@homeflare/alchemy 0.27.3 → 0.28.0

package/dist/github/repository-ruleset-props.d.ts

@@ -0,0 +1,88 @@
+/**
+ * `GitHub.RepositoryRuleset`'s declared shape — split out of repository-ruleset.ts purely to
+ * keep that file (the provider wiring) under the 250-line cap; nothing here is provider logic.
+ */
+import type { RulesetProps } from 'alchemy/GitHub';
+type UpstreamRules = NonNullable<RulesetProps['rules']>;
+export interface RepositoryRulesetReviewerRule {
+    readonly filePatterns: readonly string[];
+    readonly minimumApprovals: number;
+    readonly reviewer: {
+        readonly actorId: number;
+        readonly actorType: 'Team';
+    };
+}
+export interface RepositoryRulesetPullRequestRule extends NonNullable<UpstreamRules['pullRequest']> {
+    /** @default every method GitHub allows — the house baseline always pins `['squash']`. */
+    readonly allowedMergeMethods?: readonly ('merge' | 'squash' | 'rebase')[];
+    readonly requiredReviewers?: readonly RepositoryRulesetReviewerRule[];
+    /** `require_extra_approval_for_unattributed_changes` — see repository-ruleset.ts's H15. Only
+     * `false` is modeled: sending `true` has no house use, and GitHub already defaults absent to
+     * `true`. */
+    readonly extraApprovalForUnattributedChanges?: false;
+}
+export interface RepositoryRulesetStatusChecksRule extends NonNullable<UpstreamRules['requiredStatusChecks']> {
+    readonly doNotEnforceOnCreate?: boolean;
+}
+export interface RepositoryRulesetRules extends Omit<UpstreamRules, 'pullRequest' | 'requiredStatusChecks'> {
+    /** `undefined`: no opinion (refused if the live ruleset already has one and this is not an
+     * exact-adopt pass-through — see repository-ruleset-guards.ts's `undeclaredLiveRuleRefusal`).
+     * `false`: declare its ABSENCE — either "this repo never had one" (a create, or an adopt
+     * where live already has none, both no-ops) or a deliberate removal of a live rule, which
+     * `ruleNarrowingRefusal` gates behind `acknowledgeRuleNarrowing` (see below). Added 2026-09-23 for
+     * exact-adopt pass-through: `requiredStatusChecks` already had this `false` escape; `deletion`/
+     * `nonFastForward`/etc already have it implicitly (plain `boolean`, so `false` is already a
+     * value); `pullRequest` was the one modeled rule with NO way to express "not present at all" —
+     * a repo like `taslabs-net/taslabs-net` (measured live 2026-09-23: `rules = [deletion,
+     * non_fast_forward]`, no `pull_request`) could not be adopted through this resource without
+     * either refusing to omit the key (a type error) or silently declaring a brand-new rule. */
+    readonly pullRequest?: RepositoryRulesetPullRequestRule | false;
+    /** `undefined`: no opinion (refused if the live ruleset already has one — see
+     * repository-ruleset-guards.ts). `false`: declare its ABSENCE — removes a live one. */
+    readonly requiredStatusChecks?: RepositoryRulesetStatusChecksRule | false;
+}
+export interface RepositoryRulesetProps extends Omit<RulesetProps, 'rules'> {
+    readonly rules?: RepositoryRulesetRules;
+    /**
+     * An explicit, reasoned sign-off that THIS declaration deliberately drops a live bypass actor
+     * (`bypassActors` is a strict subset of what is live). Without this, `reconcile` refuses the
+     * write rather than silently loosen a ruleset that already protects something — see
+     * `bypassNarrowingRefusal` in repository-ruleset-narrowing-guards.ts. `reason` is not logged or
+     * sent to GitHub; it exists so the declaration's own diff carries WHY, for the next reader
+     * (S21: a refusal names the fact it checked — this is the human-authored counterpart for the
+     * one case a fact alone cannot settle: "is this narrowing intentional?").
+     *
+     * ⛔ SEPARATE FROM `acknowledgeRuleNarrowing` ON PURPOSE (2026-09-23 review finding: a single
+     *   shared `acknowledgeNarrowing` let one reason worded for a rule drop silently also rubber-
+     *   stamp an unrelated bypass-actor drop in the SAME declaration — a `bypassActors: []` left
+     *   over from an unrelated edit slipped through under a reason that never mentioned bypass at
+     *   all). Each prop authorizes only the narrowing its own guard checks; a declaration that
+     *   narrows both needs both, each with its own reason.
+     *
+     * ⛔ ALSO A STANDING PROP, NOT A ONE-TIME TOKEN — remove it from the declaration once the
+     *   narrowing it describes has landed. Left in place, it keeps disabling the bypass-narrowing
+     *   guard for every future `reconcile` of this resource, not only the change it was written
+     *   for — the same way `rules: { deletion: false }` stays a standing "this rule stays absent"
+     *   fact rather than a one-time action, only here the standing fact is "bypass narrowing needs
+     *   no review", which is a fact you want true for as short a window as possible. A reviewer
+     *   reading a diff that adds a SECOND, unrelated bypass drop under an OLD
+     *   `acknowledgeBypassNarrowing` left over from a prior change is the failure mode this note
+     *   exists to head off.
+     */
+    readonly acknowledgeBypassNarrowing?: {
+        readonly reason: string;
+    };
+    /**
+     * The `rules`-side counterpart to `acknowledgeBypassNarrowing` above — an explicit, reasoned
+     * sign-off that THIS declaration deliberately drops a live rule (a modeled rule type declared
+     * `false`/boolean-`false` while the live ruleset still has it). Without this, `reconcile`
+     * refuses the write — see `ruleNarrowingRefusal` in repository-ruleset-narrowing-guards.ts.
+     * Same standing-prop caution as `acknowledgeBypassNarrowing`: remove it once the rule drop it
+     * describes has landed, or it keeps excusing every later rule drop on this resource too.
+     */
+    readonly acknowledgeRuleNarrowing?: {
+        readonly reason: string;
+    };
+}
+export {};
+//# sourceMappingURL=repository-ruleset-props.d.ts.map

