@vivswan/github-settings-as-code 2.0.1-main.0.g3fad2b2 → 2.0.1-main.1072.gfded5f5

package/lib/pkg/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as SNAPSHOT_ONLY_INPUTS, E as parseSnapshotFileConfig, F as concludeMerge, I as concludeRun, Kt as redactRanges, L as failRun, Rt as GithubApi, S as SNAPSHOT_INPUTS, T as parseConfig, U as PRIVATE_REPORT_CHANNELS, Wt as maskRegistry, _ as INPUT_DECLS, d as runSnapshot, f as runSingle, j as readSettingsFile, k as runMulti, o as snapshotRepository, pt as SECTIONS, s as validateSettings, t as runMerge, tt as describeProblem, u as concludeSnapshot, v as MERGE_INPUTS, y as MERGE_ONLY_INPUTS, yt as sectionGrant } from "./src-DSbLta5Z.js";
+import { C as SNAPSHOT_ONLY_INPUTS, E as parseSnapshotFileConfig, F as concludeMerge, I as concludeRun, Kt as redactRanges, L as failRun, Rt as GithubApi, S as SNAPSHOT_INPUTS, T as parseConfig, U as PRIVATE_REPORT_CHANNELS, Wt as maskRegistry, _ as INPUT_DECLS, d as runSnapshot, f as runSingle, j as readSettingsFile, k as runMulti, o as snapshotRepository, pt as SECTIONS, s as validateSettings, t as runMerge, tt as describeProblem, u as concludeSnapshot, v as MERGE_INPUTS, y as MERGE_ONLY_INPUTS, yt as sectionGrant } from "./src-BFMt0V_E.js";
 import { appendFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { ResultAsync, err, ok } from "neverthrow";

package/lib/pkg/index.d.ts

@@ -1925,6 +1925,22 @@ interface SectionPlan<Op extends PlannedOpBase = ErasedPlannedOp> {
   drift: string[];
 }
 //#endregion
+//#region src/sections/repository/schema.d.ts
+declare const RepositoryConfig: z.ZodObject<{
+  topics: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+  enable_vulnerability_alerts: z.ZodOptional<z.ZodBoolean>;
+  enable_automated_security_fixes: z.ZodOptional<z.ZodBoolean>;
+  enable_private_vulnerability_reporting: z.ZodOptional<z.ZodBoolean>;
+  enable_git_lfs: z.ZodOptional<z.ZodBoolean>;
+  enable_immutable_releases: z.ZodOptional<z.ZodBoolean>;
+  enable_sponsorships: z.ZodOptional<z.ZodBoolean>;
+  issue_creation_policy: z.ZodOptional<z.ZodEnum<{
+    all: "all";
+    collaborators_only: "collaborators_only";
+  }>>;
+}, z.core.$catchall<z.ZodUnknown>>;
+type RepositoryConfig = z.infer<typeof RepositoryConfig>;
+//#endregion
 //#region src/sections/shared/list-section.d.ts
 /** A list section enumerates its live resources, so it is exactly a section with an undeclared policy. */
 type ListSectionKey = UndeclaredPolicySection;
@@ -2470,6 +2486,49 @@ declare const GRAPHQL: {
 };
 type BranchesPlan = SectionPlan<PlannedOp<typeof ENDPOINTS, typeof GRAPHQL>>;
 //#endregion
+//#region src/sections/actions/schema.d.ts
+declare const ActionsConfig: z.ZodObject<{
+  enabled: z.ZodOptional<z.ZodBoolean>;
+  allowed_actions: z.ZodOptional<z.ZodEnum<{
+    all: "all";
+    local_only: "local_only";
+    selected: "selected";
+  }>>;
+  selected_actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+  default_workflow_permissions: z.ZodOptional<z.ZodEnum<{
+    read: "read";
+    write: "write";
+  }>>;
+  can_approve_pull_request_reviews: z.ZodOptional<z.ZodBoolean>;
+  access_level: z.ZodOptional<z.ZodEnum<{
+    none: "none";
+    organization: "organization";
+    user: "user";
+  }>>;
+  artifact_and_log_retention: z.ZodOptional<z.ZodObject<{
+    days: z.ZodNumber;
+  }, z.core.$strip>>;
+  cache: z.ZodOptional<z.ZodObject<{
+    max_cache_retention_days: z.ZodOptional<z.ZodNumber>;
+    max_cache_size_gb: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strict>>;
+  oidc_customization_sub: z.ZodOptional<z.ZodObject<{
+    use_default: z.ZodBoolean;
+    include_claim_keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    use_immutable_subject: z.ZodOptional<z.ZodBoolean>;
+  }, z.core.$strip>>;
+  fork_pr_contributor_approval: z.ZodOptional<z.ZodObject<{
+    approval_policy: z.ZodString;
+  }, z.core.$strip>>;
+  fork_pr_workflows_private_repos: z.ZodOptional<z.ZodObject<{
+    run_workflows_from_fork_pull_requests: z.ZodBoolean;
+    send_write_tokens_to_workflows: z.ZodBoolean;
+    send_secrets_and_variables: z.ZodBoolean;
+    require_approval_for_fork_pr_workflows: z.ZodBoolean;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+type ActionsConfig = z.infer<typeof ActionsConfig>;
+//#endregion
 //#region src/sections/shared/secrets-engine.d.ts
 interface SecretEntry {
   name: string;
@@ -3237,6 +3296,160 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
+    snapshot(ctx: PlanContext<{
+      readonly get: {
+        readonly route: "GET /repos/{owner}/{repo}";
+        readonly statuses: {
+          readonly 200: "the repository";
+        };
+        readonly primaryRead: {
+          readonly notFound: "denied";
+        };
+      };
+      readonly update: {
+        readonly route: "PATCH /repos/{owner}/{repo}";
+        readonly statuses: {
+          readonly 200: "repository fields patched";
+        };
+      };
+      readonly topics: {
+        readonly route: "PUT /repos/{owner}/{repo}/topics";
+        readonly statuses: {
+          readonly 200: "topics replaced";
+        };
+      };
+      readonly vulnerabilityAlertsGet: {
+        readonly route: "GET /repos/{owner}/{repo}/vulnerability-alerts";
+        readonly statuses: {
+          readonly 204: "vulnerability alerts are enabled";
+          readonly 404: "vulnerability alerts are disabled";
+        };
+      };
+      readonly vulnerabilityAlertsPut: {
+        readonly route: "PUT /repos/{owner}/{repo}/vulnerability-alerts";
+        readonly statuses: {
+          readonly 204: "vulnerability alerts enabled";
+        };
+      };
+      readonly vulnerabilityAlertsRemove: {
+        readonly route: "DELETE /repos/{owner}/{repo}/vulnerability-alerts";
+        readonly statuses: {
+          readonly 204: "vulnerability alerts disabled";
+        };
+      };
+      readonly automatedSecurityFixesGet: {
+        readonly route: "GET /repos/{owner}/{repo}/automated-security-fixes";
+        readonly statuses: {
+          readonly 200: "the automated security fixes state";
+          readonly 404: "the feature is not enabled";
+        };
+      };
+      readonly automatedSecurityFixesPut: {
+        readonly route: "PUT /repos/{owner}/{repo}/automated-security-fixes";
+        readonly statuses: {
+          readonly 204: "automated security fixes enabled";
+        };
+      };
+      readonly automatedSecurityFixesRemove: {
+        readonly route: "DELETE /repos/{owner}/{repo}/automated-security-fixes";
+        readonly statuses: {
+          readonly 204: "automated security fixes disabled";
+        };
+      };
+      readonly privateVulnerabilityReportingGet: {
+        readonly route: "GET /repos/{owner}/{repo}/private-vulnerability-reporting";
+        readonly statuses: {
+          readonly 200: "the private vulnerability reporting state readable from the body";
+          readonly 404: "the feature is not applicable on this repository (observed: private repos); read as not enabled";
+          readonly 422: "the same condition as 404, alternate answer";
+        };
