@homeflare/alchemy 0.25.1 → 0.27.0

package/dist/github/repository-ruleset-errors.d.ts

@@ -0,0 +1,97 @@
+declare const DuplicateRuleset_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "DuplicateRuleset";
+} & Readonly<A>;
+/**
+ * More than one ruleset shares a name (and target) on the same repository. `probeByName`
+ * fails BEFORE reading either one — see repository-ruleset-probe.ts — because there is no
+ * way to know which one is "ours" and guessing risks converging the wrong ruleset.
+ */
+export declare class DuplicateRuleset extends DuplicateRuleset_base<{
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly ids: readonly number[];
+}> {
+    get message(): string;
+}
+declare const BypassActorWidened_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "BypassActorWidened";
+} & Readonly<A>;
+/** A declared `bypassActors` entry names an actor the live ruleset does not have. Widening
+ * bypass is a handoff, never a deploy — see repository-ruleset-guards.ts. */
+export declare class BypassActorWidened extends BypassActorWidened_base<{
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly widened: readonly string[];
+}> {
+    get message(): string;
+}
+declare const UndeclaredLiveRule_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UndeclaredLiveRule";
+} & Readonly<A>;
+/** A live rule's `type` is neither modeled nor explicitly refused by RULE_TYPE_COVERAGE, or is
+ * refused and present live anyway. The PUT replaces `rules` wholesale, so silently omitting a
+ * live rule type would drop it — this fails the plan by name instead. */
+export declare class UndeclaredLiveRule extends UndeclaredLiveRule_base<{
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly ruleType: string;
+}> {
+    get message(): string;
+}
+declare const RequiredChecksOmitted_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "RequiredChecksOmitted";
+} & Readonly<A>;
+/** The declaration omits `requiredStatusChecks` while adopting or updating a live ruleset that
+ * HAS one. Declare the contexts, or declare `requiredStatusChecks: false` to remove them. */
+export declare class RequiredChecksOmitted extends RequiredChecksOmitted_base<{
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly liveContexts: readonly string[];
+}> {
+    get message(): string;
+}
+declare const NeverReportedContext_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "NeverReportedContext";
+} & Readonly<A>;
+/** A context being ADDED to `requiredStatusChecks` has never reported success on the default
+ * branch. Requiring it would leave every future pull request pending forever. */
+export declare class NeverReportedContext extends NeverReportedContext_base<{
+    readonly owner: string;
+    readonly repository: string;
+    readonly context: string;
+}> {
+    get message(): string;
+}
+declare const RulesetConstraintRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "RulesetConstraintRefused";
+} & Readonly<A>;
+/** A prop value the wire form or GitHub's own schema refuses — an approval count outside 0–10,
+ * an empty `allowedMergeMethods`, or an unmodeled rule `type` in the declaration itself. */
+export declare class RulesetConstraintRefused extends RulesetConstraintRefused_base<{
+    readonly field: string;
+    readonly reason: string;
+}> {
+    get message(): string;
+}
+declare const ReadbackMismatch_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ReadbackMismatch";
+} & Readonly<A>;
+/** The independent readback GET after a write does not match what was sent, for one of the
+ * fields this family refuses to leave unverified (S10: the write's own report is never proof). */
+export declare class ReadbackMismatch extends ReadbackMismatch_base<{
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly field: string;
+    readonly sent: unknown;
+    readonly read: unknown;
+}> {
+    get message(): string;
+}
+export type RepositoryRulesetError = DuplicateRuleset | BypassActorWidened | UndeclaredLiveRule | RequiredChecksOmitted | NeverReportedContext | RulesetConstraintRefused | ReadbackMismatch;
+export {};
+//# sourceMappingURL=repository-ruleset-errors.d.ts.map

package/dist/github/repository-ruleset-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-errors.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-errors.ts"],"names":[],"mappings":";;;AAQA;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;6EAC6E;AAC7E,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;6FAC6F;AAC7F,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;iFACiF;AACjF,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;4FAC4F;AAC5F,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;kGACkG;AAClG,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;AAED,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,gBAAgB,CAAC"}

