 240 — the timeout catches wedged agents, not honest multi-hour review runs), `"cacheDir"` (default `~/.cache/standards-poller`; holds bare mirrors and job worktrees; relative paths resolve against the config file), `"extraCodexArgs"` (extra `codex exec` arguments, e.g. enabling the collaboration feature for subagent fan-out). Unknown keys are rejected. The poller needs `git`, `gh`, `codex` (authenticated — its rotating auth state must live in a writable location), and a GitHub token per the bullet below; the token needs issues, pull-requests, and contents write on the watched repos, and nothing else.
 - **Broker store** (created by `creds login`) — machine-global root credentials at `$XDG_CONFIG_HOME/standards/broker.yaml` (default `~/.config/standards/broker.yaml`; override with `STANDARDS_BROKER_FILE`), holding the GitHub App identity (id, slug, client id, private key) and one bootstrap token per Cloudflare account. The file is plaintext with `0600` permissions — deliberately the same local-account trust boundary as the plaintext personal age identity at `~/.config/sops/age/keys.txt`, which unlocks the same secrets; SOPS-encrypting the store to that adjacent identity would not improve custody. Writes use an owner-only temporary file and atomic replacement, and simultaneous provider logins merge rather than overwrite each other; `creds status` warns when the final mode is broader. The store lives outside every repository, is never synced or backed up, and losing it is cheap: re-run the two login commands and revoke the old App key and bootstrap token. On an additional machine, do not create a second App: generate an additional private key from the existing App's settings page (GitHub Apps support several active keys; key generation has no API) and add it to that machine's store, so retiring a machine revokes one key, not the setup.
-- **`GH_TOKEN` / `GITHUB_TOKEN`** (optional generally; poller automation requires this or a logged-in `gh`) — GitHub API token for the `github` command and the GitHub portion of `check`; poller runs pass environment tokens through to Codex, while a local poller can share the service identity's authenticated `gh` state. When neither is available, other commands can still read public repositories anonymously, but poller writes and `github --apply` fail. GitHub's REST API reveals repo merge settings only to write-capable viewers — `check` retries REST-hidden keys over GraphQL, which serves them to read-only tokens — ruleset `bypass_actors` requires repository Administration read, and private-repository labels require Issues read (or Pull requests read); a token that still cannot see declared state fails the check rather than passing unverified. In CI, the canonical workflow decrypts `ci.github_settings_read_token` from the SOPS-encrypted `secrets/ci.yaml`: a repository-scoped fine-grained PAT with read-only "Administration" and "Issues" access.
+- **`GH_TOKEN` / `GITHUB_TOKEN`** (optional generally; poller automation requires this or a logged-in `gh`) — GitHub API token for the `github` command and the GitHub portion of `check`; poller runs pass environment tokens through to Codex, while a local poller can share the service identity's authenticated `gh` state. When neither is available, other commands can still read public repositories anonymously, but poller writes and `github --apply` fail. GitHub's REST API reveals repo merge settings only to write-capable viewers, and `check` retries REST-hidden keys over GraphQL, which serves them to read-only tokens. REST serves ruleset `bypass_actors` only to a user-scoped token holding repository Administration read (a fine-grained PAT with that permission, such as CI's settings token, or the local `gh` CLI), and never to a GitHub App installation token at any permission level, so `check` retries the hidden lists over GraphQL, which withholds the actor identities but answers an exact bypass-actor count (established for a GitHub App installation token and for a non-admin classic-scope viewer, not for every identity class): a declared-empty list verifies exactly, a count that disagrees with the declared length is drift, and a matching non-zero count leaves *which* actors bypass unconfirmed, so the gate fails closed on that ruleset. An installation-token run therefore leaves a declared non-empty list failing until the check is re-run locally with admin `gh` auth; broadening the settings PAT beyond read-only Administration is not the fix. Private-repository labels require Issues read (or Pull requests read); a token that still cannot see declared state fails the check rather than passing unverified. In CI, the canonical workflow decrypts `ci.github_settings_read_token` from the SOPS-encrypted `secrets/ci.yaml`: a repository-scoped fine-grained PAT with read-only "Administration" and "Issues" access.
 