+      };
+      readonly privateVulnerabilityReportingPut: {
+        readonly route: "PUT /repos/{owner}/{repo}/private-vulnerability-reporting";
+        readonly statuses: {
+          readonly 204: "private vulnerability reporting enabled";
+        };
+      };
+      readonly privateVulnerabilityReportingRemove: {
+        readonly route: "DELETE /repos/{owner}/{repo}/private-vulnerability-reporting";
+        readonly statuses: {
+          readonly 204: "private vulnerability reporting disabled";
+          readonly 404: "the feature is not applicable, so it is already off";
+          readonly 422: "the feature is not applicable, so it is already off";
+        };
+      };
+      readonly immutableReleasesGet: {
+        readonly route: "GET /repos/{owner}/{repo}/immutable-releases";
+        readonly statuses: {
+          readonly 200: "the immutable releases state readable from the body";
+          readonly 404: "immutable releases are not enabled";
+        };
+      };
+      readonly immutableReleasesPut: {
+        readonly route: "PUT /repos/{owner}/{repo}/immutable-releases";
+        readonly statuses: {
+          readonly 204: "immutable releases enabled";
+          readonly 409: "the repository owner enforces immutable releases";
+        };
+      };
+      readonly immutableReleasesRemove: {
+        readonly route: "DELETE /repos/{owner}/{repo}/immutable-releases";
+        readonly statuses: {
+          readonly 204: "immutable releases disabled";
+          readonly 409: "the repository owner enforces immutable releases";
+        };
+      };
+      readonly lfsPut: {
+        readonly route: "PUT /repos/{owner}/{repo}/lfs";
+        readonly statuses: {
+          readonly 202: "Git LFS enabled (GitHub processes the change asynchronously)";
+        };
+        readonly denialHint: string;
+        readonly alwaysRewrite: true;
+      };
+      readonly lfsRemove: {
+        readonly route: "DELETE /repos/{owner}/{repo}/lfs";
+        readonly statuses: {
+          readonly 204: "Git LFS disabled";
+        };
+        readonly denialHint: string;
+        readonly alwaysRewrite: true;
+      };
+    }, {
+      readonly featuresQuery: {
+        readonly name: "RepositoryFeatures";
+        readonly kind: "read";
+        readonly query: "query RepositoryFeatures($owner: String!, $repo: String!) { repository(owner: $owner, name: $repo) { id hasSponsorshipsEnabled issueCreationPolicy } }";
+        readonly outcomes: {
+          readonly ok: "the sponsor-button and issue-creation-policy state, plus the node id the mutation addresses";
+        };
+      } & {
+        readonly _variables?: {
+          owner: string;
+          repo: string;
+        } | undefined;
+      };
+      readonly updateFeatures: {
+        readonly name: "UpdateRepositoryFeatures";
+        readonly kind: "write";
+        readonly query: "mutation UpdateRepositoryFeatures(\n    $repositoryId: ID!\n    $hasSponsorshipsEnabled: Boolean\n    $issueCreationPolicy: IssueCreationPolicy\n  ) {\n    updateRepository(\n      input: {\n        repositoryId: $repositoryId\n        hasSponsorshipsEnabled: $hasSponsorshipsEnabled\n        issueCreationPolicy: $issueCreationPolicy\n      }\n    ) {\n      repository { hasSponsorshipsEnabled issueCreationPolicy }\n    }\n  }";
+        readonly outcomes: {
+          readonly ok: "the carried values set; the echoed state verifies each one took";
+        };
+      } & {
+        readonly _variables?: {
+          repositoryId: string;
+          hasSponsorshipsEnabled?: boolean;
+          issueCreationPolicy?: ({
+            readonly all: "ALL";
+            readonly collaborators_only: "COLLABORATORS_ONLY";
+          })["all" | "collaborators_only"];
+        } | undefined;
+      };
+    }>): Promise<{
+      value: RepositoryConfig;
+      notes: string[];
+    }>;
   };
   labels: ListSectionModule<"labels", {
     readonly list: {
@@ -3450,6 +3663,68 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
+    snapshot(ctx: PlanContext<{
+      readonly list: {
+        readonly route: "GET /repos/{owner}/{repo}/rulesets";
+        readonly statuses: {
+          readonly 200: "the repository ruleset list";
+        };
+        readonly primaryRead: {
+          readonly notFound: "denied";
+        };
+      };
+      readonly create: {
+        readonly route: "POST /repos/{owner}/{repo}/rulesets";
+        readonly statuses: {
+          readonly 201: "ruleset created";
+        };
+        readonly hints: {
+          readonly 422: "Usually this means a rules[].type GitHub does not recognize, or \"parameters\" that do not fit that rule type (rules pass through verbatim, so a typo reaches GitHub unchanged)";
+        };
+      };
+      readonly get: {
+        readonly route: "GET /repos/{owner}/{repo}/rulesets/{ruleset_id}";
+        readonly statuses: {
+          readonly 200: "the ruleset";
+        };
+      };
+      readonly update: {
+        readonly route: "PUT /repos/{owner}/{repo}/rulesets/{ruleset_id}";
+        readonly statuses: {
+          readonly 200: "ruleset updated";
+        };
+        readonly hints: {
+          readonly 422: "Usually this means a rules[].type GitHub does not recognize, or \"parameters\" that do not fit that rule type (rules pass through verbatim, so a typo reaches GitHub unchanged)";
+        };
+      };
+      readonly remove: {
+        readonly route: "DELETE /repos/{owner}/{repo}/rulesets/{ruleset_id}";
+        readonly statuses: {
+          readonly 204: "ruleset deleted";
+        };
+      };
+    }, Readonly<Record<string, GraphqlOpDecl>>>): Promise<{
+      value: undefined;
+      notes: string[];
+    } | {
+      value: UndeclaredPolicyList<{
+        name: string;
+        target?: "branch" | "push" | "tag" | undefined;
+        enforcement?: string | undefined;
+        conditions?: {
+          ref_name?: {
+            include?: string[] | undefined;
+            exclude?: string[] | undefined;
+          } | undefined;
+        } | undefined;
+        rules?: {
+          type: string;
+          parameters?: Record<string, unknown> | undefined;
+        }[] | undefined;
+        bypass_actors?: Record<string, unknown>[] | undefined;
+      }>;
+      notes: string[];
+    }>;
   };
   environments: {
     key: "environments";
@@ -5242,6 +5517,163 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
+    snapshot(ctx: PlanContext<{
+      readonly getPermissions: {
+        readonly route: "GET /repos/{owner}/{repo}/actions/permissions";
+        readonly statuses: {
+          readonly 200: "the Actions permissions policy";
+        };
+        readonly primaryRead: {
+          readonly notFound: "denied";
+        };
+      };
+      readonly putPermissions: {
+        readonly route: "PUT /repos/{owner}/{repo}/actions/permissions";
+        readonly statuses: {
+          readonly 204: "Actions permissions policy applied";
+        };
+      };
+      readonly getSelected: {
+        readonly route: "GET /repos/{owner}/{repo}/actions/permissions/selected-actions";
