@homeflare/alchemy 0.27.4 → 0.29.0

package/dist/github/repo-baseline-data.d.ts

@@ -19,7 +19,16 @@ export interface RepoBaselineInput {
 }
 /** `GitHub.Repository` fields this baseline owns. Every merge-automation caller across the 17
  * tray checkouts uses `--squash` (measured 2026-09-23; the only non-squash mentions are
- * GitLab-era comments in cliff.toml), so squash-only is not a per-repo choice. */
+ * GitLab-era comments in cliff.toml), so squash-only is not a per-repo choice.
+ *
+ * ⛔ K5 (2026-09-24): `allowAutoMerge` FOLLOWS `checks.length`, NOT A HARDCODED `true`. `gh pr
+ *   merge --auto` (and the ruleset's own auto-merge) is a queue only while something is
+ *   outstanding — with zero required status checks there is nothing to wait for, so GitHub
+ *   merges a CLEAN pull request on the spot, with no review and no green run. This is the same
+ *   failure `repo-policy-guards.ts`'s `assertAutoMergeWaits` refuses on the sibling `repoPolicy`
+ *   path (five doors to the same "nothing outstanding" state); this baseline has no `autoMerge`
+ *   opt-out prop to refuse WITH, so the fix here is unconditional rather than a thrown refusal —
+ *   a repo with an empty `checks` list simply never gets auto-merge turned on by this baseline. */
 export declare function repoBaselineSettings(input: RepoBaselineInput): {
     owner: string;
     name: string;

package/dist/github/repo-baseline-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-baseline-data.d.ts","sourceRoot":"","sources":["../../src/github/repo-baseline-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;kFAEkF;AAClF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB;;;;;;;;;;;EAa5D;AAED;;mGAEmG;AACnG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB;;;;YAKhD,QAAQ;iBACH,QAAQ;;;QAEP,OAAO;QAAuB,OAAO;;;;;;YAK/C,4BAA4B;YAC5B,yBAAyB;YACzB,sBAAsB;YACtB,uBAAuB;YACvB,8BAA8B;YAC9B,mBAAmB;YACnB,mCAAmC;;;YAM7B,MAAM;;;YACN,gCAAgC;YAChC,oBAAoB;;;EAKjC;AAED;;;cAGc;AACd,eAAO,MAAM,wBAAwB,YACnC,0BAA0B,EAC1B,0CAA0C,EAC1C,0CAA0C,EAC1C,6CAA6C,CACrC,CAAC"}
+{"version":3,"file":"repo-baseline-data.d.ts","sourceRoot":"","sources":["../../src/github/repo-baseline-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;mGAWmG;AACnG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB;;;;;;;;;;;EAa5D;AAED;;mGAEmG;AACnG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB;;;;YAKhD,QAAQ;iBACH,QAAQ;;;QAEP,OAAO;QAAuB,OAAO;;;;;;YAK/C,4BAA4B;YAC5B,yBAAyB;YACzB,sBAAsB;YACtB,uBAAuB;YACvB,8BAA8B;YAC9B,mBAAmB;YACnB,mCAAmC;;;YAM7B,MAAM;;;YACN,gCAAgC;YAChC,oBAAoB;;;EAKjC;AAED;;;cAGc;AACd,eAAO,MAAM,wBAAwB,YACnC,0BAA0B,EAC1B,0CAA0C,EAC1C,0CAA0C,EAC1C,6CAA6C,CACrC,CAAC"}

package/dist/github/repo-policy.d.ts

@@ -17,5 +17,5 @@ export declare const declareRepoPolicy: (id: string, options: DeclareRepoPolicyO
     policy: import("./repo-policy-form.ts").RepoPolicy;
     repository: GitHub.Repository;
     ruleset: RepositoryRuleset;
-}, Error, GitHub.GitHubCredentials | GitHub.Providers>;
+}, Error, import("alchemy").Provider<RepositoryRuleset> | GitHub.Providers>;
 //# sourceMappingURL=repo-policy.d.ts.map

package/dist/github/repo-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-policy.d.ts","sourceRoot":"","sources":["../../src/github/repo-policy.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,OAAQ,MAAM,WAAW,wBAAwB;;;;sDAkB3E,CAAC"}
+{"version":3,"file":"repo-policy.d.ts","sourceRoot":"","sources":["../../src/github/repo-policy.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,OAAQ,MAAM,WAAW,wBAAwB;;;;2EAkB3E,CAAC"}

