@intentius/chant 0.54.3 → 0.56.0

package/dist/cli/commands/migrate.d.ts

@@ -46,6 +46,17 @@ interface ValidatorResult {
  * Exported for testability.
  */
 export declare function tryValidateExternal(yamlText: string): ValidatorResult;
+/**
+ * Format the migration report as Markdown, mirroring the output format
+ * prescribed by the upstream gitlab-org/ci-cd/github-actions-to-gitlab-ci
+ * skill: overview, classification, diagnostic table, aggregated manual
+ * setup steps, suggested GitLab improvements, caveats.
+ *
+ * The same data backs the SARIF report (via formatSarif); this is the
+ * human-readable surface. Exported so downstream migrate consumers can render
+ * the same report without reimplementing it (#2066).
+ */
+export declare function formatMarkdownSummary(provenance: Array<Record<string, unknown>>, diagnostics: Array<Record<string, unknown>>, sourceContent?: string): string;
 export declare function printMigrateResult(result: MigrateCliResult): void;
 export {};
 //# sourceMappingURL=migrate.d.ts.map

package/dist/cli/commands/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsJpF;AAED,UAAU,eAAe;IACvB,GAAG,EAAE,OAAO,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AASD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAUrE;AA6OD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAajE"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsJpF;AAED,UAAU,eAAe;IACvB,GAAG,EAAE,OAAO,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AASD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAUrE;AAqBD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC3C,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAkER;AAyID,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAajE"}