+        readonly statuses: {
+          readonly 200: "the selected-actions allowlist";
+          readonly 404: "no allowlist because the policy is not selected";
+          readonly 409: "the allowed_actions policy is not selected, so the allowlist does not apply";
+        };
+      };
+      readonly putSelected: {
+        readonly route: "PUT /repos/{owner}/{repo}/actions/permissions/selected-actions";
+        readonly statuses: {
+          readonly 204: "selected-actions allowlist applied";
+        };
+      };
+      readonly getWorkflow: {
+        readonly route: "GET /repos/{owner}/{repo}/actions/permissions/workflow";
+        readonly statuses: {
+          readonly 200: "the workflow token permissions";
+        };
+      };
+      readonly putWorkflow: {
+        readonly route: "PUT /repos/{owner}/{repo}/actions/permissions/workflow";
+        readonly statuses: {
+          readonly 204: "workflow token permissions applied";
+        };
+      };
+      readonly getAccess: {
+        readonly route: "GET /repos/{owner}/{repo}/actions/permissions/access";
+        readonly statuses: {
+          readonly 200: "the workflows access level";
+        };
+      };
+      readonly putAccess: {
+        readonly route: "PUT /repos/{owner}/{repo}/actions/permissions/access";
+        readonly statuses: {
+          readonly 204: "workflows access level applied";
+        };
+      };
+      readonly getRetention: {
+        readonly route: "GET /repos/{owner}/{repo}/actions/permissions/artifact-and-log-retention";
+        readonly statuses: {
+          readonly 200: "the artifact and log retention window";
+        };
+      };
+      readonly putRetention: {
+        readonly route: "PUT /repos/{owner}/{repo}/actions/permissions/artifact-and-log-retention";
+        readonly statuses: {
+          readonly 204: "artifact and log retention applied";
+        };
+        readonly hints: {
+          readonly 422: "the retention window must be a whole number of days within the plan's maximum; see the artifact-and-log-retention endpoint documentation";
+        };
+      };
+      readonly getCacheRetention: {
+        readonly route: "GET /repos/{owner}/{repo}/actions/cache/retention-limit";
+        readonly statuses: {
+          readonly 200: "the cache retention limit";
+        };
+      };
+      readonly putCacheRetention: {
+        readonly route: "PUT /repos/{owner}/{repo}/actions/cache/retention-limit";
+        readonly statuses: {
+          readonly 204: "cache retention limit applied";
+        };
+        readonly hints: {
+          readonly 400: "the retention limit must be a whole number of days within the allowed range; see the cache retention-limit endpoint documentation";
+        };
+      };
+      readonly getCacheStorage: {
+        readonly route: "GET /repos/{owner}/{repo}/actions/cache/storage-limit";
+        readonly statuses: {
+          readonly 200: "the cache storage limit";
+        };
+      };
+      readonly putCacheStorage: {
+        readonly route: "PUT /repos/{owner}/{repo}/actions/cache/storage-limit";
+        readonly statuses: {
+          readonly 204: "cache storage limit applied";
+        };
+        readonly hints: {
+          readonly 400: "the storage limit must be a whole number of gigabytes within the allowed range; see the cache storage-limit endpoint documentation";
+        };
+      };
+      readonly getOidcSub: {
+        readonly route: "GET /repos/{owner}/{repo}/actions/oidc/customization/sub";
+        readonly statuses: {
+          readonly 200: "the OIDC subject claim template";
+        };
+        readonly permission: {
+          readonly repo: readonly ["actions"];
+        };
+      };
+      readonly putOidcSub: {
+        readonly route: "PUT /repos/{owner}/{repo}/actions/oidc/customization/sub";
+        readonly statuses: {
+          readonly 201: "OIDC subject claim template applied";
+        };
+        readonly permission: {
+          readonly repo: readonly ["actions"];
+        };
+        readonly hints: {
+          readonly 400: "include_claim_keys entries must be unique claim keys of the OIDC token (alphanumeric and underscores only); see the OIDC subject claim customization endpoint documentation";
+          readonly 422: "include_claim_keys entries must be unique claim keys of the OIDC token (alphanumeric and underscores only); see the OIDC subject claim customization endpoint documentation";
+        };
+      };
+      readonly getForkPrApproval: {
+        readonly route: "GET /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval";
+        readonly statuses: {
+          readonly 200: "the fork PR contributor approval policy";
+        };
+      };
+      readonly putForkPrApproval: {
+        readonly route: "PUT /repos/{owner}/{repo}/actions/permissions/fork-pr-contributor-approval";
+        readonly statuses: {
+          readonly 204: "fork PR contributor approval policy applied";
+        };
+        readonly hints: {
+          readonly 422: "approval_policy must be one of the contributor approval policies GitHub accepts; see the fork-pr-contributor-approval endpoint documentation";
+        };
+      };
+      readonly getForkPrPrivate: {
+        readonly route: "GET /repos/{owner}/{repo}/actions/permissions/fork-pr-workflows-private-repos";
+        readonly statuses: {
+          readonly 200: "the private-repo fork PR workflow settings";
+        };
+        readonly denialHint: "the fork PR workflow settings are documented for private repositories, so a denial here can also mean the repository is public";
+      };
+      readonly putForkPrPrivate: {
+        readonly route: "PUT /repos/{owner}/{repo}/actions/permissions/fork-pr-workflows-private-repos";
+        readonly statuses: {
+          readonly 204: "private-repo fork PR workflow settings applied";
+        };
+        readonly denialHint: "the fork PR workflow settings are documented for private repositories, so a denial here can also mean the repository is public";
+        readonly hints: {
+          readonly 422: "the settings object must carry run_workflows_from_fork_pull_requests with boolean toggles only; see the fork-pr-workflows-private-repos endpoint documentation";
+        };
+      };
+    }, Readonly<Record<string, GraphqlOpDecl>>>): Promise<{
+      value: ActionsConfig;
+      notes: string[];
+    }>;
   };
   actions_secrets: RepoSecretsSectionModule<"actions_secrets">;
   dependabot_secrets: RepoSecretsSectionModule<"dependabot_secrets">;

package/lib/pkg/index.js

@@ -1,2 +1,2 @@