package/dist/github/repository-ruleset-errors.d.ts

@@ -27,6 +27,39 @@ export declare class BypassActorWidened extends BypassActorWidened_base<{
 }> {
     get message(): string;
 }
+declare const BypassActorNarrowed_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "BypassActorNarrowed";
+} & Readonly<A>;
+/** A declared `bypassActors` drops an actor the live ruleset has, with no
+ * `acknowledgeBypassNarrowing` on the declaration. Unlike widening, narrowing is not always
+ * wrong — an exact-adopt declaration that matches live exactly narrows nothing — so this is
+ * refused only when live genuinely has more than the declaration keeps, and it is escapable
+ * (`BypassActorWidened` is not): see `bypassNarrowingRefusal` in
+ * repository-ruleset-narrowing-guards.ts. */
+export declare class BypassActorNarrowed extends BypassActorNarrowed_base<{
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly narrowed: readonly string[];
+}> {
+    get message(): string;
+}
+declare const RuleNarrowed_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "RuleNarrowed";
+} & Readonly<A>;
+/** A rule type the declaration explicitly marks absent (`false`) while the live ruleset still
+ * has it, with no `acknowledgeRuleNarrowing` on the declaration — see `ruleNarrowingRefusal` in
+ * repository-ruleset-narrowing-guards.ts. Distinct from `UndeclaredLiveRule`: that one fires on
+ * SILENCE (the declaration says nothing); this one fires on an EXPLICIT, but unacknowledged,
+ * removal. */
+export declare class RuleNarrowed extends RuleNarrowed_base<{
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly ruleType: string;
+}> {
+    get message(): string;
+}
 declare const UndeclaredLiveRule_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "UndeclaredLiveRule";
 } & Readonly<A>;
@@ -57,8 +90,9 @@ export declare class RequiredChecksOmitted extends RequiredChecksOmitted_base<{
 declare const NeverReportedContext_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "NeverReportedContext";
 } & Readonly<A>;
-/** A context being ADDED to `requiredStatusChecks` has never reported success on the default
- * branch. Requiring it would leave every future pull request pending forever. */
+/** A context being ADDED to `requiredStatusChecks` has never reported success anywhere this
+ * family looks (the default branch's tip, then recent merged PR heads — K2, bounded, not full
+ * history). Requiring it would leave every future pull request pending forever. */
 export declare class NeverReportedContext extends NeverReportedContext_base<{
     readonly owner: string;
     readonly repository: string;
@@ -92,6 +126,6 @@ export declare class ReadbackMismatch extends ReadbackMismatch_base<{
 }> {
     get message(): string;
 }
-export type RepositoryRulesetError = DuplicateRuleset | BypassActorWidened | UndeclaredLiveRule | RequiredChecksOmitted | NeverReportedContext | RulesetConstraintRefused | ReadbackMismatch;
+export type RepositoryRulesetError = DuplicateRuleset | BypassActorWidened | BypassActorNarrowed | UndeclaredLiveRule | RuleNarrowed | RequiredChecksOmitted | NeverReportedContext | RulesetConstraintRefused | ReadbackMismatch;
 export {};
 //# sourceMappingURL=repository-ruleset-errors.d.ts.map

package/dist/github/repository-ruleset-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-errors.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-errors.ts"],"names":[],"mappings":";;;AAQA;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;6EAC6E;AAC7E,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;6FAC6F;AAC7F,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;iFACiF;AACjF,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;4FAC4F;AAC5F,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;kGACkG;AAClG,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;AAED,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,kBAAkB,GAClB,kBAAkB,GAClB,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,gBAAgB,CAAC"}
+{"version":3,"file":"repository-ruleset-errors.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-errors.ts"],"names":[],"mappings":";;;AAQA;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;6EAC6E;AAC7E,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;;;6CAK6C;AAC7C,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;cAIc;AACd,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;6FAC6F;AAC7F,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;mFAEmF;AACnF,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;4FAC4F;AAC5F,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;kGACkG;AAClG,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;AAED,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,YAAY,GACZ,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,gBAAgB,CAAC"}

package/dist/github/repository-ruleset-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-form.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,sBAAsB,EAEtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AA2DvF,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,SAAS,GAAG,QAAQ,EAAE,CAmCpF;AAED;0BAC0B;AAC1B,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CAqBnF;AA+CD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAiB/D"}
+{"version":3,"file":"repository-ruleset-form.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,sBAAsB,EAEtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AA+DvF,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,SAAS,GAAG,QAAQ,EAAE,CAmCpF;AAED;0BAC0B;AAC1B,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CAqBnF;AA+CD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAiB/D"}

package/dist/github/repository-ruleset-guards.d.ts

@@ -7,6 +7,14 @@ import * as Effect from 'effect/Effect';
 import type { RepositoryRulesetProps } from './repository-ruleset.ts';
 import { BypassActorWidened, NeverReportedContext, RequiredChecksOmitted, UndeclaredLiveRule } from './repository-ruleset-errors.ts';
 import type { RulesetOctokit, RulesetRecord } from './repository-ruleset-probe.ts';
+/** Exported: repository-ruleset-narrowing-guards.ts reuses the identical key so a widened and a
+ * narrowed actor are never computed by two independently-drifting definitions of "the same
+ * actor". */
+export declare const bypassKey: (a: {
+    actor_type: unknown;
+    actor_id: unknown;
+    bypass_mode?: unknown;
+}) => string;
 /**
  * ⛔ A CREATE REQUIRES `[]`; `undefined` on a create is the same thing (nothing live to widen
  *   from). On an update/adopt, `undefined` means unmanaged — the caller never sees this guard
@@ -20,6 +28,10 @@ export declare function bypassWideningRefusal(input: {
     readonly declared: RepositoryRulesetProps['bypassActors'];
     readonly live: RulesetRecord | undefined;
 }): BypassActorWidened | undefined;
+/** Exported for the same reason as `bypassKey` — repository-ruleset-narrowing-guards.ts's
+ * `ruleNarrowingRefusal` needs the identical live-type set `undeclaredLiveRuleRefusal` computes,
+ * not a second reading of `live.rules` that could disagree with this one. */
+export declare const liveRuleTypes: (live: RulesetRecord | undefined) => Set<string>;
 /**
  * Refuses (a) any live rule of a REFUSED type — this resource can never represent it, and the
  * PUT replaces `rules` wholesale, so silence would drop it; and (b) ANY live rule of a MODELED
@@ -64,7 +76,8 @@ export declare function requiredChecksOmissionRefusal(input: {
 /** Every context in the declared `requiredStatusChecks` that the LIVE ruleset does not already
  * require — i.e. being added by this plan, the only case a never-reported context can matter. */
 export declare const newlyRequiredContexts: (declared: RepositoryRulesetProps['rules'], live: RulesetRecord | undefined) => readonly string[];
-/** Fails on the first newly-required context that has never reported success on the default
- * branch — checked once here (reconcile's observe step) and again by the standalone checker. */
+/** Fails on the first newly-required context that has never reported success anywhere this
+ * family looks (the default branch's tip, then recent merged PR heads — K2) — checked once here
+ * (reconcile's observe step) and again by the standalone checker. */
 export declare const refuseUnreportedContexts: <R = never>(octokit: RulesetOctokit<R>, owner: string, repo: string, contexts: readonly string[]) => Effect.Effect<void, NeverReportedContext | Error, R>;
 //# sourceMappingURL=repository-ruleset-guards.d.ts.map

