@homeflare/alchemy 0.28.0 → 0.29.0

package/dist/github/repository-ruleset-errors.d.ts

@@ -90,8 +90,9 @@ export declare class RequiredChecksOmitted extends RequiredChecksOmitted_base<{
 declare const NeverReportedContext_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "NeverReportedContext";
 } & Readonly<A>;
-/** A context being ADDED to `requiredStatusChecks` has never reported success on the default
- * branch. Requiring it would leave every future pull request pending forever. */
+/** A context being ADDED to `requiredStatusChecks` has never reported success anywhere this
+ * family looks (the default branch's tip, then recent merged PR heads — K2, bounded, not full
+ * history). Requiring it would leave every future pull request pending forever. */
 export declare class NeverReportedContext extends NeverReportedContext_base<{
     readonly owner: string;
     readonly repository: string;

package/dist/github/repository-ruleset-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-errors.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-errors.ts"],"names":[],"mappings":";;;AAQA;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;6EAC6E;AAC7E,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;;;6CAK6C;AAC7C,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;cAIc;AACd,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;6FAC6F;AAC7F,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;iFACiF;AACjF,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;4FAC4F;AAC5F,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;kGACkG;AAClG,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;AAED,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,YAAY,GACZ,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,gBAAgB,CAAC"}
+{"version":3,"file":"repository-ruleset-errors.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-errors.ts"],"names":[],"mappings":";;;AAQA;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;6EAC6E;AAC7E,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;;;6CAK6C;AAC7C,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;cAIc;AACd,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;6FAC6F;AAC7F,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;mFAEmF;AACnF,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;4FAC4F;AAC5F,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;kGACkG;AAClG,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;AAED,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,YAAY,GACZ,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,gBAAgB,CAAC"}

package/dist/github/repository-ruleset-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-form.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,sBAAsB,EAEtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AA2DvF,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,SAAS,GAAG,QAAQ,EAAE,CAmCpF;AAED;0BAC0B;AAC1B,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CAqBnF;AA+CD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAiB/D"}
+{"version":3,"file":"repository-ruleset-form.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,sBAAsB,EAEtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AA+DvF,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,SAAS,GAAG,QAAQ,EAAE,CAmCpF;AAED;0BAC0B;AAC1B,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CAqBnF;AA+CD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAiB/D"}

package/dist/github/repository-ruleset-guards.d.ts

@@ -76,7 +76,8 @@ export declare function requiredChecksOmissionRefusal(input: {
 /** Every context in the declared `requiredStatusChecks` that the LIVE ruleset does not already
  * require — i.e. being added by this plan, the only case a never-reported context can matter. */
 export declare const newlyRequiredContexts: (declared: RepositoryRulesetProps['rules'], live: RulesetRecord | undefined) => readonly string[];
-/** Fails on the first newly-required context that has never reported success on the default
- * branch — checked once here (reconcile's observe step) and again by the standalone checker. */
+/** Fails on the first newly-required context that has never reported success anywhere this
+ * family looks (the default branch's tip, then recent merged PR heads — K2) — checked once here
+ * (reconcile's observe step) and again by the standalone checker. */
 export declare const refuseUnreportedContexts: <R = never>(octokit: RulesetOctokit<R>, owner: string, repo: string, contexts: readonly string[]) => Effect.Effect<void, NeverReportedContext | Error, R>;
 //# sourceMappingURL=repository-ruleset-guards.d.ts.map

package/dist/github/repository-ruleset-guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-guards.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-guards.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnF;;aAEa;AACb,eAAO,MAAM,SAAS,MAAO;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,WACF,CAAC;AAE7F;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;6EAE6E;AAC7E,eAAO,MAAM,aAAa,SAAU,aAAa,GAAG,SAAS,KAAG,GAAG,CAAC,MAAM,CACjB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;wFAEwF;AACxF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAgB7F;AAED;6FAC6F;AAC7F,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,qBAAqB,GAAG,SAAS,CAcpC;AAED;iGACiG;AACjG,eAAO,MAAM,qBAAqB,aACtB,sBAAsB,CAAC,OAAO,CAAC,QACnC,aAAa,GAAG,SAAS,KAC9B,SAAS,MAAM,EAWjB,CAAC;AAEF;gGACgG;AAChG,eAAO,MAAM,wBAAwB,GAAI,CAAC,GAAG,KAAK,WACvC,cAAc,CAAC,CAAC,CAAC,SACnB,MAAM,QACP,MAAM,YACF,SAAS,MAAM,EAAE,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,GAAG,KAAK,EAAE,CAAC,CAQlD,CAAC"}
+{"version":3,"file":"repository-ruleset-guards.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-guards.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnF;;aAEa;AACb,eAAO,MAAM,SAAS,MAAO;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,WACF,CAAC;AAE7F;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;6EAE6E;AAC7E,eAAO,MAAM,aAAa,SAAU,aAAa,GAAG,SAAS,KAAG,GAAG,CAAC,MAAM,CACjB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;wFAEwF;AACxF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAgB7F;AAED;6FAC6F;AAC7F,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,qBAAqB,GAAG,SAAS,CAcpC;AAED;iGACiG;AACjG,eAAO,MAAM,qBAAqB,aACtB,sBAAsB,CAAC,OAAO,CAAC,QACnC,aAAa,GAAG,SAAS,KAC9B,SAAS,MAAM,EAWjB,CAAC;AAEF;;qEAEqE;AACrE,eAAO,MAAM,wBAAwB,GAAI,CAAC,GAAG,KAAK,WACvC,cAAc,CAAC,CAAC,CAAC,SACnB,MAAM,QACP,MAAM,YACF,SAAS,MAAM,EAAE,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,GAAG,KAAK,EAAE,CAAC,CAQlD,CAAC"}

