@homeflare/alchemy 0.28.0 → 0.29.1

package/dist/github/repo-apply-order-fake-providers.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Fully in-memory `Provider.succeed(...)` fakes for `GitHub.Repository` and `RepositoryRuleset`
+ * — no octokit, no `GitHubCredentials`, no network. Unlike `repository-ruleset-fake-octokit.ts`
+ * (a fake HTTP client fed into the REAL provider's `reconcile`), these fakes replace the provider
+ * entirely, because what `declare-repo-baseline-apply-order.test.ts` and
+ * `repo-policy-apply-order.test.ts` measure is the ENGINE's own scheduling — which resource's
+ * `reconcile` runs first, and whether one's failure reaches the other — not GitHub's wire
+ * protocol. `Provider.succeed`'s runtime lookup (`tryFindProviderRegistrationByType`,
+ * `node_modules/alchemy/src/Provider.ts`) checks the INDIVIDUAL `Provider<R>` tag before falling
+ * back to a `GitHub.Providers` collection, so registering these two standalone providers is
+ * enough regardless of `GitHub.Repository`'s own declared `Providers` slot — the same shortcut
+ * `RepositoryRulesetProvider()` already relies on.
+ *
+ * ⚠️ NO LIVE NETWORK, EVER. Nothing here imports `octokit`/`GitHubCredentials`, so a test built
+ *   on this file cannot make a real GitHub call even by accident — required by this PR's own
+ *   "no live GitHub writes" rule.
+ *
+ * ⚠️ THE FAKE RULESET REFUSES A REPO THAT DOESN'T EXIST YET, ON PURPOSE — mirroring GitHub's own
+ *   `POST /repos/{owner}/{repo}/rulesets`, which 404s on a repo that hasn't been created. A first
+ *   ADVERSARIAL REVIEW pass (2026-09-24) on this PR found that the ordering fix forces the
+ *   ruleset to apply before the repository whenever auto-merge turns on — safe for an UPDATE
+ *   (the repo already exists), but a real hazard for a repo+ruleset created together for the
+ *   FIRST time with checks set from day one, and the original version of this fake modeled no
+ *   such constraint, so its own tests could not have caught that regression. It now can — see
+ *   `declare-repo-baseline-apply-order.test.ts`'s "a repo and ruleset created together" test.
+ */
+import * as GitHub from 'alchemy/GitHub';
+import * as Provider from 'alchemy/Provider';
+import * as Layer from 'effect/Layer';
+import { RepositoryRuleset } from './repository-ruleset.ts';
+/** One resource type's name, in the order its fake `reconcile` was actually invoked. */
+export type CallLog = ('repository' | 'ruleset')[];
+export interface World {
+    readonly calls: CallLog;
+    /** `owner/name` of every repository the fake repository provider has reconciled at least
+     * once — what the fake ruleset provider checks before allowing a create. */
+    readonly liveRepositories: Set<string>;
+    /** Set before `deploy` to make the ruleset's `reconcile` fail instead of succeeding, even
+     * against a repository already in `liveRepositories`. */
+    rulesetShouldFail: boolean;
+    /** `news.allowAutoMerge` as the repository's fake `reconcile` last observed it — `undefined`
+     * until (unless) the repository's `reconcile` actually runs. */
+    repositoryAllowAutoMerge: boolean | undefined;
+}
+export declare const makeWorld: () => World;
+/** Both fakes, merged — everything `declareRepoBaseline`/`declareRepoPolicy` need. */
+export declare const fakeGithubProviders: (world: World) => Layer.Layer<Provider.Provider<GitHub.Repository> | Provider.Provider<RepositoryRuleset>, never, never>;
+//# sourceMappingURL=repo-apply-order-fake-providers.d.ts.map

package/dist/github/repo-apply-order-fake-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-apply-order-fake-providers.d.ts","sourceRoot":"","sources":["../../src/github/repo-apply-order-fake-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAA+B,MAAM,yBAAyB,CAAC;AAEzF,wFAAwF;AACxF,MAAM,MAAM,OAAO,GAAG,CAAC,YAAY,GAAG,SAAS,CAAC,EAAE,CAAC;AAEnD,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;gFAC4E;IAC5E,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC;6DACyD;IACzD,iBAAiB,EAAE,OAAO,CAAC;IAC3B;oEACgE;IAChE,wBAAwB,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/C;AAED,eAAO,MAAM,SAAS,QAAO,KAK3B,CAAC;AA+DH,sFAAsF;AACtF,eAAO,MAAM,mBAAmB,UAAW,KAAK,2GAC2B,CAAC"}

package/dist/github/repo-apply-order-fake-stack.d.ts

@@ -0,0 +1,13 @@
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+export type Planned = Readonly<Record<string, string>>;
+export type StackBody = Effect.Effect<unknown, unknown, unknown>;
+export type DeployOptions = {
+    readonly adopt?: boolean;
+};
+export interface FakeStack {
+    /** Plan, then apply, `body`. Resolves to the plan; rejects with the apply's failure. */
+    readonly deploy: (body: StackBody, options?: DeployOptions) => Promise<Planned>;
+}
+export declare const fakeStack: <ROut, E, RIn>(providers: Layer.Layer<ROut, E, RIn>, name?: string) => FakeStack;
+//# sourceMappingURL=repo-apply-order-fake-stack.d.ts.map

package/dist/github/repo-apply-order-fake-stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-apply-order-fake-stack.d.ts","sourceRoot":"","sources":["../../src/github/repo-apply-order-fake-stack.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACvD,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF;AAiBD,eAAO,MAAM,SAAS,GAAI,IAAI,EAAE,CAAC,EAAE,GAAG,aACzB,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,oBAEnC,SA6BF,CAAC"}