package/dist/github/repository-ruleset-fake-octokit.d.ts

@@ -0,0 +1,24 @@
+import type { CreateRulesetBody } from './repository-ruleset-constraints.ts';
+import type { RulesetOctokit, RulesetRecord } from './repository-ruleset-probe.ts';
+/** Serves a fixed `{repo: RulesetRecord}` map and fails any write — for tests that must prove
+ * a plan is a pure read (a noop, or a refusal caught before any write). */
+export declare function makeGetOnlyFake(byRepo: Readonly<Record<string, RulesetRecord>>): RulesetOctokit;
+export interface RecordedWrite {
+    readonly op: 'create' | 'update' | 'delete';
+    readonly repo: string;
+    readonly body?: CreateRulesetBody;
+}
+export interface RecordingFake {
+    readonly octokit: RulesetOctokit;
+    readonly writes: RecordedWrite[];
+    /** Whether `hasContextReportedSuccess` answers `true` — defaults to `true` (every context
+     * has reported); set per-context to test `NeverReportedContext`. */
+    readonly reportedContexts: Set<string>;
+}
+/** An in-memory GitHub: `create` assigns an id and stores the record verbatim (merging the
+ * REQUEST body, not re-deriving it, so a test can inspect exactly what reconcile sent);
+ * `update` replaces the stored rules/enforcement/etc from the body; every write is also
+ * appended to `writes` for direct assertions ("N changed values give N non-noop results" is
+ * checked by counting entries here, not by re-reading state). */
+export declare function makeRecordingFake(initial: Readonly<Record<string, RulesetRecord>>): RecordingFake;
+//# sourceMappingURL=repository-ruleset-fake-octokit.d.ts.map

package/dist/github/repository-ruleset-fake-octokit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-fake-octokit.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-fake-octokit.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAkB,MAAM,+BAA+B,CAAC;AAKnG;2EAC2E;AAC3E,wBAAgB,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,cAAc,CAsB/F;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC;IACjC;wEACoE;IACpE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACxC;AAID;;;;iEAIiE;AACjE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,GAAG,aAAa,CAqEjG"}

package/dist/github/repository-ruleset-fixtures.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The 16 live GitHub rulesets this family was walked against — captured 2026-09-23 by the
+ * planner's read-only `gh api` survey (owner `taslabs-net`; no secrets in any of these rows,
+ * only ruleset configuration GitHub already shows to any collaborator). Used by
+ * repository-ruleset-lifecycle.test.ts as a GET-only loopback fake, so a real baseline diff is
+ * checked against real shapes rather than a hand-picked "easy" fixture.
+ *
+ * Two simplifications from the raw survey, both noted here rather than silently taken:
+ * - `aimto`'s `secret scan (any app)` context is recorded as plain `secret scan` — the survey
+ *   did not say the wire context string differs, only that the workflow's check-suite scope
+ *   does; nothing in this family reads that scope, so it would not change any comparison.
+ * - `updated_at` is a placeholder ISO date derived from the survey's two-digit day, not the
+ *   real timestamp (which the survey did not capture to the second).
+ */
+import type { RulesetRecord } from './repository-ruleset-probe.ts';
+/** Keyed by repo name — every row from the LIVE SURVEY's per-repo ruleset table. */
+export declare const LIVE_RULESET_FIXTURES: Readonly<Record<string, RulesetRecord>>;
+/** repos with NO live ruleset at all (measured: 0 rulesets), per the survey's RULESETS section. */
+export declare const REPOS_WITH_NO_RULESET: readonly string[];
+//# sourceMappingURL=repository-ruleset-fixtures.d.ts.map

package/dist/github/repository-ruleset-fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-fixtures.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AA0DnE,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CA0GzE,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAAwB,CAAC"}

package/dist/github/repository-ruleset-form.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Props → wire form, and a canonical form for comparing two wire rulesets.
+ *
+ * ★ THE CANONICALIZATION IS THE NEVER-NOOP FIX. Upstream `GitHub.Ruleset#reconcile` compares
+ *   `desired` against the live GET with a raw `deepEqual` (see repository-ruleset.ts's header).
+ *   GitHub does not promise to echo `rules`, `allowed_merge_methods` or `checks` back in
+ *   request order, and a live `required_status_checks` check carries `integration_id: null`
+ *   where the request never sent the key at all — so an unsorted, un-normalized comparison
+ *   drifts against itself on every single plan. `canonicalizeWireRuleset` sorts every list that
+ *   has no meaningful order and drops nullish `integration_id` before two wire rulesets are
+ *   ever compared.
+ */
+import type { RepositoryRulesetProps, RepositoryRulesetRules } from './repository-ruleset.ts';
+import type { CreateRulesetBody, WireRule } from './repository-ruleset-constraints.ts';
+export declare function buildWireRules(rules: RepositoryRulesetRules | undefined): WireRule[];
+/** The full desired wire body, minus `owner`/`repo` — sent verbatim to `createRepoRuleset` or
+ * `updateRepoRuleset`. */
+export declare function desiredWireRuleset(props: RepositoryRulesetProps): CreateRulesetBody;
+/**
+ * Normalize a wire ruleset (desired OR observed) so two representations of the same policy
+ * compare equal regardless of the order GitHub happens to echo lists back in.
+ *
+ * ⚠️ `input: unknown`, DELIBERATELY, NOT `CreateRulesetBody | RulesetRecord`. The two real
+ *   callers (our own request body, and GitHub's JSON response) are independently typed and
+ *   under `exactOptionalPropertyTypes` a shared structural interface fights both of them at
+ *   once for no safety this function actually uses — every field below is read defensively,
+ *   the same way a live GET already has to be, so a typed façade here would be decorative.
+ */
+export declare function canonicalizeWireRuleset(input: unknown): unknown;
+//# sourceMappingURL=repository-ruleset-form.d.ts.map