package/dist/reconcile.d.ts

@@ -57,6 +57,28 @@ export interface ChangeSet {
     org: string;
     /** All proposed changes, in stable order. */
     entries: ChangeSetEntry[];
+    /**
+     * Live entries under management across the diffed collections (#2067).
+     * `diffCollection` returns each collection's live count so the diff layer
+     * can sum it here. Optional — when absent, guardrails that want a live
+     * denominator (see {@link removalDeltaCap}) fall back to the plan-relative
+     * one.
+     *
+     * Superseded by {@link ChangeSet.managedCounts}: a single pooled total lets
+     * non-deletable and cross-collection live entries dilute the delete
+     * fraction (wiping 3 of 4 teams reads as 12.5% when 20 team members pad
+     * the pool). Kept for compatibility — a change set carrying only this
+     * total keeps the 0.55.0 pooled behavior.
+     */
+    managedCount?: number;
+    /**
+     * Live managed-entry counts per resource type, keyed by
+     * `ChangeSetEntry.resourceType`. When present, {@link removalDeltaCap}
+     * evaluates the delete fraction per resource type instead of against the
+     * pooled `managedCount`, so live entries of one type cannot dilute a wipe
+     * of another. Supersedes `managedCount`.
+     */
+    managedCounts?: Readonly<Record<string, number>>;
 }
 /** Options controlling diff behaviour. */
 export interface DiffOptions {
@@ -105,8 +127,11 @@ export interface DiffCollectionParams<D, L> {
  * when `compareFields` reports differences, and ownership-gated deletes for
  * live-not-desired. This is the selective-by-omission + ownership-gated-delete
  * pattern shared by every keyed-collection diff.
+ *
+ * Returns the live entry count for this collection, so the diff layer can sum
+ * `ChangeSet.managedCount` across the collections it diffs (#2067).
  */
-export declare function diffCollection<D, L>(params: DiffCollectionParams<D, L>): void;
+export declare function diffCollection<D, L>(params: DiffCollectionParams<D, L>): number;
 /** Count entries per change kind. */
 export declare function summarizeChangeSet(cs: ChangeSet): Record<ChangeKind, number>;
 /** Human-readable plan summary for dry-run output. Pure. */
@@ -125,18 +150,57 @@ export type GuardrailResult = {
     ok: false;
     diagnostics: GuardrailDiagnostic[];
 };
-/** A guardrail check over a (rename-resolved) change set. Returns null when it passes. */
-export type GuardrailCheck = (resolved: ChangeSet) => GuardrailDiagnostic | null;
+/** Live context threaded to guardrail checks by `runGuardrailChecks` (#2067). */
+export interface GuardrailContext {
+    /** Live entries under management this cycle (see `ChangeSet.managedCount`). */
+    managedCount?: number;
+}
+/**
+ * A guardrail check over a (rename-resolved) change set. Returns null when it
+ * passes. `ctx` carries live context when the caller has it (#2067); a check
+ * written against the single-argument shape keeps working unchanged.
+ */
+export type GuardrailCheck = (resolved: ChangeSet, ctx?: GuardrailContext) => GuardrailDiagnostic | null;
 /** Config for `removalDeltaCap`. */
 export interface RemovalDeltaCapOptions {
-    /** Max fraction of pre-existing entries that may be deleted. Must be in (0,1]. Default 0.25. */
+    /**
+     * Max fraction of pre-existing entries that may be deleted. Must be in
+     * (0,1]: `removalDeltaCap` throws an `Error` on any value outside that
+     * range (0, negatives, above 1, NaN) rather than silently disabling the
+     * cap. Default 0.25.
+     */
     maxFraction?: number;
+    /**
+     * Pooled live managed-entry denominator (#2067). When positive, deletes are
+     * divided by this count of live entries under management instead of the
+     * plan's non-create entries — a converged cycle deleting one stale entry
+     * out of many no longer reads as 1/1 = 100%. Defaults to
+     * `changeSet.managedCount`; when neither is present (or not positive) the
+     * cap keeps its plan-relative behavior.
+     *
+     * Superseded by {@link RemovalDeltaCapOptions.managedTotals} — the pooled
+     * total lets unrelated live entries dilute the delete fraction.
+     */
+    managedTotal?: number;
+    /**
+     * Live managed-entry counts per resource type (keys =
+     * `ChangeSetEntry.resourceType`), mirroring {@link ChangeSet.managedCounts}
+     * and winning over it when both are present. When per-type counts are
+     * available from either source, the cap is evaluated per resource type:
+     * each type's deletes divide by that type's live count when present and
+     * positive, else by that type's own plan non-creates. Supersedes
+     * `managedTotal`.
+     */
+    managedTotals?: Readonly<Record<string, number>>;
 }
 /**
  * Resolve rename aliases. A create entry carrying a `previously` key matching a
- * delete entry's key is collapsed into an update, removing the delete. Returns a
- * new ChangeSet with renames resolved. Provider-agnostic — works on any entry
- * whose `after.previously` is a string.
+ * delete entry's key OF THE SAME RESOURCE TYPE is collapsed into an update,
+ * removing the delete. Matching across resource types would let e.g. a team
+ * create with `previously: "old"` swallow an unrelated member delete keyed
+ * "old", hiding a real delete from guardrail counting. Returns a new ChangeSet
+ * with renames resolved. Provider-agnostic — works on any entry whose
+ * `after.previously` is a string.
  */
 export declare function resolveRenames(changeSet: ChangeSet): ChangeSet;
 /**
@@ -144,6 +208,24 @@ export declare function resolveRenames(changeSet: ChangeSet): ChangeSet;
  * (deletes + updates; creates excluded so a flood of new entries can't dilute
  * the delete fraction). Guards against a typo wiping the config in one apply.
  *
+ * With per-type live counts (`opts.managedTotals`, else
+ * `changeSet.managedCounts`) the cap is evaluated PER RESOURCE TYPE: for each
+ * type with deletes, that type's deletes divide by that type's live count when
+ * present and positive, else by that type's own plan non-creates. Any type
+ * over `maxFraction` blocks, and the diagnostic names the worst offender. The
+ * pooled denominator this replaces was unsafe — live entries of one type
+ * (team members, repos) diluted a wipe of another (teams, org secrets) below
+ * the cap.
+ *
+ * With only a pooled live denominator (`opts.managedTotal`, else
+ * `changeSet.managedCount`; #2067) deletes are measured against the pooled
+ * live entries under management — so a converged cycle's plan of exactly one
+ * stale delete does not trip at 1/1 = 100%. Without either, behavior is
+ * plan-relative as before.
+ *
+ * Throws on a `maxFraction` outside (0,1] (NaN included) — fail closed, never
+ * silently disable the cap.
+ *
  * CONTRACT: pass a RENAME-RESOLVED change set (see {@link resolveRenames}).
  */
 export declare function removalDeltaCap(changeSet: ChangeSet, opts?: RemovalDeltaCapOptions): GuardrailDiagnostic | null;
@@ -151,8 +233,10 @@ export declare function removalDeltaCap(changeSet: ChangeSet, opts?: RemovalDelt
  * Run a set of guardrail checks against a change set. Resolves renames ONCE,
  * then runs every check on the resolved set, aggregating any diagnostics. The
  * caller composes provider-specific checks (e.g. an admin floor) as closures.
+ * `ctx` (optional, #2067) threads live context — e.g. the managed-live count —
+ * to every check; single-argument checks ignore it.
  */
-export declare function runGuardrailChecks(changeSet: ChangeSet, checks: GuardrailCheck[]): GuardrailResult;
+export declare function runGuardrailChecks(changeSet: ChangeSet, checks: GuardrailCheck[], ctx?: GuardrailContext): GuardrailResult;
 /** Controls how a cycle tracks its API usage against a shared request budget. */
 export interface RateBudget {
     /** Remaining request capacity for this run. */