package/dist/github/repo-auto-merge-gate.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `gateAutoMergeOnRuleset` — the one place `declareRepoBaseline` and `declareRepoPolicy` thread
+ * a real apply-ordering edge from `GitHub.Repository`'s `allowAutoMerge` to the sibling
+ * `RepositoryRuleset`, so a deploy can never turn auto-merge on before the ruleset's required
+ * checks/approvals are actually live.
+ *
+ * ⛔ K5 (kit PR 216, 2026-09-24): both callers declare `GitHub.Repository` and `RepositoryRuleset`
+ *   as two INDEPENDENT resources with no dependency edge between them. When a repo moves from
+ *   `checks:[]` to `checks:['x']`, `allowAutoMerge` flips to `true` in the very same deploy that
+ *   adds the required check. If the Repository apply lands before the Ruleset apply — or the
+ *   Ruleset apply fails outright — the repo ends up with auto-merge on and nothing required: `gh
+ *   pr merge --auto` merges a CLEAN pull request immediately (memory `gh-auto-merge-merges-now`).
+ *   That fail-open state is exactly what K5 exists to prevent.
+ *
+ * ★ THE MECHANISM — ALCHEMY ORDERS BY OUTPUT REFERENCES IN PROPS, NOT DECLARATION ORDER.
+ *   `Plan.ts` (~l.1031-1038): a resource's upstream deps are `Output.upstreamAny(resource.Props)`.
+ *   `Apply.ts` (~l.760-762, ~l.909): `waitForDeps(allUpstreamFqns())` — built the same way from
+ *   `Output.resolveUpstream(node.props)` — runs before `reconcile`. See the kit's own
+ *   `alchemy-output-refs-order-resources` memory. `GitHub.Repository`'s upstream `RepositoryProps`
+ *   has no spare field: `reconcile` (`node_modules/alchemy/src/GitHub/Repository.ts`) sends every
+ *   declared prop straight to Octokit's create/update calls, so there is nothing to smuggle an
+ *   unrelated Output into. `allowAutoMerge` itself is the vehicle instead: its value is still
+ *   exactly `true` whenever this function is called with it already `true` — only now computed
+ *   AFTER `ruleset.rulesetId` resolves via `Output.map`, instead of written as a literal. That
+ *   single Output reference is enough for `Output.upstreamAny` to record the ruleset as this
+ *   Repository's upstream dependency, so the engine applies the ruleset first.
+ *
+ * ★ WHY THIS NEEDS NO REVERSE-DIRECTION EDGE. The opposite transition — checks/approvals
+ *   REMOVED, so `allowAutoMerge` turns off — cannot silently race the other way. Neither caller
+ *   ever declares `rules.requiredStatusChecks: false` or omits `rules.pullRequest` on purpose;
+ *   dropping `checks`/`requiredApprovals` from the options just OMITS the corresponding rule key.
+ *   `requiredChecksOmissionRefusal` and `undeclaredLiveRuleRefusal` (repository-ruleset-guards.ts)
+ *   both refuse — unconditionally, regardless of apply order — to drop a rule that is still LIVE
+ *   by omission. So the worst reachable state, whichever resource applies first, is: Repository
+ *   succeeds (auto-merge off, the correct direction anyway) and Ruleset refuses (the live rule
+ *   stays required) — never fail-open. Proved by the ordering/failure tests beside this file.
+ */
+import * as Output from 'alchemy/Output';
+/** The one attribute this gate needs from a declared `RepositoryRuleset`. */
+export interface AutoMergeGateSource {
+    readonly rulesetId: Output.Output<number, never>;
+}
+/**
+ * Returns `settings` unchanged when `allowAutoMerge` is falsy — nothing to gate, and every
+ * existing declaration with auto-merge off keeps its exact prior props (no diff, no replan).
+ * Otherwise returns `settings` with `allowAutoMerge` recomputed as an Output.map over
+ * `ruleset.rulesetId` — still resolves to `true`, now with a real dependency edge attached.
+ */
+export declare function gateAutoMergeOnRuleset<P extends {
+    readonly allowAutoMerge?: boolean;
+}>(settings: P, ruleset: AutoMergeGateSource): P | (Omit<P, 'allowAutoMerge'> & {
+    readonly allowAutoMerge: Output.Output<boolean, never>;
+});
+//# sourceMappingURL=repo-auto-merge-gate.d.ts.map

package/dist/github/repo-auto-merge-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-auto-merge-gate.d.ts","sourceRoot":"","sources":["../../src/github/repo-auto-merge-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,EACpF,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,mBAAmB,GAC3B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,gBAAgB,CAAC,GAAG;IAAE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;CAAE,CAAC,CAG9F"}

package/dist/github/repo-baseline-data.d.ts

@@ -19,7 +19,16 @@ export interface RepoBaselineInput {
 }
 /** `GitHub.Repository` fields this baseline owns. Every merge-automation caller across the 17
  * tray checkouts uses `--squash` (measured 2026-09-23; the only non-squash mentions are
- * GitLab-era comments in cliff.toml), so squash-only is not a per-repo choice. */
+ * GitLab-era comments in cliff.toml), so squash-only is not a per-repo choice.
+ *
+ * ⛔ K5 (2026-09-24): `allowAutoMerge` FOLLOWS `checks.length`, NOT A HARDCODED `true`. `gh pr
+ *   merge --auto` (and the ruleset's own auto-merge) is a queue only while something is
+ *   outstanding — with zero required status checks there is nothing to wait for, so GitHub
+ *   merges a CLEAN pull request on the spot, with no review and no green run. This is the same
+ *   failure `repo-policy-guards.ts`'s `assertAutoMergeWaits` refuses on the sibling `repoPolicy`
+ *   path (five doors to the same "nothing outstanding" state); this baseline has no `autoMerge`
+ *   opt-out prop to refuse WITH, so the fix here is unconditional rather than a thrown refusal —
+ *   a repo with an empty `checks` list simply never gets auto-merge turned on by this baseline. */
 export declare function repoBaselineSettings(input: RepoBaselineInput): {
     owner: string;
     name: string;

package/dist/github/repo-baseline-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-baseline-data.d.ts","sourceRoot":"","sources":["../../src/github/repo-baseline-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;kFAEkF;AAClF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB;;;;;;;;;;;EAa5D;AAED;;mGAEmG;AACnG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB;;;;YAKhD,QAAQ;iBACH,QAAQ;;;QAEP,OAAO;QAAuB,OAAO;;;;;;YAK/C,4BAA4B;YAC5B,yBAAyB;YACzB,sBAAsB;YACtB,uBAAuB;YACvB,8BAA8B;YAC9B,mBAAmB;YACnB,mCAAmC;;;YAM7B,MAAM;;;YACN,gCAAgC;YAChC,oBAAoB;;;EAKjC;AAED;;;cAGc;AACd,eAAO,MAAM,wBAAwB,YACnC,0BAA0B,EAC1B,0CAA0C,EAC1C,0CAA0C,EAC1C,6CAA6C,CACrC,CAAC"}
+{"version":3,"file":"repo-baseline-data.d.ts","sourceRoot":"","sources":["../../src/github/repo-baseline-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;mGAWmG;AACnG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB;;;;;;;;;;;EAa5D;AAED;;mGAEmG;AACnG,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB;;;;YAKhD,QAAQ;iBACH,QAAQ;;;QAEP,OAAO;QAAuB,OAAO;;;;;;YAK/C,4BAA4B;YAC5B,yBAAyB;YACzB,sBAAsB;YACtB,uBAAuB;YACvB,8BAA8B;YAC9B,mBAAmB;YACnB,mCAAmC;;;YAM7B,MAAM;;;YACN,gCAAgC;YAChC,oBAAoB;;;EAKjC;AAED;;;cAGc;AACd,eAAO,MAAM,wBAAwB,YACnC,0BAA0B,EAC1B,0CAA0C,EAC1C,0CAA0C,EAC1C,6CAA6C,CACrC,CAAC"}