package/dist/github/repository-ruleset-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-form.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,sBAAsB,EAEtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AA2DvF,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,SAAS,GAAG,QAAQ,EAAE,CAmCpF;AAED;0BAC0B;AAC1B,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CAqBnF;AA+CD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAiB/D"}

package/dist/github/repository-ruleset-guards.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Everything `reconcile` refuses before it writes, and why. Extracted so
+ * repository-ruleset.ts stays the wiring, and the reasoning stays whole — the same split
+ * `repo-policy-guards.ts` uses for `declareRepoPolicy`.
+ */
+import * as Effect from 'effect/Effect';
+import type { RepositoryRulesetProps } from './repository-ruleset.ts';
+import { BypassActorWidened, NeverReportedContext, RequiredChecksOmitted, UndeclaredLiveRule } from './repository-ruleset-errors.ts';
+import type { RulesetOctokit, RulesetRecord } from './repository-ruleset-probe.ts';
+/**
+ * ⛔ A CREATE REQUIRES `[]`; `undefined` on a create is the same thing (nothing live to widen
+ *   from). On an update/adopt, `undefined` means unmanaged — the caller never sees this guard
+ *   because repository-ruleset.ts sends the LIVE value back unchanged in that case, and this
+ *   function is only called when `props.bypassActors` is explicitly declared.
+ */
+export declare function bypassWideningRefusal(input: {
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly declared: RepositoryRulesetProps['bypassActors'];
+    readonly live: RulesetRecord | undefined;
+}): BypassActorWidened | undefined;
+/**
+ * Refuses (a) any live rule of a REFUSED type — this resource can never represent it, and the
+ * PUT replaces `rules` wholesale, so silence would drop it; and (b) ANY live rule of a MODELED
+ * type the declaration is silent about — same hazard, for every rule this resource owns.
+ *
+ * ⚠️ `declaredTypes` MUST BE PRESENCE, NOT TRUTHINESS — this is the fix for a real bug this
+ *   family's own design first shipped with. A plain `rules?.deletion` check cannot distinguish
+ *   "omitted" from "declared `false`", so `undeclaredLiveRuleRefusal` originally exempted every
+ *   boolean rule (`creation`/`update`/`deletion`/`requiredLinearHistory`/`requiredSignatures`/
+ *   `nonFastForward`) as "fully owned — omission IS the removal". Concretely, that meant: a
+ *   live ruleset has `deletion: true` (blocks branch deletion); a caller declares this resource
+ *   with `rules: { pullRequest: {...}, requiredStatusChecks: {...} }`, simply forgetting
+ *   `deletion: true` — an easy mistake, since omitting an optional boolean is not a type error.
+ *   The wholesale PUT would have sent `rules` without a `deletion` entry, silently REMOVING
+ *   branch-deletion protection on the very next `reconcile` — exactly the hazard this whole
+ *   guard exists to prevent, reached through the one door it left open. Found by a self-review
+ *   pass (no subagent available in this harness), not by a test; there is now one:
+ *   repository-ruleset-write-refusals.test.ts's "an omitted boolean rule" case.
+ *   `required_status_checks` still gets its own, better-worded `RequiredChecksOmitted` from
+ *   {@link requiredChecksOmissionRefusal} and is excluded here so it is not refused twice.
+ */
+export declare function undeclaredLiveRuleRefusal(input: {
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly live: RulesetRecord | undefined;
+    readonly declaredTypes: ReadonlySet<string>;
+}): UndeclaredLiveRule | undefined;
+/** The wire `type` for every rule key present ON THE DECLARATION OBJECT ITSELF — `Object.hasOwn`,
+ * not truthiness, so `{ deletion: false }` (an explicit, deliberate removal) counts as declared
+ * and a bare omission does not. Feeds `undeclaredLiveRuleRefusal`'s `declaredTypes`. */
+export declare function declaredRuleTypes(rules: RepositoryRulesetProps['rules']): ReadonlySet<string>;
+/** `requiredStatusChecks: undefined` while the live ruleset HAS one → refused, naming the live
+ * contexts. `requiredStatusChecks: false` is the declared removal and never reaches here. */
+export declare function requiredChecksOmissionRefusal(input: {
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly declared: RepositoryRulesetProps['rules'];
+    readonly live: RulesetRecord | undefined;
+}): RequiredChecksOmitted | undefined;
+/** Every context in the declared `requiredStatusChecks` that the LIVE ruleset does not already
+ * require — i.e. being added by this plan, the only case a never-reported context can matter. */
+export declare const newlyRequiredContexts: (declared: RepositoryRulesetProps['rules'], live: RulesetRecord | undefined) => readonly string[];
+/** Fails on the first newly-required context that has never reported success on the default
+ * branch — checked once here (reconcile's observe step) and again by the standalone checker. */
+export declare const refuseUnreportedContexts: <R = never>(octokit: RulesetOctokit<R>, owner: string, repo: string, contexts: readonly string[]) => Effect.Effect<void, NeverReportedContext | Error, R>;
+//# sourceMappingURL=repository-ruleset-guards.d.ts.map