package/dist/github/repository-ruleset-octokit.d.ts

@@ -1,5 +1,54 @@
+/**
+ * The real {@link RulesetOctokit} — every wire call this family makes, built from the EXPORTED
+ * `GitHubCredentials` service via `creds.octokit()`, exactly upstream's own `octokitFor` does
+ * (`node_modules/alchemy/src/GitHub/Octokit.ts`). H15: Octokit, not `@distilled.cloud/github`
+ * — its `S.Struct` request schemas have no field for `require_extra_approval_for_unattributed_
+ * changes` and would very likely strip an unknown key on encode; Octokit's REST methods hand
+ * their `parameters` object to `@octokit/endpoint` mostly as-is, so an extra JSON body key
+ * should reach the wire. repository-ruleset-wire.test.ts MEASURES this against a real Octokit
+ * instance with a fetch shim rather than asserting it from reading the source.
+ *
+ * ★ K2 (2026-09-24): "REPORTED SUCCESS" IS THE DEFAULT BRANCH'S TIP, THEN RECENT MERGED PR
+ *   HEADS — NOT FULL HISTORY. The rendered CI (`packages/config/src/repo-shape/ci.ts`) triggers
+ *   on `pull_request` ONLY, deliberately (measured 2026-09-15..22: 613 of 619 main-push runs
+ *   duplicated an already-green PR run, ~41% of the mini's CI load) — so `ci`/`secret scan`/
+ *   `CodeQL` NEVER report on the default branch's tip itself, only on PR heads. Checking the tip
+ *   alone therefore refused adding any of them everywhere, including homeflare-builds' pending
+ *   first ruleset. `contextReportedSuccess` now falls back to `recentMergedHeadShas` — bounded
+ *   (`RECENT_MERGED_PR_LIMIT` heads, from one `per_page`-bounded list call, never the repo's
+ *   full PR history) — so a context that only ever reports on PR heads is no longer refused
+ *   everywhere, while a context that has never reported ANYWHERE (not the tip, not any recent
+ *   merged head) still is: `NeverReportedContext`'s whole purpose survives unchanged.
+ * ⚠️ Still not full history: a context whose only successful run predates
+ *   `RECENT_MERGED_PR_LIMIT` merges ago reads as never-reported until it runs again. Widening
+ *   the bound trades this guard's cost (more vendor calls per newly-required context) against
+ *   its reach; `RECENT_MERGED_PR_LIMIT` is a deliberate, named number for exactly that reason,
+ *   not a magic constant.
+ */
+import type { Octokit as OctokitClient } from '@octokit/rest';
 import { GitHubCredentials } from 'alchemy/GitHub';
+import * as Effect from 'effect/Effect';
 import type { RulesetOctokit } from './repository-ruleset-probe.ts';
 export type RealRulesetOctokit = RulesetOctokit<GitHubCredentials>;
+/** How many of the most-recently-updated MERGED pull requests' head SHAs to check, once the
+ * default branch's own tip has no reported success — see the file header (K2). */
+export declare const RECENT_MERGED_PR_LIMIT = 10;
+/** Whether `context` reported success for a single ref — a branch tip or a PR head SHA, both
+ * checked the same way (checks + statuses, exactly as GitHub's own UI does). Takes a plain
+ * `OctokitClient`, not an Effect service, so it and its caller below are testable directly
+ * against a real `@octokit/rest` instance with a fetch shim (repository-ruleset-octokit.test.ts)
+ * — no `GitHubCredentials` layer needed, mirroring `desiredWireRuleset`'s pure-function seam. */
+export declare const hasRefReportedSuccess: (octokit: OctokitClient, owner: string, repo: string, ref: string, context: string) => Effect.Effect<boolean, Error>;
+/** The head SHAs of up to `RECENT_MERGED_PR_LIMIT` most-recently-updated MERGED pull requests
+ * against `base` — one bounded list call (`RECENT_CLOSED_PR_PAGE_SIZE` closed PRs), filtered to
+ * merged, then capped. Never paginates further: a repo whose last `RECENT_MERGED_PR_LIMIT`
+ * merges are all older than its last `RECENT_CLOSED_PR_PAGE_SIZE` closed PRs simply yields fewer
+ * than the limit, same as a repo with too little history — both are the "still refused" case. */
+export declare const recentMergedHeadShas: (octokit: OctokitClient, owner: string, repo: string, base: string) => Effect.Effect<readonly string[], Error>;
+/** The full K2 answer: the default branch's tip, then (only if the tip has no success) up to
+ * `RECENT_MERGED_PR_LIMIT` recent merged PR heads, short-circuiting on the first success. `false`
+ * only once every one of those has been checked and none reported — the case
+ * `NeverReportedContext` exists to refuse. */
+export declare const contextReportedSuccess: (octokit: OctokitClient, owner: string, repo: string, context: string) => Effect.Effect<boolean, Error>;
 export declare const makeRulesetOctokit: (baseUrl: string | undefined) => RealRulesetOctokit;
 //# sourceMappingURL=repository-ruleset-octokit.d.ts.map