package/dist/github/repository-ruleset-props.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-props.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-props.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,gCAAiC,SAAQ,WAAW,CACnE,aAAa,CAAC,aAAa,CAAC,CAC7B;IACC,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACtE;;iBAEa;IACb,QAAQ,CAAC,mCAAmC,CAAC,EAAE,KAAK,CAAC;CACtD;AAED,MAAM,WAAW,iCAAkC,SAAQ,WAAW,CACpE,aAAa,CAAC,sBAAsB,CAAC,CACtC;IACC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAClD,aAAa,EACb,aAAa,GAAG,sBAAsB,CACvC;IACC;;;;;;;;;;gGAU4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,gCAAgC,GAAG,KAAK,CAAC;IAChE;2FACuF;IACvF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,iCAAiC,GAAG,KAAK,CAAC;CAC3E;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC;IACxC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}

package/dist/github/repository-ruleset-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-reconcile.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-reconcile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEnG,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,gCAAgC,CAAC;AAUxC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,+BAA+B,CAAC;AA+CvC;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,KAAK,SAAS;IACjD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,sBAAsB,KAC1B,wBAAwB,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,2BAA2B,CAAC;CACrE,KAAG,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,sBAAsB,GAAG,KAAK,EAAE,CAAC,CAuF5E,CAAC"}
+{"version":3,"file":"repository-ruleset-reconcile.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-reconcile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEnG,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,gCAAgC,CAAC;AAgBxC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,+BAA+B,CAAC;AA+CvC;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,KAAK,SAAS;IACjD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,sBAAsB,KAC1B,wBAAwB,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,2BAA2B,CAAC;CACrE,KAAG,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,sBAAsB,GAAG,KAAK,EAAE,CAAC,CAoH5E,CAAC"}