package/dist/github/repository-ruleset-guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-guards.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-guards.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAKnF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAKD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;wFAEwF;AACxF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAgB7F;AAED;6FAC6F;AAC7F,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,qBAAqB,GAAG,SAAS,CAcpC;AAED;iGACiG;AACjG,eAAO,MAAM,qBAAqB,aACtB,sBAAsB,CAAC,OAAO,CAAC,QACnC,aAAa,GAAG,SAAS,KAC9B,SAAS,MAAM,EAWjB,CAAC;AAEF;gGACgG;AAChG,eAAO,MAAM,wBAAwB,GAAI,CAAC,GAAG,KAAK,WACvC,cAAc,CAAC,CAAC,CAAC,SACnB,MAAM,QACP,MAAM,YACF,SAAS,MAAM,EAAE,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,GAAG,KAAK,EAAE,CAAC,CAQlD,CAAC"}
+{"version":3,"file":"repository-ruleset-guards.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-guards.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnF;;aAEa;AACb,eAAO,MAAM,SAAS,MAAO;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,WACF,CAAC;AAE7F;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;6EAE6E;AAC7E,eAAO,MAAM,aAAa,SAAU,aAAa,GAAG,SAAS,KAAG,GAAG,CAAC,MAAM,CACjB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;wFAEwF;AACxF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAgB7F;AAED;6FAC6F;AAC7F,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,qBAAqB,GAAG,SAAS,CAcpC;AAED;iGACiG;AACjG,eAAO,MAAM,qBAAqB,aACtB,sBAAsB,CAAC,OAAO,CAAC,QACnC,aAAa,GAAG,SAAS,KAC9B,SAAS,MAAM,EAWjB,CAAC;AAEF;;qEAEqE;AACrE,eAAO,MAAM,wBAAwB,GAAI,CAAC,GAAG,KAAK,WACvC,cAAc,CAAC,CAAC,CAAC,SACnB,MAAM,QACP,MAAM,YACF,SAAS,MAAM,EAAE,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,GAAG,KAAK,EAAE,CAAC,CAQlD,CAAC"}

package/dist/github/repository-ruleset-narrowing-guards.d.ts

@@ -0,0 +1,39 @@
+import { BypassActorNarrowed, RuleNarrowed } from './repository-ruleset-errors.ts';
+import type { RepositoryRulesetProps } from './repository-ruleset-props.ts';
+import type { RulesetRecord } from './repository-ruleset-probe.ts';
+/** `true` only for a non-empty, non-whitespace `reason` on `acknowledgeBypassNarrowing` — a bare
+ * `{}` or a blank string is not an acknowledgement (repository-ruleset.ts's `constraintRefusal`
+ * refuses the latter at plan time; this is the read `bypassNarrowingRefusal` shares). Deliberately
+ * ignorant of `acknowledgeRuleNarrowing` — see the file header. */
+export declare const isBypassNarrowingAcknowledged: (props: RepositoryRulesetProps) => boolean;
+/** The `rules`-side counterpart to `isBypassNarrowingAcknowledged`, reading only
+ * `acknowledgeRuleNarrowing` — see the file header. */
+export declare const isRuleNarrowingAcknowledged: (props: RepositoryRulesetProps) => boolean;
+/**
+ * A live bypass actor the declaration drops, unacknowledged. `undefined` `declared` never
+ * reaches here — same rule as `bypassWideningRefusal`: unmanaged means the live value is
+ * preserved unchanged (repository-ruleset-reconcile.ts), so there is nothing to narrow.
+ */
+export declare function bypassNarrowingRefusal(input: {
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly declared: RepositoryRulesetProps['bypassActors'];
+    readonly live: RulesetRecord | undefined;
+    readonly acknowledged: boolean;
+}): BypassActorNarrowed | undefined;
+/**
+ * A rule the declaration explicitly marks absent (a boolean rule or `pullRequest` declared
+ * `false`, or `requiredStatusChecks: false`) while the LIVE ruleset still has it, unacknowledged
+ * — the drop `undeclaredLiveRuleRefusal` (repository-ruleset-guards.ts) never sees, because an
+ * explicit `false` IS "declared" there (see its own `declaredRuleTypes`).
+ */
+export declare function ruleNarrowingRefusal(input: {
+    readonly owner: string;
+    readonly repository: string;
+    readonly name: string;
+    readonly declared: RepositoryRulesetProps['rules'];
+    readonly live: RulesetRecord | undefined;
+    readonly acknowledged: boolean;
+}): RuleNarrowed | undefined;
+//# sourceMappingURL=repository-ruleset-narrowing-guards.d.ts.map

package/dist/github/repository-ruleset-narrowing-guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-narrowing-guards.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-narrowing-guards.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnF,OAAO,KAAK,EAAE,sBAAsB,EAA0B,MAAM,+BAA+B,CAAC;AACpG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnE;;;mEAGmE;AACnE,eAAO,MAAM,6BAA6B,UAAW,sBAAsB,KAAG,OAEnB,CAAC;AAE5D;uDACuD;AACvD,eAAO,MAAM,2BAA2B,UAAW,sBAAsB,KAAG,OAEnB,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC,GAAG,mBAAmB,GAAG,SAAS,CAyBlC;AA0BD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC,GAAG,YAAY,GAAG,SAAS,CAiB3B"}