package/dist/github/repository-ruleset-octokit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-octokit.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-octokit.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,KAAK,EAAE,cAAc,EAAiC,MAAM,+BAA+B,CAAC;AAEnG,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;AAcnE,eAAO,MAAM,kBAAkB,YAAa,MAAM,GAAG,SAAS,KAAG,kBAoG/D,CAAC"}
+{"version":3,"file":"repository-ruleset-octokit.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-octokit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAiC,MAAM,+BAA+B,CAAC;AAEnG,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;AAcnE;kFACkF;AAClF,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAczC;;;;iGAIiG;AACjG,eAAO,MAAM,qBAAqB,YACvB,aAAa,SACf,MAAM,QACP,MAAM,OACP,MAAM,WACF,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAmB3B,CAAC;AAEL;;;;iGAIiG;AACjG,eAAO,MAAM,oBAAoB,YACtB,aAAa,SACf,MAAM,QACP,MAAM,QACN,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,EAAE,KAAK,CAmBrC,CAAC;AAEL;;;8CAG8C;AAC9C,eAAO,MAAM,sBAAsB,YACxB,aAAa,SACf,MAAM,QACP,MAAM,WACH,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAc3B,CAAC;AAEL,eAAO,MAAM,kBAAkB,YAAa,MAAM,GAAG,SAAS,KAAG,kBA+E/D,CAAC"}

package/dist/github/repository-ruleset-probe.d.ts

@@ -64,7 +64,8 @@ export interface RulesetOctokit<R = never> {
         readonly repo: string;
         readonly rulesetId: number;
     }) => Effect.Effect<void, Error, R>;
-    /** Whether `context` has ever reported success against the repository's default branch —
+    /** Whether `context` has reported success against the repository's default branch tip OR a
+     * recent merged PR head (K2, bounded — see repository-ruleset-octokit.ts's file header) —
      * backs the `NeverReportedContext` guard. */
     readonly hasContextReportedSuccess: (input: {
         readonly owner: string;

package/dist/github/repository-ruleset-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-probe.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMlE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;wFAIwF;AACxF,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,KAAK;IACvC;sFACkF;IAClF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpC;iDAC6C;IAC7C,QAAQ,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE;QAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,GAAG,KAAK,WAC1B,cAAc,CAAC,CAAC,CAAC,SACnB;IACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,KACA,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAAC,CAmBnE,CAAC"}
+{"version":3,"file":"repository-ruleset-probe.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMlE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;wFAIwF;AACxF,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,KAAK;IACvC;sFACkF;IAClF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpC;;iDAE6C;IAC7C,QAAQ,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE;QAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,GAAG,KAAK,WAC1B,cAAc,CAAC,CAAC,CAAC,SACnB;IACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,KACA,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAAC,CAmBnE,CAAC"}