-import { $ as renderSnapshotYaml, A as parseSettingsDoc, At as parseReposInput, B as planRedaction, Bt as SECRET_TRANSPORT_WITHHELD, C as SNAPSHOT_ONLY_INPUTS, Ct as endpointMethod, D as DEFAULT_SETTINGS_FILE, Dt as SECTION_KEYS, E as parseSnapshotFileConfig, Et as PROBOT_PARITY_KEYS, F as concludeMerge, Ft as VISIBILITY_FILTERS, G as openReportChannel, Gt as prefixedIo, H as toPublicView, Ht as isRateLimitError, I as concludeRun, It as discoverRepos, J as MARKER_LABEL_CONFIG, Jt as resolveCentralTargets, K as ISSUE_TITLE, Kt as redactRanges, L as failRun, Lt as DEFAULT_API_VERSION, M as createVisibilityResolver, Mt as ARCHIVED_FILTERS, N as getRepoFile, Nt as DEFAULT_DISCOVERY_FILTERS, O as resolveTargets, Ot as SettingsFile, P as MERGE_RESULT, Pt as FORKS_FILTERS, Q as parseRecipient, R as PRIVATE_REPOS_POLICIES, Rt as GithubApi, S as SNAPSHOT_INPUTS, St as grantFor, T as parseConfig, Tt as DOCUMENT_DIRECTIVE_KEYS, U as PRIVATE_REPORT_CHANNELS, Ut as collectingIo, V as publicDetail, Vt as isPermissionError, W as applyMarkerInjection, Wt as maskRegistry, X as deliverArtifactReport, Xt as parseRepoSlug, Y as composeReport, Yt as dedupeTargets, Z as encryptReport, _ as INPUT_DECLS, _t as denialPosture, a as snapshotRepositories, at as preflightProbe, b as MERGE_REJECTED_INPUTS, bt as sectionOperations, c as SNAPSHOT_RESULTS, ct as validateSettingsDoc, d as runSnapshot, dt as mergeLayers, et as RERUN_ADVICE, f as runSingle, ft as stripNulls, g as FILTER_INPUTS, gt as sectionModule, h as DEFAULT_PRIVATE_REPOS, ht as allGraphqlOps, i as renderMergedYaml, it as REPO_RESULTS, j as readSettingsFile, jt as AFFILIATIONS, k as runMulti, kt as UNDECLARED_POLICY_SECTIONS, l as SNAPSHOT_SCHEMA_URL, lt as worstOf, m as readLayerFiles, mt as allEndpoints, n as applyRepository, nt as quoteList, o as snapshotRepository, ot as runForRepo, p as foldLayers, pt as SECTIONS, q as MARKER_LABEL, qt as silentIo, r as checkRepository, rt as SectionSelection, s as validateSettings, st as skippedSectionKeys, t as runMerge, tt as describeProblem, u as concludeSnapshot, ut as describeOptOut, v as MERGE_INPUTS, vt as readGating, w as SNAPSHOT_REJECTED_INPUTS, wt as endpointPath, x as MODES, xt as writeGatedReads, y as MERGE_ONLY_INPUTS, yt as sectionGrant, z as capturingIo, zt as SECRET_RESPONSE_WITHHELD } from "./src-DSbLta5Z.js";
+import { $ as renderSnapshotYaml, A as parseSettingsDoc, At as parseReposInput, B as planRedaction, Bt as SECRET_TRANSPORT_WITHHELD, C as SNAPSHOT_ONLY_INPUTS, Ct as endpointMethod, D as DEFAULT_SETTINGS_FILE, Dt as SECTION_KEYS, E as parseSnapshotFileConfig, Et as PROBOT_PARITY_KEYS, F as concludeMerge, Ft as VISIBILITY_FILTERS, G as openReportChannel, Gt as prefixedIo, H as toPublicView, Ht as isRateLimitError, I as concludeRun, It as discoverRepos, J as MARKER_LABEL_CONFIG, Jt as resolveCentralTargets, K as ISSUE_TITLE, Kt as redactRanges, L as failRun, Lt as DEFAULT_API_VERSION, M as createVisibilityResolver, Mt as ARCHIVED_FILTERS, N as getRepoFile, Nt as DEFAULT_DISCOVERY_FILTERS, O as resolveTargets, Ot as SettingsFile, P as MERGE_RESULT, Pt as FORKS_FILTERS, Q as parseRecipient, R as PRIVATE_REPOS_POLICIES, Rt as GithubApi, S as SNAPSHOT_INPUTS, St as grantFor, T as parseConfig, Tt as DOCUMENT_DIRECTIVE_KEYS, U as PRIVATE_REPORT_CHANNELS, Ut as collectingIo, V as publicDetail, Vt as isPermissionError, W as applyMarkerInjection, Wt as maskRegistry, X as deliverArtifactReport, Xt as parseRepoSlug, Y as composeReport, Yt as dedupeTargets, Z as encryptReport, _ as INPUT_DECLS, _t as denialPosture, a as snapshotRepositories, at as preflightProbe, b as MERGE_REJECTED_INPUTS, bt as sectionOperations, c as SNAPSHOT_RESULTS, ct as validateSettingsDoc, d as runSnapshot, dt as mergeLayers, et as RERUN_ADVICE, f as runSingle, ft as stripNulls, g as FILTER_INPUTS, gt as sectionModule, h as DEFAULT_PRIVATE_REPOS, ht as allGraphqlOps, i as renderMergedYaml, it as REPO_RESULTS, j as readSettingsFile, jt as AFFILIATIONS, k as runMulti, kt as UNDECLARED_POLICY_SECTIONS, l as SNAPSHOT_SCHEMA_URL, lt as worstOf, m as readLayerFiles, mt as allEndpoints, n as applyRepository, nt as quoteList, o as snapshotRepository, ot as runForRepo, p as foldLayers, pt as SECTIONS, q as MARKER_LABEL, qt as silentIo, r as checkRepository, rt as SectionSelection, s as validateSettings, st as skippedSectionKeys, t as runMerge, tt as describeProblem, u as concludeSnapshot, ut as describeOptOut, v as MERGE_INPUTS, vt as readGating, w as SNAPSHOT_REJECTED_INPUTS, wt as endpointPath, x as MODES, xt as writeGatedReads, y as MERGE_ONLY_INPUTS, yt as sectionGrant, z as capturingIo, zt as SECRET_RESPONSE_WITHHELD } from "./src-BFMt0V_E.js";
 export { AFFILIATIONS, ARCHIVED_FILTERS, DEFAULT_API_VERSION, DEFAULT_DISCOVERY_FILTERS, DEFAULT_PRIVATE_REPOS, DEFAULT_SETTINGS_FILE, DOCUMENT_DIRECTIVE_KEYS, FILTER_INPUTS, FORKS_FILTERS, GithubApi, INPUT_DECLS, ISSUE_TITLE, MARKER_LABEL, MARKER_LABEL_CONFIG, MERGE_INPUTS, MERGE_ONLY_INPUTS, MERGE_REJECTED_INPUTS, MERGE_RESULT, MODES, PRIVATE_REPORT_CHANNELS, PRIVATE_REPOS_POLICIES, PROBOT_PARITY_KEYS, REPO_RESULTS, RERUN_ADVICE, SECRET_RESPONSE_WITHHELD, SECRET_TRANSPORT_WITHHELD, SECTIONS, SECTION_KEYS, SNAPSHOT_INPUTS, SNAPSHOT_ONLY_INPUTS, SNAPSHOT_REJECTED_INPUTS, SNAPSHOT_RESULTS, SNAPSHOT_SCHEMA_URL, SectionSelection, SettingsFile, UNDECLARED_POLICY_SECTIONS, VISIBILITY_FILTERS, allEndpoints, allGraphqlOps, applyMarkerInjection, applyRepository, capturingIo, checkRepository, collectingIo, composeReport, concludeMerge, concludeRun, concludeSnapshot, createVisibilityResolver, dedupeTargets, deliverArtifactReport, denialPosture, describeOptOut, describeProblem, discoverRepos, encryptReport, endpointMethod, endpointPath, failRun, foldLayers, getRepoFile, grantFor, isPermissionError, isRateLimitError, maskRegistry, mergeLayers, openReportChannel, parseConfig, parseRecipient, parseRepoSlug, parseReposInput, parseSettingsDoc, parseSnapshotFileConfig, planRedaction, prefixedIo, preflightProbe, publicDetail, quoteList, readGating, readLayerFiles, readSettingsFile, redactRanges, renderMergedYaml, renderSnapshotYaml, resolveCentralTargets, resolveTargets, runForRepo, runMerge, runMulti, runSingle, runSnapshot, sectionGrant, sectionModule, sectionOperations, silentIo, skippedSectionKeys, snapshotRepositories, snapshotRepository, stripNulls, toPublicView, validateSettings, validateSettingsDoc, worstOf, writeGatedReads };

package/lib/pkg/{src-DSbLta5Z.js → src-BFMt0V_E.js}

@@ -2699,6 +2699,100 @@ function planContext(meta, api, repo) {
 	};
 }
 //#endregion
+//#region src/sections/shared/snapshot-helpers.ts
+function defOf(schema) {
+	return schema._zod.def;
+}
+/** The schema types the projection treats as leaves: the live value passes through verbatim. */
+const LEAF_TYPES = /* @__PURE__ */ new Set([
+	"string",
+	"number",
+	"int",
+	"boolean",
+	"enum",
+	"literal",
+	"unknown",
+	"null"
+]);
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* A live value projected onto a schema slice, so server-assigned fields fall away without a hand
+* list per section. A nested `null` the slice cannot hold is GitHub's "no value" (a not-configured
+* setup's runner_type) and its key is omitted; a value the slice rejects at the root stays, so the
+* engine's validation names a body outside the shape instead of the section vanishing. A
+* passthrough slice (a catchall other than never) keeps every live key by design, so a section on
+* one names the keys it reads back itself. The casts are the boundary the engine validates behind.
