@homeflare/alchemy 0.26.0 → 0.27.0

package/dist/github/index.js

@@ -138,9 +138,643 @@ function repoPolicy(options) {
 import { adopt } from "alchemy/AdoptPolicy";
 import * as GitHub from "alchemy/GitHub";
 import * as RemovalPolicy from "alchemy/RemovalPolicy";
+import * as Effect6 from "effect/Effect";
+
+// src/github/repository-ruleset.ts
+import { Resource } from "alchemy";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import * as Effect5 from "effect/Effect";
+
+// src/github/repository-ruleset-constraints.ts
+var RULE_TYPE_COVERAGE = {
+  creation: "modeled",
+  update: "modeled",
+  deletion: "modeled",
+  required_linear_history: "modeled",
+  required_signatures: "modeled",
+  pull_request: "modeled",
+  required_status_checks: "modeled",
+  non_fast_forward: "modeled",
+  merge_queue: "refused",
+  required_deployments: "refused",
+  commit_message_pattern: "refused",
+  commit_author_email_pattern: "refused",
+  committer_email_pattern: "refused",
+  branch_name_pattern: "refused",
+  tag_name_pattern: "refused",
+  workflows: "refused",
+  code_scanning: "refused",
+  copilot_code_review: "refused",
+  file_path_restriction: "refused",
+  max_file_path_length: "refused",
+  file_extension_restriction: "refused",
+  max_file_size: "refused"
+};
+var MODELED_RULE_TYPES = Object.keys(RULE_TYPE_COVERAGE).filter((type) => RULE_TYPE_COVERAGE[type] === "modeled");
+var ALLOWED_MERGE_METHODS = ["merge", "squash", "rebase"];
+var MIN_REQUIRED_APPROVALS = 0;
+var MAX_REQUIRED_APPROVALS = 10;
+function approvalCountRefusal(count) {
+  if (!Number.isInteger(count) || count < MIN_REQUIRED_APPROVALS || count > MAX_REQUIRED_APPROVALS) {
+    return `requiredApprovingReviewCount must be a whole number from ${String(MIN_REQUIRED_APPROVALS)} ` + `to ${String(MAX_REQUIRED_APPROVALS)} (GitHub's own bound); got ${String(count)}.`;
+  }
+  return;
+}
+function allowedMergeMethodsRefusal(methods) {
+  if (methods.length === 0) {
+    return "allowedMergeMethods must name at least one method — GitHub refuses an empty list.";
+  }
+  const bad = methods.filter((m) => !ALLOWED_MERGE_METHODS.includes(m));
+  if (bad.length > 0) {
+    return `allowedMergeMethods has values GitHub does not accept: ${bad.join(", ")}.`;
+  }
+  return;
+}
+
+// src/github/repository-ruleset-errors.ts
+import * as Data from "effect/Data";
+
+class DuplicateRuleset extends Data.TaggedError("DuplicateRuleset") {
+  get message() {
+    return `GitHub.RepositoryRuleset: ${this.owner}/${this.repository} has ${String(this.ids.length)} ` + `rulesets named "${this.name}" (ids ${this.ids.join(", ")}). Delete the extra one or rename ` + "it by hand before this resource can adopt or manage it — nothing was read or written.";
+  }
+}
+
+class BypassActorWidened extends Data.TaggedError("BypassActorWidened") {
+  get message() {
+    return `GitHub.RepositoryRuleset "${this.name}" on ${this.owner}/${this.repository}: the ` + `declaration adds a bypass actor the live ruleset does not have (${this.widened.join(", ")}). ` + "Widening bypass is refused here; grant it by hand and adopt the change, or use handoff.";
+  }
+}
+
+class UndeclaredLiveRule extends Data.TaggedError("UndeclaredLiveRule") {
+  get message() {
+    return `GitHub.RepositoryRuleset "${this.name}" on ${this.owner}/${this.repository}: the live ` + `ruleset has a "${this.ruleType}" rule this resource does not model. Declare it (if it is ` + "now modeled) or an explicit `false` to remove it — the PUT replaces `rules` wholesale, so " + "nothing may be dropped silently.";
+  }
+}
+
+class RequiredChecksOmitted extends Data.TaggedError("RequiredChecksOmitted") {
+  get message() {
+    return `GitHub.RepositoryRuleset "${this.name}" on ${this.owner}/${this.repository}: the live ` + `ruleset requires ${this.liveContexts.join(", ")}, and the declaration says nothing about ` + "requiredStatusChecks. Declare the same contexts, or `rules.requiredStatusChecks: false` to " + "remove them on purpose.";