package/dist/reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMxE,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wDAAwD;IACxD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAEzD;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAKzD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE,MAAM,EAAE,GACd,WAAW,EAAE,CAUf;AAMD,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB,CAAC,CAAC,EAAE,CAAC;IACxC,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,0CAA0C;IAC1C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrB,mEAAmE;IACnE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,WAAW,EAAE,CAAC;IACtD,uEAAuE;IACvE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC;IACnD,wEAAwE;IACxE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;IAC5D,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,cAAc,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CA6C7E;AAMD,qCAAqC;AACrC,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAI5E;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAgCrD;AAaD,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,WAAW,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AAE/F,0FAA0F;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,SAAS,KAAK,mBAAmB,GAAG,IAAI,CAAC;AAEjF,oCAAoC;AACpC,MAAM,WAAW,sBAAsB;IACrC,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAyC9D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,IAAI,GAAE,sBAA2B,GAChC,mBAAmB,GAAG,IAAI,CAgB5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,eAAe,CAQlG;AAMD,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,gFAAgF;IAChF,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAA0B;CAI9C;AAmBD;;;;;;;;;GASG;AACH,MAAM,WAAW,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC9D,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/F,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACvE,KAAK,CACH,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,GAAG,cAAc,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,YAAY,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC5E,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qDAAqD;IACrD,MAAM,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,KAAK,SAAS,CAAC;IACvF,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,KAAK,eAAe,CAAC;IACpE,wCAAwC;IACxC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sDAAsD;IACtD,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,EAC1E,IAAI,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GACzD,OAAO,CAAC,eAAe,CAAC,CA6G1B"}
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMxE,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wDAAwD;IACxD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAEzD;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAKzD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE,MAAM,EAAE,GACd,WAAW,EAAE,CAUf;AAMD,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB,CAAC,CAAC,EAAE,CAAC;IACxC,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,0CAA0C;IAC1C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrB,mEAAmE;IACnE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,WAAW,EAAE,CAAC;IACtD,uEAAuE;IACvE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC;IACnD,wEAAwE;IACxE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;IAC5D,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,cAAc,EAAE,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CA+C/E;AAMD,qCAAqC;AACrC,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAI5E;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAgCrD;AAaD,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,WAAW,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AAE/F,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,gBAAgB,KAAK,mBAAmB,GAAG,IAAI,CAAC;AAEzG,oCAAoC;AACpC,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CA6C9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,IAAI,GAAE,sBAA2B,GAChC,mBAAmB,GAAG,IAAI,CA2C5B;AAqED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,cAAc,EAAE,EACxB,GAAG,CAAC,EAAE,gBAAgB,GACrB,eAAe,CAQjB;AAMD,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,gFAAgF;IAChF,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAA0B;CAI9C;AAmBD;;;;;;;;;GASG;AACH,MAAM,WAAW,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC9D,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/F,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACvE,KAAK,CACH,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,GAAG,cAAc,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,YAAY,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC5E,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qDAAqD;IACrD,MAAM,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,KAAK,SAAS,CAAC;IACvF,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,KAAK,eAAe,CAAC;IACpE,wCAAwC;IACxC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sDAAsD;IACtD,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,EAC1E,IAAI,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GACzD,OAAO,CAAC,eAAe,CAAC,CA6G1B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.54.3",
+  "version": "0.56.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/migrate.ts

@@ -251,9 +251,10 @@ async function loadMigrationRules(targetLexicon: string): Promise<LintRule[]> {
  * setup steps, suggested GitLab improvements, caveats.
  *
  * The same data backs the SARIF report (via formatSarif); this is the
- * human-readable surface.
+ * human-readable surface. Exported so downstream migrate consumers can render
+ * the same report without reimplementing it (#2066).
  */
-function formatMarkdownSummary(
+export function formatMarkdownSummary(
   provenance: Array<Record<string, unknown>>,
   diagnostics: Array<Record<string, unknown>>,
   sourceContent?: string,

package/src/reconcile.test.ts

@@ -102,6 +102,23 @@ describe("diffCollection", () => {
     ]);
   });
 
+  test("returns the live entry count for managedCount accumulation (#2067)", () => {
+    const out: ChangeSetEntry[] = [];
+    const count = diffCollection<D, L>({
+      resourceType: "thing",
+      desired: new Map([["a", { name: "a", v: 1 }]]),
+      live: new Map([
+        ["a", { name: "a", v: 1 }],
+        ["b", { name: "b", v: 2 }],
+        ["c", { name: "c", v: 3 }],
+      ]),
+      compareFields: () => [],
+      opts: noOpts,
+      out,
+    });
+    expect(count).toBe(3);
+  });
+
   test("honours createAfter / updateAfter mappers", () => {
     const out: ChangeSetEntry[] = [];
     diffCollection<D, L>({
@@ -171,6 +188,53 @@ describe("resolveRenames", () => {
     const cs: ChangeSet = { org: "acme", entries: [{ kind: "delete", resourceType: "team", key: "old" }] };
     expect(resolveRenames(cs)).toBe(cs);
   });
+
+  test("preserves managedCount and managedCounts on the resolved set", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      managedCount: 7,
+      managedCounts: { team: 4, member: 3 },
+      entries: [
+        { kind: "delete", resourceType: "team", key: "old", before: { slug: "old" } },
+        { kind: "create", resourceType: "team", key: "new", after: { previously: "old" } },
+      ],
+    };
+    const resolved = resolveRenames(cs);
+    expect(resolved.managedCount).toBe(7);
+    expect(resolved.managedCounts).toEqual({ team: 4, member: 3 });
+  });
+
+  test("only matches previously within the same resourceType", () => {
+    // A team create claiming previously "old" must NOT swallow a member
+    // delete that happens to share the key — that would hide a real delete
+    // from guardrail counting.
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: [
+        { kind: "delete", resourceType: "member", key: "old", before: { login: "old" } },
+        { kind: "create", resourceType: "team", key: "new", after: { previously: "old" } },
+      ],
+    };
+    const resolved = resolveRenames(cs);
+    expect(resolved).toBe(cs); // untouched: no same-type match exists
+    expect(resolved.entries.filter((e) => e.kind === "delete")).toHaveLength(1);
+
+    // With a same-type delete alongside the cross-type collision, exactly
+    // the team delete collapses; the member delete survives.
+    const both: ChangeSet = {
+      org: "acme",
+      entries: [
+        { kind: "delete", resourceType: "member", key: "old", before: { login: "old" } },
+        { kind: "delete", resourceType: "team", key: "old", before: { slug: "old" } },
+        { kind: "create", resourceType: "team", key: "new", after: { previously: "old" } },
+      ],
+    };
+    const bothResolved = resolveRenames(both);
+    expect(bothResolved.entries.filter((e) => e.kind === "delete")).toEqual([
+      { kind: "delete", resourceType: "member", key: "old", before: { login: "old" } },
+    ]);
+    expect(bothResolved.entries.find((e) => e.kind === "update")!.before).toEqual({ slug: "old" });
+  });
 });
 