package/dist/github/repository-ruleset-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-guards.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-guards.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAKnF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAKD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;wFAEwF;AACxF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAgB7F;AAED;6FAC6F;AAC7F,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,qBAAqB,GAAG,SAAS,CAcpC;AAED;iGACiG;AACjG,eAAO,MAAM,qBAAqB,aACtB,sBAAsB,CAAC,OAAO,CAAC,QACnC,aAAa,GAAG,SAAS,KAC9B,SAAS,MAAM,EAWjB,CAAC;AAEF;gGACgG;AAChG,eAAO,MAAM,wBAAwB,GAAI,CAAC,GAAG,KAAK,WACvC,cAAc,CAAC,CAAC,CAAC,SACnB,MAAM,QACP,MAAM,YACF,SAAS,MAAM,EAAE,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,GAAG,KAAK,EAAE,CAAC,CAQlD,CAAC"}

package/dist/github/repository-ruleset-octokit.d.ts

@@ -0,0 +1,5 @@
+import { GitHubCredentials } from 'alchemy/GitHub';
+import type { RulesetOctokit } from './repository-ruleset-probe.ts';
+export type RealRulesetOctokit = RulesetOctokit<GitHubCredentials>;
+export declare const makeRulesetOctokit: (baseUrl: string | undefined) => RealRulesetOctokit;
+//# sourceMappingURL=repository-ruleset-octokit.d.ts.map

package/dist/github/repository-ruleset-octokit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-octokit.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-octokit.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,KAAK,EAAE,cAAc,EAAiC,MAAM,+BAA+B,CAAC;AAEnG,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;AAcnE,eAAO,MAAM,kBAAkB,YAAa,MAAM,GAAG,SAAS,KAAG,kBAoG/D,CAAC"}