 See the standards repository README for the ownership model and adoption workflow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.17.3",
+  "version": "0.18.0",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
   "repository": {
@@ -54,6 +54,9 @@
     "src/creds-store-lock.ts",
     "src/dependabot-compose-input.ts",
     "src/dependabot-compose.ts",
+    "src/dependabot-directory-character-class.ts",
+    "src/dependabot-directory-normalize.ts",
+    "src/dependabot-directory-overlap.ts",
     "src/dependabot-inspect.ts",
     "src/dependabot-update.ts",
     "src/dev-env-document.ts",
@@ -66,13 +69,18 @@
     "src/dev-env.ts",
     "src/github-api.ts",
     "src/github-apply.ts",
+    "src/github-bypass-actors.ts",
     "src/github-command-shared.ts",
     "src/github-commands.ts",
     "src/github-diff.ts",
+    "src/github-graphql.ts",
     "src/github-labels.ts",
     "src/github-label-identity.ts",
     "src/github-live-drift.ts",
     "src/github-paginate.ts",
+    "src/github-ruleset-api.ts",
+    "src/github-ruleset-diff.ts",
+    "src/github-ruleset-visibility.ts",
     "src/github-settings-merge.ts",
     "src/github-settings-parse.ts",
     "src/github-settings.ts",

package/src/cli.ts

@@ -328,13 +328,6 @@ const reportMirror = (result: MirrorResult, dryRun: boolean): void => {
         `  would overwrite ${result.tampered.length} locally-modified canonical file(s): ${result.tampered.join(', ')}`,
       );
     }
-    const changes =
-      result.created.length + result.updated.length + result.deleted.length;
-    console.log(
-      changes === 0
-        ? 'dry run: already in sync; no changes'
-        : `dry run: ${result.created.length} to create, ${result.updated.length} to update, ${result.deleted.length} to delete`,
-    );
     return;
   }
   for (const rel of result.deleted) {
@@ -347,6 +340,22 @@ const reportMirror = (result: MirrorResult, dryRun: boolean): void => {
   }
 };
 
+const reportDryRunSummary = (
+  result: MirrorResult,
+  generated: boolean,
+): void => {
+  const changes =
+    result.created.length +
+    result.updated.length +
+    result.deleted.length +
+    Number(generated);
+  console.log(
+    changes === 0
+      ? 'dry run: already in sync; no changes'
+      : `dry run: ${result.created.length} to create, ${result.updated.length} to update, ${result.deleted.length} to delete, ${Number(generated)} to generate`,
+  );
+};
+
 const seedTargets = (
   srcDir: string,
   seedDir: string,
@@ -422,8 +431,13 @@ const runSync = async (
     dryRun,
   });
   reportMirror(result, dryRun);
-  await applyProspectiveDependabot(consumer, prospectiveDependabot, dryRun);
+  const generated = await applyProspectiveDependabot(
+    consumer,
+    prospectiveDependabot,
+    dryRun,
+  );
   if (dryRun) {
+    reportDryRunSummary(result, generated);
     return;
   }
   await writeLock(consumer, {
@@ -612,16 +626,17 @@ const applyProspectiveDependabot = async (
   consumer: string,
   prospective: ProspectiveDependabot,
   dryRun: boolean,
-): Promise<void> => {
+): Promise<boolean> => {
   if (prospective.current === prospective.composed) {
-    return;
+    return false;
   }
   if (dryRun) {
     console.log(`  would generate ${DEPENDABOT_FILE}`);
-    return;
+    return true;
   }
   await writeComposedDependabot(consumer, prospective.composed);
   console.log(`  generated ${DEPENDABOT_FILE}`);
+  return true;
 };
 
 const runDependabotCheck = async (consumer: string): Promise<boolean> => {

package/src/creds-login-github-manifest.ts

@@ -10,13 +10,20 @@ import { isRecord } from './github-settings-parse';
 
 export const MANIFEST_STATE_BYTES = 32;
 
