@homeflare/alchemy 0.25.1 → 0.27.0

package/src/github/repository-ruleset-octokit.ts

@@ -0,0 +1,140 @@
+/**
+ * The real {@link RulesetOctokit} — every wire call this family makes, built from the EXPORTED
+ * `GitHubCredentials` service via `creds.octokit()`, exactly upstream's own `octokitFor` does
+ * (`node_modules/alchemy/src/GitHub/Octokit.ts`). H15: Octokit, not `@distilled.cloud/github`
+ * — its `S.Struct` request schemas have no field for `require_extra_approval_for_unattributed_
+ * changes` and would very likely strip an unknown key on encode; Octokit's REST methods hand
+ * their `parameters` object to `@octokit/endpoint` mostly as-is, so an extra JSON body key
+ * should reach the wire. repository-ruleset-wire.test.ts MEASURES this against a real Octokit
+ * instance with a fetch shim rather than asserting it from reading the source.
+ *
+ * ⚠️ "Reported success" is checked at the default branch's CURRENT TIP only, not its full
+ *   history — a context that reported success three merges ago and has since started failing
+ *   reads as reported (true), and one that has only ever run on a branch nobody has merged
+ *   since reads as never-reported (false) until the next merge updates the tip. A full-history
+ *   search is disproportionate to what this guard protects against (adding a context that
+ *   plainly cannot report), and GitHub's check-runs/statuses APIs are themselves scoped to a
+ *   single ref, not "ever, anywhere" — there is no cheaper vendor call that answers the wider
+ *   question.
+ */
+import type { Octokit as OctokitClient } from '@octokit/rest';
+import { GitHubCredentials } from 'alchemy/GitHub';
+import * as Effect from 'effect/Effect';
+import type { CreateRulesetBody } from './repository-ruleset-constraints.ts';
+import type { RulesetOctokit, RulesetRecord, RulesetSummary } from './repository-ruleset-probe.ts';
+
+export type RealRulesetOctokit = RulesetOctokit<GitHubCredentials>;
+
+const asError = (e: unknown): Error => (e instanceof Error ? e : new Error(String(e)));
+
+const octokitFor = (
+  baseUrl: string | undefined,
+): Effect.Effect<OctokitClient, Error, GitHubCredentials> =>
+  Effect.gen(function* () {
+    const creds = yield* yield* GitHubCredentials;
+    return baseUrl === undefined ? creds.octokit() : creds.octokit({ baseUrl });
+  }).pipe(Effect.mapError(asError));
+
+const is404 = (e: unknown): boolean => (e as { status?: number } | undefined)?.status === 404;
+
+export const makeRulesetOctokit = (baseUrl: string | undefined): RealRulesetOctokit => ({
+  list: ({ owner, repo }) =>
+    Effect.gen(function* () {
+      const octokit = yield* octokitFor(baseUrl);
+      const rulesets = yield* Effect.tryPromise({
+        try: () =>
+          octokit.paginate(octokit.rest.repos.getRepoRulesets, {
+            owner,
+            repo,
+            includes_parents: false,
+            per_page: 100,
+          }),
+        catch: asError,
+      });
+      return rulesets as RulesetSummary[];
+    }),
+
+  get: ({ owner, repo, rulesetId }) =>
+    Effect.gen(function* () {
+      const octokit = yield* octokitFor(baseUrl);
+      return yield* Effect.tryPromise({
+        try: () => octokit.rest.repos.getRepoRuleset({ owner, repo, ruleset_id: rulesetId }),
+        catch: (e) => e,
+      }).pipe(
+        Effect.map(({ data }) => data as RulesetRecord),
+        Effect.catchIf(is404, () => Effect.succeed(undefined)),
+        Effect.mapError(asError),
+      );
+    }),
+
+  create: (input: { owner: string; repo: string; body: CreateRulesetBody }) =>
+    Effect.gen(function* () {
+      const octokit = yield* octokitFor(baseUrl);
+      const { data } = yield* Effect.tryPromise({
+        try: () =>