package/dist/github/repository-ruleset-probe.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The name-probe: how this resource finds a ruleset it has no prior state for, and the one
+ * place `DuplicateRuleset` is raised. This is the fix for the hazard documented at the top of
+ * repository-ruleset.ts — upstream's `Ruleset#reconcile` only ever looks up by the id in prior
+ * `output`, so with none it calls `createRepoRuleset` unconditionally (measured in
+ * `node_modules/alchemy/src/GitHub/Ruleset.ts`, `reconcile`).
+ *
+ * `RulesetOctokit` is a small injected seam (mirrors `PgExecutor` in `postgres/database-sql.ts`)
+ * so the write-recording and GET-only fakes in the test files implement it directly — no HTTP
+ * mocking needed for the resource's own logic. `repository-ruleset.ts` supplies the real
+ * implementation, built from `octokitFor`/`GitHubCredentials` exactly as upstream's own
+ * `getRuleset`/`createRepoRuleset` calls do.
+ */
+import * as Effect from 'effect/Effect';
+import type { CreateRulesetBody } from './repository-ruleset-constraints.ts';
+import { DuplicateRuleset } from './repository-ruleset-errors.ts';
+export interface RulesetSummary {
+    readonly id: number;
+    readonly name: string;
+    readonly target?: string | undefined;
+    readonly source_type?: string | undefined;
+}
+export interface RulesetRecord extends RulesetSummary {
+    readonly node_id?: string | undefined;
+    readonly enforcement: string;
+    readonly bypass_actors?: readonly Record<string, unknown>[] | undefined;
+    readonly conditions?: unknown;
+    readonly rules?: readonly Record<string, unknown>[] | undefined;
+    readonly created_at?: string | undefined;
+    readonly updated_at?: string | undefined;
+}
+/** Every method carries `Error` in its error channel, matching upstream `Ruleset.ts`'s own
+ * `catch: (e) => e as Error` — a transport failure is not this resource's to type more
+ * precisely than upstream types its own. `R` is the real adapter's ambient requirement
+ * (`GitHubCredentials`, via `octokitFor` — see repository-ruleset-octokit.ts); test fakes need
+ * none, so they satisfy `RulesetOctokit<never>` — the default — without carrying it. */
+export interface RulesetOctokit<R = never> {
+    /** Every ruleset owned directly by this repository (`includes_parents: false`, paginated) —
+     * the list endpoint omits `bypass_actors`, so a match is always re-read by id. */
+    readonly list: (input: {
+        readonly owner: string;
+        readonly repo: string;
+    }) => Effect.Effect<readonly RulesetSummary[], Error, R>;
+    /** `undefined` on a 404. */
+    readonly get: (input: {
+        readonly owner: string;
+        readonly repo: string;
+        readonly rulesetId: number;
+    }) => Effect.Effect<RulesetRecord | undefined, Error, R>;
+    readonly create: (input: {
+        readonly owner: string;
+        readonly repo: string;
+        readonly body: CreateRulesetBody;
+    }) => Effect.Effect<RulesetRecord, Error, R>;
+    readonly update: (input: {
+        readonly owner: string;
+        readonly repo: string;
+        readonly rulesetId: number;
+        readonly body: CreateRulesetBody;
+    }) => Effect.Effect<RulesetRecord, Error, R>;
+    /** A 404 is success (S11: idempotent delete). */
+    readonly delete: (input: {
+        readonly owner: string;
+        readonly repo: string;
+        readonly rulesetId: number;
+    }) => Effect.Effect<void, Error, R>;
+    /** Whether `context` has ever reported success against the repository's default branch —
+     * backs the `NeverReportedContext` guard. */
+    readonly hasContextReportedSuccess: (input: {
+        readonly owner: string;
+        readonly repo: string;
+        readonly context: string;
+    }) => Effect.Effect<boolean, Error, R>;
+}
+/**
+ * List + filter by name and target, then:
+ * - 0 matches → `undefined` (a create is coming).
+ * - 1 match → GET it by id (the list omits `bypass_actors`) and return the full record.
+ * - `>1` → fail with `DuplicateRuleset`, naming every id, before reading any of them.
+ */
+export declare const probeByName: <R = never>(octokit: RulesetOctokit<R>, input: {
+    readonly owner: string;
+    readonly repo: string;
+    readonly name: string;
+    readonly target: string;
+}) => Effect.Effect<RulesetRecord | undefined, DuplicateRuleset | Error, R>;
+//# sourceMappingURL=repository-ruleset-probe.d.ts.map

package/dist/github/repository-ruleset-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-probe.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMlE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;wFAIwF;AACxF,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,KAAK;IACvC;sFACkF;IAClF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpC;iDAC6C;IAC7C,QAAQ,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE;QAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,GAAG,KAAK,WAC1B,cAAc,CAAC,CAAC,CAAC,SACnB;IACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,KACA,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAAC,CAmBnE,CAAC"}