-// Root-credential ceiling: everything the broker may ever delegate. Actual
-// grants are narrowed per installation token at mint time.
-const DEFAULT_PERMISSIONS = Object.fromEntries(
-  'administration actions contents issues pull_requests secrets workflows'
-    .split(' ')
-    .map((permission) => [permission, 'write']),
-);
+// Root-credential ceiling: everything the broker may ever delegate. The
+// `permission-*` inputs a workflow passes when minting are a request, not a
+// constraint — anything holding the durable private key can request the whole
+// ceiling — so this, not those inputs, is the blast radius of the App identity
+// sitting in every consumer's secrets/ci.yaml. It therefore lists only grants a
+// workflow actually uses today; widening it is a deliberate edit here plus a
+// settings-page change on the existing App, not a default to grow into.
+const DEFAULT_PERMISSIONS = {
+  actions: 'read',
+  contents: 'write',
+  issues: 'write',
+  metadata: 'read',
+  pull_requests: 'write',
+} as const;
 
 export const buildAppManifest = (
   name: string,

package/src/dependabot-directory-character-class.ts

@@ -0,0 +1,139 @@
+export type CharacterMatcher =
+  | { readonly kind: 'literal'; readonly value: number }
+  | { readonly kind: 'non-slash' }
+  | {
+      readonly kind: 'class';
+      readonly ranges: ReadonlyArray<readonly [number, number]>;
+      readonly negated: boolean;
+    };
+
+type CharacterRange = readonly [number, number];
+
+type ClassValue = {
+  readonly escaped: boolean;
+  readonly value: number;
+};
+
+const BEFORE_SLASH = '/'.codePointAt(0) ?? 0;
+const AFTER_SLASH = BEFORE_SLASH + 1;
+const HYPHEN = '-'.codePointAt(0) ?? 0;
+const MAXIMUM_CODE_POINT = 0x10_ff_ff;
+
+const NON_SLASH_RANGES: ReadonlyArray<CharacterRange> = [
+  [0, BEFORE_SLASH - 1],
+  [AFTER_SLASH, MAXIMUM_CODE_POINT],
+];
+
+const intersectRanges = (
+  left: ReadonlyArray<CharacterRange>,
+  right: ReadonlyArray<CharacterRange>,
+): ReadonlyArray<CharacterRange> => {
+  const intersection: Array<CharacterRange> = [];
+  for (const [leftStart, leftEnd] of left) {
+    for (const [rightStart, rightEnd] of right) {
+      const start = Math.max(leftStart, rightStart);
+      const end = Math.min(leftEnd, rightEnd);
+      if (start <= end) {
+        intersection.push([start, end]);
+      }
+    }
+  }
+  return intersection;
+};
+
+const subtractRanges = (
+  ranges: ReadonlyArray<CharacterRange>,
+  excluded: ReadonlyArray<CharacterRange>,
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: Range subtraction keeps the finite character-class intersection exact.
+): ReadonlyArray<CharacterRange> => {
+  let remaining = [...ranges];