package/dist/github/repository-ruleset-octokit.d.ts

@@ -1,5 +1,54 @@
+/**
+ * The real {@link RulesetOctokit} — every wire call this family makes, built from the EXPORTED
+ * `GitHubCredentials` service via `creds.octokit()`, exactly upstream's own `octokitFor` does
+ * (`node_modules/alchemy/src/GitHub/Octokit.ts`). H15: Octokit, not `@distilled.cloud/github`
+ * — its `S.Struct` request schemas have no field for `require_extra_approval_for_unattributed_
+ * changes` and would very likely strip an unknown key on encode; Octokit's REST methods hand
+ * their `parameters` object to `@octokit/endpoint` mostly as-is, so an extra JSON body key
+ * should reach the wire. repository-ruleset-wire.test.ts MEASURES this against a real Octokit
+ * instance with a fetch shim rather than asserting it from reading the source.
+ *
+ * ★ K2 (2026-09-24): "REPORTED SUCCESS" IS THE DEFAULT BRANCH'S TIP, THEN RECENT MERGED PR
+ *   HEADS — NOT FULL HISTORY. The rendered CI (`packages/config/src/repo-shape/ci.ts`) triggers
+ *   on `pull_request` ONLY, deliberately (measured 2026-09-15..22: 613 of 619 main-push runs
+ *   duplicated an already-green PR run, ~41% of the mini's CI load) — so `ci`/`secret scan`/
+ *   `CodeQL` NEVER report on the default branch's tip itself, only on PR heads. Checking the tip
+ *   alone therefore refused adding any of them everywhere, including homeflare-builds' pending
+ *   first ruleset. `contextReportedSuccess` now falls back to `recentMergedHeadShas` — bounded
+ *   (`RECENT_MERGED_PR_LIMIT` heads, from one `per_page`-bounded list call, never the repo's
+ *   full PR history) — so a context that only ever reports on PR heads is no longer refused
+ *   everywhere, while a context that has never reported ANYWHERE (not the tip, not any recent
+ *   merged head) still is: `NeverReportedContext`'s whole purpose survives unchanged.
+ * ⚠️ Still not full history: a context whose only successful run predates
+ *   `RECENT_MERGED_PR_LIMIT` merges ago reads as never-reported until it runs again. Widening
+ *   the bound trades this guard's cost (more vendor calls per newly-required context) against
+ *   its reach; `RECENT_MERGED_PR_LIMIT` is a deliberate, named number for exactly that reason,
+ *   not a magic constant.
+ */
+import type { Octokit as OctokitClient } from '@octokit/rest';
 import { GitHubCredentials } from 'alchemy/GitHub';
+import * as Effect from 'effect/Effect';
 import type { RulesetOctokit } from './repository-ruleset-probe.ts';
 export type RealRulesetOctokit = RulesetOctokit<GitHubCredentials>;
+/** How many of the most-recently-updated MERGED pull requests' head SHAs to check, once the
+ * default branch's own tip has no reported success — see the file header (K2). */
+export declare const RECENT_MERGED_PR_LIMIT = 10;
+/** Whether `context` reported success for a single ref — a branch tip or a PR head SHA, both
+ * checked the same way (checks + statuses, exactly as GitHub's own UI does). Takes a plain
+ * `OctokitClient`, not an Effect service, so it and its caller below are testable directly
+ * against a real `@octokit/rest` instance with a fetch shim (repository-ruleset-octokit.test.ts)
+ * — no `GitHubCredentials` layer needed, mirroring `desiredWireRuleset`'s pure-function seam. */
+export declare const hasRefReportedSuccess: (octokit: OctokitClient, owner: string, repo: string, ref: string, context: string) => Effect.Effect<boolean, Error>;
+/** The head SHAs of up to `RECENT_MERGED_PR_LIMIT` most-recently-updated MERGED pull requests
+ * against `base` — one bounded list call (`RECENT_CLOSED_PR_PAGE_SIZE` closed PRs), filtered to
+ * merged, then capped. Never paginates further: a repo whose last `RECENT_MERGED_PR_LIMIT`
+ * merges are all older than its last `RECENT_CLOSED_PR_PAGE_SIZE` closed PRs simply yields fewer
+ * than the limit, same as a repo with too little history — both are the "still refused" case. */
+export declare const recentMergedHeadShas: (octokit: OctokitClient, owner: string, repo: string, base: string) => Effect.Effect<readonly string[], Error>;
+/** The full K2 answer: the default branch's tip, then (only if the tip has no success) up to
+ * `RECENT_MERGED_PR_LIMIT` recent merged PR heads, short-circuiting on the first success. `false`
+ * only once every one of those has been checked and none reported — the case
+ * `NeverReportedContext` exists to refuse. */
+export declare const contextReportedSuccess: (octokit: OctokitClient, owner: string, repo: string, context: string) => Effect.Effect<boolean, Error>;
 export declare const makeRulesetOctokit: (baseUrl: string | undefined) => RealRulesetOctokit;
 //# sourceMappingURL=repository-ruleset-octokit.d.ts.map