+  }
+}
+
+class NeverReportedContext extends Data.TaggedError("NeverReportedContext") {
+  get message() {
+    return `GitHub.RepositoryRuleset: "${this.context}" has never reported success on ` + `${this.owner}/${this.repository}'s default branch. Requiring it now would leave every ` + "pull request waiting on a check that has never once reported — refused before any write.";
+  }
+}
+
+class RulesetConstraintRefused extends Data.TaggedError("RulesetConstraintRefused") {
+  get message() {
+    return `GitHub.RepositoryRuleset: ${this.field} — ${this.reason}`;
+  }
+}
+
+class ReadbackMismatch extends Data.TaggedError("ReadbackMismatch") {
+  get message() {
+    return `GitHub.RepositoryRuleset "${this.name}" on ${this.owner}/${this.repository}: after the ` + `write, an independent GET of ${this.field} read back ${JSON.stringify(this.read)}, not the ` + `${JSON.stringify(this.sent)} that was sent. The write did not persist as declared.`;
+  }
+}
+
+// src/github/repository-ruleset-octokit.ts
+import { GitHubCredentials } from "alchemy/GitHub";
 import * as Effect from "effect/Effect";
-var declareRepoPolicy = (id, options) => Effect.gen(function* () {
-  const policy = yield* Effect.try({
+var asError = (e) => e instanceof Error ? e : new Error(String(e));
+var octokitFor = (baseUrl) => Effect.gen(function* () {
+  const creds = yield* yield* GitHubCredentials;
+  return baseUrl === undefined ? creds.octokit() : creds.octokit({ baseUrl });
+}).pipe(Effect.mapError(asError));
+var is404 = (e) => e?.status === 404;
+var makeRulesetOctokit = (baseUrl) => ({
+  list: ({ owner, repo }) => Effect.gen(function* () {
+    const octokit = yield* octokitFor(baseUrl);
+    const rulesets = yield* Effect.tryPromise({
+      try: () => octokit.paginate(octokit.rest.repos.getRepoRulesets, {
+        owner,
+        repo,
+        includes_parents: false,
+        per_page: 100
+      }),
+      catch: asError
+    });
+    return rulesets;
+  }),
+  get: ({ owner, repo, rulesetId }) => Effect.gen(function* () {
+    const octokit = yield* octokitFor(baseUrl);
+    return yield* Effect.tryPromise({
+      try: () => octokit.rest.repos.getRepoRuleset({ owner, repo, ruleset_id: rulesetId }),
+      catch: (e) => e
+    }).pipe(Effect.map(({ data }) => data), Effect.catchIf(is404, () => Effect.succeed(undefined)), Effect.mapError(asError));
+  }),
+  create: (input) => Effect.gen(function* () {
+    const octokit = yield* octokitFor(baseUrl);
+    const { data } = yield* Effect.tryPromise({
+      try: () => octokit.rest.repos.createRepoRuleset({
+        owner: input.owner,
+        repo: input.repo,
+        ...input.body
+      }),
+      catch: asError
+    });
+    return data;
+  }),
+  update: (input) => Effect.gen(function* () {
+    const octokit = yield* octokitFor(baseUrl);
+    const { data } = yield* Effect.tryPromise({
+      try: () => octokit.rest.repos.updateRepoRuleset({
+        owner: input.owner,
+        repo: input.repo,
+        ruleset_id: input.rulesetId,
+        ...input.body
+      }),
+      catch: asError
+    });
+    return data;
+  }),
+  delete: ({ owner, repo, rulesetId }) => Effect.gen(function* () {
+    const octokit = yield* octokitFor(baseUrl);
+    yield* Effect.tryPromise({
+      try: () => octokit.rest.repos.deleteRepoRuleset({ owner, repo, ruleset_id: rulesetId }),
+      catch: (e) => e
+    }).pipe(Effect.asVoid, Effect.catchIf(is404, () => Effect.void), Effect.mapError(asError));
+  }),
+  hasContextReportedSuccess: ({ owner, repo, context }) => Effect.gen(function* () {
+    const octokit = yield* octokitFor(baseUrl);
+    const repository = yield* Effect.tryPromise({
+      try: () => octokit.rest.repos.get({ owner, repo }),
+      catch: asError
+    });
+    const ref = repository.data.default_branch;
+    const [checkRuns, statuses] = yield* Effect.all([
+      Effect.tryPromise({
+        try: () => octokit.rest.checks.listForRef({ owner, repo, ref, check_name: context }),