 describe("removalDeltaCap", () => {
@@ -199,6 +263,199 @@ describe("removalDeltaCap", () => {
     };
     expect(removalDeltaCap(cs)).toBeNull(); // 1/4 = 25%, not > 25%
   });
+
+  // Live-denominator mode (#2067) — the warden reference cases.
+
+  test("one stale delete of 10 live managed entries passes at the default cap", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: [{ kind: "delete", resourceType: "x", key: "stale" }],
+    };
+    // Plan-relative this is 1/1 = 100% and trips; against the live count it
+    // is 1/10 = 10% and passes — the routine converged-cycle cleanup.
+    expect(removalDeltaCap(cs)).not.toBeNull();
+    expect(removalDeltaCap(cs, { managedTotal: 10 })).toBeNull();
+  });
+
+  test("4 deletes of 10 live managed entries blocks, with the live-mode message", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: Array.from({ length: 4 }, (_, i) => ({
+        kind: "delete" as const,
+        resourceType: "x",
+        key: `k${i}`,
+      })),
+    };
+    const d = removalDeltaCap(cs, { managedTotal: 10 })!;
+    expect(d.guardrail).toBe("removalDeltaCap");
+    expect(d.message).toContain("4 of 10 live managed entries (40%)");
+  });
+
+  test("reads changeSet.managedCount when opts.managedTotal is absent", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      managedCount: 10,
+      entries: [{ kind: "delete", resourceType: "x", key: "stale" }],
+    };
+    expect(removalDeltaCap(cs)).toBeNull(); // 1/10 via the change set's own count
+    // An explicit managedTotal wins over the change set's count.
+    expect(removalDeltaCap({ ...cs, managedCount: 2 }, { managedTotal: 10 })).toBeNull();
+  });
+
+  test("without managed info the diagnostic deep-equals the plan-relative one", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: [
+        { kind: "delete", resourceType: "x", key: "a" },
+        { kind: "delete", resourceType: "x", key: "b" },
+      ],
+    };
+    const expected = {
+      guardrail: "removalDeltaCap",
+      message:
+        "2 of 2 managed entries (100%) would be deleted, exceeding the 25% threshold. " +
+        "Check for typos in config or raise maxFraction to proceed.",
+    };
+    expect(removalDeltaCap(cs)).toEqual(expected);
+    // A zero live count means "no live info" — it never divides by zero and
+    // never loosens the cap; behavior stays exactly plan-relative.
+    expect(removalDeltaCap(cs, { managedTotal: 0 })).toEqual(expected);
+  });
+
+  test("a changeSet with only the legacy managedCount deep-equals the 0.55.0 behavior", () => {
+    const entries = Array.from({ length: 4 }, (_, i) => ({
+      kind: "delete" as const,
+      resourceType: "x",
+      key: `k${i}`,
+    }));
+    expect(removalDeltaCap({ org: "acme", managedCount: 10, entries })).toEqual({
+      guardrail: "removalDeltaCap",
+      message:
+        "4 of 10 live managed entries (40%) would be deleted, exceeding the 25% threshold. " +
+        "Check for typos in config or raise maxFraction to proceed.",
+    });
+    expect(removalDeltaCap({ org: "acme", managedCount: 20, entries })).toBeNull(); // 4/20
+  });
+
+  // Per-resource-type mode — the three-repo review cases. The pooled
+  // denominator let live entries of one type dilute a wipe of another.
+
+  test("3 of 4 team deletes blocks at 75% even with 20 live members in another type", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      managedCounts: { team: 4, member: 20 },
+      entries: Array.from({ length: 3 }, (_, i) => ({
+        kind: "delete" as const,
+        resourceType: "team",
+        key: `t${i}`,
+      })),
+    };
+    // Pooled (0.55.0) this read 3/24 = 12.5% and sailed under the default cap.
+    expect(removalDeltaCap({ ...cs, managedCounts: undefined, managedCount: 24 })).toBeNull();
+    const d = removalDeltaCap(cs)!;
+    expect(d.guardrail).toBe("removalDeltaCap");
+    expect(d.message).toContain("3 of 4 live team entries (75%) would be deleted");
+  });
+
+  test("a full org-secret wipe blocks at 100% regardless of live repo count", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      managedCounts: { "org-secret": 2, repo: 75 },
+      entries: [