+          octokit.rest.repos.createRepoRuleset({
+            owner: input.owner,
+            repo: input.repo,
+            ...input.body,
+          }),
+        catch: asError,
+      });
+      return data as RulesetRecord;
+    }),
+
+  update: (input: { owner: string; repo: string; rulesetId: number; body: CreateRulesetBody }) =>
+    Effect.gen(function* () {
+      const octokit = yield* octokitFor(baseUrl);
+      const { data } = yield* Effect.tryPromise({
+        try: () =>
+          octokit.rest.repos.updateRepoRuleset({
+            owner: input.owner,
+            repo: input.repo,
+            ruleset_id: input.rulesetId,
+            ...input.body,
+          }),
+        catch: asError,
+      });
+      return data as RulesetRecord;
+    }),
+
+  delete: ({ owner, repo, rulesetId }) =>
+    Effect.gen(function* () {
+      const octokit = yield* octokitFor(baseUrl);
+      yield* Effect.tryPromise({
+        try: () => octokit.rest.repos.deleteRepoRuleset({ owner, repo, ruleset_id: rulesetId }),
+        catch: (e) => e,
+      }).pipe(
+        Effect.asVoid,
+        Effect.catchIf(is404, () => Effect.void),
+        Effect.mapError(asError),
+      );
+    }),
+
+  hasContextReportedSuccess: ({ owner, repo, context }) =>
+    Effect.gen(function* () {
+      const octokit = yield* octokitFor(baseUrl);
+      const repository = yield* Effect.tryPromise({
+        try: () => octokit.rest.repos.get({ owner, repo }),
+        catch: asError,
+      });
+      const ref = repository.data.default_branch;
+      const [checkRuns, statuses] = yield* Effect.all([
+        Effect.tryPromise({
+          try: () => octokit.rest.checks.listForRef({ owner, repo, ref, check_name: context }),
+          catch: asError,
+        }),
+        Effect.tryPromise({
+          try: () => octokit.rest.repos.listCommitStatusesForRef({ owner, repo, ref }),
+          catch: asError,
+        }),
+      ]);
+      const checkReported = checkRuns.data.check_runs.some(
+        (run) => run.name === context && run.conclusion === 'success',
+      );
+      const statusReported = statuses.data.some(
+        (status) => status.context === context && status.state === 'success',
+      );
+      return checkReported || statusReported;
+    }),
+});

package/src/github/repository-ruleset-probe.ts

@@ -0,0 +1,116 @@
+/**
+ * The name-probe: how this resource finds a ruleset it has no prior state for, and the one
+ * place `DuplicateRuleset` is raised. This is the fix for the hazard documented at the top of
+ * repository-ruleset.ts — upstream's `Ruleset#reconcile` only ever looks up by the id in prior
+ * `output`, so with none it calls `createRepoRuleset` unconditionally (measured in
+ * `node_modules/alchemy/src/GitHub/Ruleset.ts`, `reconcile`).
+ *
+ * `RulesetOctokit` is a small injected seam (mirrors `PgExecutor` in `postgres/database-sql.ts`)
+ * so the write-recording and GET-only fakes in the test files implement it directly — no HTTP
+ * mocking needed for the resource's own logic. `repository-ruleset.ts` supplies the real
+ * implementation, built from `octokitFor`/`GitHubCredentials` exactly as upstream's own
+ * `getRuleset`/`createRepoRuleset` calls do.
+ */
+import * as Effect from 'effect/Effect';
+import type { CreateRulesetBody } from './repository-ruleset-constraints.ts';
+import { DuplicateRuleset } from './repository-ruleset-errors.ts';
+
+// Every optional field spells out `| undefined` explicitly (not just `field?:`) so a fake or
+// adapter built from a value that is itself `T | undefined` — the common shape once you have
+// pulled a field off another object — can assign it directly under `exactOptionalPropertyTypes`
+// without a conditional-spread dance at every call site.