+*/
+function projectOntoSchema(schema, live) {
+	if (live === null && !schema.safeParse(null).success) return live;
+	return project(schema, live);
+}
+function project(schema, live) {
+	if (live === void 0) return;
+	if (live === null) return schema.safeParse(null).success ? null : void 0;
+	const def = defOf(schema);
+	switch (def.type) {
+		case "optional":
+		case "nullable": return project(def.innerType, live);
+		case "object": {
+			if (!isPlainObject(live)) return live;
+			const shape = def.shape ?? {};
+			const out = {};
+			for (const [key, child] of Object.entries(shape)) {
+				const projected = project(child, live[key]);
+				if (projected !== void 0) out[key] = projected;
+			}
+			if (def.catchall !== void 0 && defOf(def.catchall).type !== "never") {
+				for (const [key, value] of Object.entries(live)) if (!(key in shape) && value !== void 0) out[key] = value;
+			}
+			return out;
+		}
+		case "array": return Array.isArray(live) ? live.map((item) => project(def.element, item)) : live;
+		case "record": return isPlainObject(live) ? Object.fromEntries(Object.entries(live).map(([key, value]) => [key, project(def.valueType, value)])) : live;
+		case "union": {
+			const option = (def.options ?? []).find((candidate) => candidate.safeParse(live).success);
+			return option === void 0 ? live : project(option, live);
+		}
+		default:
+			if (!LEAF_TYPES.has(def.type)) throw new Error(`projectOntoSchema(): unhandled schema type "${def.type}" - teach the projection its walk before authoring it in a section slice`);
+			return live;
+	}
+}
+/**
+* Refuse a live list holding two resources under one identity (GitHub allows repeated deploy-key
+* titles and hook urls): the planner manages one resource per identity and would refuse the
+* snapshot's own file, so the snapshot fails here, naming the pairs, instead of emitting it.
+*/
+function rejectLiveDuplicates(section, noun, items, keyOf, describe) {
+	const collisions = collidingPairs(items, keyOf, describe);
+	if (collisions.length > 0) throw new Error(`${section.key}: GitHub holds ${noun}s that resolve to one identity: ${collisions.join("; ")}. This section manages one ${noun} per identity, so the snapshot cannot declare them; delete all but one of each on GitHub, then snapshot again`);
+}
+/**
+* One read of a snapshot that a denial may take out without failing the section: a
+* PermissionDenied becomes a note naming the key left out and the grant advice, anything else
+* propagates. For a section whose keys sit behind different grants (repository, actions).
+*/
+async function readOrNote(notes, label, read) {
+	try {
+		return { value: await read() };
+	} catch (error) {
+		if (error instanceof PermissionDenied) {
+			notes.push(`${label}: left out of the snapshot - ${error.detail}`);
+			return { denied: true };
+		}
+		throw error;
+	}
+}
+/** A knobbed section's snapshot value: its entries under the section's own default policy, spelled out. */
+function knobbedSnapshot(section, entries) {
+	return {
+		_undeclared: defaultUndeclaredPolicy(section),
+		entries
+	};
+}
+//#endregion
 //#region src/sections/actions/index.ts
 const permission$14 = { repo: ["administration"] };
 const OIDC_TEMPLATE_HINT = "include_claim_keys entries must be unique claim keys of the OIDC token (alphanumeric and underscores only); see the OIDC subject claim customization endpoint documentation";
@@ -2830,32 +2924,46 @@ const LiveOidcSub = z.looseObject({ include_claim_keys: z.array(z.string()).null
 /** `N` is inferred from the GET alone, so a PUT of another name does not compile. */
 function endpointRouted(wiring) {
 	const body = wiring.body ?? ((declared) => declared);
-	return { plan: async (ctx, _section, declared, plan) => {
-		const live = await ctx.read[wiring.get].call();
-		const payload = body(declared);
-		const drift = subsetDiff(payload, live, wiring.label);
-		if (hasDrift(drift)) plan.ops.push({
-			role: wiring.put,
-			payload: plainData(payload),
-			describe: wiring.describe,
-			drift,
-			change: wiring.applied
-		});
-	} };
+	return {
+		plan: async (ctx, _section, declared, plan) => {
+			const live = await ctx.read[wiring.get].call();
+			const payload = body(declared);
+			const drift = subsetDiff(payload, live, wiring.label);
+			if (hasDrift(drift)) plan.ops.push({
+				role: wiring.put,
+				payload: plainData(payload),
+				describe: wiring.describe,
+				drift,
+				change: wiring.applied
+			});
+		},
+		snapshot: async (ctx) => wiring.read(await ctx.read[wiring.get].call())
+	};
+}
+function sliceOf(key) {
+	const slice = ActionsConfig.shape[key];
+	return (live) => projectOntoSchema(slice, live);
 }
 const KEY_DESTINATION = {
 	enabled: "base",
 	allowed_actions: "base",
-	selected_actions: { plan: async (ctx, _section, declared, plan) => {
-		const probe = await ctx.read.getSelected.probeAbsent();
-		const drift = "missing" in probe ? ["actions.selected: no selected-actions allowlist is readable (the live allowed_actions policy is not \"selected\", or no allowlist has been set); apply will set the declared allowlist"] : subsetDiff(declared, probe.data, "actions.selected");
-		if (hasDrift(drift)) plan.ops.push({
-			role: "putSelected",
-			payload: plainData(declared),
-			drift,
-			change: "applied selected-actions policy"
-		});
-	} },
+	selected_actions: {
+		plan: async (ctx, _section, declared, plan) => {
+			const probe = await ctx.read.getSelected.probeAbsent();
+			const drift = "missing" in probe ? ["actions.selected: no selected-actions allowlist is readable (the live allowed_actions policy is not \"selected\", or no allowlist has been set); apply will set the declared allowlist"] : subsetDiff(declared, probe.data, "actions.selected");
+			if (hasDrift(drift)) plan.ops.push({
+				role: "putSelected",
+				payload: plainData(declared),
+				drift,
+				change: "applied selected-actions policy"
+			});
+		},
+		snapshot: async (ctx, _section, base) => {
+			if (base.allowed_actions !== "selected") return;
+			const probe = await ctx.read.getSelected.probeAbsent();
+			return "missing" in probe ? void 0 : sliceOf("selected_actions")(probe.data);
+		}
+	},
 	default_workflow_permissions: "workflow",
 	can_approve_pull_request_reviews: "workflow",
 	access_level: endpointRouted({
@@ -2863,60 +2971,77 @@ const KEY_DESTINATION = {
 		put: "putAccess",
 		label: "actions.access",
 		applied: "applied workflows access level",
-		body: (value) => ({ access_level: value })
+		body: (value) => ({ access_level: value }),
+		read: (live) => sliceOf("access_level")(live.access_level)
 	}),
 	artifact_and_log_retention: endpointRouted({
 		get: "getRetention",
 		put: "putRetention",
 		label: "actions.artifact_and_log_retention",
 		applied: "applied artifact and log retention",
-		describe: "setting the artifact and log retention window"
+		describe: "setting the artifact and log retention window",
+		read: sliceOf("artifact_and_log_retention")
 	}),
-	cache: { plan: async (ctx, _section, declared, plan) => {
-		const cache = declared;