package/dist/github/repository-ruleset-octokit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-octokit.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-octokit.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,KAAK,EAAE,cAAc,EAAiC,MAAM,+BAA+B,CAAC;AAEnG,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;AAcnE,eAAO,MAAM,kBAAkB,YAAa,MAAM,GAAG,SAAS,KAAG,kBAoG/D,CAAC"}
+{"version":3,"file":"repository-ruleset-octokit.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-octokit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAiC,MAAM,+BAA+B,CAAC;AAEnG,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;AAcnE;kFACkF;AAClF,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAczC;;;;iGAIiG;AACjG,eAAO,MAAM,qBAAqB,YACvB,aAAa,SACf,MAAM,QACP,MAAM,OACP,MAAM,WACF,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAmB3B,CAAC;AAEL;;;;iGAIiG;AACjG,eAAO,MAAM,oBAAoB,YACtB,aAAa,SACf,MAAM,QACP,MAAM,QACN,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,EAAE,KAAK,CAmBrC,CAAC;AAEL;;;8CAG8C;AAC9C,eAAO,MAAM,sBAAsB,YACxB,aAAa,SACf,MAAM,QACP,MAAM,WACH,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAc3B,CAAC;AAEL,eAAO,MAAM,kBAAkB,YAAa,MAAM,GAAG,SAAS,KAAG,kBA+E/D,CAAC"}

package/dist/github/repository-ruleset-probe.d.ts

@@ -64,7 +64,8 @@ export interface RulesetOctokit<R = never> {
         readonly repo: string;
         readonly rulesetId: number;
     }) => Effect.Effect<void, Error, R>;
-    /** Whether `context` has ever reported success against the repository's default branch —
+    /** Whether `context` has reported success against the repository's default branch tip OR a
+     * recent merged PR head (K2, bounded — see repository-ruleset-octokit.ts's file header) —
      * backs the `NeverReportedContext` guard. */
     readonly hasContextReportedSuccess: (input: {
         readonly owner: string;

package/dist/github/repository-ruleset-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-probe.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMlE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;wFAIwF;AACxF,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,KAAK;IACvC;sFACkF;IAClF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpC;iDAC6C;IAC7C,QAAQ,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE;QAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,GAAG,KAAK,WAC1B,cAAc,CAAC,CAAC,CAAC,SACnB;IACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,KACA,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAAC,CAmBnE,CAAC"}
+{"version":3,"file":"repository-ruleset-probe.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMlE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;wFAIwF;AACxF,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,KAAK;IACvC;sFACkF;IAClF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpC;;iDAE6C;IAC7C,QAAQ,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE;QAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,GAAG,KAAK,WAC1B,cAAc,CAAC,CAAC,CAAC,SACnB;IACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,KACA,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAAC,CAmBnE,CAAC"}

package/dist/github/repository-ruleset-props.d.ts

@@ -0,0 +1,91 @@
+/**
+ * `GitHub.RepositoryRuleset`'s declared shape — split out of repository-ruleset.ts purely to
+ * keep that file (the provider wiring) under the 250-line cap; nothing here is provider logic.
+ */
+import type { RulesetProps } from 'alchemy/GitHub';
+type UpstreamRules = NonNullable<RulesetProps['rules']>;
+export interface RepositoryRulesetReviewerRule {
+    readonly filePatterns: readonly string[];
+    readonly minimumApprovals: number;
+    readonly reviewer: {
+        readonly actorId: number;
+        readonly actorType: 'Team';
+    };
+}
+export interface RepositoryRulesetPullRequestRule extends NonNullable<UpstreamRules['pullRequest']> {
+    /** @default every method GitHub allows — the house baseline always pins `['squash']`. */
+    readonly allowedMergeMethods?: readonly ('merge' | 'squash' | 'rebase')[];
+    readonly requiredReviewers?: readonly RepositoryRulesetReviewerRule[];
+    /** `require_extra_approval_for_unattributed_changes` — see repository-ruleset.ts's H15.
+     * Both values are modeled (K1, 2026-09-23): 8 live rulesets carry `true` (aop, cloudflareforms,
+     * doesthishelp-workeropen, homeflare-anyauth, homeflare-desktop, loggarr, magictransit,
+     * proxmox-tb4 — re-read live via `gh api repos/taslabs-net/<repo>/rulesets/<id>`,
+     * 2026-09-23), and this resource declares exactly what is live or it cannot adopt them —
+     * `undefined` stays "no opinion" (GitHub defaults an absent key to `true`). */
+    readonly extraApprovalForUnattributedChanges?: boolean;
+}
+export interface RepositoryRulesetStatusChecksRule extends NonNullable<UpstreamRules['requiredStatusChecks']> {
+    readonly doNotEnforceOnCreate?: boolean;
+}
+export interface RepositoryRulesetRules extends Omit<UpstreamRules, 'pullRequest' | 'requiredStatusChecks'> {
+    /** `undefined`: no opinion (refused if the live ruleset already has one and this is not an
+     * exact-adopt pass-through — see repository-ruleset-guards.ts's `undeclaredLiveRuleRefusal`).
+     * `false`: declare its ABSENCE — either "this repo never had one" (a create, or an adopt
+     * where live already has none, both no-ops) or a deliberate removal of a live rule, which
+     * `ruleNarrowingRefusal` gates behind `acknowledgeRuleNarrowing` (see below). Added 2026-09-23 for
+     * exact-adopt pass-through: `requiredStatusChecks` already had this `false` escape; `deletion`/
+     * `nonFastForward`/etc already have it implicitly (plain `boolean`, so `false` is already a
+     * value); `pullRequest` was the one modeled rule with NO way to express "not present at all" —
+     * a repo like `taslabs-net/taslabs-net` (measured live 2026-09-23: `rules = [deletion,
+     * non_fast_forward]`, no `pull_request`) could not be adopted through this resource without
+     * either refusing to omit the key (a type error) or silently declaring a brand-new rule. */
+    readonly pullRequest?: RepositoryRulesetPullRequestRule | false;
+    /** `undefined`: no opinion (refused if the live ruleset already has one — see
+     * repository-ruleset-guards.ts). `false`: declare its ABSENCE — removes a live one. */
+    readonly requiredStatusChecks?: RepositoryRulesetStatusChecksRule | false;
+}
+export interface RepositoryRulesetProps extends Omit<RulesetProps, 'rules'> {
+    readonly rules?: RepositoryRulesetRules;
+    /**
+     * An explicit, reasoned sign-off that THIS declaration deliberately drops a live bypass actor
+     * (`bypassActors` is a strict subset of what is live). Without this, `reconcile` refuses the
+     * write rather than silently loosen a ruleset that already protects something — see
+     * `bypassNarrowingRefusal` in repository-ruleset-narrowing-guards.ts. `reason` is not logged or
+     * sent to GitHub; it exists so the declaration's own diff carries WHY, for the next reader
+     * (S21: a refusal names the fact it checked — this is the human-authored counterpart for the
+     * one case a fact alone cannot settle: "is this narrowing intentional?").
+     *
+     * ⛔ SEPARATE FROM `acknowledgeRuleNarrowing` ON PURPOSE (2026-09-23 review finding: a single
+     *   shared `acknowledgeNarrowing` let one reason worded for a rule drop silently also rubber-
+     *   stamp an unrelated bypass-actor drop in the SAME declaration — a `bypassActors: []` left
+     *   over from an unrelated edit slipped through under a reason that never mentioned bypass at
+     *   all). Each prop authorizes only the narrowing its own guard checks; a declaration that
+     *   narrows both needs both, each with its own reason.
+     *
+     * ⛔ ALSO A STANDING PROP, NOT A ONE-TIME TOKEN — remove it from the declaration once the
+     *   narrowing it describes has landed. Left in place, it keeps disabling the bypass-narrowing
+     *   guard for every future `reconcile` of this resource, not only the change it was written
+     *   for — the same way `rules: { deletion: false }` stays a standing "this rule stays absent"
+     *   fact rather than a one-time action, only here the standing fact is "bypass narrowing needs
+     *   no review", which is a fact you want true for as short a window as possible. A reviewer
+     *   reading a diff that adds a SECOND, unrelated bypass drop under an OLD
+     *   `acknowledgeBypassNarrowing` left over from a prior change is the failure mode this note
+     *   exists to head off.
+     */
+    readonly acknowledgeBypassNarrowing?: {
+        readonly reason: string;
+    };
+    /**
+     * The `rules`-side counterpart to `acknowledgeBypassNarrowing` above — an explicit, reasoned
+     * sign-off that THIS declaration deliberately drops a live rule (a modeled rule type declared
+     * `false`/boolean-`false` while the live ruleset still has it). Without this, `reconcile`
+     * refuses the write — see `ruleNarrowingRefusal` in repository-ruleset-narrowing-guards.ts.
+     * Same standing-prop caution as `acknowledgeBypassNarrowing`: remove it once the rule drop it
+     * describes has landed, or it keeps excusing every later rule drop on this resource too.
+     */
+    readonly acknowledgeRuleNarrowing?: {
+        readonly reason: string;
+    };
+}
+export {};
+//# sourceMappingURL=repository-ruleset-props.d.ts.map