package/dist/github/repo-policy.d.ts

@@ -17,5 +17,5 @@ export declare const declareRepoPolicy: (id: string, options: DeclareRepoPolicyO
     policy: import("./repo-policy-form.ts").RepoPolicy;
     repository: GitHub.Repository;
     ruleset: RepositoryRuleset;
-}, Error, GitHub.GitHubCredentials | GitHub.Providers>;
+}, Error, import("alchemy").Provider<RepositoryRuleset> | GitHub.Providers>;
 //# sourceMappingURL=repo-policy.d.ts.map

package/dist/github/repo-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo-policy.d.ts","sourceRoot":"","sources":["../../src/github/repo-policy.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,OAAQ,MAAM,WAAW,wBAAwB;;;;sDAkB3E,CAAC"}
+{"version":3,"file":"repo-policy.d.ts","sourceRoot":"","sources":["../../src/github/repo-policy.ts"],"names":[],"mappings":"AA4CA,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AAEzC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE;;;OAGG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,OAAQ,MAAM,WAAW,wBAAwB;;;;2EA6B3E,CAAC"}

package/dist/github/repository-ruleset-errors.d.ts

@@ -90,8 +90,9 @@ export declare class RequiredChecksOmitted extends RequiredChecksOmitted_base<{
 declare const NeverReportedContext_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "NeverReportedContext";
 } & Readonly<A>;
-/** A context being ADDED to `requiredStatusChecks` has never reported success on the default
- * branch. Requiring it would leave every future pull request pending forever. */
+/** A context being ADDED to `requiredStatusChecks` has never reported success anywhere this
+ * family looks (the default branch's tip, then recent merged PR heads — K2, bounded, not full
+ * history). Requiring it would leave every future pull request pending forever. */
 export declare class NeverReportedContext extends NeverReportedContext_base<{
     readonly owner: string;
     readonly repository: string;

package/dist/github/repository-ruleset-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-errors.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-errors.ts"],"names":[],"mappings":";;;AAQA;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;6EAC6E;AAC7E,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;;;6CAK6C;AAC7C,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;cAIc;AACd,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;6FAC6F;AAC7F,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;iFACiF;AACjF,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;4FAC4F;AAC5F,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;kGACkG;AAClG,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;AAED,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,YAAY,GACZ,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,gBAAgB,CAAC"}
+{"version":3,"file":"repository-ruleset-errors.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-errors.ts"],"names":[],"mappings":";;;AAQA;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;6EAC6E;AAC7E,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;;;6CAK6C;AAC7C,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;cAIc;AACd,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,kBAAmB,SAAQ,wBAAuC;IAC7E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;6FAC6F;AAC7F,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;mFAEmF;AACnF,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;4FAC4F;AAC5F,qBAAa,wBAAyB,SAAQ,8BAA6C;IACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;kGACkG;AAClG,qBAAa,gBAAiB,SAAQ,sBAAqC;IACzE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;AAED,MAAM,MAAM,sBAAsB,GAC9B,gBAAgB,GAChB,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,YAAY,GACZ,qBAAqB,GACrB,oBAAoB,GACpB,wBAAwB,GACxB,gBAAgB,CAAC"}

package/dist/github/repository-ruleset-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-form.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,sBAAsB,EAEtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AA2DvF,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,SAAS,GAAG,QAAQ,EAAE,CAmCpF;AAED;0BAC0B;AAC1B,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CAqBnF;AA+CD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAiB/D"}
+{"version":3,"file":"repository-ruleset-form.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EACV,sBAAsB,EAEtB,sBAAsB,EAEvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AA+DvF,wBAAgB,cAAc,CAAC,KAAK,EAAE,sBAAsB,GAAG,SAAS,GAAG,QAAQ,EAAE,CAmCpF;AAED;0BAC0B;AAC1B,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CAqBnF;AA+CD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAiB/D"}

package/dist/github/repository-ruleset-guards.d.ts

@@ -76,7 +76,8 @@ export declare function requiredChecksOmissionRefusal(input: {
 /** Every context in the declared `requiredStatusChecks` that the LIVE ruleset does not already
  * require — i.e. being added by this plan, the only case a never-reported context can matter. */
 export declare const newlyRequiredContexts: (declared: RepositoryRulesetProps['rules'], live: RulesetRecord | undefined) => readonly string[];
-/** Fails on the first newly-required context that has never reported success on the default
- * branch — checked once here (reconcile's observe step) and again by the standalone checker. */
+/** Fails on the first newly-required context that has never reported success anywhere this
+ * family looks (the default branch's tip, then recent merged PR heads — K2) — checked once here
+ * (reconcile's observe step) and again by the standalone checker. */
 export declare const refuseUnreportedContexts: <R = never>(octokit: RulesetOctokit<R>, owner: string, repo: string, contexts: readonly string[]) => Effect.Effect<void, NeverReportedContext | Error, R>;
 //# sourceMappingURL=repository-ruleset-guards.d.ts.map

package/dist/github/repository-ruleset-guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-guards.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-guards.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnF;;aAEa;AACb,eAAO,MAAM,SAAS,MAAO;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,WACF,CAAC;AAE7F;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;6EAE6E;AAC7E,eAAO,MAAM,aAAa,SAAU,aAAa,GAAG,SAAS,KAAG,GAAG,CAAC,MAAM,CACjB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;wFAEwF;AACxF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAgB7F;AAED;6FAC6F;AAC7F,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,qBAAqB,GAAG,SAAS,CAcpC;AAED;iGACiG;AACjG,eAAO,MAAM,qBAAqB,aACtB,sBAAsB,CAAC,OAAO,CAAC,QACnC,aAAa,GAAG,SAAS,KAC9B,SAAS,MAAM,EAWjB,CAAC;AAEF;gGACgG;AAChG,eAAO,MAAM,wBAAwB,GAAI,CAAC,GAAG,KAAK,WACvC,cAAc,CAAC,CAAC,CAAC,SACnB,MAAM,QACP,MAAM,YACF,SAAS,MAAM,EAAE,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,GAAG,KAAK,EAAE,CAAC,CAQlD,CAAC"}
+{"version":3,"file":"repository-ruleset-guards.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-guards.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEtE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAEnF;;aAEa;AACb,eAAO,MAAM,SAAS,MAAO;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,WACF,CAAC;AAE7F;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,cAAc,CAAC,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;6EAE6E;AAC7E,eAAO,MAAM,aAAa,SAAU,aAAa,GAAG,SAAS,KAAG,GAAG,CAAC,MAAM,CACjB,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC7C,GAAG,kBAAkB,GAAG,SAAS,CAyBjC;AAED;;wFAEwF;AACxF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAgB7F;AAED;6FAC6F;AAC7F,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C,GAAG,qBAAqB,GAAG,SAAS,CAcpC;AAED;iGACiG;AACjG,eAAO,MAAM,qBAAqB,aACtB,sBAAsB,CAAC,OAAO,CAAC,QACnC,aAAa,GAAG,SAAS,KAC9B,SAAS,MAAM,EAWjB,CAAC;AAEF;;qEAEqE;AACrE,eAAO,MAAM,wBAAwB,GAAI,CAAC,GAAG,KAAK,WACvC,cAAc,CAAC,CAAC,CAAC,SACnB,MAAM,QACP,MAAM,YACF,SAAS,MAAM,EAAE,KAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,oBAAoB,GAAG,KAAK,EAAE,CAAC,CAQlD,CAAC"}