+        catch: asError
+      }),
+      Effect.tryPromise({
+        try: () => octokit.rest.repos.listCommitStatusesForRef({ owner, repo, ref }),
+        catch: asError
+      })
+    ]);
+    const checkReported = checkRuns.data.check_runs.some((run) => run.name === context && run.conclusion === "success");
+    const statusReported = statuses.data.some((status) => status.context === context && status.state === "success");
+    return checkReported || statusReported;
+  })
+});
+
+// src/github/repository-ruleset-probe.ts
+import * as Effect2 from "effect/Effect";
+var probeByName = (octokit, input) => Effect2.gen(function* () {
+  const all2 = yield* octokit.list({ owner: input.owner, repo: input.repo });
+  const matches = all2.filter((r) => r.name === input.name && (r.target ?? "branch") === input.target);
+  const [only, ...rest] = matches;
+  if (only === undefined)
+    return;
+  if (rest.length > 0) {
+    return yield* Effect2.fail(new DuplicateRuleset({
+      owner: input.owner,
+      repository: input.repo,
+      name: input.name,
+      ids: matches.map((m) => m.id)
+    }));
+  }
+  return yield* octokit.get({ owner: input.owner, repo: input.repo, rulesetId: only.id });
+});
+
+// src/github/repository-ruleset-reconcile.ts
+import * as Effect4 from "effect/Effect";
+
+// src/github/repository-ruleset-form.ts
+var RULE_BUILD_ORDER = [
+  "creation",
+  "update",
+  "deletion",
+  "required_linear_history",
+  "required_signatures",
+  "non_fast_forward",
+  "pull_request",
+  "required_status_checks"
+];
+function buildPullRequestRule(rule) {
+  return {
+    type: "pull_request",
+    parameters: {
+      required_approving_review_count: rule.requiredApprovingReviewCount ?? 0,
+      dismiss_stale_reviews_on_push: rule.dismissStaleReviewsOnPush ?? false,
+      require_code_owner_review: rule.requireCodeOwnerReview ?? false,
+      require_last_push_approval: rule.requireLastPushApproval ?? false,
+      required_review_thread_resolution: rule.requiredReviewThreadResolution ?? false,
+      ...rule.allowedMergeMethods === undefined ? {} : { allowed_merge_methods: [...rule.allowedMergeMethods] },
+      required_reviewers: (rule.requiredReviewers ?? []).map((r) => ({
+        file_patterns: [...r.filePatterns],
+        minimum_approvals: r.minimumApprovals,
+        reviewer: { id: r.reviewer.actorId, type: r.reviewer.actorType }
+      })),
+      ...rule.extraApprovalForUnattributedChanges === undefined ? {} : { require_extra_approval_for_unattributed_changes: false }
+    }
+  };
+}
+function buildStatusChecksRule(rule) {
+  return {
+    type: "required_status_checks",
+    parameters: {
+      required_status_checks: rule.checks.map((c) => ({
+        context: c.context,
+        ...c.integrationId === undefined ? {} : { integration_id: c.integrationId }
+      })),
+      strict_required_status_checks_policy: rule.strictRequiredStatusChecksPolicy ?? false,
+      do_not_enforce_on_create: rule.doNotEnforceOnCreate ?? false
+    }
+  };
+}
+function buildWireRules(rules) {
+  const wire = [];
+  for (const type of RULE_BUILD_ORDER) {
+    switch (type) {
+      case "creation":
+        if (rules?.creation)
+          wire.push({ type: "creation" });
+        break;
+      case "update":
+        if (rules?.update) {
+          wire.push({ type: "update", parameters: { update_allows_fetch_and_merge: false } });
+        }
+        break;
+      case "deletion":
+        if (rules?.deletion)
+          wire.push({ type: "deletion" });
+        break;
+      case "required_linear_history":
+        if (rules?.requiredLinearHistory)
+          wire.push({ type: "required_linear_history" });
+        break;
+      case "required_signatures":
+        if (rules?.requiredSignatures)
+          wire.push({ type: "required_signatures" });
+        break;
+      case "non_fast_forward":
+        if (rules?.nonFastForward)
+          wire.push({ type: "non_fast_forward" });