-		for (const [key, wiring] of Object.entries(CACHE_ENDPOINT_BY_KEY)) {
-			if (!(key in cache)) continue;
-			const live = await ctx.read[wiring.get].call();
-			const body = { [key]: cache[key] };
-			const drift = subsetDiff(body, live, "actions.cache");
+	cache: {
+		plan: async (ctx, _section, declared, plan) => {
+			const cache = declared;
+			for (const [key, wiring] of Object.entries(CACHE_ENDPOINT_BY_KEY)) {
+				if (!(key in cache)) continue;
+				const live = await ctx.read[wiring.get].call();
+				const body = { [key]: cache[key] };
+				const drift = subsetDiff(body, live, "actions.cache");
+				if (hasDrift(drift)) plan.ops.push({
+					role: wiring.put,
+					payload: plainData(body),
+					describe: `setting the cache ${wiring.label} limit`,
+					drift,
+					change: `applied cache ${wiring.label} limit`
+				});
+			}
+		},
+		snapshot: async (ctx, _section, _base, notes) => {
+			const limits = {};
+			for (const [key, wiring] of Object.entries(CACHE_ENDPOINT_BY_KEY)) {
+				const read = await readOrNote(notes, `actions.cache.${key}`, () => ctx.read[wiring.get].call());
+				if (!("denied" in read)) Object.assign(limits, read.value);
+			}
+			return Object.keys(limits).length === 0 ? void 0 : sliceOf("cache")(limits);
+		}
+	},
+	oidc_customization_sub: {
+		plan: async (ctx, section, declared, plan) => {
+			const live = parseLive(section, ENDPOINTS$17.getOidcSub, LiveOidcSub, await ctx.read.getOidcSub.call());
+			const { include_claim_keys, ...comparable } = declared;
+			const drift = subsetDiff(comparable, live, "actions.oidc_customization_sub");
+			if (declared.use_default === false && include_claim_keys !== void 0) {
+				const liveKeys = live.include_claim_keys ?? [];
+				if (!sameClaimKeyOrder(include_claim_keys, liveKeys)) drift.push(`actions.oidc_customization_sub.include_claim_keys: declared ${JSON.stringify(include_claim_keys)} != live ${JSON.stringify(liveKeys)} (claim-key order defines the subject format, so order counts); apply will set the declared value`);
+			}
 			if (hasDrift(drift)) plan.ops.push({
-				role: wiring.put,
-				payload: plainData(body),
-				describe: `setting the cache ${wiring.label} limit`,
+				role: "putOidcSub",
+				payload: plainData(declared),
+				describe: "customizing the OIDC subject claim",
 				drift,
-				change: `applied cache ${wiring.label} limit`
+				change: "applied the OIDC subject claim template"
 			});
-		}
-	} },
-	oidc_customization_sub: { plan: async (ctx, section, declared, plan) => {
-		const live = parseLive(section, ENDPOINTS$17.getOidcSub, LiveOidcSub, await ctx.read.getOidcSub.call());
-		const { include_claim_keys, ...comparable } = declared;
-		const drift = subsetDiff(comparable, live, "actions.oidc_customization_sub");
-		if (declared.use_default === false && include_claim_keys !== void 0) {
-			const liveKeys = live.include_claim_keys ?? [];
-			if (!sameClaimKeyOrder(include_claim_keys, liveKeys)) drift.push(`actions.oidc_customization_sub.include_claim_keys: declared ${JSON.stringify(include_claim_keys)} != live ${JSON.stringify(liveKeys)} (claim-key order defines the subject format, so order counts); apply will set the declared value`);
-		}
-		if (hasDrift(drift)) plan.ops.push({
-			role: "putOidcSub",
-			payload: plainData(declared),
-			describe: "customizing the OIDC subject claim",
-			drift,
-			change: "applied the OIDC subject claim template"
-		});
-	} },
+		},
+		snapshot: async (ctx, section) => sliceOf("oidc_customization_sub")(parseLive(section, ENDPOINTS$17.getOidcSub, LiveOidcSub, await ctx.read.getOidcSub.call()))
+	},
 	fork_pr_contributor_approval: endpointRouted({
 		get: "getForkPrApproval",
 		put: "putForkPrApproval",
 		label: "actions.fork_pr_contributor_approval",
 		applied: "applied the fork PR contributor approval policy",
-		describe: "setting the fork PR contributor approval policy"
+		describe: "setting the fork PR contributor approval policy",
+		read: sliceOf("fork_pr_contributor_approval")
 	}),
 	fork_pr_workflows_private_repos: endpointRouted({
 		get: "getForkPrPrivate",
 		put: "putForkPrPrivate",
 		label: "actions.fork_pr_workflows_private_repos",
 		applied: "applied the private-repo fork PR workflow settings",
-		describe: "setting the private-repo fork PR workflow settings"
+		describe: "setting the private-repo fork PR workflow settings",
+		read: sliceOf("fork_pr_workflows_private_repos")
 	})
 };
 const ROUTED_DESTINATIONS = KEY_DESTINATION;
@@ -2927,6 +3052,11 @@ async function planRouted(key, ctx, section, desired, plan) {
 	if (declared === void 0) return;
 	await ROUTED_DESTINATIONS[key].plan(ctx, section, declared, plan);
 }
+/** Read one routed key back; generic so the handler and the value stay correlated to one key. */
+async function snapshotRouted(key, ctx, section, base, notes) {
+	const read = await readOrNote(notes, `actions.${key}`, () => ROUTED_DESTINATIONS[key].snapshot(ctx, section, base, notes));
+	return "denied" in read ? void 0 : read.value;
+}
 function keysTo(destination) {
 	return new Set(Object.entries(KEY_DESTINATION).filter(([, dest]) => dest === destination).map(([key]) => key));
 }
@@ -2979,6 +3109,21 @@ const actionsSection = {
 		}
 		for (const key of ROUTED_KEYS) await planRouted(key, ctx, this, desired, plan);
 		return plan;
+	},
+	async snapshot(ctx) {
+		const notes = [];
+		const base = projectOntoSchema(ActionsConfig, await ctx.read.getPermissions.call());
+		const value = { ...base };
+		const workflow = await readOrNote(notes, `actions.${[...WORKFLOW_KEYS].join("/")}`, () => ctx.read.getWorkflow.call());
+		if (!("denied" in workflow)) Object.assign(value, projectOntoSchema(ActionsConfig, workflow.value));
+		for (const key of ROUTED_KEYS) {
+			const read = await snapshotRouted(key, ctx, this, base, notes);
+			if (read !== void 0) value[key] = read;
+		}
+		return {
+			value,
+			notes
+		};
 	}
 };
 //#endregion
@@ -3289,101 +3434,6 @@ async function planSecrets(section, scope, opts) {
 	return plan;
 }
 //#endregion
-//#region src/sections/shared/snapshot-helpers.ts
-function defOf(schema) {
-	return schema._zod.def;
-}
-/** The schema types the projection treats as leaves: the live value passes through verbatim. */
-const LEAF_TYPES = /* @__PURE__ */ new Set([
-	"string",
-	"number",
-	"int",
-	"boolean",
-	"enum",
-	"literal",
-	"unknown",
-	"null"
-]);
-function isPlainObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/**
-* A live value projected onto a schema slice, so server-assigned fields fall away without a hand
-* list per section. A nested `null` the slice cannot hold is GitHub's "no value" (a not-configured
-* setup's runner_type) and its key is omitted; a value the slice rejects at the root stays, so the
-* engine's validation names a body outside the shape instead of the section vanishing. A
-* passthrough slice (a catchall other than never) keeps every live key by design, so a section on
-* one names the keys it reads back itself. The casts are the boundary the engine validates behind.