+export interface RulesetSummary {
+  readonly id: number;
+  readonly name: string;
+  readonly target?: string | undefined;
+  readonly source_type?: string | undefined;
+}
+
+export interface RulesetRecord extends RulesetSummary {
+  readonly node_id?: string | undefined;
+  readonly enforcement: string;
+  readonly bypass_actors?: readonly Record<string, unknown>[] | undefined;
+  readonly conditions?: unknown;
+  readonly rules?: readonly Record<string, unknown>[] | undefined;
+  readonly created_at?: string | undefined;
+  readonly updated_at?: string | undefined;
+}
+
+/** Every method carries `Error` in its error channel, matching upstream `Ruleset.ts`'s own
+ * `catch: (e) => e as Error` — a transport failure is not this resource's to type more
+ * precisely than upstream types its own. `R` is the real adapter's ambient requirement
+ * (`GitHubCredentials`, via `octokitFor` — see repository-ruleset-octokit.ts); test fakes need
+ * none, so they satisfy `RulesetOctokit<never>` — the default — without carrying it. */
+export interface RulesetOctokit<R = never> {
+  /** Every ruleset owned directly by this repository (`includes_parents: false`, paginated) —
+   * the list endpoint omits `bypass_actors`, so a match is always re-read by id. */
+  readonly list: (input: {
+    readonly owner: string;
+    readonly repo: string;
+  }) => Effect.Effect<readonly RulesetSummary[], Error, R>;
+  /** `undefined` on a 404. */
+  readonly get: (input: {
+    readonly owner: string;
+    readonly repo: string;
+    readonly rulesetId: number;
+  }) => Effect.Effect<RulesetRecord | undefined, Error, R>;
+  readonly create: (input: {
+    readonly owner: string;
+    readonly repo: string;
+    readonly body: CreateRulesetBody;
+  }) => Effect.Effect<RulesetRecord, Error, R>;
+  readonly update: (input: {
+    readonly owner: string;
+    readonly repo: string;
+    readonly rulesetId: number;
+    readonly body: CreateRulesetBody;
+  }) => Effect.Effect<RulesetRecord, Error, R>;
+  /** A 404 is success (S11: idempotent delete). */
+  readonly delete: (input: {
+    readonly owner: string;
+    readonly repo: string;
+    readonly rulesetId: number;
+  }) => Effect.Effect<void, Error, R>;
+  /** Whether `context` has ever reported success against the repository's default branch —
+   * backs the `NeverReportedContext` guard. */
+  readonly hasContextReportedSuccess: (input: {
+    readonly owner: string;
+    readonly repo: string;
+    readonly context: string;
+  }) => Effect.Effect<boolean, Error, R>;
+}
+
+/**
+ * List + filter by name and target, then:
+ * - 0 matches → `undefined` (a create is coming).
+ * - 1 match → GET it by id (the list omits `bypass_actors`) and return the full record.
+ * - `>1` → fail with `DuplicateRuleset`, naming every id, before reading any of them.
+ */
+export const probeByName = <R = never>(
+  octokit: RulesetOctokit<R>,
+  input: {
+    readonly owner: string;
+    readonly repo: string;
+    readonly name: string;
+    readonly target: string;
+  },
+): Effect.Effect<RulesetRecord | undefined, DuplicateRuleset | Error, R> =>
+  Effect.gen(function* () {
+    const all = yield* octokit.list({ owner: input.owner, repo: input.repo });
+    const matches = all.filter(
+      (r) => r.name === input.name && (r.target ?? 'branch') === input.target,
+    );
+    const [only, ...rest] = matches;
+    if (only === undefined) return undefined;
+    if (rest.length > 0) {
+      return yield* Effect.fail(
+        new DuplicateRuleset({
+          owner: input.owner,
+          repository: input.repo,
+          name: input.name,
+          ids: matches.map((m) => m.id),
+        }),
+      );
+    }
+    return yield* octokit.get({ owner: input.owner, repo: input.repo, rulesetId: only.id });
+  });

package/src/github/repository-ruleset-reconcile.ts

@@ -0,0 +1,176 @@
+/**
+ * `reconcile`'s body, apart from repository-ruleset.ts so the wiring there stays readable.
+ * One flow (S9): observe, then every plan-time and live-data refusal, then write only on
+ * drift (S10 — a matching noop makes zero calls), then an INDEPENDENT readback.