+        break;
+      case "pull_request":
+        if (rules?.pullRequest)
+          wire.push(buildPullRequestRule(rules.pullRequest));
+        break;
+      case "required_status_checks":
+        if (rules?.requiredStatusChecks) {
+          wire.push(buildStatusChecksRule(rules.requiredStatusChecks));
+        }
+        break;
+    }
+  }
+  return wire;
+}
+function desiredWireRuleset(props) {
+  return {
+    name: props.name,
+    target: props.target ?? "branch",
+    enforcement: props.enforcement ?? "active",
+    bypass_actors: (props.bypassActors ?? []).map((a) => ({
+      actor_type: a.actorType,
+      ...a.actorId === undefined ? {} : { actor_id: a.actorId },
+      bypass_mode: a.bypassMode ?? "always"
+    })),
+    conditions: {
+      ref_name: {
+        include: [...props.conditions?.include ?? ["~ALL"]].sort(),
+        exclude: [...props.conditions?.exclude ?? []].sort()
+      }
+    },
+    rules: buildWireRules(props.rules)
+  };
+}
+var sortByJson = (items) => [...items].sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
+function stripNullish(value) {
+  if (Array.isArray(value))
+    return value.map(stripNullish);
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const k of Object.keys(value).sort()) {
+      const v = value[k];
+      if (v !== null && v !== undefined)
+        out[k] = stripNullish(v);
+    }
+    return out;
+  }
+  return value;
+}
+function canonicalizeRule(rule) {
+  const stripped = stripNullish(rule);
+  const params = stripped.parameters;
+  if (params === undefined)
+    return stripped;
+  const next = { ...params };
+  if (Array.isArray(next.allowed_merge_methods)) {
+    next.allowed_merge_methods = [...next.allowed_merge_methods].sort();
+  }
+  if (Array.isArray(next.required_status_checks)) {
+    next.required_status_checks = sortByJson(next.required_status_checks);
+  }
+  return { ...stripped, parameters: next };
+}
+function canonicalizeWireRuleset(input) {
+  const r = input ?? {};
+  return stripNullish({
+    name: r.name,
+    target: r.target ?? "branch",
+    enforcement: r.enforcement,
+    bypass_actors: sortByJson(r.bypass_actors ?? []),
+    conditions: r.conditions,
+    rules: sortByJson((r.rules ?? []).map(canonicalizeRule))
+  });
+}
+
+// src/github/repository-ruleset-guards.ts
+import * as Effect3 from "effect/Effect";
+var bypassKey = (a) => `${String(a.actor_type)}:${String(a.actor_id ?? "")}:${String(a.bypass_mode ?? "always")}`;
+function bypassWideningRefusal(input) {
+  if (input.live === undefined)
+    return;
+  const liveActors = input.live.bypass_actors ?? [];
+  const liveKeys = new Set(liveActors.map(bypassKey));
+  const widened = (input.declared ?? []).map((a) => bypassKey({
+    actor_type: a.actorType,
+    actor_id: a.actorId,
+    bypass_mode: a.bypassMode ?? "always"
+  })).filter((k) => !liveKeys.has(k));
+  if (widened.length === 0)
+    return;
+  return new BypassActorWidened({
+    owner: input.owner,
+    repository: input.repository,
+    name: input.name,
+    widened
+  });
+}
+var liveRuleTypes = (live) => new Set((live?.rules ?? []).map((r) => String(r.type)));
+function undeclaredLiveRuleRefusal(input) {
+  for (const type of liveRuleTypes(input.live)) {
+    const coverage = RULE_TYPE_COVERAGE[type];
+    if (coverage === "refused") {
+      return new UndeclaredLiveRule({
+        owner: input.owner,
+        repository: input.repository,
+        name: input.name,
+        ruleType: type
+      });
+    }
+    if (coverage === "modeled" && type !== "required_status_checks" && !input.declaredTypes.has(type)) {
+      return new UndeclaredLiveRule({
+        owner: input.owner,
+        repository: input.repository,
+        name: input.name,
+        ruleType: type
+      });
+    }
+  }
+  return;
+}
+function declaredRuleTypes(rules) {
+  if (rules === undefined)
+    return new Set;
+  const BOOLEAN_KEY_TO_TYPE = {
+    creation: "creation",
+    update: "update",