+        { kind: "delete", resourceType: "org-secret", key: "s1" },
+        { kind: "delete", resourceType: "org-secret", key: "s2" },
+      ],
+    };
+    // Pooled this read 2/77 = 2.6% and passed.
+    expect(removalDeltaCap({ ...cs, managedCounts: undefined, managedCount: 77 })).toBeNull();
+    const d = removalDeltaCap(cs)!;
+    expect(d.message).toContain("2 of 2 live org-secret entries (100%) would be deleted");
+  });
+
+  test("a type with no live count falls back to its own plan non-creates", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      managedCounts: { team: 10 },
+      entries: [
+        { kind: "delete", resourceType: "team", key: "t0" }, // 1/10 live: fine
+        { kind: "delete", resourceType: "webhook", key: "w0" },
+        { kind: "delete", resourceType: "webhook", key: "w1" },
+        { kind: "update", resourceType: "webhook", key: "w2" },
+      ],
+    };
+    // webhook has no live count → plan-relative within the type: 2/3 = 67%.
+    const d = removalDeltaCap(cs)!;
+    expect(d.message).toContain("2 of 3 planned webhook entries (67%) would be deleted");
+    // team creates never pad the webhook denominator, and vice versa.
+    expect(d.message).not.toContain("team");
+  });
+
+  test("passes when every type stays under the cap, and zero live counts fall back", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      managedCounts: { team: 10, member: 20 },
+      entries: [
+        { kind: "delete", resourceType: "team", key: "t0" },
+        { kind: "delete", resourceType: "member", key: "m0" },
+        { kind: "delete", resourceType: "member", key: "m1" },
+      ],
+    };
+    expect(removalDeltaCap(cs)).toBeNull(); // 1/10 and 2/20
+
+    // A zero live count for a type means "no live info for it" — that type
+    // is measured plan-relative (1/1 here), never divided by zero.
+    const zero: ChangeSet = {
+      org: "acme",
+      managedCounts: { team: 0 },
+      entries: [{ kind: "delete", resourceType: "team", key: "t0" }],
+    };
+    expect(removalDeltaCap(zero)!.message).toContain("1 of 1 planned team entries (100%)");
+  });
+
+  test("names the worst offender first and lists other tripping types", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      managedCounts: { "org-secret": 2, team: 4 },
+      entries: [
+        { kind: "delete", resourceType: "team", key: "t0" },
+        { kind: "delete", resourceType: "team", key: "t1" },
+        { kind: "delete", resourceType: "team", key: "t2" },
+        { kind: "delete", resourceType: "org-secret", key: "s0" },
+        { kind: "delete", resourceType: "org-secret", key: "s1" },
+      ],
+    };
+    const d = removalDeltaCap(cs)!;
+    // 100% secrets beats 75% teams for the headline; teams are still listed.
+    expect(d.message).toMatch(/^2 of 2 live org-secret entries \(100%\) would be deleted/);
+    expect(d.message).toContain("Also over the cap: 3 of 4 live team entries (75%)");
+  });
+
+  test("opts.managedTotals wins over changeSet counts; per-type wins over pooled", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      managedCounts: { team: 2 },
+      managedCount: 100,
+      entries: [{ kind: "delete", resourceType: "team", key: "t0" }],
+    };
+    // Per-type (2) beats the diluting pooled 100: 1/2 = 50% trips.
+    expect(removalDeltaCap(cs)).not.toBeNull();
+    // Explicit opts.managedTotals overrides the change set's counts.
+    expect(removalDeltaCap(cs, { managedTotals: { team: 10 } })).toBeNull();
+  });
+
+  test("maxFraction outside (0,1] throws instead of silently disabling the cap", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: [{ kind: "delete", resourceType: "x", key: "a" }],
+    };
+    for (const bad of [Number.NaN, 0, 1.5, -1]) {
+      expect(() => removalDeltaCap(cs, { maxFraction: bad })).toThrow(/maxFraction must be in \(0, 1\]/);
+    }
+    // The bounds themselves: 1 is allowed (nothing short of a full wipe trips)…
+    expect(removalDeltaCap(cs, { maxFraction: 1, managedTotal: 2 })).toBeNull();
+    // …and the default 0.25 stays valid explicitly.
+    expect(removalDeltaCap(cs, { maxFraction: 0.25, managedTotal: 10 })).toBeNull();
+  });
 });
 