package/dist/github/repository-ruleset.d.ts

@@ -40,38 +40,11 @@
  *   is not hand-rolled — only the choice of Octokit over distilled is a recorded divergence.
  */
 import { Resource } from 'alchemy';
-import type { GitHubCredentials, RulesetProps } from 'alchemy/GitHub';
+import type { GitHubCredentials } from 'alchemy/GitHub';
 import * as Provider from 'alchemy/Provider';
 import { type RulesetRecord } from './repository-ruleset-probe.ts';
-type UpstreamRules = NonNullable<RulesetProps['rules']>;
-export interface RepositoryRulesetReviewerRule {
-    readonly filePatterns: readonly string[];
-    readonly minimumApprovals: number;
-    readonly reviewer: {
-        readonly actorId: number;
-        readonly actorType: 'Team';
-    };
-}
-export interface RepositoryRulesetPullRequestRule extends NonNullable<UpstreamRules['pullRequest']> {
-    /** @default every method GitHub allows — the house baseline always pins `['squash']`. */
-    readonly allowedMergeMethods?: readonly ('merge' | 'squash' | 'rebase')[];
-    readonly requiredReviewers?: readonly RepositoryRulesetReviewerRule[];
-    /** `require_extra_approval_for_unattributed_changes` — see H15 above. Only `false` is
-     * modeled: sending `true` has no house use, and GitHub already defaults absent to `true`. */
-    readonly extraApprovalForUnattributedChanges?: false;
-}
-export interface RepositoryRulesetStatusChecksRule extends NonNullable<UpstreamRules['requiredStatusChecks']> {
-    readonly doNotEnforceOnCreate?: boolean;
-}
-export interface RepositoryRulesetRules extends Omit<UpstreamRules, 'pullRequest' | 'requiredStatusChecks'> {
-    readonly pullRequest?: RepositoryRulesetPullRequestRule;
-    /** `undefined`: no opinion (refused if the live ruleset already has one — see
-     * repository-ruleset-guards.ts). `false`: declare its ABSENCE — removes a live one. */
-    readonly requiredStatusChecks?: RepositoryRulesetStatusChecksRule | false;
-}
-export interface RepositoryRulesetProps extends Omit<RulesetProps, 'rules'> {
-    readonly rules?: RepositoryRulesetRules;
-}
+import type { RepositoryRulesetProps } from './repository-ruleset-props.ts';
+export type { RepositoryRulesetProps, RepositoryRulesetPullRequestRule, RepositoryRulesetReviewerRule, RepositoryRulesetRules, RepositoryRulesetStatusChecksRule, } from './repository-ruleset-props.ts';
 export interface RepositoryRulesetAttributes {
     readonly rulesetId: number;
     readonly nodeId: string | undefined;
@@ -85,5 +58,4 @@ export declare const RepositoryRuleset: import("alchemy").ResourceClass<Reposito
 export declare const attrsOf: (r: RulesetRecord) => RepositoryRulesetAttributes;
 export declare const repositoryRulesetHandlers: Provider.ProviderService<RepositoryRuleset, GitHubCredentials, never, never, GitHubCredentials, GitHubCredentials, never, never, never>;
 export declare const RepositoryRulesetProvider: () => import("effect/Layer").Layer<Provider.Provider<RepositoryRuleset>, never, GitHubCredentials>;
-export {};
 //# sourceMappingURL=repository-ruleset.d.ts.map