package/dist/github/repository-ruleset-reconcile.d.ts

@@ -0,0 +1,24 @@
+/**
+ * `reconcile`'s body, apart from repository-ruleset.ts so the wiring there stays readable.
+ * One flow (S9): observe, then every plan-time and live-data refusal, then write only on
+ * drift (S10 — a matching noop makes zero calls), then an INDEPENDENT readback.
+ */
+import * as Effect from 'effect/Effect';
+import type { RepositoryRulesetAttributes, RepositoryRulesetProps } from './repository-ruleset.ts';
+import { type RepositoryRulesetError, type RulesetConstraintRefused } from './repository-ruleset-errors.ts';
+import { type RulesetOctokit, type RulesetRecord } from './repository-ruleset-probe.ts';
+/**
+ * `octokit` is INJECTED, never constructed in here — the real adapter comes from
+ * repository-ruleset.ts (`makeRulesetOctokit(news.baseUrl)`), and the write-recording and
+ * GET-only fakes in the test files pass their own. Nothing about the flow below depends on
+ * which one it is, which is the whole point of the seam (mirrors `reconcileWithClient(pg, …)`
+ * in postgres/database.ts taking its `PgExecutor` the same way).
+ */
+export declare const reconcileRuleset: <R = never>(input: {
+    readonly octokit: RulesetOctokit<R>;
+    readonly news: RepositoryRulesetProps;
+    readonly output: RepositoryRulesetAttributes | undefined;
+    readonly constraintRefusal: (props: RepositoryRulesetProps) => RulesetConstraintRefused | undefined;
+    readonly attrsOf: (r: RulesetRecord) => RepositoryRulesetAttributes;
+}) => Effect.Effect<RepositoryRulesetAttributes, RepositoryRulesetError | Error, R>;
+//# sourceMappingURL=repository-ruleset-reconcile.d.ts.map

package/dist/github/repository-ruleset-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-reconcile.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-reconcile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEnG,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,gCAAgC,CAAC;AAUxC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,+BAA+B,CAAC;AA+CvC;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,KAAK,SAAS;IACjD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,sBAAsB,KAC1B,wBAAwB,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,2BAA2B,CAAC;CACrE,KAAG,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,sBAAsB,GAAG,KAAK,EAAE,CAAC,CAuF5E,CAAC"}

package/dist/github/repository-ruleset-test-helpers.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Shared plumbing for the write-recording fake tests, split out of
+ * repository-ruleset-write.test.ts and repository-ruleset-write-refusals.test.ts purely to keep
+ * both under the 250-line file cap — nothing here is a fixture of house-standard VALUES (that
+ * is repository-ruleset-fixtures.ts); this is just "run an Effect", "expect it to fail", and one
+ * baseline-shaped `RepositoryRulesetProps` for `widgets`.
+ */
+import * as Effect from 'effect/Effect';
+import type { RecordingFake } from './repository-ruleset-fake-octokit.ts';
+import { type RepositoryRulesetProps, type RepositoryRulesetPullRequestRule } from './repository-ruleset.ts';
+import type { RepositoryRulesetError, RulesetConstraintRefused } from './repository-ruleset-errors.ts';
+import type { RulesetOctokit } from './repository-ruleset-probe.ts';
+export declare const run: <A, E>(eff: Effect.Effect<A, E>) => Promise<A>;
+export declare const fails: <A, E>(eff: Effect.Effect<A, E>) => Promise<E>;
+/** Every case across both files expects a TAGGED refusal, never the plain transport `Error` a
+ * real fetch failure would carry — narrowing here keeps every test's assertion a one-liner. */
+export declare const tagOf: (error: RepositoryRulesetError | Error) => string;
+export declare const constraintRefusal: () => RulesetConstraintRefused | undefined;
+export declare const BASE_PULL_REQUEST: RepositoryRulesetPullRequestRule;
+export declare const props: (over?: Partial<RepositoryRulesetProps>) => RepositoryRulesetProps;
+/** Reconciles `p` against a `RecordingFake`, with `output` (when given) shaped as a real
+ * `RepositoryRulesetAttributes` — every field but `rulesetId` defaulted, since no test here
+ * reads `nodeId`/timestamps. */
+export declare const reconcileAgainst: (fake: RecordingFake, p: RepositoryRulesetProps, output?: {
+    rulesetId: number;
+}) => Effect.Effect<import("./repository-ruleset.ts").RepositoryRulesetAttributes, Error | RepositoryRulesetError, never>;
+/** For the hand-built fakes in the refusals file, which construct a `RulesetOctokit` directly
+ * rather than going through `RecordingFake`. */
+export declare const reconcileWithOctokit: (octokit: RulesetOctokit, p: RepositoryRulesetProps, output?: {
+    rulesetId: number;
+}) => Effect.Effect<import("./repository-ruleset.ts").RepositoryRulesetAttributes, Error | RepositoryRulesetError, never>;
+//# sourceMappingURL=repository-ruleset-test-helpers.d.ts.map