-*/
-function projectOntoSchema(schema, live) {
-	if (live === null && !schema.safeParse(null).success) return live;
-	return project(schema, live);
-}
-function project(schema, live) {
-	if (live === void 0) return;
-	if (live === null) return schema.safeParse(null).success ? null : void 0;
-	const def = defOf(schema);
-	switch (def.type) {
-		case "optional":
-		case "nullable": return project(def.innerType, live);
-		case "object": {
-			if (!isPlainObject(live)) return live;
-			const shape = def.shape ?? {};
-			const out = {};
-			for (const [key, child] of Object.entries(shape)) {
-				const projected = project(child, live[key]);
-				if (projected !== void 0) out[key] = projected;
-			}
-			if (def.catchall !== void 0 && defOf(def.catchall).type !== "never") {
-				for (const [key, value] of Object.entries(live)) if (!(key in shape) && value !== void 0) out[key] = value;
-			}
-			return out;
-		}
-		case "array": return Array.isArray(live) ? live.map((item) => project(def.element, item)) : live;
-		case "record": return isPlainObject(live) ? Object.fromEntries(Object.entries(live).map(([key, value]) => [key, project(def.valueType, value)])) : live;
-		case "union": {
-			const option = (def.options ?? []).find((candidate) => candidate.safeParse(live).success);
-			return option === void 0 ? live : project(option, live);
-		}
-		default:
-			if (!LEAF_TYPES.has(def.type)) throw new Error(`projectOntoSchema(): unhandled schema type "${def.type}" - teach the projection its walk before authoring it in a section slice`);
-			return live;
-	}
-}
-/**
-* Refuse a live list holding two resources under one identity (GitHub allows repeated deploy-key
-* titles and hook urls): the planner manages one resource per identity and would refuse the
-* snapshot's own file, so the snapshot fails here, naming the pairs, instead of emitting it.
-*/
-function rejectLiveDuplicates(section, noun, items, keyOf, describe) {
-	const collisions = collidingPairs(items, keyOf, describe);
-	if (collisions.length > 0) throw new Error(`${section.key}: GitHub holds ${noun}s that resolve to one identity: ${collisions.join("; ")}. This section manages one ${noun} per identity, so the snapshot cannot declare them; delete all but one of each on GitHub, then snapshot again`);
-}
-/**
-* One read of a snapshot that a denial may take out without failing the section: a
-* PermissionDenied becomes a note naming the key left out and the grant advice, anything else
-* propagates. For a section whose keys sit behind different grants (repository, actions).
-* @public
-*/
-async function readOrNote(notes, label, read) {
-	try {
-		return { value: await read() };
-	} catch (error) {
-		if (error instanceof PermissionDenied) {
-			notes.push(`${label}: left out of the snapshot - ${error.detail}`);
-			return { denied: true };
-		}
-		throw error;
-	}
-}
-/** A knobbed section's snapshot value: its entries under the section's own default policy, spelled out. */
-function knobbedSnapshot(section, entries) {
-	return {
-		_undeclared: defaultUndeclaredPolicy(section),
-		entries
-	};
-}
-//#endregion
 //#region src/sections/shared/repo-secrets.ts
 /**
 * The factory derives the routes from THIS map, so a key paired with another family's segment (which the
@@ -7290,6 +7340,66 @@ const ENDPOINTS$5 = {
 	}
 };
 const LiveRepository = z.looseObject({ topics: z.array(z.string()).nullish() });
+/**
+* The GET also reports what nobody can PATCH (ids, urls, counts, has_downloads) and the passthrough
+* slice cannot tell those apart, so the PATCH fields are spelled out and pinned below.
+* `name` stays out: a settings file reused on another repository would rename it.
+*/
+const SNAPSHOT_PATCH_FIELDS = [
+	"description",
+	"homepage",
+	"private",
+	"visibility",
+	"security_and_analysis",
+	"has_issues",
+	"has_projects",
+	"has_wiki",
+	"has_discussions",
+	"has_pull_requests",
+	"pull_request_creation_policy",
+	"is_template",
+	"default_branch",
+	"allow_squash_merge",
+	"allow_merge_commit",
+	"allow_rebase_merge",
+	"allow_auto_merge",
+	"delete_branch_on_merge",
+	"allow_update_branch",
+	"use_squash_pr_title_as_default",
+	"squash_merge_commit_title",
+	"squash_merge_commit_message",
+	"merge_commit_title",
+	"merge_commit_message",
+	"archived",
+	"allow_forking",
+	"web_commit_signoff_required"
+];
+/**
+* The GET's dependabot_security_updates is the automated-security-fixes toggle, already emitted from
+* its own endpoint, and the PATCH rejects an unknown sub-key, so the nested object is pinned too.
+*/
+const SECURITY_AND_ANALYSIS_PATCH_FIELDS = [
+	"advanced_security",
+	"code_security",
+	"secret_scanning",
+	"secret_scanning_push_protection",
+	"secret_scanning_ai_detection",
+	"secret_scanning_non_provider_patterns",
+	"secret_scanning_delegated_alert_dismissal",
+	"secret_scanning_delegated_bypass",
+	"secret_scanning_delegated_bypass_options",
+	"secret_scanning_validity_checks"
+];
+/** The live security_and_analysis object narrowed to its PATCHable sub-keys; undefined when none. */
+function snapshotSecurityAndAnalysis(live) {
+	if (typeof live !== "object" || live === null || Array.isArray(live)) return;
+	const out = {};
+	for (const field of SECURITY_AND_ANALYSIS_PATCH_FIELDS) {
+		const value = live[field];
+		if (value !== void 0 && value !== null) out[field] = value;
+	}
+	return Object.keys(out).length === 0 ? void 0 : out;
+}
 const FEATURES_QUERY = graphqlOp()({
 	name: "RepositoryFeatures",
 	kind: "read",
@@ -7392,6 +7502,11 @@ const GRAPHQL_ROUTED_KEYS = [{
 	changeText: (value) => String(value),
 	unreadableHint: "a null policy means GitHub reported no issue creation policy for this repository; otherwise the field vocabulary may have changed"
 }];
+/** Why a routed field's live value cannot be read into the settings vocabulary. */
+function unreadableRoutedValue(entry, raw, opName) {
+	const hint = entry.unreadableHint ? `; ${entry.unreadableHint}` : "";
+	return `GRAPHQL ${opName} returned ${entry.field} ${JSON.stringify(raw)}, which this section cannot read as a repository.${entry.key} value${hint}`;
+}
 /**
 * Strictness is scoped to the DECLARED keys: an unreadable value (the SDL-nullable policy, a future
 * enum member) must fail loudly for a key the file declares and must not fail a run that never declared it.