package/dist/github/repository-ruleset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAQ7C,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,+BAA+B,CAAC;AAGhF,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,gCAAiC,SAAQ,WAAW,CACnE,aAAa,CAAC,aAAa,CAAC,CAC7B;IACC,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACtE;iGAC6F;IAC7F,QAAQ,CAAC,mCAAmC,CAAC,EAAE,KAAK,CAAC;CACtD;AAED,MAAM,WAAW,iCAAkC,SAAQ,WAAW,CACpE,aAAa,CAAC,sBAAsB,CAAC,CACtC;IACC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAClD,aAAa,EACb,aAAa,GAAG,sBAAsB,CACvC;IACC,QAAQ,CAAC,WAAW,CAAC,EAAE,gCAAgC,CAAC;IACxD;2FACuF;IACvF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,iCAAiC,GAAG,KAAK,CAAC;CAC3E;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,OAAO,MAAO,aAAa,KAAG,2BAMzC,CAAC;AA4BH,eAAO,MAAM,yBAAyB,yIAkEpC,CAAC;AAEH,eAAO,MAAM,yBAAyB,oGAC0B,CAAC"}
+{"version":3,"file":"repository-ruleset.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAQ7C,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAG5E,YAAY,EACV,sBAAsB,EACtB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,OAAO,MAAO,aAAa,KAAG,2BAMzC,CAAC;AA4CH,eAAO,MAAM,yBAAyB,yIAkEpC,CAAC;AAEH,eAAO,MAAM,yBAAyB,oGAC0B,CAAC"}

package/dist/netbox/fake-netbox.d.ts

@@ -0,0 +1,43 @@
+/**
+ * A minimal in-memory NetBox REST API for this family's tests — an in-memory `fetch` handed to
+ * Effect's real `FetchHttpClient` through its `Fetch` reference, mirroring
+ * `../forgejo/fake-forgejo.ts` (itself mirroring `cloudflare/fake-mesh.ts`). Tests exercise
+ * distilled's REAL path assembly, JSON encode/decode and status→typed-error matching (`404` →
+ * `NotFound`, `403` → `Forbidden`, …) — nothing about that matching is re-implemented here, only
+ * the wire responses a scenario needs.
+ *
+ * ⛔ TEST-ONLY, AND NO NETWORK. No provider imports this file. The base URL is RFC 2606
+ *   `netbox.example.com`, and the token is a placeholder.
+ */
+import { type Credentials } from '@distilled.cloud/netbox/Credentials';
+import * as Layer from 'effect/Layer';
+export declare const FAKE_BASE = "https://netbox.example.com";
+export declare const FAKE_TOKEN = "placeholder-netbox-token";
+export type Seen = {
+    readonly method: string;
+    readonly path: string;
+};
+/** NetBox's `{ detail }` failure envelope (403/404) — matching protocol.ts's `errorEnvelope`. */
+export declare const fakeFailure: (status: number, detail: string) => Response;
+/**
+ * `route` decides every response; this wrapper only records what was sent and adapts to
+ * `globalThis.fetch`'s signature. A test that expects no request at all asserts `seen` is empty.
+ */
+export declare const fakeNetbox: (route: (method: string, url: URL) => Response) => {
+    fetch: typeof fetch;
+    seen: Seen[];
+};
+/**
+ * distilled Credentials + the real FetchHttpClient over the fake — `NetboxOpContext`, what every
+ * resource file's exported `spec.fetchLive` needs.
+ *
+ * ⚠️ NOT PAIRED WITH `handlers` (each resource file's `netboxHandlers(spec)` export). `handlers`
+ *   bakes in `CredentialsFromEnv`, which resolves `NETBOX_URL` / `NETBOX_TOKEN` through Effect's
+ *   `Config` — whose default provider snapshots `process.env` once and never re-reads it (measured
+ *   in the forgejo migration, kit PR 180: mutating `process.env` mid-test-run had no effect). So a
+ *   test cannot point `handlers` at a fake server; it calls `spec.fetchLive`/`spec.attributes`
+ *   directly instead, with this explicit layer, exercising exactly the same production code
+ *   without that env seam.
+ */
+export declare const fakeNetboxLayer: (fetchFn: typeof globalThis.fetch, creds?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/unstable/http/HttpClient").HttpClient, never, never>;
+//# sourceMappingURL=fake-netbox.d.ts.map