package/dist/github/repository-ruleset-test-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-test-helpers.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-test-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,gCAAgC,EAEtC,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EACV,sBAAsB,EACtB,wBAAwB,EACzB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpE,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CAA2B,CAAC;AAC1F,eAAO,MAAM,KAAK,GAAI,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CAC3B,CAAC;AAEtC;+FAC+F;AAC/F,eAAO,MAAM,KAAK,UAAW,sBAAsB,GAAG,KAAK,KAAG,MACA,CAAC;AAE/D,eAAO,MAAM,iBAAiB,QAAsB,wBAAwB,GAAG,SAAS,CAAC;AAEzF,eAAO,MAAM,iBAAiB,EAAE,gCAI/B,CAAC;AAEF,eAAO,MAAM,KAAK,UAAU,OAAO,CAAC,sBAAsB,CAAC,KAAQ,sBAcjE,CAAC;AAEH;;gCAEgC;AAChC,eAAO,MAAM,gBAAgB,SACrB,aAAa,KAChB,sBAAsB,WAChB;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,wHAiB5B,CAAC;AAEL;gDACgD;AAChD,eAAO,MAAM,oBAAoB,YACtB,cAAc,KACpB,sBAAsB,WAChB;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,wHAiB5B,CAAC"}

package/dist/github/repository-ruleset.d.ts

@@ -0,0 +1,89 @@
+/**
+ * `GitHub.RepositoryRuleset` — a bridge resource for the one thing upstream `GitHub.Ruleset`
+ * cannot do: find a ruleset that already exists before creating a second one with the same
+ * name.
+ *
+ * ⛔ THE HAZARD THIS EXISTS TO CLOSE. Read out of `alchemy@2.0.0-beta.79`'s own source
+ *   (`node_modules/alchemy/src/GitHub/Ruleset.ts`, `reconcile`): `let observed = output ===
+ *   undefined ? undefined : yield* getRuleset(news, output.rulesetId)`. With no prior state,
+ *   `observed` stays `undefined` and `createRepoRuleset` runs UNCONDITIONALLY — there is no
+ *   probe by name. GitHub permits several rulesets with one name on a repository, so nothing
+ *   errors; the repo quietly ends up with two, both enforcing. `declareRepoPolicy` in this same
+ *   package (repo-policy.ts) documents the same hazard and tells a caller to check `gh api
+ *   repos/<owner>/<repo>/rulesets` by hand before every first deploy. This resource makes that
+ *   check the engine's own job: `read`/`reconcile` list-and-filter by name+target before ever
+ *   creating (see repository-ruleset-probe.ts).
+ *
+ * ★ WHY A NEW TYPE STRING, NOT A PATCHED `GitHub.Ruleset`. Upstream's `Ruleset` cannot be
+ *   edited from here — it ships inside the `alchemy` package. `GitHub.RepositoryRuleset` is a
+ *   distinct `Provider` (its own `Context.Service` keyed by this type string — see
+ *   `alchemy/src/Provider.ts#Provider`), so it is declared and merged into a stack's provider
+ *   layer independently of `GitHub.providers()` — the same way `postgres/database.ts` merges
+ *   `PostgresDatabaseProvider()` beside it. Nothing about upstream's `GitHub.Providers`
+ *   collection needs touching for the two to coexist in one stack. Props are a strict superset
+ *   of upstream's `RulesetProps` (H14: the type string sits inside upstream's own `GitHub`
+ *   namespace, recorded as house difference H15 below for the client choice).
+ *
+ * ⛔ H15: CLIENT IS OCTOKIT, NOT DISTILLED — A NAMED DIVERGENCE FROM S23. The house's default is
+ *   `@distilled.cloud/*` when a vendor SDK exists there, and `@distilled.cloud/github@1.0.0-rc.12`
+ *   does ship `createRepoRuleset`/`updateRepoRuleset`. But it has NO field for
+ *   `require_extra_approval_for_unattributed_changes` (measured 2026-09-22: grep of its
+ *   generated types), and its request bodies are plain `effect/Schema` `S.Struct`s, which strip
+ *   properties a schema does not declare on encode — REASONED, not measured against distilled
+ *   itself; repository-ruleset-wire.test.ts measures the Octokit side of the same question
+ *   instead, because Octokit is the client this file actually uses. That flag is the entire
+ *   reason this resource exists for the 0-approval, solo-maintainer shape (see
+ *   repo-policy-guards.ts's `resolveApprovals` for the same story on the upstream-only path):
+ *   GitHub defaults it to `true` when absent, which blocks the very pull requests a `0` was