package/dist/github/repository-ruleset-props.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-props.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-props.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,gCAAiC,SAAQ,WAAW,CACnE,aAAa,CAAC,aAAa,CAAC,CAC7B;IACC,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACtE;;;;;mFAK+E;IAC/E,QAAQ,CAAC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CACxD;AAED,MAAM,WAAW,iCAAkC,SAAQ,WAAW,CACpE,aAAa,CAAC,sBAAsB,CAAC,CACtC;IACC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAClD,aAAa,EACb,aAAa,GAAG,sBAAsB,CACvC;IACC;;;;;;;;;;gGAU4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,gCAAgC,GAAG,KAAK,CAAC;IAChE;2FACuF;IACvF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,iCAAiC,GAAG,KAAK,CAAC;CAC3E;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC;IACxC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}

package/dist/github/repository-ruleset-providers.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `repoPolicyProviders` — the documented stack wiring for `RepositoryRuleset` (directly, or
+ * through `declareRepoPolicy` / `declareRepoBaseline`): `GitHub.providers()` and
+ * `RepositoryRulesetProvider()`, composed so the whole thing typechecks and needs nothing
+ * further from the stack.
+ *
+ *     providers: repoPolicyProviders()
+ *
+ * ⛔ WHY THIS EXISTS — MEASURED 2026-09-24 (homeflare-builds bump PR 6, tsc). Writing the two
+ *   providers side by side, `Layer.mergeAll(GitHub.providers(), RepositoryRulesetProvider())`,
+ *   type-errors: `RepositoryRulesetProvider()`'s handlers call `octokitFor`, which needs
+ *   `GitHubCredentials` — a requirement of the PROVIDER's layer, correctly inferred by
+ *   `Provider.succeed` from `repositoryRulesetHandlers` in repository-ruleset.ts. Merging two
+ *   layers does not thread one's output into the other's requirement; `RepositoryRulesetProvider()`
+ *   still needs `GitHubCredentials` fed in. `GitHub.providers()` is the only thing here that
+ *   resolves credentials (env, stored PAT, `gh` CLI, or OAuth — see `alchemy/src/GitHub/
+ *   Providers.ts`), and — because it chains `Layer.provideMerge(Credentials.fromAuthProvider(…))`
+ *   internally rather than `Layer.provide` — its own OUTPUT includes `GitHubCredentials`
+ *   alongside `GitHub.Providers`. `Layer.provideMerge(github)` on `RepositoryRulesetProvider()`
+ *   both supplies that requirement AND keeps `github`'s own output merged in for any
+ *   `GitHub.Repository`/`GitHub.Ruleset` the caller also declares. `github` is built once and
+ *   referenced twice below — Effect's layer memoization (by reference) builds it once, not
+ *   twice, not twice against the auth provider either.
+ *
+ * ★ THIS IS ONLY HALF OF 2026-09-24's FIX. The other half — `RepositoryRuleset`'s own `Resource<>`
+ *   declaration no longer naming `GitHubCredentials` in its 5th (`Providers`) slot — lives in
+ *   repository-ruleset.ts's file header; that half is what let a stack BODY calling
+ *   `declareRepoPolicy`/`declareRepoBaseline` typecheck at all. Composing the providers
+ *   correctly, as this function does, does not by itself fix a body that still requires
+ *   `GitHubCredentials` directly.
+ *
+ * ⚠️ DON'T ALSO MERGE A SEPARATE `GitHub.providers()` CALL IN. `github` here is one Layer
+ *   object referenced twice, which Effect's layer memoization (by reference, ADVERSARIAL
+ *   REVIEW 2026-09-24: confirmed against `effect@4.0.0-rc.115`'s own `MemoMap`) builds once. A
+ *   stack that ALSO writes its own `GitHub.providers()` alongside this function's result is a
+ *   second, distinct Layer object — a genuine second credential resolution, not shared with
+ *   this one. Get every GitHub resource's providers from this one call.
+ */
+import * as GitHub from 'alchemy/GitHub';
+import * as Layer from 'effect/Layer';
+export declare const repoPolicyProviders: (options?: GitHub.ProvidersOptions) => Layer.Layer<import("alchemy/Auth/Credentials").CredentialsStore | GitHub.GitHubCredentials | import("alchemy/Auth/Profile").ProfileStore | import("alchemy").Provider<import("./repository-ruleset.ts").RepositoryRuleset> | GitHub.Providers, never, import("alchemy").AuthProviders | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
+//# sourceMappingURL=repository-ruleset-providers.d.ts.map