package/dist/github/repository-ruleset-props.d.ts

@@ -16,10 +16,13 @@ export interface RepositoryRulesetPullRequestRule extends NonNullable<UpstreamRu
     /** @default every method GitHub allows — the house baseline always pins `['squash']`. */
     readonly allowedMergeMethods?: readonly ('merge' | 'squash' | 'rebase')[];
     readonly requiredReviewers?: readonly RepositoryRulesetReviewerRule[];
-    /** `require_extra_approval_for_unattributed_changes` — see repository-ruleset.ts's H15. Only
-     * `false` is modeled: sending `true` has no house use, and GitHub already defaults absent to
-     * `true`. */
-    readonly extraApprovalForUnattributedChanges?: false;
+    /** `require_extra_approval_for_unattributed_changes` — see repository-ruleset.ts's H15.
+     * Both values are modeled (K1, 2026-09-23): 8 live rulesets carry `true` (aop, cloudflareforms,
+     * doesthishelp-workeropen, homeflare-anyauth, homeflare-desktop, loggarr, magictransit,
+     * proxmox-tb4 — re-read live via `gh api repos/taslabs-net/<repo>/rulesets/<id>`,
+     * 2026-09-23), and this resource declares exactly what is live or it cannot adopt them —
+     * `undefined` stays "no opinion" (GitHub defaults an absent key to `true`). */
+    readonly extraApprovalForUnattributedChanges?: boolean;
 }
 export interface RepositoryRulesetStatusChecksRule extends NonNullable<UpstreamRules['requiredStatusChecks']> {
     readonly doNotEnforceOnCreate?: boolean;

package/dist/github/repository-ruleset-props.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-props.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-props.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,gCAAiC,SAAQ,WAAW,CACnE,aAAa,CAAC,aAAa,CAAC,CAC7B;IACC,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACtE;;iBAEa;IACb,QAAQ,CAAC,mCAAmC,CAAC,EAAE,KAAK,CAAC;CACtD;AAED,MAAM,WAAW,iCAAkC,SAAQ,WAAW,CACpE,aAAa,CAAC,sBAAsB,CAAC,CACtC;IACC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAClD,aAAa,EACb,aAAa,GAAG,sBAAsB,CACvC;IACC;;;;;;;;;;gGAU4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,gCAAgC,GAAG,KAAK,CAAC;IAChE;2FACuF;IACvF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,iCAAiC,GAAG,KAAK,CAAC;CAC3E;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC;IACxC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}
+{"version":3,"file":"repository-ruleset-props.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-props.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,gCAAiC,SAAQ,WAAW,CACnE,aAAa,CAAC,aAAa,CAAC,CAC7B;IACC,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACtE;;;;;mFAK+E;IAC/E,QAAQ,CAAC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CACxD;AAED,MAAM,WAAW,iCAAkC,SAAQ,WAAW,CACpE,aAAa,CAAC,sBAAsB,CAAC,CACtC;IACC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAClD,aAAa,EACb,aAAa,GAAG,sBAAsB,CACvC;IACC;;;;;;;;;;gGAU4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,gCAAgC,GAAG,KAAK,CAAC;IAChE;2FACuF;IACvF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,iCAAiC,GAAG,KAAK,CAAC;CAC3E;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC;IACxC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}