package/dist/netbox/fake-netbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-netbox.d.ts","sourceRoot":"","sources":["../../src/netbox/fake-netbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,KAAK,WAAW,EAAe,MAAM,qCAAqC,CAAC;AACpF,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,eAAO,MAAM,SAAS,+BAA+B,CAAC;AACtD,eAAO,MAAM,UAAU,6BAA6B,CAAC;AAErD,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE,iGAAiG;AACjG,eAAO,MAAM,WAAW,WAAY,MAAM,UAAU,MAAM,aACnB,CAAC;AAExC;;;GAGG;AACH,eAAO,MAAM,UAAU,UAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ;;;CAUvE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe,YACjB,OAAO,UAAU,CAAC,KAAK,UACzB,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kGAC+D,CAAC"}

package/dist/netbox/index.d.ts

@@ -8,10 +8,9 @@
  * ★ The constraint reader IS exported, because a consumer writing its own family needs the same
  *   guard — and because a table nobody can reach is a table nobody uses.
  */
-export { NetboxError, apiBase } from './client.ts';
 export { NETBOX_CONSTRAINTS, bodyViolations, constraintsFor, guardBody, } from './constraint-guard.ts';
 export { type EndpointConstraints, type EndpointKey, type NetboxBody, type ParamConstraint, refusal, violations, } from './constraints.ts';
 export { NETBOX_CONSTRAINTS_DIGEST } from './generated/constraints/index.ts';
 export { NetboxPrefix, NetboxPrefixProvider, type PrefixAttributes, type PrefixProps, type PrefixStatus, } from './prefix.ts';
-export { type NetboxRequirements, type NetboxSpec, netboxHandlers } from './resource.ts';
+export { LOCATE_PAGE, locateOne, type NetboxRequirements, type NetboxSpec, netboxHandlers, soleMatch, } from './resource.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/netbox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/netbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,OAAO,EACP,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,kBAAkB,EAAE,KAAK,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/netbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,SAAS,GACV,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,OAAO,EACP,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAC7E,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,YAAY,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,SAAS,EACT,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,cAAc,EACd,SAAS,GACV,MAAM,eAAe,CAAC"}

package/dist/netbox/index.js

@@ -1,59 +1,5 @@
-// src/netbox/client.ts
-import * as Effect from "effect/Effect";
-import * as HttpClient from "effect/unstable/http/HttpClient";
-import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
-var PATH_PREFIX = "/api";
-var apiBase = () => {
-  const raw = process.env["NETBOX_URL"];
-  if (raw === undefined || raw.trim() === "") {
-    throw new Error("NETBOX_URL is not set. Point it at your NetBox instance, e.g. https://netbox.example.com");
-  }
-  return raw.trim().replace(/\/$/, "");
-};
-
-class NetboxError extends Error {
-  status;
-  method;
-  path;
-  constructor(status, method, path, detail) {
-    super(`NetBox ${method} ${path} -> ${String(status)}: ${detail}`);
-    this.status = status;
-    this.method = method;
-    this.path = path;
-    this.name = "NetboxError";
-  }
-}
-var token = () => Effect.gen(function* () {
-  const raw = process.env["NETBOX_TOKEN"];
-  if (raw === undefined || raw.trim() === "") {
-    return yield* Effect.fail(new NetboxError(0, "GET", "", "NETBOX_TOKEN is unset. Mint a scoped token and export it — never store it in Alchemy props."));
-  }
-  return raw.trim();
-});
-var netbox = (method, path, body) => Effect.gen(function* () {
-  const credential = yield* token();
-  const url = `${apiBase()}${PATH_PREFIX}/${path.replace(/^\//, "")}`;
-  const client = yield* HttpClient.HttpClient;
-  const request = HttpClientRequest.make(method)(url).pipe(HttpClientRequest.setHeaders({
-    Accept: "application/json",
-    Authorization: `Token ${credential}`
-  }), body === undefined ? (self) => self : HttpClientRequest.bodyText(JSON.stringify(body), "application/json"));
-  const response = yield* client.execute(request).pipe(Effect.mapError((cause) => new NetboxError(0, method, path, String(cause))));
-  if (response.status < 200 || response.status >= 300) {
-    const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ""));
-    return yield* Effect.fail(new NetboxError(response.status, method, path, detail.slice(0, 300)));
-  }
-  const text = yield* response.text.pipe(Effect.mapError((cause) => new NetboxError(0, method, path, String(cause))));
-  return text === "" ? undefined : JSON.parse(text);
-});
-var soleMatch = (rows, describe) => {
-  if (rows.length > 1) {
-    throw new Error(`${describe} matched ${String(rows.length)} NetBox objects. An object's identity must be ` + "unique; narrow it (the VRF, the site, the tenant) rather than taking the first row.");
-  }
-  return rows[0];
-};
 // src/netbox/constraint-guard.ts
-import * as Effect2 from "effect/Effect";
+import * as Effect from "effect/Effect";
 