+  for (const [excludedStart, excludedEnd] of excluded) {
+    const next: Array<CharacterRange> = [];
+    for (const [start, end] of remaining) {
+      if (excludedEnd < start || excludedStart > end) {
+        next.push([start, end]);
+      } else {
+        if (start < excludedStart) {
+          next.push([start, excludedStart - 1]);
+        }
+        if (excludedEnd < end) {
+          next.push([excludedEnd + 1, end]);
+        }
+      }
+    }
+    remaining = next;
+  }
+  return remaining;
+};
+
+const matcherRanges = (
+  matcher: CharacterMatcher,
+): ReadonlyArray<CharacterRange> => {
+  if (matcher.kind === 'literal') {
+    return [[matcher.value, matcher.value]];
+  }
+  if (matcher.kind === 'non-slash') {
+    return NON_SLASH_RANGES;
+  }
+  return matcher.negated
+    ? subtractRanges(NON_SLASH_RANGES, matcher.ranges)
+    : intersectRanges(NON_SLASH_RANGES, matcher.ranges);
+};
+
+export const matchersIntersect = (
+  left: CharacterMatcher,
+  right: CharacterMatcher,
+): boolean =>
+  intersectRanges(matcherRanges(left), matcherRanges(right)).length > 0;
+
+export const parseCharacterClass = (
+  characters: ReadonlyArray<string>,
+  start: number,
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: Ruby character classes require escape, negation, and range state in one parser.
+): { readonly end: number; readonly matcher: CharacterMatcher } | null => {
+  let cursor = start + 1;
+  const negated = characters[cursor] === '!' || characters[cursor] === '^';
+  if (negated) {
+    cursor += 1;
+  }
+  const values: Array<ClassValue> = [];
+  for (
+    ;
+    cursor < characters.length && characters[cursor] !== ']';
+    cursor += 1
+  ) {
+    let escaped = false;
+    if (characters[cursor] === '\\' && characters[cursor + 1] !== undefined) {
+      cursor += 1;
+      escaped = true;
+    }
+    values.push({
+      escaped,
+      value: characters[cursor]?.codePointAt(0) ?? 0,
+    });
+  }
+  if (characters[cursor] !== ']') {
+    return null;
+  }
+  const ranges: Array<CharacterRange> = [];
+  for (let index = 0; index < values.length; index += 1) {
+    const startValue = values[index]?.value ?? 0;
+    const separator = values[index + 1];
+    const endValue = values[index + 2]?.value ?? 0;
+    if (
+      index + 2 < values.length &&
+      separator?.value === HYPHEN &&
+      !separator.escaped
+    ) {
+      if (startValue <= endValue) {
+        ranges.push([startValue, endValue]);
+      } else {
+        ranges.push([startValue, startValue], [endValue, endValue]);
+      }
+      index += 2;
+    } else {
+      ranges.push([startValue, startValue]);
+    }
+  }
+  return { end: cursor, matcher: { kind: 'class', ranges, negated } };
+};