package/dist/github/repository-ruleset-octokit.d.ts

@@ -1,5 +1,54 @@
+/**
+ * The real {@link RulesetOctokit} — every wire call this family makes, built from the EXPORTED
+ * `GitHubCredentials` service via `creds.octokit()`, exactly upstream's own `octokitFor` does
+ * (`node_modules/alchemy/src/GitHub/Octokit.ts`). H15: Octokit, not `@distilled.cloud/github`
+ * — its `S.Struct` request schemas have no field for `require_extra_approval_for_unattributed_
+ * changes` and would very likely strip an unknown key on encode; Octokit's REST methods hand
+ * their `parameters` object to `@octokit/endpoint` mostly as-is, so an extra JSON body key
+ * should reach the wire. repository-ruleset-wire.test.ts MEASURES this against a real Octokit
+ * instance with a fetch shim rather than asserting it from reading the source.
+ *
+ * ★ K2 (2026-09-24): "REPORTED SUCCESS" IS THE DEFAULT BRANCH'S TIP, THEN RECENT MERGED PR
+ *   HEADS — NOT FULL HISTORY. The rendered CI (`packages/config/src/repo-shape/ci.ts`) triggers
+ *   on `pull_request` ONLY, deliberately (measured 2026-09-15..22: 613 of 619 main-push runs
+ *   duplicated an already-green PR run, ~41% of the mini's CI load) — so `ci`/`secret scan`/
+ *   `CodeQL` NEVER report on the default branch's tip itself, only on PR heads. Checking the tip
+ *   alone therefore refused adding any of them everywhere, including homeflare-builds' pending
+ *   first ruleset. `contextReportedSuccess` now falls back to `recentMergedHeadShas` — bounded
+ *   (`RECENT_MERGED_PR_LIMIT` heads, from one `per_page`-bounded list call, never the repo's
+ *   full PR history) — so a context that only ever reports on PR heads is no longer refused
+ *   everywhere, while a context that has never reported ANYWHERE (not the tip, not any recent
+ *   merged head) still is: `NeverReportedContext`'s whole purpose survives unchanged.
+ * ⚠️ Still not full history: a context whose only successful run predates
+ *   `RECENT_MERGED_PR_LIMIT` merges ago reads as never-reported until it runs again. Widening
+ *   the bound trades this guard's cost (more vendor calls per newly-required context) against
+ *   its reach; `RECENT_MERGED_PR_LIMIT` is a deliberate, named number for exactly that reason,
+ *   not a magic constant.
+ */
+import type { Octokit as OctokitClient } from '@octokit/rest';
 import { GitHubCredentials } from 'alchemy/GitHub';
+import * as Effect from 'effect/Effect';
 import type { RulesetOctokit } from './repository-ruleset-probe.ts';
 export type RealRulesetOctokit = RulesetOctokit<GitHubCredentials>;
+/** How many of the most-recently-updated MERGED pull requests' head SHAs to check, once the
+ * default branch's own tip has no reported success — see the file header (K2). */
+export declare const RECENT_MERGED_PR_LIMIT = 10;
+/** Whether `context` reported success for a single ref — a branch tip or a PR head SHA, both
+ * checked the same way (checks + statuses, exactly as GitHub's own UI does). Takes a plain
+ * `OctokitClient`, not an Effect service, so it and its caller below are testable directly
+ * against a real `@octokit/rest` instance with a fetch shim (repository-ruleset-octokit.test.ts)
+ * — no `GitHubCredentials` layer needed, mirroring `desiredWireRuleset`'s pure-function seam. */
+export declare const hasRefReportedSuccess: (octokit: OctokitClient, owner: string, repo: string, ref: string, context: string) => Effect.Effect<boolean, Error>;
+/** The head SHAs of up to `RECENT_MERGED_PR_LIMIT` most-recently-updated MERGED pull requests
+ * against `base` — one bounded list call (`RECENT_CLOSED_PR_PAGE_SIZE` closed PRs), filtered to
+ * merged, then capped. Never paginates further: a repo whose last `RECENT_MERGED_PR_LIMIT`
+ * merges are all older than its last `RECENT_CLOSED_PR_PAGE_SIZE` closed PRs simply yields fewer
+ * than the limit, same as a repo with too little history — both are the "still refused" case. */
+export declare const recentMergedHeadShas: (octokit: OctokitClient, owner: string, repo: string, base: string) => Effect.Effect<readonly string[], Error>;
+/** The full K2 answer: the default branch's tip, then (only if the tip has no success) up to
+ * `RECENT_MERGED_PR_LIMIT` recent merged PR heads, short-circuiting on the first success. `false`
+ * only once every one of those has been checked and none reported — the case
+ * `NeverReportedContext` exists to refuse. */
+export declare const contextReportedSuccess: (octokit: OctokitClient, owner: string, repo: string, context: string) => Effect.Effect<boolean, Error>;
 export declare const makeRulesetOctokit: (baseUrl: string | undefined) => RealRulesetOctokit;
 //# sourceMappingURL=repository-ruleset-octokit.d.ts.map