+    deletion: "deletion",
+    requiredLinearHistory: "required_linear_history",
+    requiredSignatures: "required_signatures",
+    nonFastForward: "non_fast_forward"
+  };
+  const types = new Set;
+  for (const [key, type] of Object.entries(BOOLEAN_KEY_TO_TYPE)) {
+    if (Object.hasOwn(rules, key))
+      types.add(type);
+  }
+  if (Object.hasOwn(rules, "pullRequest"))
+    types.add("pull_request");
+  return types;
+}
+function requiredChecksOmissionRefusal(input) {
+  if (input.declared?.requiredStatusChecks !== undefined)
+    return;
+  const liveRule = (input.live?.rules ?? []).find((r) => r.type === "required_status_checks");
+  if (liveRule === undefined)
+    return;
+  const params = liveRule.parameters;
+  const liveContexts = (params?.required_status_checks ?? []).map((c) => c.context);
+  return new RequiredChecksOmitted({
+    owner: input.owner,
+    repository: input.repository,
+    name: input.name,
+    liveContexts
+  });
+}
+var newlyRequiredContexts = (declared, live) => {
+  if (declared?.requiredStatusChecks === false || declared?.requiredStatusChecks === undefined)
+    return [];
+  const liveRule = (live?.rules ?? []).find((r) => r.type === "required_status_checks");
+  const liveParams = liveRule?.parameters;
+  const liveContexts = new Set((liveParams?.required_status_checks ?? []).map((c) => c.context));
+  return declared.requiredStatusChecks.checks.map((c) => c.context).filter((c) => !liveContexts.has(c));
+};
+var refuseUnreportedContexts = (octokit, owner, repo, contexts) => Effect3.gen(function* () {
+  for (const context of contexts) {
+    const reported = yield* octokit.hasContextReportedSuccess({ owner, repo, context });
+    if (!reported) {
+      return yield* Effect3.fail(new NeverReportedContext({ owner, repository: repo, context }));
+    }
+  }
+});
+
+// src/github/repository-ruleset-reconcile.ts
+var guardedPullRequestFields = (rule) => {
+  const params = rule?.parameters ?? {};
+  return {
+    required_approving_review_count: params.required_approving_review_count,
+    allowed_merge_methods: Array.isArray(params.allowed_merge_methods) ? [...params.allowed_merge_methods].sort() : undefined,
+    require_extra_approval_for_unattributed_changes: params.require_extra_approval_for_unattributed_changes
+  };
+};
+function readbackRefusal(owner, repository, name, sentRules, independent) {
+  const sentPr = sentRules.find((r) => r.type === "pull_request");
+  if (sentPr === undefined)
+    return;
+  const readPr = (independent.rules ?? []).find((r) => r.type === "pull_request");
+  const sent = guardedPullRequestFields(sentPr);
+  const read = guardedPullRequestFields(readPr);
+  for (const field of Object.keys(sent)) {
+    if (sent[field] === undefined)
+      continue;
+    if (JSON.stringify(sent[field]) !== JSON.stringify(read[field])) {
+      return new ReadbackMismatch({
+        owner,
+        repository,
+        name,
+        field: `rules.pull_request.parameters.${field}`,
+        sent: sent[field],
+        read: read[field]
+      });
+    }
+  }
+  return;
+}
+var reconcileRuleset = (input) => Effect4.gen(function* () {
+  const { news, output, constraintRefusal, attrsOf, octokit } = input;
+  const refusal = constraintRefusal(news);
+  if (refusal !== undefined)
+    return yield* Effect4.fail(refusal);
+  const owner = news.owner;
+  const repo = news.repository;
+  const target = news.target ?? "branch";
+  let observed = output === undefined ? undefined : yield* octokit.get({ owner, repo, rulesetId: output.rulesetId });
+  if (observed === undefined) {
+    observed = yield* probeByName(octokit, { owner, repo, name: news.name, target });
+  }
+  const bypassRefusal = news.bypassActors === undefined ? undefined : bypassWideningRefusal({
+    owner,
+    repository: repo,
+    name: news.name,
+    declared: news.bypassActors,
+    live: observed
+  });
+  if (bypassRefusal !== undefined)
+    return yield* Effect4.fail(bypassRefusal);