package/src/dependabot-directory-normalize.ts

@@ -0,0 +1,33 @@
+const applySegment = (
+  segments: Array<string>,
+  segment: string,
+  absolute: boolean,
+): void => {
+  if (segment !== '' && segment !== '.') {
+    if (segment !== '..') {
+      segments.push(segment);
+    } else if (segments.at(-1) !== undefined && segments.at(-1) !== '..') {
+      segments.pop();
+    } else if (!absolute) {
+      segments.push(segment);
+    }
+  }
+};
+
+export const normalizeDependabotDirectory = (directory: string): string => {
+  const absolute = directory.startsWith('/');
+  const segments: Array<string> = [];
+  for (const segment of directory.split('/')) {
+    applySegment(segments, segment, absolute);
+  }
+  let normalized = segments.join('/');
+  if (normalized === '') {
+    normalized = absolute ? '/' : '.';
+  }
+  return normalized.startsWith('/') ? normalized : `/${normalized}`;
+};
+
+export const isDependabotGlob = (directory: string): boolean =>
+  directory.includes('*') ||
+  directory.includes('?') ||
+  (directory.includes('[') && directory.includes(']'));

package/src/dependabot-directory-overlap.ts

@@ -0,0 +1,139 @@
+import {
+  type CharacterMatcher,
+  matchersIntersect,
+  parseCharacterClass,
+} from './dependabot-directory-character-class';
+
+type Edge = {
+  readonly from: number;
+  readonly to: number;
+  readonly matcher: CharacterMatcher | null;
+};
+
+type Automaton = {
+  readonly accept: number;
+  readonly edges: ReadonlyArray<Edge>;
+};
+
+const compileDirectory = (
+  directory: string,
+  supportsGlobs: boolean,
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: Ruby glob tokens have distinct NFA transitions that are clearest in one ordered parser.
+): Automaton => {
+  const characters = [...directory];
+  const edges: Array<Edge> = [];
+  let current = 0;
+  let states = 1;
+  const append = (matcher: CharacterMatcher): void => {
+    const next = states;
+    states += 1;
+    edges.push({ from: current, to: next, matcher });
+    current = next;
+  };
+
+  for (let index = 0; index < characters.length; index += 1) {
+    const character = characters[index];
+    if (!supportsGlobs) {
+      append({ kind: 'literal', value: character?.codePointAt(0) ?? 0 });
+    } else if (character === '\\' && characters[index + 1] !== undefined) {
+      index += 1;
+      append({
+        kind: 'literal',
+        value: characters[index]?.codePointAt(0) ?? 0,
+      });
+    } else if (
+      character === '*' &&
+      characters[index + 1] === '*' &&
+      characters[index + 2] === '/' &&
+      (index === 0 || characters[index - 1] === '/')
+    ) {
+      const next = states;
+      const insideDirectory = states + 1;
+      states += 2;
+      edges.push(
+        { from: current, to: next, matcher: null },
+        { from: current, to: insideDirectory, matcher: { kind: 'non-slash' } },
+        {
+          from: insideDirectory,
+          to: insideDirectory,
+          matcher: { kind: 'non-slash' },
+        },
+        {
+          from: insideDirectory,
+          to: current,
+          matcher: { kind: 'literal', value: '/'.codePointAt(0) ?? 0 },
+        },
+      );
+      current = next;
+      index += 2;
+    } else if (character === '*') {
+      while (characters[index + 1] === '*') {
+        index += 1;
+      }
+      const next = states;
+      states += 1;
+      edges.push(
+        { from: current, to: next, matcher: null },
+        { from: current, to: current, matcher: { kind: 'non-slash' } },
+      );
+      current = next;
+    } else if (character === '?') {
+      append({ kind: 'non-slash' });
+    } else if (character === '[') {
+      const parsed = parseCharacterClass(characters, index);
+      if (parsed === null) {
+        append({ kind: 'literal', value: '['.codePointAt(0) ?? 0 });
+      } else {
+        append(parsed.matcher);
+        index = parsed.end;
+      }
+    } else {
+      append({ kind: 'literal', value: character?.codePointAt(0) ?? 0 });
+    }
+  }
+  return { accept: current, edges };
+};
+
+export const directoriesOverlap = (
+  leftDirectory: string,
+  leftSupportsGlobs: boolean,
+  rightDirectory: string,
+  rightSupportsGlobs: boolean,
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: The product walk must process both automata's epsilon and consuming transitions together.
+): boolean => {
+  const left = compileDirectory(leftDirectory, leftSupportsGlobs);
+  const right = compileDirectory(rightDirectory, rightSupportsGlobs);
+  const pending: Array<readonly [number, number]> = [[0, 0]];
+  const visited = new Set<string>();
+  for (const [leftState, rightState] of pending) {
+    const key = `${leftState}:${rightState}`;
+    if (!visited.has(key)) {
+      visited.add(key);
+      if (leftState === left.accept && rightState === right.accept) {
+        return true;
+      }
+      const leftEdges = left.edges.filter((edge) => edge.from === leftState);
+      const rightEdges = right.edges.filter((edge) => edge.from === rightState);
+      pending.push(
+        ...leftEdges
+          .filter((edge) => edge.matcher === null)
+          .map((edge) => [edge.to, rightState] as const),
+        ...rightEdges
+          .filter((edge) => edge.matcher === null)
+          .map((edge) => [leftState, edge.to] as const),
+      );
+      for (const leftEdge of leftEdges) {
+        for (const rightEdge of rightEdges) {
+          if (
+            leftEdge.matcher !== null &&
+            rightEdge.matcher !== null &&
+            matchersIntersect(leftEdge.matcher, rightEdge.matcher)
+          ) {
+            pending.push([leftEdge.to, rightEdge.to]);
+          }
+        }
+      }
+    }
+  }
+  return false;
+};