package/dist/github/repository-ruleset-octokit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-octokit.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-octokit.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAGnD,OAAO,KAAK,EAAE,cAAc,EAAiC,MAAM,+BAA+B,CAAC;AAEnG,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;AAcnE,eAAO,MAAM,kBAAkB,YAAa,MAAM,GAAG,SAAS,KAAG,kBAoG/D,CAAC"}
+{"version":3,"file":"repository-ruleset-octokit.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-octokit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,EAAE,OAAO,IAAI,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAiC,MAAM,+BAA+B,CAAC;AAEnG,MAAM,MAAM,kBAAkB,GAAG,cAAc,CAAC,iBAAiB,CAAC,CAAC;AAcnE;kFACkF;AAClF,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAczC;;;;iGAIiG;AACjG,eAAO,MAAM,qBAAqB,YACvB,aAAa,SACf,MAAM,QACP,MAAM,OACP,MAAM,WACF,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAmB3B,CAAC;AAEL;;;;iGAIiG;AACjG,eAAO,MAAM,oBAAoB,YACtB,aAAa,SACf,MAAM,QACP,MAAM,QACN,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,EAAE,KAAK,CAmBrC,CAAC;AAEL;;;8CAG8C;AAC9C,eAAO,MAAM,sBAAsB,YACxB,aAAa,SACf,MAAM,QACP,MAAM,WACH,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAc3B,CAAC;AAEL,eAAO,MAAM,kBAAkB,YAAa,MAAM,GAAG,SAAS,KAAG,kBA+E/D,CAAC"}

package/dist/github/repository-ruleset-probe.d.ts

@@ -64,7 +64,8 @@ export interface RulesetOctokit<R = never> {
         readonly repo: string;
         readonly rulesetId: number;
     }) => Effect.Effect<void, Error, R>;
-    /** Whether `context` has ever reported success against the repository's default branch —
+    /** Whether `context` has reported success against the repository's default branch tip OR a
+     * recent merged PR head (K2, bounded — see repository-ruleset-octokit.ts's file header) —
      * backs the `NeverReportedContext` guard. */
     readonly hasContextReportedSuccess: (input: {
         readonly owner: string;

package/dist/github/repository-ruleset-probe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-probe.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMlE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;wFAIwF;AACxF,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,KAAK;IACvC;sFACkF;IAClF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpC;iDAC6C;IAC7C,QAAQ,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE;QAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,GAAG,KAAK,WAC1B,cAAc,CAAC,CAAC,CAAC,SACnB;IACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,KACA,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAAC,CAmBnE,CAAC"}
+{"version":3,"file":"repository-ruleset-probe.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAMlE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;wFAIwF;AACxF,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,KAAK;IACvC;sFACkF;IAClF,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAClC,KAAK,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7C,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;KAC5B,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACpC;;iDAE6C;IAC7C,QAAQ,CAAC,yBAAyB,EAAE,CAAC,KAAK,EAAE;QAC1C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;CACxC;AAED;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,GAAG,KAAK,WAC1B,cAAc,CAAC,CAAC,CAAC,SACnB;IACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,KACA,MAAM,CAAC,MAAM,CAAC,aAAa,GAAG,SAAS,EAAE,gBAAgB,GAAG,KAAK,EAAE,CAAC,CAmBnE,CAAC"}

package/dist/github/repository-ruleset-props.d.ts

@@ -16,10 +16,13 @@ export interface RepositoryRulesetPullRequestRule extends NonNullable<UpstreamRu
     /** @default every method GitHub allows — the house baseline always pins `['squash']`. */
     readonly allowedMergeMethods?: readonly ('merge' | 'squash' | 'rebase')[];
     readonly requiredReviewers?: readonly RepositoryRulesetReviewerRule[];
-    /** `require_extra_approval_for_unattributed_changes` — see repository-ruleset.ts's H15. Only
-     * `false` is modeled: sending `true` has no house use, and GitHub already defaults absent to
-     * `true`. */
-    readonly extraApprovalForUnattributedChanges?: false;
+    /** `require_extra_approval_for_unattributed_changes` — see repository-ruleset.ts's H15.
+     * Both values are modeled (K1, 2026-09-23): 8 live rulesets carry `true` (aop, cloudflareforms,
+     * doesthishelp-workeropen, homeflare-anyauth, homeflare-desktop, loggarr, magictransit,
+     * proxmox-tb4 — re-read live via `gh api repos/taslabs-net/<repo>/rulesets/<id>`,
+     * 2026-09-23), and this resource declares exactly what is live or it cannot adopt them —
+     * `undefined` stays "no opinion" (GitHub defaults an absent key to `true`). */
+    readonly extraApprovalForUnattributedChanges?: boolean;
 }
 export interface RepositoryRulesetStatusChecksRule extends NonNullable<UpstreamRules['requiredStatusChecks']> {
     readonly doNotEnforceOnCreate?: boolean;

package/dist/github/repository-ruleset-props.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset-props.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-props.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,gCAAiC,SAAQ,WAAW,CACnE,aAAa,CAAC,aAAa,CAAC,CAC7B;IACC,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACtE;;iBAEa;IACb,QAAQ,CAAC,mCAAmC,CAAC,EAAE,KAAK,CAAC;CACtD;AAED,MAAM,WAAW,iCAAkC,SAAQ,WAAW,CACpE,aAAa,CAAC,sBAAsB,CAAC,CACtC;IACC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAClD,aAAa,EACb,aAAa,GAAG,sBAAsB,CACvC;IACC;;;;;;;;;;gGAU4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,gCAAgC,GAAG,KAAK,CAAC;IAChE;2FACuF;IACvF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,iCAAiC,GAAG,KAAK,CAAC;CAC3E;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC;IACxC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}
+{"version":3,"file":"repository-ruleset-props.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-props.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,KAAK,aAAa,GAAG,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;AAExD,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CAC7E;AAED,MAAM,WAAW,gCAAiC,SAAQ,WAAW,CACnE,aAAa,CAAC,aAAa,CAAC,CAC7B;IACC,yFAAyF;IACzF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACtE;;;;;mFAK+E;IAC/E,QAAQ,CAAC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CACxD;AAED,MAAM,WAAW,iCAAkC,SAAQ,WAAW,CACpE,aAAa,CAAC,sBAAsB,CAAC,CACtC;IACC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAClD,aAAa,EACb,aAAa,GAAG,sBAAsB,CACvC;IACC;;;;;;;;;;gGAU4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE,gCAAgC,GAAG,KAAK,CAAC;IAChE;2FACuF;IACvF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,iCAAiC,GAAG,KAAK,CAAC;CAC3E;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC;IACxC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE;;;;;;;OAOG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACjE"}