 // src/netbox/constraints.ts
 var lengthOf = (value) => [...value].length;
@@ -141,16 +87,17 @@ var constraintsFor = (key) => {
   return table;
 };
 var bodyViolations = (key, body, presence) => violations(constraintsFor(key), body, { presence });
-var guardBody = (key, body, presence) => Effect2.suspend(() => {
+var guardBody = (key, body, presence) => Effect.suspend(() => {
   if (key === undefined)
-    return Effect2.void;
+    return Effect.void;
   const found = bodyViolations(key, body, presence);
-  return found.length === 0 ? Effect2.void : Effect2.die(new Error(refusal(key, found)));
+  return found.length === 0 ? Effect.void : Effect.die(new Error(refusal(key, found)));
 });
 // src/netbox/prefix.ts
 import { Resource } from "alchemy";
 import * as Provider from "alchemy/Provider";
-import * as Effect4 from "effect/Effect";
+import * as ipam from "@distilled.cloud/netbox/ipam";
+import * as Effect3 from "effect/Effect";
 
 // src/netbox/prefix-form.ts
 var DEFAULT_STATUS = "active";
@@ -186,27 +133,27 @@ var prefixMatches = (attributes, props) => {
 
 // src/netbox/resource.ts
 import { isResolved } from "alchemy/Diff";
-import * as Effect3 from "effect/Effect";
-var absentOn404 = (io) => io.pipe(Effect3.catchIf((cause) => cause instanceof NetboxError && cause.status === 404, () => Effect3.succeed(undefined)));
+import { CredentialsFromEnv } from "@distilled.cloud/netbox/Credentials";
+import * as Effect2 from "effect/Effect";
 var LOCATE_PAGE = 20;
-var query = (pairs) => new URLSearchParams([
-  ...pairs.map(([k, v]) => [k, v]),
-  ["limit", String(LOCATE_PAGE)]
-]).toString();
+var soleMatch = (rows, describe) => {
+  if (rows.length > 1) {
+    throw new Error(`${describe} matched ${String(rows.length)} NetBox objects. An object's identity must be ` + "unique; narrow it (the VRF, the site, the tenant) rather than taking the first row.");
+  }
+  return rows[0];
+};
+var locateOne = (list, describe, identifies) => list.pipe(Effect2.map((page) => {
+  if (page.count > LOCATE_PAGE) {
+    throw new Error(`${describe}: the locate filter matched ${String(page.count)} rows, more than the ` + `${String(LOCATE_PAGE)}-row page this reads. That is not a natural key — narrow the ` + "filter rather than paging through candidates.");
+  }
+  const rows = identifies === undefined ? page.results : page.results.filter(identifies);
+  return soleMatch(rows, describe);
+}));
 var netboxOperations = (spec) => {
-  const fetchLive = (props) => absentOn404(netbox("GET", `${spec.collection}/?${query(spec.locate(props))}`)).pipe(Effect3.map((list) => {
-    if (list !== undefined && list.count > LOCATE_PAGE) {
-      throw new Error(`${spec.describe(props)}: the locate filter matched ${String(list.count)} rows, more ` + `than the ${String(LOCATE_PAGE)}-row page this reads. That is not a natural key — ` + "narrow the filter rather than paging through candidates.");
-    }
-    const rows = list?.results ?? [];
-    const narrow = spec.identifies;
-    return soleMatch(narrow === undefined ? rows : rows.filter((row) => narrow(row, props)), spec.describe(props));
-  }));
-  const objectPath = (live) => `${spec.collection}/${String(live["id"])}`;
-  const read = (props) => fetchLive(props).pipe(Effect3.map((live) => live === undefined ? undefined : spec.attributes(live, props)));