 describe("runGuardrailChecks", () => {
@@ -221,6 +478,19 @@ describe("runGuardrailChecks", () => {
     const cs: ChangeSet = { org: "acme", entries: [{ kind: "create", resourceType: "x", key: "a" }] };
     expect(runGuardrailChecks(cs, [() => null])).toEqual({ ok: true });
   });
+
+  test("threads live context to checks that take it (#2067)", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: [{ kind: "delete", resourceType: "x", key: "stale" }],
+    };
+    const check: GuardrailCheck = (resolved, ctx) =>
+      removalDeltaCap(resolved, { managedTotal: ctx?.managedCount });
+    // Without ctx the check falls back to plan-relative and trips (1/1).
+    expect(runGuardrailChecks(cs, [check]).ok).toBe(false);
+    // With the live count threaded through, 1/10 passes.
+    expect(runGuardrailChecks(cs, [check], { managedCount: 10 })).toEqual({ ok: true });
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/reconcile.ts

@@ -66,6 +66,28 @@ export interface ChangeSet {
   org: string;
   /** All proposed changes, in stable order. */
   entries: ChangeSetEntry[];
+  /**
+   * Live entries under management across the diffed collections (#2067).
+   * `diffCollection` returns each collection's live count so the diff layer
+   * can sum it here. Optional — when absent, guardrails that want a live
+   * denominator (see {@link removalDeltaCap}) fall back to the plan-relative
+   * one.
+   *
+   * Superseded by {@link ChangeSet.managedCounts}: a single pooled total lets
+   * non-deletable and cross-collection live entries dilute the delete
+   * fraction (wiping 3 of 4 teams reads as 12.5% when 20 team members pad
+   * the pool). Kept for compatibility — a change set carrying only this
+   * total keeps the 0.55.0 pooled behavior.
+   */
+  managedCount?: number;
+  /**
+   * Live managed-entry counts per resource type, keyed by
+   * `ChangeSetEntry.resourceType`. When present, {@link removalDeltaCap}
+   * evaluates the delete fraction per resource type instead of against the
+   * pooled `managedCount`, so live entries of one type cannot dilute a wipe
+   * of another. Supersedes `managedCount`.
+   */
+  managedCounts?: Readonly<Record<string, number>>;
 }
 
 /** Options controlling diff behaviour. */
@@ -147,8 +169,11 @@ export interface DiffCollectionParams<D, L> {
  * when `compareFields` reports differences, and ownership-gated deletes for
  * live-not-desired. This is the selective-by-omission + ownership-gated-delete
  * pattern shared by every keyed-collection diff.
+ *
+ * Returns the live entry count for this collection, so the diff layer can sum
+ * `ChangeSet.managedCount` across the collections it diffs (#2067).
  */
-export function diffCollection<D, L>(params: DiffCollectionParams<D, L>): void {
+export function diffCollection<D, L>(params: DiffCollectionParams<D, L>): number {
   const {
     resourceType,
     keyPrefix = "",
@@ -193,6 +218,8 @@ export function diffCollection<D, L>(params: DiffCollectionParams<D, L>): void {
       out.push({ kind: "delete", resourceType, key: entryKey, before: l });
     }
   }
+
+  return live.size;
 }
 
 // ---------------------------------------------------------------------------
@@ -263,25 +290,69 @@ export interface GuardrailDiagnostic {
 /** Aggregated guardrail result. */
 export type GuardrailResult = { ok: true } | { ok: false; diagnostics: GuardrailDiagnostic[] };
 
-/** A guardrail check over a (rename-resolved) change set. Returns null when it passes. */
-export type GuardrailCheck = (resolved: ChangeSet) => GuardrailDiagnostic | null;
+/** Live context threaded to guardrail checks by `runGuardrailChecks` (#2067). */
+export interface GuardrailContext {
+  /** Live entries under management this cycle (see `ChangeSet.managedCount`). */
+  managedCount?: number;
+}
+
+/**
+ * A guardrail check over a (rename-resolved) change set. Returns null when it
+ * passes. `ctx` carries live context when the caller has it (#2067); a check
+ * written against the single-argument shape keeps working unchanged.
+ */
+export type GuardrailCheck = (resolved: ChangeSet, ctx?: GuardrailContext) => GuardrailDiagnostic | null;
 
 /** Config for `removalDeltaCap`. */
 export interface RemovalDeltaCapOptions {
-  /** Max fraction of pre-existing entries that may be deleted. Must be in (0,1]. Default 0.25. */
+  /**
+   * Max fraction of pre-existing entries that may be deleted. Must be in
+   * (0,1]: `removalDeltaCap` throws an `Error` on any value outside that
+   * range (0, negatives, above 1, NaN) rather than silently disabling the
+   * cap. Default 0.25.
+   */
   maxFraction?: number;
+  /**
+   * Pooled live managed-entry denominator (#2067). When positive, deletes are
+   * divided by this count of live entries under management instead of the
+   * plan's non-create entries — a converged cycle deleting one stale entry
+   * out of many no longer reads as 1/1 = 100%. Defaults to
+   * `changeSet.managedCount`; when neither is present (or not positive) the
+   * cap keeps its plan-relative behavior.
+   *
+   * Superseded by {@link RemovalDeltaCapOptions.managedTotals} — the pooled
+   * total lets unrelated live entries dilute the delete fraction.
+   */
+  managedTotal?: number;
+  /**
+   * Live managed-entry counts per resource type (keys =
+   * `ChangeSetEntry.resourceType`), mirroring {@link ChangeSet.managedCounts}
+   * and winning over it when both are present. When per-type counts are
+   * available from either source, the cap is evaluated per resource type:
+   * each type's deletes divide by that type's live count when present and
+   * positive, else by that type's own plan non-creates. Supersedes
+   * `managedTotal`.
+   */
+  managedTotals?: Readonly<Record<string, number>>;
 }
 