+ */
+import * as Effect from 'effect/Effect';
+import type { RepositoryRulesetAttributes, RepositoryRulesetProps } from './repository-ruleset.ts';
+import type { CreateRulesetBody } from './repository-ruleset-constraints.ts';
+import {
+  ReadbackMismatch,
+  type RepositoryRulesetError,
+  type RulesetConstraintRefused,
+} from './repository-ruleset-errors.ts';
+import { canonicalizeWireRuleset, desiredWireRuleset } from './repository-ruleset-form.ts';
+import {
+  bypassWideningRefusal,
+  declaredRuleTypes,
+  newlyRequiredContexts,
+  refuseUnreportedContexts,
+  requiredChecksOmissionRefusal,
+  undeclaredLiveRuleRefusal,
+} from './repository-ruleset-guards.ts';
+import {
+  type RulesetOctokit,
+  type RulesetRecord,
+  probeByName,
+} from './repository-ruleset-probe.ts';
+
+const guardedPullRequestFields = (
+  rule: Record<string, unknown> | undefined,
+): Record<string, unknown> => {
+  const params = (rule?.parameters ?? {}) as Record<string, unknown>;
+  return {
+    required_approving_review_count: params.required_approving_review_count,
+    allowed_merge_methods: Array.isArray(params.allowed_merge_methods)
+      ? [...(params.allowed_merge_methods as string[])].sort()
+      : undefined,
+    require_extra_approval_for_unattributed_changes:
+      params.require_extra_approval_for_unattributed_changes,
+  };
+};
+
+/** Compares only the fields this resource exists to guarantee (H15's extension flag,
+ * `allowedMergeMethods`, the approval count) between what was SENT and an INDEPENDENT re-read —
+ * never the write response itself (S10). */
+function readbackRefusal(
+  owner: string,
+  repository: string,
+  name: string,
+  sentRules: readonly Record<string, unknown>[],
+  independent: RulesetRecord,
+): ReadbackMismatch | undefined {
+  const sentPr = sentRules.find((r) => r.type === 'pull_request');
+  if (sentPr === undefined) return undefined;
+  const readPr = (independent.rules ?? []).find((r) => r.type === 'pull_request');
+  const sent = guardedPullRequestFields(sentPr);
+  const read = guardedPullRequestFields(readPr);
+  for (const field of Object.keys(sent) as (keyof typeof sent)[]) {
+    if (sent[field] === undefined) continue;
+    if (JSON.stringify(sent[field]) !== JSON.stringify(read[field])) {
+      return new ReadbackMismatch({
+        owner,
+        repository,
+        name,
+        field: `rules.pull_request.parameters.${field}`,
+        sent: sent[field],
+        read: read[field],
+      });
+    }
+  }
+  return undefined;
+}
+
+/**
+ * `octokit` is INJECTED, never constructed in here — the real adapter comes from
+ * repository-ruleset.ts (`makeRulesetOctokit(news.baseUrl)`), and the write-recording and
+ * GET-only fakes in the test files pass their own. Nothing about the flow below depends on
+ * which one it is, which is the whole point of the seam (mirrors `reconcileWithClient(pg, …)`
+ * in postgres/database.ts taking its `PgExecutor` the same way).
+ */
+export const reconcileRuleset = <R = never>(input: {
+  readonly octokit: RulesetOctokit<R>;
+  readonly news: RepositoryRulesetProps;
+  readonly output: RepositoryRulesetAttributes | undefined;
+  readonly constraintRefusal: (
+    props: RepositoryRulesetProps,
+  ) => RulesetConstraintRefused | undefined;
+  readonly attrsOf: (r: RulesetRecord) => RepositoryRulesetAttributes;
+}): Effect.Effect<RepositoryRulesetAttributes, RepositoryRulesetError | Error, R> =>
+  Effect.gen(function* () {
+    const { news, output, constraintRefusal, attrsOf, octokit } = input;
+    const refusal = constraintRefusal(news);
+    if (refusal !== undefined) return yield* Effect.fail(refusal);
+
+    const owner = news.owner;
+    const repo = news.repository;
+    const target = news.target ?? 'branch';
+
+    let observed: RulesetRecord | undefined =
+      output === undefined
+        ? undefined
+        : yield* octokit.get({ owner, repo, rulesetId: output.rulesetId });
+    if (observed === undefined) {
+      observed = yield* probeByName(octokit, { owner, repo, name: news.name, target });
+    }
+
+    const bypassRefusal =
+      news.bypassActors === undefined
+        ? undefined
+        : bypassWideningRefusal({
+            owner,
+            repository: repo,
+            name: news.name,
+            declared: news.bypassActors,
+            live: observed,
+          });
+    if (bypassRefusal !== undefined) return yield* Effect.fail(bypassRefusal);
+
+    const ruleRefusal = undeclaredLiveRuleRefusal({
+      owner,
+      repository: repo,
+      name: news.name,
+      live: observed,
+      declaredTypes: declaredRuleTypes(news.rules),
+    });
+    if (ruleRefusal !== undefined) return yield* Effect.fail(ruleRefusal);
+
+    const checksRefusal = requiredChecksOmissionRefusal({
+      owner,
+      repository: repo,
+      name: news.name,
+      declared: news.rules,
+      live: observed,
+    });
+    if (checksRefusal !== undefined) return yield* Effect.fail(checksRefusal);
+
+    const newContexts = newlyRequiredContexts(news.rules, observed);
+    yield* refuseUnreportedContexts(octokit, owner, repo, newContexts);
+
+    const desired = desiredWireRuleset(news);
+    // `undefined` means unmanaged: the live value is sent back unchanged rather than the `[]`
+    // `desiredWireRuleset` defaults to. On a create there is nothing live to carry forward, so
+    // `[]` (already inside `desired`) is correct there too.