package/dist/github/repository-ruleset-providers.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `repoPolicyProviders` — the documented stack wiring for `RepositoryRuleset` (directly, or
+ * through `declareRepoPolicy` / `declareRepoBaseline`): `GitHub.providers()` and
+ * `RepositoryRulesetProvider()`, composed so the whole thing typechecks and needs nothing
+ * further from the stack.
+ *
+ *     providers: repoPolicyProviders()
+ *
+ * ⛔ WHY THIS EXISTS — MEASURED 2026-09-24 (homeflare-builds bump PR 6, tsc). Writing the two
+ *   providers side by side, `Layer.mergeAll(GitHub.providers(), RepositoryRulesetProvider())`,
+ *   type-errors: `RepositoryRulesetProvider()`'s handlers call `octokitFor`, which needs
+ *   `GitHubCredentials` — a requirement of the PROVIDER's layer, correctly inferred by
+ *   `Provider.succeed` from `repositoryRulesetHandlers` in repository-ruleset.ts. Merging two
+ *   layers does not thread one's output into the other's requirement; `RepositoryRulesetProvider()`
+ *   still needs `GitHubCredentials` fed in. `GitHub.providers()` is the only thing here that
+ *   resolves credentials (env, stored PAT, `gh` CLI, or OAuth — see `alchemy/src/GitHub/
+ *   Providers.ts`), and — because it chains `Layer.provideMerge(Credentials.fromAuthProvider(…))`
+ *   internally rather than `Layer.provide` — its own OUTPUT includes `GitHubCredentials`
+ *   alongside `GitHub.Providers`. `Layer.provideMerge(github)` on `RepositoryRulesetProvider()`
+ *   both supplies that requirement AND keeps `github`'s own output merged in for any
+ *   `GitHub.Repository`/`GitHub.Ruleset` the caller also declares. `github` is built once and
+ *   referenced twice below — Effect's layer memoization (by reference) builds it once, not
+ *   twice, not twice against the auth provider either.
+ *
+ * ★ THIS IS ONLY HALF OF 2026-09-24's FIX. The other half — `RepositoryRuleset`'s own `Resource<>`
+ *   declaration no longer naming `GitHubCredentials` in its 5th (`Providers`) slot — lives in
+ *   repository-ruleset.ts's file header; that half is what let a stack BODY calling
+ *   `declareRepoPolicy`/`declareRepoBaseline` typecheck at all. Composing the providers
+ *   correctly, as this function does, does not by itself fix a body that still requires
+ *   `GitHubCredentials` directly.
+ *
+ * ⚠️ DON'T ALSO MERGE A SEPARATE `GitHub.providers()` CALL IN. `github` here is one Layer
+ *   object referenced twice, which Effect's layer memoization (by reference, ADVERSARIAL
+ *   REVIEW 2026-09-24: confirmed against `effect@4.0.0-rc.115`'s own `MemoMap`) builds once. A
+ *   stack that ALSO writes its own `GitHub.providers()` alongside this function's result is a
+ *   second, distinct Layer object — a genuine second credential resolution, not shared with
+ *   this one. Get every GitHub resource's providers from this one call.
+ */
+import * as GitHub from 'alchemy/GitHub';
+import * as Layer from 'effect/Layer';
+export declare const repoPolicyProviders: (options?: GitHub.ProvidersOptions) => Layer.Layer<import("alchemy/Auth/Credentials").CredentialsStore | GitHub.GitHubCredentials | import("alchemy/Auth/Profile").ProfileStore | import("alchemy").Provider<import("./repository-ruleset.ts").RepositoryRuleset> | GitHub.Providers, never, import("alchemy").AuthProviders | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
+//# sourceMappingURL=repository-ruleset-providers.d.ts.map

package/dist/github/repository-ruleset-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-providers.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,eAAO,MAAM,mBAAmB,aAAc,MAAM,CAAC,gBAAgB,6aAGpE,CAAC"}

package/dist/github/repository-ruleset.d.ts

@@ -38,9 +38,31 @@
  *   meant to allow. `octokitFor`/`GitHubCredentials` are upstream's own EXPORTED building
  *   blocks (S23's second clause: reuse Alchemy's own client construction), so the client itself