+  const read = (props) => spec.fetchLive(props).pipe(Effect2.map((live) => live === undefined ? undefined : spec.attributes(live, props)));
   return {
     read,
-    diff: (news, output) => Effect3.gen(function* () {
+    diff: (news, output) => Effect2.gen(function* () {
       if (output === undefined || !isResolved(news))
         return;
       const live = yield* read(news);
@@ -214,46 +161,47 @@ var netboxOperations = (spec) => {
         return { action: "update" };
       if (spec.matches(live, news))
         return { action: "noop" };
-      return spec.updateBody === undefined ? { action: "replace" } : { action: "update" };
+      return spec.update === undefined ? { action: "replace" } : { action: "update" };
     }),
-    reconcile: (news) => Effect3.gen(function* () {
-      const before = yield* fetchLive(news);
+    reconcile: (news) => Effect2.gen(function* () {
+      const before = yield* spec.fetchLive(news);
       if (before === undefined) {
         const body = spec.createBody(news);
         yield* guardBody(spec.endpoint.create, body, true);
-        yield* netbox("POST", `${spec.collection}/`, body);
-      } else if (spec.updateBody !== undefined) {
+        yield* spec.create(news, body);
+      } else if (spec.update !== undefined) {
         const mapped = spec.attributes(before, news);
         if (mapped !== undefined && !spec.matches(mapped, news)) {
-          const body = spec.updateBody(news);
+          const body = spec.update.body(news);
           yield* guardBody(spec.endpoint.update, body, false);
           if (Object.keys(body).length > 0) {
-            yield* netbox("PATCH", `${objectPath(before)}/`, body);
+            yield* spec.update.call(news, before, body);
           }
         }
       }
       const after = yield* read(news);
       if (after === undefined) {
-        return yield* Effect3.die(new Error(`${spec.describe(news)}: the write returned no error but the object is still ` + "absent. NetBox returns the object it wrote — read back rather than trusting the " + "status code."));
+        return yield* Effect2.die(new Error(`${spec.describe(news)}: the write returned no error but the object is still ` + "absent. NetBox returns the object it wrote — read back rather than trusting the " + "status code."));
       }
       return after;
     }),
-    destroy: (olds) => Effect3.gen(function* () {
-      const live = yield* fetchLive(olds);
+    destroy: (olds) => Effect2.gen(function* () {
+      const live = yield* spec.fetchLive(olds);
       if (live === undefined)
         return;
-      yield* netbox("DELETE", `${objectPath(live)}/`);
+      yield* spec.destroy(olds, live);
     })
   };
 };
 var netboxHandlers = (spec) => {
   const ops = netboxOperations(spec);
+  const withCredentials = (effect) => Effect2.provide(effect, CredentialsFromEnv);
   return {
-    list: () => Effect3.succeed([]),
-    read: ({ olds }) => ops.read(olds),
-    diff: ({ news, output }) => ops.diff(news, output),
-    reconcile: ({ news }) => ops.reconcile(news),
-    delete: ({ olds }) => ops.destroy(olds)
+    list: () => Effect2.succeed([]),
+    read: ({ olds }) => withCredentials(ops.read(olds)),
+    diff: ({ news, output }) => withCredentials(ops.diff(news, output)),
+    reconcile: ({ news }) => withCredentials(ops.reconcile(news)),
+    delete: ({ olds }) => withCredentials(ops.destroy(olds))
   };
 };
 