+    const body: CreateRulesetBody =
+      news.bypassActors === undefined && observed !== undefined
+        ? ({ ...desired, bypass_actors: observed.bypass_actors ?? [] } as CreateRulesetBody)
+        : desired;
+
+    let record: RulesetRecord;
+    let wrote = false;
+    if (observed === undefined) {
+      record = yield* octokit.create({ owner, repo, body });
+      wrote = true;
+    } else {
+      const same =
+        JSON.stringify(canonicalizeWireRuleset(body)) ===
+        JSON.stringify(canonicalizeWireRuleset(observed));
+      if (same) {
+        record = observed;
+      } else {
+        record = yield* octokit.update({ owner, repo, rulesetId: observed.id, body });
+        wrote = true;
+      }
+    }
+
+    if (wrote) {
+      const independent = yield* octokit.get({ owner, repo, rulesetId: record.id });
+      if (independent !== undefined) {
+        const sentRules = (body.rules ?? []) as unknown as Record<string, unknown>[];
+        const mismatch = readbackRefusal(owner, repo, news.name, sentRules, independent);
+        if (mismatch !== undefined) return yield* Effect.fail(mismatch);
+      }
+    }
+
+    return attrsOf(record);
+  });

package/src/github/repository-ruleset-test-helpers.ts

@@ -0,0 +1,102 @@
+/**
+ * Shared plumbing for the write-recording fake tests, split out of
+ * repository-ruleset-write.test.ts and repository-ruleset-write-refusals.test.ts purely to keep
+ * both under the 250-line file cap — nothing here is a fixture of house-standard VALUES (that
+ * is repository-ruleset-fixtures.ts); this is just "run an Effect", "expect it to fail", and one
+ * baseline-shaped `RepositoryRulesetProps` for `widgets`.
+ */
+import * as Effect from 'effect/Effect';
+import type { RecordingFake } from './repository-ruleset-fake-octokit.ts';
+import {
+  type RepositoryRulesetProps,
+  type RepositoryRulesetPullRequestRule,
+  attrsOf,
+} from './repository-ruleset.ts';
+import type {
+  RepositoryRulesetError,
+  RulesetConstraintRefused,
+} from './repository-ruleset-errors.ts';
+import { reconcileRuleset } from './repository-ruleset-reconcile.ts';
+import type { RulesetOctokit } from './repository-ruleset-probe.ts';
+
+export const run = <A, E>(eff: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(eff);
+export const fails = <A, E>(eff: Effect.Effect<A, E>): Promise<E> =>
+  Effect.runPromise(Effect.flip(eff));
+
+/** Every case across both files expects a TAGGED refusal, never the plain transport `Error` a
+ * real fetch failure would carry — narrowing here keeps every test's assertion a one-liner. */
+export const tagOf = (error: RepositoryRulesetError | Error): string =>
+  '_tag' in error ? error._tag : `(untagged) ${error.message}`;
+
+export const constraintRefusal = () => undefined as RulesetConstraintRefused | undefined;
+
+export const BASE_PULL_REQUEST: RepositoryRulesetPullRequestRule = {
+  requiredApprovingReviewCount: 0,
+  allowedMergeMethods: ['squash'],
+  extraApprovalForUnattributedChanges: false,
+};
+
+export const props = (over: Partial<RepositoryRulesetProps> = {}): RepositoryRulesetProps => ({
+  owner: 'taslabs-net',
+  repository: 'widgets',
+  name: 'main',
+  target: 'branch',
+  enforcement: 'active',
+  conditions: { include: ['~DEFAULT_BRANCH'], exclude: [] },
+  rules: {
+    deletion: true,
+    nonFastForward: true,
+    pullRequest: BASE_PULL_REQUEST,
+    requiredStatusChecks: { checks: [{ context: 'ci' }] },
+  },
+  ...over,
+});
+
+/** Reconciles `p` against a `RecordingFake`, with `output` (when given) shaped as a real
+ * `RepositoryRulesetAttributes` — every field but `rulesetId` defaulted, since no test here
+ * reads `nodeId`/timestamps. */
+export const reconcileAgainst = (
+  fake: RecordingFake,
+  p: RepositoryRulesetProps,
+  output?: { rulesetId: number },
+) =>