  *   is not hand-rolled — only the choice of Octokit over distilled is a recorded divergence.
+ *
+ * ⛔ CREDENTIALS BELONG TO THE PROVIDER'S LAYER, NOT THE RESOURCE'S DECLARATION — MEASURED
+ *   2026-09-24 (homeflare-builds bump PR 6, tsc TS2345). The `Resource<Type, Props, Attributes,
+ *   Binding, Providers>` 5th type parameter had `GitHubCredentials` here; that puts the
+ *   credential requirement on every `yield* RepositoryRuleset(...)` CALL SITE (see
+ *   `alchemy/src/Resource.ts#ResourceClass`: `Req = R["Providers"] extends undefined ?
+ *   Provider<R> : R["Providers"]`), so a STACK BODY that merely declares the resource would
+ *   itself need `GitHubCredentials` in its own effect context — which a stack body cannot
+ *   produce (`Alchemy.Stack`'s own type, `alchemy/src/Stack.ts#ProviderServices`, is a closed
+ *   union of tagged marker interfaces — `ProviderCollectionLike | Provider<any> |
+ *   EnvironmentLike | CredentialsLike | DockerLike` — and `GitHubCredentials` matches none of
+ *   them structurally). VERIFIED against upstream `Ruleset` (`node_modules/alchemy/src/GitHub/
+ *   Ruleset.ts`): its 5th slot is `GitHub.Providers`, the ProviderCollection tag `GitHub.
+ *   providers()` OUTPUTS — never the raw `GitHubCredentials` service upstream's OWN provider
+ *   handlers pull in via `octokitFor`. `GitHubCredentials` stays confined to the PROVIDER's
+ *   layer requirement (`Provider.succeed`'s inferred `ReadReq | DiffReq | ReconcileReq |
+ *   DeleteReq`, below), never the declaration's. Omitting the 5th parameter here defaults it to
+ *   `undefined`, so the declaration's own requirement becomes `Provider<RepositoryRuleset>` —
+ *   itself a `Provider<any>`, a real `ProviderServices` member — matching the pattern a
+ *   standalone (non-collection) resource actually needs. See `repoPolicyProviders()` in
+ *   repository-ruleset-providers.ts for the layer composition this now requires (the provider
+ *   still needs `GitHubCredentials` fed in — that half of the fix was already correct, per
+ *   `docs/repository-ruleset.md`).
  */
 import { Resource } from 'alchemy';
-import type { GitHubCredentials } from 'alchemy/GitHub';
 import * as Provider from 'alchemy/Provider';
 import { type RulesetRecord } from './repository-ruleset-probe.ts';
 import type { RepositoryRulesetProps } from './repository-ruleset-props.ts';
@@ -52,10 +74,10 @@ export interface RepositoryRulesetAttributes {
     readonly createdAt: string | undefined;
     readonly updatedAt: string | undefined;
 }
-export interface RepositoryRuleset extends Resource<'GitHub.RepositoryRuleset', RepositoryRulesetProps, RepositoryRulesetAttributes, never, GitHubCredentials> {
+export interface RepositoryRuleset extends Resource<'GitHub.RepositoryRuleset', RepositoryRulesetProps, RepositoryRulesetAttributes, never> {
 }
 export declare const RepositoryRuleset: import("alchemy").ResourceClass<RepositoryRuleset>;
 export declare const attrsOf: (r: RulesetRecord) => RepositoryRulesetAttributes;
-export declare const repositoryRulesetHandlers: Provider.ProviderService<RepositoryRuleset, GitHubCredentials, never, never, GitHubCredentials, GitHubCredentials, never, never, never>;
-export declare const RepositoryRulesetProvider: () => import("effect/Layer").Layer<Provider.Provider<RepositoryRuleset>, never, GitHubCredentials>;
+export declare const repositoryRulesetHandlers: Provider.ProviderService<RepositoryRuleset, import("alchemy/GitHub/Credentials").GitHubCredentials, never, never, import("alchemy/GitHub/Credentials").GitHubCredentials, import("alchemy/GitHub/Credentials").GitHubCredentials, never, never, never>;
+export declare const RepositoryRulesetProvider: () => import("effect/Layer").Layer<Provider.Provider<RepositoryRuleset>, never, import("alchemy/GitHub/Credentials").GitHubCredentials>;
 //# sourceMappingURL=repository-ruleset.d.ts.map