package/dist/github/repository-ruleset-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-providers.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,eAAO,MAAM,mBAAmB,aAAc,MAAM,CAAC,gBAAgB,6aAGpE,CAAC"}

package/dist/github/repository-ruleset-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-reconcile.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-reconcile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEnG,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,gCAAgC,CAAC;AAUxC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,+BAA+B,CAAC;AA+CvC;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,KAAK,SAAS;IACjD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,sBAAsB,KAC1B,wBAAwB,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,2BAA2B,CAAC;CACrE,KAAG,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,sBAAsB,GAAG,KAAK,EAAE,CAAC,CAuF5E,CAAC"}
+{"version":3,"file":"repository-ruleset-reconcile.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-reconcile.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEnG,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC9B,MAAM,gCAAgC,CAAC;AAgBxC,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,aAAa,EAEnB,MAAM,+BAA+B,CAAC;AA+CvC;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,KAAK,SAAS;IACjD,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,2BAA2B,GAAG,SAAS,CAAC;IACzD,QAAQ,CAAC,iBAAiB,EAAE,CAC1B,KAAK,EAAE,sBAAsB,KAC1B,wBAAwB,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,aAAa,KAAK,2BAA2B,CAAC;CACrE,KAAG,MAAM,CAAC,MAAM,CAAC,2BAA2B,EAAE,sBAAsB,GAAG,KAAK,EAAE,CAAC,CAoH5E,CAAC"}