+  reconcileRuleset({
+    octokit: fake.octokit,
+    news: p,
+    output:
+      output === undefined
+        ? undefined
+        : {
+            ...output,
+            nodeId: undefined,
+            name: p.name,
+            createdAt: undefined,
+            updatedAt: undefined,
+          },
+    constraintRefusal,
+    attrsOf,
+  });
+
+/** For the hand-built fakes in the refusals file, which construct a `RulesetOctokit` directly
+ * rather than going through `RecordingFake`. */
+export const reconcileWithOctokit = (
+  octokit: RulesetOctokit,
+  p: RepositoryRulesetProps,
+  output?: { rulesetId: number },
+) =>
+  reconcileRuleset({
+    octokit,
+    news: p,
+    output:
+      output === undefined
+        ? undefined
+        : {
+            ...output,
+            nodeId: undefined,
+            name: p.name,
+            createdAt: undefined,
+            updatedAt: undefined,
+          },
+    constraintRefusal,
+    attrsOf,
+  });

package/src/github/repository-ruleset-wire.test.ts

@@ -0,0 +1,66 @@
+/**
+ * (iii) MEASURES, against a real `@octokit/rest` instance with a fetch shim (no network), the
+ * one open question H15 depends on: does Octokit's own request builder forward
+ * `require_extra_approval_for_unattributed_changes` — a field its own TypeScript types do not
+ * declare — onto the wire, or silently strip it the way `@distilled.cloud/github`'s `S.Struct`
+ * request schemas are reasoned (not measured) to? This is a MEASUREMENT, not an assertion about
+ * intent: if this test ever starts failing, H15's premise no longer holds and the client choice
+ * in repository-ruleset.ts needs revisiting, not a quiet update to make the test pass again.
+ */
+import { describe, expect, test } from 'bun:test';
+import { Octokit } from '@octokit/rest';
+import { desiredWireRuleset } from './repository-ruleset-form.ts';
+
+interface CapturedRequest {
+  readonly url: string;
+  readonly method: string;
+  readonly body: unknown;
+}
+
+function makeCapturingFetch(captured: CapturedRequest[]): typeof fetch {
+  return (async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {
+    captured.push({
+      url: String(input),
+      method: init?.method ?? 'GET',
+      body: init?.body === undefined ? undefined : JSON.parse(init.body as string),
+    });
+    return new Response(JSON.stringify({ id: 1, name: 'main', rules: [] }), {
+      status: 201,
+      headers: { 'content-type': 'application/json' },
+    });
+  }) as typeof fetch;
+}
+
+describe('does Octokit forward an untyped extra body field to the wire?', () => {
+  test('require_extra_approval_for_unattributed_changes survives createRepoRuleset', async () => {
+    const captured: CapturedRequest[] = [];
+    const octokit = new Octokit({
+      auth: 'fake-token-not-a-real-credential',
+      request: { fetch: makeCapturingFetch(captured) },
+    });
+
+    const body = desiredWireRuleset({
+      owner: 'taslabs-net',
+      repository: 'widgets',
+      name: 'main',
+      rules: {
+        pullRequest: {
+          requiredApprovingReviewCount: 0,
+          allowedMergeMethods: ['squash'],
+          extraApprovalForUnattributedChanges: false,
+        },
+      },
+    });
+
+    await octokit.rest.repos.createRepoRuleset({ owner: 'taslabs-net', repo: 'widgets', ...body });
+
+    expect(captured).toHaveLength(1);
+    const sent = captured[0]?.body as {
+      rules?: { type: string; parameters?: Record<string, unknown> }[];
+    };
+    const pr = sent?.rules?.find((r) => r.type === 'pull_request');
+    // MEASURED: this is what actually crossed the wire, not what Octokit's types say is legal.
+    expect(pr?.parameters?.require_extra_approval_for_unattributed_changes).toBe(false);
+    expect(pr?.parameters?.allowed_merge_methods).toEqual(['squash']);
+  });
+});