package/dist/github/repository-ruleset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAQ7C,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAG5E,YAAY,EACV,sBAAsB,EACtB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,OAAO,MAAO,aAAa,KAAG,2BAMzC,CAAC;AA4CH,eAAO,MAAM,yBAAyB,yIAkEpC,CAAC;AAEH,eAAO,MAAM,yBAAyB,oGAC0B,CAAC"}
+{"version":3,"file":"repository-ruleset.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAQ7C,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAG5E,YAAY,EACV,sBAAsB,EACtB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,CAIN;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,OAAO,MAAO,aAAa,KAAG,2BAMzC,CAAC;AA4CH,eAAO,MAAM,yBAAyB,wPAkEpC,CAAC;AAEH,eAAO,MAAM,yBAAyB,yIAC0B,CAAC"}

package/dist/litellm/fake-litellm.d.ts

@@ -1,31 +1,42 @@
 /**
- * A loopback `Bun.serve` fake of LiteLLM's `/config/pass_through_endpoint` routes — TEST ONLY,
- * never imported by `index.ts` (the netbox/proxmox house convention for test-only helpers).
+ * A fake of LiteLLM's `/config/pass_through_endpoint` routes for tests — TEST ONLY, never imported
+ * by `index.ts` (the netbox/forgejo house convention for test-only helpers). Mirrors
+ * `../netbox/fake-netbox.ts`/`../forgejo/fake-forgejo.ts`: a `fetch` function handed to Effect's
+ * real `FetchHttpClient` through its `Fetch` reference, so a test exercises distilled's REAL path
+ * assembly, JSON encode/decode and status→typed-error matching (`BadRequest`, `NotFound`, …) —
+ * nothing about that matching is re-implemented here, only the wire responses a scenario needs.
  *
  * ★ MODELS THE WHOLE-FIELD READ-MODIFY-WRITE ON PURPOSE. `general_settings.pass_through_endpoints`
- *   is ONE field (client.ts's header), so every mutation here reads the CURRENT row list, waits
- *   (so two concurrent requests can interleave), then writes back what it captured — not what is
- *   there by the time it writes. Two `create` calls that race lose one row, exactly like the
- *   vendor field would without the client's per-base-URL semaphore serialising them.
+ *   is ONE field (operations.ts's header), so every mutation here reads the CURRENT row list,
+ *   awaits (so two concurrent calls can interleave — no real socket needed, `fetch` is just an
+ *   async function the runtime awaits), then writes back what it captured — not what is there by
+ *   the time it writes. Two `create` calls that race lose one row, exactly like the vendor field
+ *   would without `operations.ts`'s per-base-URL semaphore serialising them.
  * ⚠️ WHAT THIS FAKE DOES NOT MODEL: PROXY_ADMIN vs. a lesser role for most routes (any correct
- *   bearer token is accepted); and update-of-a-missing-id, which is not measured at the tag — this
- *   fake 400s it, the same status a missing delete gets, as a documented TEST SIMPLIFICATION, not a
- *   vendor fact (docs/litellm.md says so too). `forbidDelete` is the one exception: it models the
- *   real asymmetry client.ts's header describes — `DELETE` routes through
- *   `update_config_general_settings`, which 400s `not_allowed_access` for a non-PROXY_ADMIN caller
- *   (or a disconnected DB) on a row that is genuinely still live, the SAME status a missing-id
- *   delete gets (proxy_server.py:16389-16416 at v1.100.0).
+ *   bearer token is accepted). `forbidDelete` is the one exception: it models the real asymmetry
+ *   `operations.ts`'s header describes — `DELETE` routes through `update_config_general_settings`,
+ *   which 400s `not_allowed_access` for a non-PROXY_ADMIN caller (or a disconnected DB) on a row
+ *   that is genuinely still live, the SAME status a missing-id delete gets (proxy_server.py:
+ *   16389-16416 at v1.100.0).
+ * ⚠️ UPDATE-OF-A-MISSING-ID IS 404, NOT 400 — corrected by this migration. The retired hand-rolled
+ *   fake 400'd it as "not measured at the tag, a documented test simplification". The distilled
+ *   SDK's own `patches/misc/update_pass_through_endpoints_*.json` cites the real source
+ *   (`pass_through_endpoints.py`'s `update_pass_through_endpoints` at the tag): unlike DELETE, this
+ *   route raises a genuine, unambiguous `HTTPException(404)` for a missing id, distinct from the
+ *   400 `update_config_general_settings` raises for the trailing auth/DB-disconnected write. This
+ *   fake now matches that measured vendor behaviour.
  */
-import type { PassThroughGenericEndpoint } from './generated/pass-through.ts';
+import type { PassThroughGenericEndpoint } from '@distilled.cloud/litellm/misc';
+/** RFC 2606 placeholder — never a real host. Shared across tests, like `../netbox/fake-netbox.ts`. */
+export declare const FAKE_BASE = "https://litellm.example.com";
 export interface FakeRequest {
     readonly method: string;
     readonly path: string;
 }
 export interface FakeLitellm {
-    readonly url: string;
+    readonly fetch: typeof globalThis.fetch;
     readonly rows: () => readonly PassThroughGenericEndpoint[];
     readonly requests: () => readonly FakeRequest[];
-    readonly stop: () => void;
 }
 export declare const startFakeLitellm: (options?: {
     readonly masterKey?: string;

package/dist/litellm/fake-litellm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-litellm.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-litellm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAE9E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,0BAA0B,EAAE,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,SAAS,WAAW,EAAE,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;CAC3B;AAKD,eAAO,MAAM,gBAAgB,aAAc;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,qGAAqG;IACrG,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC,KAAG,WA2EH,CAAC"}
+{"version":3,"file":"fake-litellm.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-litellm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,sGAAsG;AACtG,eAAO,MAAM,SAAS,gCAAgC,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,0BAA0B,EAAE,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,SAAS,WAAW,EAAE,CAAC;CACjD;AAQD,eAAO,MAAM,gBAAgB,aAAc;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,qGAAqG;IACrG,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC,KAAG,WAiEH,CAAC"}