package/src/dependabot-update.ts

@@ -1,3 +1,8 @@
+import {
+  isDependabotGlob,
+  normalizeDependabotDirectory,
+} from './dependabot-directory-normalize';
+import { directoriesOverlap } from './dependabot-directory-overlap';
 import { isNonEmptyString, isRecord } from './github-settings-parse';
 
 export type UpdateBlock = Record<string, unknown>;
@@ -6,6 +11,8 @@ export type UpdateTarget = {
   readonly ecosystem: string;
   readonly targetBranch: string | null;
   readonly directories: ReadonlyArray<string>;
+  readonly normalizedDirectories: ReadonlyArray<string>;
+  readonly globDirectories: ReadonlySet<string>;
 };
 
 const listOfNonEmptyStrings = (
@@ -72,6 +79,7 @@ export const updateTarget = (
   block: UpdateBlock,
   label: string,
   problems: Array<string>,
+  // biome-ignore lint/complexity/noExcessiveCognitiveComplexity: Target validation deliberately gathers every independent configuration problem.
 ): UpdateTarget | null => {
   const ecosystem = block['package-ecosystem'];
   if (!isNonEmptyString(ecosystem)) {
@@ -103,6 +111,9 @@ export const updateTarget = (
     ? [directory as string]
     : (directories as ReadonlyArray<string>);
   const normalized = [...new Set(rawDirectories)].sort();
+  const normalizedDirectories = [
+    ...new Set(normalized.map(normalizeDependabotDirectory)),
+  ].sort();
   if (
     !hasDirectory &&
     Array.isArray(directories) &&
@@ -120,6 +131,10 @@ export const updateTarget = (
     ecosystem,
     targetBranch: targetBranch ?? null,
     directories: normalized,
+    normalizedDirectories,
+    globDirectories: new Set(
+      hasDirectories ? normalizedDirectories.filter(isDependabotGlob) : [],
+    ),
   };
 };
 
@@ -135,9 +150,13 @@ export const sameUpdateTarget = (
   right: UpdateTarget,
 ): boolean =>
   sameUpdateScope(left, right) &&
-  left.directories.length === right.directories.length &&
-  left.directories.every(
-    (directory, index) => directory === right.directories[index],
+  left.normalizedDirectories.length === right.normalizedDirectories.length &&
+  left.normalizedDirectories.every(
+    (directory, index) => directory === right.normalizedDirectories[index],
+  ) &&
+  left.globDirectories.size === right.globDirectories.size &&
+  [...left.globDirectories].every((directory) =>
+    right.globDirectories.has(directory),
   );
 
 export const overlapsUpdateTarget = (
@@ -145,7 +164,16 @@ export const overlapsUpdateTarget = (
   right: UpdateTarget,
 ): boolean =>
   sameUpdateScope(left, right) &&
-  left.directories.some((directory) => right.directories.includes(directory));
+  left.normalizedDirectories.some((leftDirectory) =>
+    right.normalizedDirectories.some((rightDirectory) =>
+      directoriesOverlap(
+        leftDirectory,
+        left.globDirectories.has(leftDirectory),
+        rightDirectory,
+        right.globDirectories.has(rightDirectory),
+      ),
+    ),
+  );
 
 export const updateTargetDescription = (target: UpdateTarget): string => {
   const branch =