package/dist/github/repository-ruleset-providers.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `repoPolicyProviders` — the documented stack wiring for `RepositoryRuleset` (directly, or
+ * through `declareRepoPolicy` / `declareRepoBaseline`): `GitHub.providers()` and
+ * `RepositoryRulesetProvider()`, composed so the whole thing typechecks and needs nothing
+ * further from the stack.
+ *
+ *     providers: repoPolicyProviders()
+ *
+ * ⛔ WHY THIS EXISTS — MEASURED 2026-09-24 (homeflare-builds bump PR 6, tsc). Writing the two
+ *   providers side by side, `Layer.mergeAll(GitHub.providers(), RepositoryRulesetProvider())`,
+ *   type-errors: `RepositoryRulesetProvider()`'s handlers call `octokitFor`, which needs
+ *   `GitHubCredentials` — a requirement of the PROVIDER's layer, correctly inferred by
+ *   `Provider.succeed` from `repositoryRulesetHandlers` in repository-ruleset.ts. Merging two
+ *   layers does not thread one's output into the other's requirement; `RepositoryRulesetProvider()`
+ *   still needs `GitHubCredentials` fed in. `GitHub.providers()` is the only thing here that
+ *   resolves credentials (env, stored PAT, `gh` CLI, or OAuth — see `alchemy/src/GitHub/
+ *   Providers.ts`), and — because it chains `Layer.provideMerge(Credentials.fromAuthProvider(…))`
+ *   internally rather than `Layer.provide` — its own OUTPUT includes `GitHubCredentials`
+ *   alongside `GitHub.Providers`. `Layer.provideMerge(github)` on `RepositoryRulesetProvider()`
+ *   both supplies that requirement AND keeps `github`'s own output merged in for any
+ *   `GitHub.Repository`/`GitHub.Ruleset` the caller also declares. `github` is built once and
+ *   referenced twice below — Effect's layer memoization (by reference) builds it once, not
+ *   twice, not twice against the auth provider either.
+ *
+ * ★ THIS IS ONLY HALF OF 2026-09-24's FIX. The other half — `RepositoryRuleset`'s own `Resource<>`
+ *   declaration no longer naming `GitHubCredentials` in its 5th (`Providers`) slot — lives in
+ *   repository-ruleset.ts's file header; that half is what let a stack BODY calling
+ *   `declareRepoPolicy`/`declareRepoBaseline` typecheck at all. Composing the providers
+ *   correctly, as this function does, does not by itself fix a body that still requires
+ *   `GitHubCredentials` directly.
+ *
+ * ⚠️ DON'T ALSO MERGE A SEPARATE `GitHub.providers()` CALL IN. `github` here is one Layer
+ *   object referenced twice, which Effect's layer memoization (by reference, ADVERSARIAL
+ *   REVIEW 2026-09-24: confirmed against `effect@4.0.0-rc.115`'s own `MemoMap`) builds once. A
+ *   stack that ALSO writes its own `GitHub.providers()` alongside this function's result is a
+ *   second, distinct Layer object — a genuine second credential resolution, not shared with
+ *   this one. Get every GitHub resource's providers from this one call.
+ */
+import * as GitHub from 'alchemy/GitHub';
+import * as Layer from 'effect/Layer';
+export declare const repoPolicyProviders: (options?: GitHub.ProvidersOptions) => Layer.Layer<import("alchemy/Auth/Credentials").CredentialsStore | GitHub.GitHubCredentials | import("alchemy/Auth/Profile").ProfileStore | import("alchemy").Provider<import("./repository-ruleset.ts").RepositoryRuleset> | GitHub.Providers, never, import("alchemy").AuthProviders | import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
+//# sourceMappingURL=repository-ruleset-providers.d.ts.map

package/dist/github/repository-ruleset-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-ruleset-providers.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,OAAO,KAAK,MAAM,MAAM,gBAAgB,CAAC;AACzC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,eAAO,MAAM,mBAAmB,aAAc,MAAM,CAAC,gBAAgB,6aAGpE,CAAC"}

package/dist/github/repository-ruleset.d.ts

@@ -38,9 +38,31 @@
  *   meant to allow. `octokitFor`/`GitHubCredentials` are upstream's own EXPORTED building
  *   blocks (S23's second clause: reuse Alchemy's own client construction), so the client itself
  *   is not hand-rolled — only the choice of Octokit over distilled is a recorded divergence.
+ *
+ * ⛔ CREDENTIALS BELONG TO THE PROVIDER'S LAYER, NOT THE RESOURCE'S DECLARATION — MEASURED
+ *   2026-09-24 (homeflare-builds bump PR 6, tsc TS2345). The `Resource<Type, Props, Attributes,
+ *   Binding, Providers>` 5th type parameter had `GitHubCredentials` here; that puts the
+ *   credential requirement on every `yield* RepositoryRuleset(...)` CALL SITE (see
+ *   `alchemy/src/Resource.ts#ResourceClass`: `Req = R["Providers"] extends undefined ?
+ *   Provider<R> : R["Providers"]`), so a STACK BODY that merely declares the resource would
+ *   itself need `GitHubCredentials` in its own effect context — which a stack body cannot
+ *   produce (`Alchemy.Stack`'s own type, `alchemy/src/Stack.ts#ProviderServices`, is a closed
+ *   union of tagged marker interfaces — `ProviderCollectionLike | Provider<any> |
+ *   EnvironmentLike | CredentialsLike | DockerLike` — and `GitHubCredentials` matches none of
+ *   them structurally). VERIFIED against upstream `Ruleset` (`node_modules/alchemy/src/GitHub/
+ *   Ruleset.ts`): its 5th slot is `GitHub.Providers`, the ProviderCollection tag `GitHub.
+ *   providers()` OUTPUTS — never the raw `GitHubCredentials` service upstream's OWN provider
+ *   handlers pull in via `octokitFor`. `GitHubCredentials` stays confined to the PROVIDER's
+ *   layer requirement (`Provider.succeed`'s inferred `ReadReq | DiffReq | ReconcileReq |
+ *   DeleteReq`, below), never the declaration's. Omitting the 5th parameter here defaults it to
+ *   `undefined`, so the declaration's own requirement becomes `Provider<RepositoryRuleset>` —
+ *   itself a `Provider<any>`, a real `ProviderServices` member — matching the pattern a
+ *   standalone (non-collection) resource actually needs. See `repoPolicyProviders()` in
+ *   repository-ruleset-providers.ts for the layer composition this now requires (the provider
+ *   still needs `GitHubCredentials` fed in — that half of the fix was already correct, per
+ *   `docs/repository-ruleset.md`).
  */
 import { Resource } from 'alchemy';
-import type { GitHubCredentials } from 'alchemy/GitHub';
 import * as Provider from 'alchemy/Provider';
 import { type RulesetRecord } from './repository-ruleset-probe.ts';
 import type { RepositoryRulesetProps } from './repository-ruleset-props.ts';
@@ -52,10 +74,10 @@ export interface RepositoryRulesetAttributes {
     readonly createdAt: string | undefined;
     readonly updatedAt: string | undefined;
 }
-export interface RepositoryRuleset extends Resource<'GitHub.RepositoryRuleset', RepositoryRulesetProps, RepositoryRulesetAttributes, never, GitHubCredentials> {
+export interface RepositoryRuleset extends Resource<'GitHub.RepositoryRuleset', RepositoryRulesetProps, RepositoryRulesetAttributes, never> {
 }
 export declare const RepositoryRuleset: import("alchemy").ResourceClass<RepositoryRuleset>;
 export declare const attrsOf: (r: RulesetRecord) => RepositoryRulesetAttributes;
-export declare const repositoryRulesetHandlers: Provider.ProviderService<RepositoryRuleset, GitHubCredentials, never, never, GitHubCredentials, GitHubCredentials, never, never, never>;
-export declare const RepositoryRulesetProvider: () => import("effect/Layer").Layer<Provider.Provider<RepositoryRuleset>, never, GitHubCredentials>;
+export declare const repositoryRulesetHandlers: Provider.ProviderService<RepositoryRuleset, import("alchemy/GitHub/Credentials").GitHubCredentials, never, never, import("alchemy/GitHub/Credentials").GitHubCredentials, import("alchemy/GitHub/Credentials").GitHubCredentials, never, never, never>;
+export declare const RepositoryRulesetProvider: () => import("effect/Layer").Layer<Provider.Provider<RepositoryRuleset>, never, import("alchemy/GitHub/Credentials").GitHubCredentials>;
 //# sourceMappingURL=repository-ruleset.d.ts.map