 /**
  * Resolve rename aliases. A create entry carrying a `previously` key matching a
- * delete entry's key is collapsed into an update, removing the delete. Returns a
- * new ChangeSet with renames resolved. Provider-agnostic — works on any entry
- * whose `after.previously` is a string.
+ * delete entry's key OF THE SAME RESOURCE TYPE is collapsed into an update,
+ * removing the delete. Matching across resource types would let e.g. a team
+ * create with `previously: "old"` swallow an unrelated member delete keyed
+ * "old", hiding a real delete from guardrail counting. Returns a new ChangeSet
+ * with renames resolved. Provider-agnostic — works on any entry whose
+ * `after.previously` is a string.
  */
 export function resolveRenames(changeSet: ChangeSet): ChangeSet {
+  // Keys and resource types are both free-form strings, so scope the lookup
+  // with an unambiguous composite key ("\u0000" cannot appear in either).
+  const typedKey = (resourceType: string, key: string): string => `${resourceType}\u0000${key}`;
+
   const deleteEntries = new Map<string, ChangeSetEntry>();
   for (const e of changeSet.entries) {
-    if (e.kind === "delete") deleteEntries.set(e.key, e);
+    if (e.kind === "delete") deleteEntries.set(typedKey(e.resourceType, e.key), e);
   }
 
   const resolvedDeletes = new Set<string>();
@@ -295,11 +366,11 @@ export function resolveRenames(changeSet: ChangeSet): ChangeSet {
     const previously = after["previously"];
     if (typeof previously !== "string") continue;
 
-    const deleted = deleteEntries.get(previously);
+    const deleted = deleteEntries.get(typedKey(e.resourceType, previously));
     if (!deleted) continue;
 
-    resolvedDeletes.add(previously);
-    resolvedCreates.add(e.key);
+    resolvedDeletes.add(typedKey(e.resourceType, previously));
+    resolvedCreates.add(typedKey(e.resourceType, e.key));
     syntheticUpdates.push({
       kind: "update",
       resourceType: e.resourceType,
@@ -314,11 +385,11 @@ export function resolveRenames(changeSet: ChangeSet): ChangeSet {
 
   const filteredEntries = changeSet.entries.filter(
     (e) =>
-      !(e.kind === "delete" && resolvedDeletes.has(e.key)) &&
-      !(e.kind === "create" && resolvedCreates.has(e.key)),
+      !(e.kind === "delete" && resolvedDeletes.has(typedKey(e.resourceType, e.key))) &&
+      !(e.kind === "create" && resolvedCreates.has(typedKey(e.resourceType, e.key))),
   );
 
-  return { org: changeSet.org, entries: [...filteredEntries, ...syntheticUpdates] };
+  return { ...changeSet, entries: [...filteredEntries, ...syntheticUpdates] };
 }
 
 /**
@@ -326,6 +397,24 @@ export function resolveRenames(changeSet: ChangeSet): ChangeSet {
  * (deletes + updates; creates excluded so a flood of new entries can't dilute
  * the delete fraction). Guards against a typo wiping the config in one apply.
  *
+ * With per-type live counts (`opts.managedTotals`, else
+ * `changeSet.managedCounts`) the cap is evaluated PER RESOURCE TYPE: for each
+ * type with deletes, that type's deletes divide by that type's live count when
+ * present and positive, else by that type's own plan non-creates. Any type
+ * over `maxFraction` blocks, and the diagnostic names the worst offender. The
+ * pooled denominator this replaces was unsafe — live entries of one type
+ * (team members, repos) diluted a wipe of another (teams, org secrets) below
+ * the cap.
+ *
+ * With only a pooled live denominator (`opts.managedTotal`, else
+ * `changeSet.managedCount`; #2067) deletes are measured against the pooled
+ * live entries under management — so a converged cycle's plan of exactly one
+ * stale delete does not trip at 1/1 = 100%. Without either, behavior is
+ * plan-relative as before.
+ *
+ * Throws on a `maxFraction` outside (0,1] (NaN included) — fail closed, never
+ * silently disable the cap.
+ *
  * CONTRACT: pass a RENAME-RESOLVED change set (see {@link resolveRenames}).
  */
 export function removalDeltaCap(
@@ -333,9 +422,36 @@ export function removalDeltaCap(
   opts: RemovalDeltaCapOptions = {},
 ): GuardrailDiagnostic | null {
   const maxFraction = opts.maxFraction ?? 0.25;
+  if (!(maxFraction > 0 && maxFraction <= 1)) {
+    // The negated form catches NaN too. A bad cap must never pass silently:
+    // maxFraction: 5 would otherwise wave every wipe through.
+    throw new Error(
+      `removalDeltaCap: maxFraction must be in (0, 1], got ${String(maxFraction)}`,
+    );
+  }
+  const managedTotals = opts.managedTotals ?? changeSet.managedCounts;
+  if (managedTotals !== undefined) {
+    return removalDeltaCapPerType(changeSet, managedTotals, maxFraction);
+  }
+
+  const deletes = changeSet.entries.filter((e) => e.kind === "delete").length;
+  const managedTotal = opts.managedTotal ?? changeSet.managedCount;
+  if (managedTotal !== undefined && managedTotal > 0) {
+    const fraction = deletes / managedTotal;
+    if (fraction > maxFraction) {
+      return {
+        guardrail: "removalDeltaCap",
+        message:
+          `${deletes} of ${managedTotal} live managed entries (${Math.round(fraction * 100)}%) would be deleted, ` +
+          `exceeding the ${Math.round(maxFraction * 100)}% threshold. ` +
+          `Check for typos in config or raise maxFraction to proceed.`,
+      };
+    }
+    return null;
+  }
+
   const total = changeSet.entries.filter((e) => e.kind !== "create").length;
   if (total === 0) return null;
-  const deletes = changeSet.entries.filter((e) => e.kind === "delete").length;
   const fraction = deletes / total;
   if (fraction > maxFraction) {
     return {
@@ -349,16 +465,89 @@ export function removalDeltaCap(
   return null;
 }
 