package/src/github-api.ts

@@ -112,83 +112,3 @@ export const loadDeclared = async (
     existsSync(localPath) ? await readFile(localPath, 'utf8') : null,
   );
 };
-
-const GRAPHQL_MERGE_FIELDS: ReadonlyMap<string, string> = new Map([
-  ['allow_auto_merge', 'autoMergeAllowed'],
-  ['allow_merge_commit', 'mergeCommitAllowed'],
-  ['allow_rebase_merge', 'rebaseMergeAllowed'],
-  ['allow_squash_merge', 'squashMergeAllowed'],
-  ['delete_branch_on_merge', 'deleteBranchOnMerge'],
-  ['merge_commit_message', 'mergeCommitMessage'],
-  ['merge_commit_title', 'mergeCommitTitle'],
-  ['squash_merge_commit_message', 'squashMergeCommitMessage'],
-  ['squash_merge_commit_title', 'squashMergeCommitTitle'],
-]);
-
-// REST omits repository merge settings for read-only viewers (they surface
-// only with write access — community discussion #153258), but GraphQL serves
-// the same values, with identical enum spellings, to any token that can read
-// the repository. This keeps a read-only PAT sufficient for the check.
-// Returns only the keys GraphQL answered; the rest stay unverifiable.
-export const fetchMergeSettingsViaGraphql = async (
-  token: string | null,
-  repo: string,
-  keys: ReadonlyArray<string>,
-): Promise<Readonly<Record<string, unknown>>> => {
-  const mapped = keys.filter((key) => GRAPHQL_MERGE_FIELDS.has(key));
-  const [owner, name] = repo.split('/');
-  if (mapped.length === 0 || owner === undefined || name === undefined) {
-    return {};
-  }
-  const fields = mapped.map((key) => GRAPHQL_MERGE_FIELDS.get(key)).join(' ');
-  const response = await request(token, 'POST', '/graphql', {
-    query: `query { repository(owner: ${JSON.stringify(owner)}, name: ${JSON.stringify(name)}) { ${fields} } }`,
-  });
-  if (response.status !== HTTP_OK || !isRecord(response.body)) {
-    return {};
-  }
-  const data = isRecord(response.body.data) ? response.body.data : null;
-  const repository =
-    data !== null && isRecord(data.repository) ? data.repository : null;
-  if (repository === null) {
-    return {};
-  }
-  return Object.fromEntries(
-    mapped
-      .map((key) => [key, repository[GRAPHQL_MERGE_FIELDS.get(key) ?? '']])
-      .filter(([, value]) => value !== undefined && value !== null),
-  );
-};
-
-export type LiveRulesets = {
-  readonly rulesets: ReadonlyArray<Record<string, unknown>> | null;
-  readonly problem: string | null;
-};
-
-// Only repository-sourced rulesets are managed; org-level rulesets a consumer
-// inherits are outside this declaration's authority.
-export const fetchLiveRulesets = async (
-  token: string | null,
-  repo: string,
-): Promise<LiveRulesets> => {
-  const list = await request(token, 'GET', `/repos/${repo}/rulesets`);
-  if (list.status !== HTTP_OK || !Array.isArray(list.body)) {
-    return { rulesets: null, problem: apiError('listing rulesets', list) };
-  }
-  const repoOwned = list.body
-    .filter(isRecord)
-    .filter((ruleset) => ruleset.source_type === 'Repository');
-  const detailed = await Promise.all(
-    repoOwned.map((ruleset) =>
-      request(token, 'GET', `/repos/${repo}/rulesets/${ruleset.id}`),
-    ),
-  );
-  const failed = detailed.find((response) => response.status !== HTTP_OK);
-  if (failed !== undefined) {
-    return { rulesets: null, problem: apiError('reading a ruleset', failed) };
-  }
-  return {
-    rulesets: detailed.map((response) => response.body).filter(isRecord),
-    problem: null,
-  };
-};

package/src/github-apply.ts

@@ -4,13 +4,14 @@
 
 import {
   apiError,
-  fetchLiveRulesets,
   HTTP_CREATED,
   HTTP_NO_CONTENT,
   HTTP_OK,
   request,
 } from './github-api';
-import { diffRepositorySettings, diffRuleset } from './github-diff';
+import { diffRepositorySettings } from './github-diff';
+import { fetchLiveRulesets } from './github-ruleset-api';
+import { diffRuleset } from './github-ruleset-diff';
 import { type GithubSettings, isRecord } from './github-settings-parse';
 
 // GitHub answers a PATCH containing a plan-unavailable setting with HTTP 200