package/dist/github/repository-ruleset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository-ruleset.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAQ7C,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAG5E,YAAY,EACV,sBAAsB,EACtB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,OAAO,MAAO,aAAa,KAAG,2BAMzC,CAAC;AA4CH,eAAO,MAAM,yBAAyB,yIAkEpC,CAAC;AAEH,eAAO,MAAM,yBAAyB,oGAC0B,CAAC"}
+{"version":3,"file":"repository-ruleset.d.ts","sourceRoot":"","sources":["../../src/github/repository-ruleset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAQ7C,OAAO,EAAE,KAAK,aAAa,EAAe,MAAM,+BAA+B,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAG5E,YAAY,EACV,sBAAsB,EACtB,gCAAgC,EAChC,6BAA6B,EAC7B,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,CAIN;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,eAAO,MAAM,OAAO,MAAO,aAAa,KAAG,2BAMzC,CAAC;AA4CH,eAAO,MAAM,yBAAyB,wPAkEpC,CAAC;AAEH,eAAO,MAAM,yBAAyB,yIAC0B,CAAC"}

package/dist/litellm/fake-litellm.d.ts

@@ -1,31 +1,42 @@
 /**
- * A loopback `Bun.serve` fake of LiteLLM's `/config/pass_through_endpoint` routes — TEST ONLY,
- * never imported by `index.ts` (the netbox/proxmox house convention for test-only helpers).
+ * A fake of LiteLLM's `/config/pass_through_endpoint` routes for tests — TEST ONLY, never imported
+ * by `index.ts` (the netbox/forgejo house convention for test-only helpers). Mirrors
+ * `../netbox/fake-netbox.ts`/`../forgejo/fake-forgejo.ts`: a `fetch` function handed to Effect's
+ * real `FetchHttpClient` through its `Fetch` reference, so a test exercises distilled's REAL path
+ * assembly, JSON encode/decode and status→typed-error matching (`BadRequest`, `NotFound`, …) —
+ * nothing about that matching is re-implemented here, only the wire responses a scenario needs.
  *
  * ★ MODELS THE WHOLE-FIELD READ-MODIFY-WRITE ON PURPOSE. `general_settings.pass_through_endpoints`
- *   is ONE field (client.ts's header), so every mutation here reads the CURRENT row list, waits
- *   (so two concurrent requests can interleave), then writes back what it captured — not what is
- *   there by the time it writes. Two `create` calls that race lose one row, exactly like the
- *   vendor field would without the client's per-base-URL semaphore serialising them.
+ *   is ONE field (operations.ts's header), so every mutation here reads the CURRENT row list,
+ *   awaits (so two concurrent calls can interleave — no real socket needed, `fetch` is just an
+ *   async function the runtime awaits), then writes back what it captured — not what is there by
+ *   the time it writes. Two `create` calls that race lose one row, exactly like the vendor field
+ *   would without `operations.ts`'s per-base-URL semaphore serialising them.
  * ⚠️ WHAT THIS FAKE DOES NOT MODEL: PROXY_ADMIN vs. a lesser role for most routes (any correct
- *   bearer token is accepted); and update-of-a-missing-id, which is not measured at the tag — this
- *   fake 400s it, the same status a missing delete gets, as a documented TEST SIMPLIFICATION, not a
- *   vendor fact (docs/litellm.md says so too). `forbidDelete` is the one exception: it models the
- *   real asymmetry client.ts's header describes — `DELETE` routes through
- *   `update_config_general_settings`, which 400s `not_allowed_access` for a non-PROXY_ADMIN caller
- *   (or a disconnected DB) on a row that is genuinely still live, the SAME status a missing-id
- *   delete gets (proxy_server.py:16389-16416 at v1.100.0).
+ *   bearer token is accepted). `forbidDelete` is the one exception: it models the real asymmetry
+ *   `operations.ts`'s header describes — `DELETE` routes through `update_config_general_settings`,
+ *   which 400s `not_allowed_access` for a non-PROXY_ADMIN caller (or a disconnected DB) on a row
+ *   that is genuinely still live, the SAME status a missing-id delete gets (proxy_server.py:
+ *   16389-16416 at v1.100.0).
+ * ⚠️ UPDATE-OF-A-MISSING-ID IS 404, NOT 400 — corrected by this migration. The retired hand-rolled
+ *   fake 400'd it as "not measured at the tag, a documented test simplification". The distilled
+ *   SDK's own `patches/misc/update_pass_through_endpoints_*.json` cites the real source
+ *   (`pass_through_endpoints.py`'s `update_pass_through_endpoints` at the tag): unlike DELETE, this
+ *   route raises a genuine, unambiguous `HTTPException(404)` for a missing id, distinct from the
+ *   400 `update_config_general_settings` raises for the trailing auth/DB-disconnected write. This
+ *   fake now matches that measured vendor behaviour.
  */
-import type { PassThroughGenericEndpoint } from './generated/pass-through.ts';
+import type { PassThroughGenericEndpoint } from '@distilled.cloud/litellm/misc';
+/** RFC 2606 placeholder — never a real host. Shared across tests, like `../netbox/fake-netbox.ts`. */
+export declare const FAKE_BASE = "https://litellm.example.com";
 export interface FakeRequest {
     readonly method: string;
     readonly path: string;
 }
 export interface FakeLitellm {
-    readonly url: string;
+    readonly fetch: typeof globalThis.fetch;
     readonly rows: () => readonly PassThroughGenericEndpoint[];
     readonly requests: () => readonly FakeRequest[];
-    readonly stop: () => void;
 }
 export declare const startFakeLitellm: (options?: {
     readonly masterKey?: string;