+  const ruleRefusal = undeclaredLiveRuleRefusal({
+    owner,
+    repository: repo,
+    name: news.name,
+    live: observed,
+    declaredTypes: declaredRuleTypes(news.rules)
+  });
+  if (ruleRefusal !== undefined)
+    return yield* Effect4.fail(ruleRefusal);
+  const checksRefusal = requiredChecksOmissionRefusal({
+    owner,
+    repository: repo,
+    name: news.name,
+    declared: news.rules,
+    live: observed
+  });
+  if (checksRefusal !== undefined)
+    return yield* Effect4.fail(checksRefusal);
+  const newContexts = newlyRequiredContexts(news.rules, observed);
+  yield* refuseUnreportedContexts(octokit, owner, repo, newContexts);
+  const desired = desiredWireRuleset(news);
+  const body = news.bypassActors === undefined && observed !== undefined ? { ...desired, bypass_actors: observed.bypass_actors ?? [] } : desired;
+  let record;
+  let wrote = false;
+  if (observed === undefined) {
+    record = yield* octokit.create({ owner, repo, body });
+    wrote = true;
+  } else {
+    const same = JSON.stringify(canonicalizeWireRuleset(body)) === JSON.stringify(canonicalizeWireRuleset(observed));
+    if (same) {
+      record = observed;
+    } else {
+      record = yield* octokit.update({ owner, repo, rulesetId: observed.id, body });
+      wrote = true;
+    }
+  }
+  if (wrote) {
+    const independent = yield* octokit.get({ owner, repo, rulesetId: record.id });
+    if (independent !== undefined) {
+      const sentRules = body.rules ?? [];
+      const mismatch = readbackRefusal(owner, repo, news.name, sentRules, independent);
+      if (mismatch !== undefined)
+        return yield* Effect4.fail(mismatch);
+    }
+  }
+  return attrsOf(record);
+});
+
+// src/github/repository-ruleset.ts
+var RepositoryRuleset = Resource("GitHub.RepositoryRuleset", {
+  defaultRemovalPolicy: "retain"
+});
+var attrsOf = (r) => ({
+  rulesetId: r.id,
+  nodeId: r.node_id,
+  name: r.name,
+  createdAt: r.created_at,
+  updatedAt: r.updated_at
+});
+function constraintRefusal(props) {
+  const approvals = props.rules?.pullRequest?.requiredApprovingReviewCount;
+  if (approvals !== undefined) {
+    const reason = approvalCountRefusal(approvals);
+    if (reason !== undefined) {
+      return new RulesetConstraintRefused({
+        field: "rules.pullRequest.requiredApprovingReviewCount",
+        reason
+      });
+    }
+  }
+  const methods = props.rules?.pullRequest?.allowedMergeMethods;
+  if (methods !== undefined) {
+    const reason = allowedMergeMethodsRefusal(methods);
+    if (reason !== undefined) {
+      return new RulesetConstraintRefused({
+        field: "rules.pullRequest.allowedMergeMethods",
+        reason
+      });
+    }
+  }
+  return;
+}
+var repositoryRulesetHandlers = RepositoryRuleset.Provider.of({
+  list: () => Effect5.succeed([]),
+  nuke: { skip: true },
+  read: ({ output, olds }) => Effect5.gen(function* () {
+    const octokit = makeRulesetOctokit(olds.baseUrl);
+    if (output === undefined) {
+      const match = yield* probeByName(octokit, {
+        owner: olds.owner,
+        repo: olds.repository,
+        name: olds.name,
+        target: olds.target ?? "branch"
+      });
+      return match === undefined ? undefined : Unowned(attrsOf(match));
+    }
+    const byId = yield* octokit.get({
+      owner: olds.owner,
+      repo: olds.repository,
+      rulesetId: output.rulesetId
+    });
+    if (byId !== undefined)
+      return attrsOf(byId);
+    const byName = yield* probeByName(octokit, {
+      owner: olds.owner,
+      repo: olds.repository,
+      name: olds.name,
+      target: olds.target ?? "branch"
+    });
+    return byName === undefined ? undefined : attrsOf(byName);
+  }),
+  diff: ({ news, olds }) => Effect5.succeed(isResolved(news) && olds !== undefined && (news.owner !== olds.owner || news.repository !== olds.repository) ? { action: "replace" } : undefined),
+  reconcile: ({ news, output }) => reconcileRuleset({
+    octokit: makeRulesetOctokit(news.baseUrl),