+/** One resource type's delete fraction, for the per-type cap evaluation. */
+interface TypeFraction {
+  resourceType: string;
+  deletes: number;
+  total: number;
+  fraction: number;
+  /** True when `total` is a live count; false for the plan-relative fallback. */
+  live: boolean;
+}
+
+/**
+ * Per-resource-type evaluation for {@link removalDeltaCap}. Each type with
+ * deletes gets its own denominator: the type's live count from `managedTotals`
+ * when present and positive, else that type's plan non-creates (the same
+ * plan-relative rule as the typeless cap, scoped to the type). Blocks when ANY
+ * type exceeds `maxFraction`; the message leads with the worst offender and
+ * lists the rest.
+ */
+function removalDeltaCapPerType(
+  changeSet: ChangeSet,
+  managedTotals: Readonly<Record<string, number>>,
+  maxFraction: number,
+): GuardrailDiagnostic | null {
+  const deletesByType = new Map<string, number>();
+  const nonCreatesByType = new Map<string, number>();
+  for (const e of changeSet.entries) {
+    if (e.kind === "create") continue;
+    nonCreatesByType.set(e.resourceType, (nonCreatesByType.get(e.resourceType) ?? 0) + 1);
+    if (e.kind === "delete") {
+      deletesByType.set(e.resourceType, (deletesByType.get(e.resourceType) ?? 0) + 1);
+    }
+  }
+
+  const tripping: TypeFraction[] = [];
+  for (const [resourceType, deletes] of deletesByType) {
+    const liveCount = managedTotals[resourceType];
+    // A zero (or negative) live count means "no live info for this type",
+    // never a looser or divide-by-zero cap — same rule as the pooled total.
+    const live = liveCount !== undefined && liveCount > 0;
+    const total = live ? (liveCount as number) : nonCreatesByType.get(resourceType)!;
+    const fraction = deletes / total;
+    if (fraction > maxFraction) tripping.push({ resourceType, deletes, total, fraction, live });
+  }
+
+  if (tripping.length === 0) return null;
+
+  // Worst offender first; deterministic tie-break by delete count then name.
+  tripping.sort(
+    (a, b) =>
+      b.fraction - a.fraction ||
+      b.deletes - a.deletes ||
+      a.resourceType.localeCompare(b.resourceType),
+  );
+  const [worst, ...rest] = tripping as [TypeFraction, ...TypeFraction[]];
+  const pct = (f: number): number => Math.round(f * 100);
+  const describe = (t: TypeFraction): string =>
+    `${t.deletes} of ${t.total} ${t.live ? "live" : "planned"} ${t.resourceType} entries (${pct(t.fraction)}%)`;
+
+  return {
+    guardrail: "removalDeltaCap",
+    message:
+      `${describe(worst)} would be deleted, exceeding the ${pct(maxFraction)}% threshold. ` +
+      (rest.length > 0 ? `Also over the cap: ${rest.map(describe).join(", ")}. ` : "") +
+      `Check for typos in config or raise maxFraction to proceed.`,
+  };
+}
+
 /**
  * Run a set of guardrail checks against a change set. Resolves renames ONCE,
  * then runs every check on the resolved set, aggregating any diagnostics. The
  * caller composes provider-specific checks (e.g. an admin floor) as closures.
+ * `ctx` (optional, #2067) threads live context — e.g. the managed-live count —
+ * to every check; single-argument checks ignore it.
  */
-export function runGuardrailChecks(changeSet: ChangeSet, checks: GuardrailCheck[]): GuardrailResult {
+export function runGuardrailChecks(
+  changeSet: ChangeSet,
+  checks: GuardrailCheck[],
+  ctx?: GuardrailContext,
+): GuardrailResult {
   const resolved = resolveRenames(changeSet);
   const diagnostics: GuardrailDiagnostic[] = [];
   for (const check of checks) {
-    const d = check(resolved);
+    const d = check(resolved, ctx);
     if (d) diagnostics.push(d);
   }
   return diagnostics.length > 0 ? { ok: false, diagnostics } : { ok: true };