package/dist/litellm/fake-litellm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-litellm.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-litellm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAE9E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,0BAA0B,EAAE,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,SAAS,WAAW,EAAE,CAAC;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;CAC3B;AAKD,eAAO,MAAM,gBAAgB,aAAc;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,qGAAqG;IACrG,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC,KAAG,WA2EH,CAAC"}
+{"version":3,"file":"fake-litellm.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-litellm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+BAA+B,CAAC;AAEhF,sGAAsG;AACtG,eAAO,MAAM,SAAS,gCAAgC,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,0BAA0B,EAAE,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,SAAS,WAAW,EAAE,CAAC;CACjD;AAQD,eAAO,MAAM,gBAAgB,aAAc;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,qGAAqG;IACrG,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC,KAAG,WAiEH,CAAC"}

package/dist/litellm/fake-stack.d.ts

@@ -1,5 +1,4 @@
 import * as Effect from 'effect/Effect';
-import { type LitellmCreds } from './credentials.ts';
 /** The planned action for each resource, deletions included, keyed by FQN. */
 export type Planned = Readonly<Record<string, string>>;
 /** A stack body: resource declarations, as an `alchemy.run.ts` would write them. */
@@ -15,13 +14,19 @@ export interface FakeStack {
 /**
  * ⚠️ CREDENTIALS/HTTPCLIENT ARE PROVIDED AROUND `deploy`, NOT BAKED INTO THE PROVIDER LAYER.
  *   `Provider.effect`'s own construction effect is `Effect.succeed(...)` (pass-through-endpoint.ts)
- *   — it never actually reads `LitellmCredentials`/`HttpClient`; only the HANDLERS it returns do,
- *   and those run later, whenever `Apply.ts` calls `provider.reconcile`/`read`/`delete`. Effect
+ *   — it never actually reads `Credentials`/`HttpClient`; only the HANDLERS it returns do, and
+ *   those run later, whenever `Apply.ts` calls `provider.reconcile`/`read`/`delete`. Effect
  *   resolves a `yield*`'s service from whatever ambient context wraps the CALL SITE, so the layers
  *   those handlers need must wrap the whole plan+apply pipeline below, exactly where openbao's
  *   fake-stack.ts wraps `BaoEnv` around its own `deploy`.
+ * ★ `fetchFn` IS `startFakeLitellm(...).fetch` (fake-litellm.ts) — this harness never opens a real
+ *   socket; `FetchHttpClient.Fetch` is the seam the SDK's protocol layer calls through, same as
+ *   `../netbox/fake-netbox.ts`'s `fakeNetboxLayer`.
  */
-export declare const fakeStack: (creds: LitellmCreds, name?: string) => FakeStack;
+export declare const fakeStack: (creds: {
+    readonly apiKey: string;
+    readonly baseUrl: string;
+}, fetchFn: typeof globalThis.fetch, name?: string) => FakeStack;
 /** Every call that changed something, as `METHOD path`, in order. */
 export declare const writesOf: (requests: readonly {
     readonly method: string;

package/dist/litellm/fake-stack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-stack.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-stack.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,KAAK,YAAY,EAA8B,MAAM,kBAAkB,CAAC;AAGjF,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvD,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF;AAiBD;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,UAAW,YAAY,oBAA8B,SAgC1E,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,QAAQ,aACT,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KACtE,MAAM,EACsF,CAAC"}
+{"version":3,"file":"fake-stack.d.ts","sourceRoot":"","sources":["../../src/litellm/fake-stack.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvD,oFAAoF;AACpF,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEjE,6FAA6F;AAC7F,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzD,MAAM,WAAW,SAAS;IACxB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACjF;AAiBD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,UACb;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,WACnD,OAAO,UAAU,CAAC,KAAK,oBAE/B,SAiCF,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,QAAQ,aACT,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KACtE,MAAM,EACsF,CAAC"}

package/dist/litellm/index.d.ts

@@ -2,12 +2,14 @@
  * LiteLLM providers for Alchemy.
  *
  * ⛔ THIS BARREL IS THE PUBLIC API, deliberately smaller than the directory — `fake-litellm.ts`
- *   and the internals `pass-through-form.ts`/`client.ts` need but a consumer should not depend on
- *   directly are not re-exported here (netbox/index.ts's own rule).
+ *   and the internals `pass-through-form.ts`/`operations.ts` need but a consumer should not depend
+ *   on directly are not re-exported here (netbox/index.ts's own rule).
+ * ★ CREDENTIALS AND TYPES NOW COME FROM `@distilled.cloud/litellm` ITSELF (2026-09-24, moved off a
+ *   hand-rolled `client.ts`/`credentials.ts` the same way `/netbox` and `/forgejo` did) — a
+ *   consumer building its own credentials layer imports `Credentials`/`CredentialsFromEnv`/
+ *   `credentials` from `@distilled.cloud/litellm/Credentials` directly, not through this barrel.
  */
-export { LITELLM_PROXY_API_KEY_ENV, LITELLM_PROXY_URL_ENV, LitellmCredentials, type LitellmCreds, LitellmCredentialsError, litellmCredentialsLayer, litellmCredentialsLayerFor, } from './credentials.ts';
-export { LITELLM_OPERATIONS, LitellmBadRequestError, type LitellmError, LitellmHttpError, type LitellmRequirements, LitellmTransportError, LitellmUnauthorizedError, } from './client.ts';
-export type { PassThroughEndpointResponse, PassThroughGenericEndpoint, PassThroughGuardrailSettings, } from './generated/pass-through.ts';
+export type { PassThroughEndpointResponse, PassThroughGenericEndpoint, PassThroughGuardrailSettings, } from '@distilled.cloud/litellm/misc';
 export { LiteLLMPassThroughEndpoint, LiteLLMPassThroughEndpointProvider, LitellmConfigPathConflictError, LitellmLiteralSecretHeaderError, LitellmUnaddressableRowError, isLiteLLMPassThroughEndpoint, type PassThroughEndpointAttributes, type PassThroughEndpointError, type PassThroughEndpointProps, } from './pass-through-endpoint.ts';
 export { litellmProviders } from './providers.ts';
 //# sourceMappingURL=index.d.ts.map