@@ -281,51 +229,55 @@ var fk = (value) => {
 var NetboxPrefix = Resource("Netbox.Prefix", {
   defaultRemovalPolicy: "retain"
 });
-var handlers = netboxHandlers({
-  attributes: (live, props) => {
-    const id = live["id"];
-    if (typeof id !== "number")
-      return;
-    return {
-      comments: text(live["comments"]),
-      description: text(live["description"]),
-      isPool: live["is_pool"] === true,
-      markUtilized: live["mark_utilized"] === true,
-      prefix: text(live["prefix"]) || props.prefix,
-      prefixId: id,
-      status: choice(live["status"]),
-      tenant: fk(live["tenant"]),
-      vlan: fk(live["vlan"]),
-      vrf: fk(live["vrf"])
-    };
-  },
-  collection: "ipam/prefixes",
+var attributesOf = (live, props) => ({
+  comments: text(live.comments),
+  description: text(live.description),
+  isPool: live.is_pool === true,
+  markUtilized: live.mark_utilized === true,
+  prefix: live.prefix || props.prefix,
+  prefixId: live.id,
+  status: choice(live.status),
+  tenant: fk(live.tenant),
+  vlan: fk(live.vlan),
+  vrf: fk(live.vrf)
+});
+var spec = {
+  attributes: attributesOf,
+  create: (_props, body) => ipam.createIpamPrefix({ body }),
   createBody: prefixBody,
+  destroy: (_props, live) => ipam.ipamPrefixesDestroy({ id: live.id }),
   describe: (props) => `ipam/prefixes ${props.prefix}`,
   endpoint: {
     create: "netbox:POST /api/ipam/prefixes/",
     update: "netbox:PATCH /api/ipam/prefixes/{id}/"
   },
-  identifies: (live, props) => fk(live["vrf"]) === props.vrf,
-  locate: (props) => [["prefix", props.prefix]],
+  fetchLive: (props) => locateOne(ipam.listIpamPrefixes({ limit: LOCATE_PAGE, prefix: [props.prefix] }), `ipam/prefixes ${props.prefix}`, (row) => fk(row.vrf) === props.vrf),
   matches: prefixMatches,
-  updateBody: prefixBody
-});
-var NetboxPrefixProvider = () => Provider.effect(NetboxPrefix, Effect4.succeed(NetboxPrefix.Provider.of(handlers)));
+  update: {
+    body: prefixBody,
+    call: (_props, live, body) => ipam.updateIpamPrefixesPartial({
+      ...body,
+      id: live.id
+    })
+  }
+};
+var handlers = netboxHandlers(spec);
+var NetboxPrefixProvider = () => Provider.effect(NetboxPrefix, Effect3.succeed(NetboxPrefix.Provider.of(handlers)));
 export {
+  LOCATE_PAGE,
   NETBOX_CONSTRAINTS,
   NETBOX_CONSTRAINTS_DIGEST,
-  NetboxError,
   NetboxPrefix,
   NetboxPrefixProvider,
-  apiBase,
   bodyViolations,
   constraintsFor,
   guardBody,
+  locateOne,
   netboxHandlers,
   refusal,
+  soleMatch,
   violations
 };
 
-//# debugId=8207BD9178A5636864756E2164756E21
+//# debugId=546DA12AD639183464756E2164756E21
 //# sourceMappingURL=index.js.map