+ *   meant to allow. `octokitFor`/`GitHubCredentials` are upstream's own EXPORTED building
+ *   blocks (S23's second clause: reuse Alchemy's own client construction), so the client itself
+ *   is not hand-rolled — only the choice of Octokit over distilled is a recorded divergence.
+ */
+import { Resource } from 'alchemy';
+import type { GitHubCredentials, RulesetProps } from 'alchemy/GitHub';
+import * as Provider from 'alchemy/Provider';
+import { type RulesetRecord } from './repository-ruleset-probe.ts';
+type UpstreamRules = NonNullable<RulesetProps['rules']>;
+export interface RepositoryRulesetReviewerRule {
+    readonly filePatterns: readonly string[];
+    readonly minimumApprovals: number;
+    readonly reviewer: {
+        readonly actorId: number;
+        readonly actorType: 'Team';
+    };
+}
+export interface RepositoryRulesetPullRequestRule extends NonNullable<UpstreamRules['pullRequest']> {
+    /** @default every method GitHub allows — the house baseline always pins `['squash']`. */
+    readonly allowedMergeMethods?: readonly ('merge' | 'squash' | 'rebase')[];
+    readonly requiredReviewers?: readonly RepositoryRulesetReviewerRule[];
+    /** `require_extra_approval_for_unattributed_changes` — see H15 above. Only `false` is
+     * modeled: sending `true` has no house use, and GitHub already defaults absent to `true`. */
+    readonly extraApprovalForUnattributedChanges?: false;
+}
+export interface RepositoryRulesetStatusChecksRule extends NonNullable<UpstreamRules['requiredStatusChecks']> {
+    readonly doNotEnforceOnCreate?: boolean;
+}
+export interface RepositoryRulesetRules extends Omit<UpstreamRules, 'pullRequest' | 'requiredStatusChecks'> {
+    readonly pullRequest?: RepositoryRulesetPullRequestRule;
+    /** `undefined`: no opinion (refused if the live ruleset already has one — see
+     * repository-ruleset-guards.ts). `false`: declare its ABSENCE — removes a live one. */
+    readonly requiredStatusChecks?: RepositoryRulesetStatusChecksRule | false;
+}
+export interface RepositoryRulesetProps extends Omit<RulesetProps, 'rules'> {
+    readonly rules?: RepositoryRulesetRules;
+}
+export interface RepositoryRulesetAttributes {
+    readonly rulesetId: number;
+    readonly nodeId: string | undefined;
+    readonly name: string;
+    readonly createdAt: string | undefined;
+    readonly updatedAt: string | undefined;
+}
+export interface RepositoryRuleset extends Resource<'GitHub.RepositoryRuleset', RepositoryRulesetProps, RepositoryRulesetAttributes, never, GitHubCredentials> {
+}
+export declare const RepositoryRuleset: import("alchemy").ResourceClass<RepositoryRuleset>;
+export declare const attrsOf: (r: RulesetRecord) => RepositoryRulesetAttributes;
+export declare const repositoryRulesetHandlers: Provider.ProviderService<RepositoryRuleset, GitHubCredentials, never, never, GitHubCredentials, GitHubCredentials, never, never, never>;
+export declare const RepositoryRulesetProvider: () => import("effect/Layer").Layer<Provider.Provider<RepositoryRuleset>, never, GitHubCredentials>;
+export {};
+//# sourceMappingURL=repository-ruleset.d.ts.map

package/dist/github/repository-ruleset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAQ7C,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,+BAA+B,CAAC;AAGhF,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,gCAAiC,SAAQ,WAAW,CACnE,aAAa,CAAC,aAAa,CAAC,CAC7B;IACC,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACtE;iGAC6F;IAC7F,QAAQ,CAAC,mCAAmC,CAAC,EAAE,KAAK,CAAC;CACtD;AAED,MAAM,WAAW,iCAAkC,SAAQ,WAAW,CACpE,aAAa,CAAC,sBAAsB,CAAC,CACtC;IACC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAClD,aAAa,EACb,aAAa,GAAG,sBAAsB,CACvC;IACC,QAAQ,CAAC,WAAW,CAAC,EAAE,gCAAgC,CAAC;IACxD;2FACuF;IACvF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,iCAAiC,GAAG,KAAK,CAAC;CAC3E;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,OAAO,MAAO,aAAa,KAAG,2BAMzC,CAAC;AA4BH,eAAO,MAAM,yBAAyB,yIAkEpC,CAAC;AAEH,eAAO,MAAM,yBAAyB,oGAC0B,CAAC"}