package/dist/litellm/fake-stack.d.ts

@@ -1,5 +1,4 @@
 import * as Effect from 'effect/Effect';
-import { type LitellmCreds } from './credentials.ts';
 /** The planned action for each resource, deletions included, keyed by FQN. */
 export type Planned = Readonly<Record<string, string>>;
 /** A stack body: resource declarations, as an `alchemy.run.ts` would write them. */
@@ -15,13 +14,19 @@ export interface FakeStack {
 /**
  * ⚠️ CREDENTIALS/HTTPCLIENT ARE PROVIDED AROUND `deploy`, NOT BAKED INTO THE PROVIDER LAYER.
  *   `Provider.effect`'s own construction effect is `Effect.succeed(...)` (pass-through-endpoint.ts)
- *   — it never actually reads `LitellmCredentials`/`HttpClient`; only the HANDLERS it returns do,
- *   and those run later, whenever `Apply.ts` calls `provider.reconcile`/`read`/`delete`. Effect
+ *   — it never actually reads `Credentials`/`HttpClient`; only the HANDLERS it returns do, and
+ *   those run later, whenever `Apply.ts` calls `provider.reconcile`/`read`/`delete`. Effect
  *   resolves a `yield*`'s service from whatever ambient context wraps the CALL SITE, so the layers
  *   those handlers need must wrap the whole plan+apply pipeline below, exactly where openbao's
  *   fake-stack.ts wraps `BaoEnv` around its own `deploy`.
+ * ★ `fetchFn` IS `startFakeLitellm(...).fetch` (fake-litellm.ts) — this harness never opens a real
+ *   socket; `FetchHttpClient.Fetch` is the seam the SDK's protocol layer calls through, same as
+ *   `../netbox/fake-netbox.ts`'s `fakeNetboxLayer`.
  */
-export declare const fakeStack: (creds: LitellmCreds, name?: string) => FakeStack;
+export declare const fakeStack: (creds: {
+    readonly apiKey: string;
+    readonly baseUrl: string;
+}, fetchFn: typeof globalThis.fetch, name?: string) => FakeStack;
 /** Every call that changed something, as `METHOD path`, in order. */
 export declare const writesOf: (requests: readonly {
     readonly method: string;

package/dist/litellm/fake-stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-stack.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-stack.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,KAAK,YAAY,EAA8B,MAAM,kBAAkB,CAAC;AAGjF,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvD,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF;AAiBD;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,UAAW,YAAY,oBAA8B,SAgC1E,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,QAAQ,aACT,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KACtE,MAAM,EACsF,CAAC"}
+{"version":3,"file":"fake-stack.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-stack.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvD,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF;AAiBD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,UACb;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,WACnD,OAAO,UAAU,CAAC,KAAK,oBAE/B,SAiCF,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,QAAQ,aACT,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KACtE,MAAM,EACsF,CAAC"}

package/dist/litellm/index.d.ts

@@ -2,12 +2,14 @@
  * LiteLLM providers for Alchemy.
  *
  * ⛔ THIS BARREL IS THE PUBLIC API, deliberately smaller than the directory — `fake-litellm.ts`
- *   and the internals `pass-through-form.ts`/`client.ts` need but a consumer should not depend on
- *   directly are not re-exported here (netbox/index.ts's own rule).
+ *   and the internals `pass-through-form.ts`/`operations.ts` need but a consumer should not depend
+ *   on directly are not re-exported here (netbox/index.ts's own rule).
+ * ★ CREDENTIALS AND TYPES NOW COME FROM `@distilled.cloud/litellm` ITSELF (2026-09-24, moved off a
+ *   hand-rolled `client.ts`/`credentials.ts` the same way `/netbox` and `/forgejo` did) — a
+ *   consumer building its own credentials layer imports `Credentials`/`CredentialsFromEnv`/
+ *   `credentials` from `@distilled.cloud/litellm/Credentials` directly, not through this barrel.
  */
-export { LITELLM_PROXY_API_KEY_ENV, LITELLM_PROXY_URL_ENV, LitellmCredentials, type LitellmCreds, LitellmCredentialsError, litellmCredentialsLayer, litellmCredentialsLayerFor, } from './credentials.ts';
-export { LITELLM_OPERATIONS, LitellmBadRequestError, type LitellmError, LitellmHttpError, type LitellmRequirements, LitellmTransportError, LitellmUnauthorizedError, } from './client.ts';
-export type { PassThroughEndpointResponse, PassThroughGenericEndpoint, PassThroughGuardrailSettings, } from './generated/pass-through.ts';
+export type { PassThroughEndpointResponse, PassThroughGenericEndpoint, PassThroughGuardrailSettings, } from '@distilled.cloud/litellm/misc';
 export { LiteLLMPassThroughEndpoint, LiteLLMPassThroughEndpointProvider, LitellmConfigPathConflictError, LitellmLiteralSecretHeaderError, LitellmUnaddressableRowError, isLiteLLMPassThroughEndpoint, type PassThroughEndpointAttributes, type PassThroughEndpointError, type PassThroughEndpointProps, } from './pass-through-endpoint.ts';
 export { litellmProviders } from './providers.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/litellm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/litellm/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,EAClB,KAAK,YAAY,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,EAClC,8BAA8B,EAC9B,+BAA+B,EAC/B,4BAA4B,EAC5B,4BAA4B,EAC5B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/litellm/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,YAAY,EACV,2BAA2B,EAC3B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,EAClC,8BAA8B,EAC9B,+BAA+B,EAC/B,4BAA4B,EAC5B,4BAA4B,EAC5B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC"}