+    news,
+    output,
+    constraintRefusal,
+    attrsOf
+  }),
+  delete: ({ olds, output }) => Effect5.gen(function* () {
+    if (output?.rulesetId === undefined)
+      return;
+    const octokit = makeRulesetOctokit(olds.baseUrl);
+    yield* octokit.delete({
+      owner: olds.owner,
+      repo: olds.repository,
+      rulesetId: output.rulesetId
+    });
+  })
+});
+var RepositoryRulesetProvider = () => Provider.succeed(RepositoryRuleset, repositoryRulesetHandlers);
+
+// src/github/repo-policy.ts
+var declareRepoPolicy = (id, options) => Effect6.gen(function* () {
+  const policy = yield* Effect6.try({
     catch: (cause) => cause instanceof Error ? cause : new Error(String(cause)),
     try: () => repoPolicy(options)
   });
@@ -149,13 +783,90 @@ var declareRepoPolicy = (id, options) => Effect.gen(function* () {
     return options.adopt === undefined ? kept : kept.pipe(adopt(options.adopt));
   };
   const repository = yield* owned(GitHub.Repository(id, policy.repository));
-  const ruleset = yield* owned(GitHub.Ruleset(`${id}-ruleset`, policy.ruleset));
+  const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, policy.ruleset));
   return { policy, repository, ruleset };
 });
+// src/github/repo-baseline-data.ts
+function repoBaselineSettings(input) {
+  return {
+    owner: input.owner,
+    name: input.repository,
+    ...input.description === undefined ? {} : { description: input.description },
+    visibility: input.visibility,
+    allowSquashMerge: true,
+    allowMergeCommit: false,
+    allowRebaseMerge: false,
+    allowAutoMerge: true,
+    deleteBranchOnMerge: true,
+    hasWiki: false
+  };
+}
+function repoBaselineRuleset(input) {
+  return {
+    owner: input.owner,
+    repository: input.repository,
+    name: "main",
+    target: "branch",
+    enforcement: "active",
+    bypassActors: [],
+    conditions: { include: ["~DEFAULT_BRANCH"], exclude: [] },
+    rules: {
+      deletion: true,
+      nonFastForward: true,
+      pullRequest: {
+        requiredApprovingReviewCount: 0,
+        dismissStaleReviewsOnPush: true,
+        requireCodeOwnerReview: false,
+        requireLastPushApproval: false,
+        requiredReviewThreadResolution: false,
+        allowedMergeMethods: ["squash"],
+        extraApprovalForUnattributedChanges: false
+      },
+      ...input.checks.length === 0 ? {} : {
+        requiredStatusChecks: {
+          checks: input.checks.map((context) => ({ context })),
+          strictRequiredStatusChecksPolicy: false,
+          doNotEnforceOnCreate: false
+        }
+      }
+    }
+  };
+}
+var PUBLIC_ONLY_UNDECLARABLE = [
+  "secret_scanning: enabled",
+  "secret_scanning_push_protection: enabled",
+  "private_vulnerability_reporting: enabled",
+  "fork-PR approval: 'first_time_contributors'"
+];
+// src/github/declare-repo-baseline.ts
+import { adopt as adopt2 } from "alchemy/AdoptPolicy";
+import * as GitHub2 from "alchemy/GitHub";
+import * as RemovalPolicy2 from "alchemy/RemovalPolicy";
+import * as Effect7 from "effect/Effect";
+var declareRepoBaseline = (id, options) => Effect7.gen(function* () {
+  const owned = (resource) => resource.pipe(RemovalPolicy2.retain(), adopt2(true));
+  const repository = yield* owned(GitHub2.Repository(id, repoBaselineSettings(options)));
+  const ruleset = yield* owned(RepositoryRuleset(`${id}-ruleset`, repoBaselineRuleset(options)));
+  return { repository, ruleset };
+});
 export {
+  BypassActorWidened,
+  DuplicateRuleset,
+  NeverReportedContext,
+  PUBLIC_ONLY_UNDECLARABLE,
+  RULE_TYPE_COVERAGE,
+  ReadbackMismatch,
+  RepositoryRuleset,
+  RepositoryRulesetProvider,
+  RequiredChecksOmitted,
+  RulesetConstraintRefused,
+  UndeclaredLiveRule,
+  declareRepoBaseline,
   declareRepoPolicy,
+  repoBaselineRuleset,
+  repoBaselineSettings,
   repoPolicy
 };
 
-//# debugId=1A73506791DB202C64756E2164756E21
+//# debugId=45989F9C0ABF077664756E2164756E21
 //# sourceMappingURL=index.js.map