package/dist/github/repository-ruleset.d.ts

@@ -38,40 +38,35 @@
  *   meant to allow. `octokitFor`/`GitHubCredentials` are upstream's own EXPORTED building
  *   blocks (S23's second clause: reuse Alchemy's own client construction), so the client itself
  *   is not hand-rolled — only the choice of Octokit over distilled is a recorded divergence.
+ *
+ * ⛔ CREDENTIALS BELONG TO THE PROVIDER'S LAYER, NOT THE RESOURCE'S DECLARATION — MEASURED
+ *   2026-09-24 (homeflare-builds bump PR 6, tsc TS2345). The `Resource<Type, Props, Attributes,
+ *   Binding, Providers>` 5th type parameter had `GitHubCredentials` here; that puts the
+ *   credential requirement on every `yield* RepositoryRuleset(...)` CALL SITE (see
+ *   `alchemy/src/Resource.ts#ResourceClass`: `Req = R["Providers"] extends undefined ?
+ *   Provider<R> : R["Providers"]`), so a STACK BODY that merely declares the resource would
+ *   itself need `GitHubCredentials` in its own effect context — which a stack body cannot
+ *   produce (`Alchemy.Stack`'s own type, `alchemy/src/Stack.ts#ProviderServices`, is a closed
+ *   union of tagged marker interfaces — `ProviderCollectionLike | Provider<any> |
+ *   EnvironmentLike | CredentialsLike | DockerLike` — and `GitHubCredentials` matches none of
+ *   them structurally). VERIFIED against upstream `Ruleset` (`node_modules/alchemy/src/GitHub/
+ *   Ruleset.ts`): its 5th slot is `GitHub.Providers`, the ProviderCollection tag `GitHub.
+ *   providers()` OUTPUTS — never the raw `GitHubCredentials` service upstream's OWN provider
+ *   handlers pull in via `octokitFor`. `GitHubCredentials` stays confined to the PROVIDER's
+ *   layer requirement (`Provider.succeed`'s inferred `ReadReq | DiffReq | ReconcileReq |
+ *   DeleteReq`, below), never the declaration's. Omitting the 5th parameter here defaults it to
+ *   `undefined`, so the declaration's own requirement becomes `Provider<RepositoryRuleset>` —
+ *   itself a `Provider<any>`, a real `ProviderServices` member — matching the pattern a
+ *   standalone (non-collection) resource actually needs. See `repoPolicyProviders()` in
+ *   repository-ruleset-providers.ts for the layer composition this now requires (the provider
+ *   still needs `GitHubCredentials` fed in — that half of the fix was already correct, per
+ *   `docs/repository-ruleset.md`).
  */
 import { Resource } from 'alchemy';
-import type { GitHubCredentials, RulesetProps } from 'alchemy/GitHub';
 import * as Provider from 'alchemy/Provider';
 import { type RulesetRecord } from './repository-ruleset-probe.ts';
-type UpstreamRules = NonNullable<RulesetProps['rules']>;
-export interface RepositoryRulesetReviewerRule {
-    readonly filePatterns: readonly string[];
-    readonly minimumApprovals: number;
-    readonly reviewer: {
-        readonly actorId: number;
-        readonly actorType: 'Team';
-    };
-}
-export interface RepositoryRulesetPullRequestRule extends NonNullable<UpstreamRules['pullRequest']> {
-    /** @default every method GitHub allows — the house baseline always pins `['squash']`. */
-    readonly allowedMergeMethods?: readonly ('merge' | 'squash' | 'rebase')[];
-    readonly requiredReviewers?: readonly RepositoryRulesetReviewerRule[];
-    /** `require_extra_approval_for_unattributed_changes` — see H15 above. Only `false` is
-     * modeled: sending `true` has no house use, and GitHub already defaults absent to `true`. */
-    readonly extraApprovalForUnattributedChanges?: false;
-}
-export interface RepositoryRulesetStatusChecksRule extends NonNullable<UpstreamRules['requiredStatusChecks']> {
-    readonly doNotEnforceOnCreate?: boolean;
-}
-export interface RepositoryRulesetRules extends Omit<UpstreamRules, 'pullRequest' | 'requiredStatusChecks'> {
-    readonly pullRequest?: RepositoryRulesetPullRequestRule;
-    /** `undefined`: no opinion (refused if the live ruleset already has one — see
-     * repository-ruleset-guards.ts). `false`: declare its ABSENCE — removes a live one. */
-    readonly requiredStatusChecks?: RepositoryRulesetStatusChecksRule | false;
-}
-export interface RepositoryRulesetProps extends Omit<RulesetProps, 'rules'> {
-    readonly rules?: RepositoryRulesetRules;
-}
+import type { RepositoryRulesetProps } from './repository-ruleset-props.ts';
+export type { RepositoryRulesetProps, RepositoryRulesetPullRequestRule, RepositoryRulesetReviewerRule, RepositoryRulesetRules, RepositoryRulesetStatusChecksRule, } from './repository-ruleset-props.ts';
 export interface RepositoryRulesetAttributes {
     readonly rulesetId: number;
     readonly nodeId: string | undefined;
@@ -79,11 +74,10 @@ export interface RepositoryRulesetAttributes {
     readonly createdAt: string | undefined;
     readonly updatedAt: string | undefined;
 }
-export interface RepositoryRuleset extends Resource<'GitHub.RepositoryRuleset', RepositoryRulesetProps, RepositoryRulesetAttributes, never, GitHubCredentials> {
+export interface RepositoryRuleset extends Resource<'GitHub.RepositoryRuleset', RepositoryRulesetProps, RepositoryRulesetAttributes, never> {
 }
 export declare const RepositoryRuleset: import("alchemy").ResourceClass<RepositoryRuleset>;
 export declare const attrsOf: (r: RulesetRecord) => RepositoryRulesetAttributes;
-export declare const repositoryRulesetHandlers: Provider.ProviderService<RepositoryRuleset, GitHubCredentials, never, never, GitHubCredentials, GitHubCredentials, never, never, never>;
-export declare const RepositoryRulesetProvider: () => import("effect/Layer").Layer<Provider.Provider<RepositoryRuleset>, never, GitHubCredentials>;
-export {};
+export declare const repositoryRulesetHandlers: Provider.ProviderService<RepositoryRuleset, import("alchemy/GitHub/Credentials").GitHubCredentials, never, never, import("alchemy/GitHub/Credentials").GitHubCredentials, import("alchemy/GitHub/Credentials").GitHubCredentials, never, never, never>;
+export declare const RepositoryRulesetProvider: () => import("effect/Layer").Layer<Provider.Provider<RepositoryRuleset>, never, import("alchemy/GitHub/Credentials").GitHubCredentials>;
 //# sourceMappingURL=repository-ruleset.d.ts.map

package/dist/github/repository-ruleset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAQ7C,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,+BAA+B,CAAC;AAGhF,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,gCAAiC,SAAQ,WAAW,CACnE,aAAa,CAAC,aAAa,CAAC,CAC7B;IACC,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACtE;iGAC6F;IAC7F,QAAQ,CAAC,mCAAmC,CAAC,EAAE,KAAK,CAAC;CACtD;AAED,MAAM,WAAW,iCAAkC,SAAQ,WAAW,CACpE,aAAa,CAAC,sBAAsB,CAAC,CACtC;IACC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAClD,aAAa,EACb,aAAa,GAAG,sBAAsB,CACvC;IACC,QAAQ,CAAC,WAAW,CAAC,EAAE,gCAAgC,CAAC;IACxD;2FACuF;IACvF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,iCAAiC,GAAG,KAAK,CAAC;CAC3E;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC;CACzC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,OAAO,MAAO,aAAa,KAAG,2BAMzC,CAAC;AA4BH,eAAO,MAAM,yBAAyB,yIAkEpC,CAAC;AAEH,eAAO,MAAM,yBAAyB,oGAC0B,CAAC"}
+{"version":3,"file":"repository-ruleset.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAQ7C,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAG5E,YAAY,EACV,sBAAsB,EACtB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,CAIN;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,OAAO,MAAO,aAAa,KAAG,2BAMzC,CAAC;AA4CH,eAAO,MAAM,yBAAyB,wPAkEpC,CAAC;AAEH,eAAO,MAAM,yBAAyB,yIAC0B,CAAC"}