@@ -7400,17 +7515,19 @@ function decodeRoutedFields(fields, routed, opName) {
 	const values = {};
 	for (const entry of routed) {
 		const decoded = entry.decode(fields[entry.field]);
-		if (decoded === void 0) {
-			const hint = entry.unreadableHint ? `; ${entry.unreadableHint}` : "";
-			throw new Error(`repository: GRAPHQL ${opName} returned ${entry.field} ${JSON.stringify(fields[entry.field])}, which this section cannot read as a repository.${entry.key} value${hint}. Drop the key, or update the action if GitHub's vocabulary moved`);
-		}
+		if (decoded === void 0) throw new Error(`repository: ${unreadableRoutedValue(entry, fields[entry.field], opName)}. Drop the key, or update the action if GitHub's vocabulary moved`);
 		values[entry.key] = decoded;
 	}
 	return values;
 }
-async function fetchRoutedState(ctx, routed) {
-	const repository = (await ctx.read.featuresQuery.call(repoVariables(ctx))).repository;
+/** The Repository object of a features read, with the node id the mutation addresses. */
+function repositoryNode(data) {
+	const repository = data.repository;
 	if (!repository || typeof repository.id !== "string") throw new Error(`repository: GRAPHQL ${FEATURES_QUERY.name} returned no repository object with an id, so the ${GRAPHQL_ROUTED_KEYS.map((entry) => entry.key).join("/")} state cannot be read. Check the token's repository access`);
+	return repository;
+}
+async function fetchRoutedState(ctx, routed) {
+	const repository = repositoryNode(await ctx.read.featuresQuery.call(repoVariables(ctx)));
 	return {
 		id: repository.id,
 		values: decodeRoutedFields(repository, routed, FEATURES_QUERY.name)
@@ -7518,6 +7635,57 @@ const repositorySection = {
 			}
 		}
 		return plan;
+	},
+	async snapshot(ctx) {
+		const notes = [];
+		const live = parseLive(this, ENDPOINTS$5.get, LiveRepository, await ctx.read.get.call());
+		const value = {};
+		for (const field of SNAPSHOT_PATCH_FIELDS) {
+			const read = field === "security_and_analysis" ? snapshotSecurityAndAnalysis(live[field]) : live[field];
+			if (read !== void 0 && read !== null) value[field] = read;
+		}
+		if (live.topics !== void 0 && live.topics !== null && live.topics.length > 0) value.topics = [...live.topics];
+		const probes = [];
+		for (const toggle of READABLE_TOGGLES) {
+			const read = await readOrNote(notes, `repository.${toggle.key}`, async () => {
+				const answer = await ctx.read[toggle.get].tryCall();
+				if ("error" in answer) return {
+					live: void 0,
+					concealable: answer.error.status === 404
+				};
+				return {
+					live: parseLive(this, ENDPOINTS$5[toggle.get], toggle.live, answer.data),
+					concealable: false
+				};
+			});
+			if (!("denied" in read)) probes.push({
+				toggle,
+				...read.value
+			});
+		}
+		if (probes.length > 0 && probes.every((probe) => probe.concealable)) notes.push(`repository.${probes.map((probe) => probe.toggle.key).join("/")}: every toggle GET answered 404, which reads as off but is also how a fine-grained token missing the grant is answered, so they are left out; if the token does ${sectionGrant(this)}, they are all off and can be declared false`);
+		else for (const { toggle, live } of probes) {
+			const enabled = live === void 0 ? false : toggle.isEnabled(live);
+			value[toggle.key] = enabled;
+			if (live !== void 0 && toggle.isEnforced?.(live) === true) notes.push(`repository.${toggle.key}: ${OWNER_ENFORCED}, so it reads back as ${enabled} but cannot be changed from the repository`);
+		}
+		for (const toggle of WRITE_ONLY_TOGGLES) notes.push(`repository.${toggle.key}: GitHub exposes no endpoint to read ${toggle.label} back, so the snapshot leaves it out; declare it yourself to manage it`);
+		const routed = await readOrNote(notes, GRAPHQL_ROUTED_KEYS.map((entry) => `repository.${entry.key}`).join(" and "), () => ctx.read.featuresQuery.call(repoVariables(ctx)));
+		if (!("denied" in routed)) {
+			const repository = repositoryNode(routed.value);
+			for (const entry of GRAPHQL_ROUTED_KEYS) {
+				const decoded = entry.decode(repository[entry.field]);
+				if (decoded === void 0) {
+					notes.push(`repository.${entry.key}: ${unreadableRoutedValue(entry, repository[entry.field], FEATURES_QUERY.name)}, so the snapshot leaves it out`);
+					continue;
+				}
+				value[entry.key] = decoded;
+			}
+		}
+		return {
+			value,
+			notes
+		};
 	}
 };
 //#endregion
@@ -7552,12 +7720,24 @@ const LiveRulesetSummary = z.looseObject({
 });
 const permission$4 = { repo: ["administration"] };
 /**
-* GitHub returns a ruleset's bypass_actors only to a token with write access to the ruleset
-* (Administration at write); any other GET omits the KEY, never `[]`. Returns the input itself when
-* nothing is hidden, so the caller can tell the two apart by identity.
+* A summary this section may manage: one no other source explicitly owns (source_type is optional in
+* the API type). Deletion is gated harder in plan(): only an explicit "Repository" is ever deleted,
+* since a missing field is not proof.
+*/
+function notInherited(summary) {
+	return (summary.source_type ?? "Repository") === "Repository";
+}
+const BYPASS_HIDDEN = "bypass_actors is not visible to this token (GitHub returns it only to a token with write access to the ruleset)";
+/** GitHub omits the bypass_actors KEY (never `[]`) from a GET the token lacks write access for. */
+function bypassActorsVisible(live) {
+	return typeof live === "object" && live !== null && Object.hasOwn(live, "bypass_actors");
+}
+/**
+* The declared ruleset minus a bypass_actors list the token cannot observe, so it reads as neither
+* drift nor a phantom key. Returns the input itself when nothing is hidden, so the caller can tell.
 */
 function observableRuleset(ruleset, live) {
-	if (!(Object.hasOwn(ruleset, "bypass_actors") && typeof live === "object" && live !== null && !Object.hasOwn(live, "bypass_actors"))) return ruleset;
+	if (!Object.hasOwn(ruleset, "bypass_actors") || bypassActorsVisible(live)) return ruleset;
 	const { bypass_actors: _hidden, ...visible } = ruleset;
 	return visible;
 }
@@ -7607,7 +7787,7 @@ const rulesetsSection = {
 		const { policy, entries } = undeclaredPolicy(declared, defaultUndeclaredPolicy(this));
 		const desired = entries.map(normalizeRuleset);
 		rejectDuplicates(this, desired, (r) => r.name, (r) => r.name);
-		const repoRulesets = parseLive(this, ENDPOINTS$4.list, z.array(LiveRulesetSummary), await ctx.read.list.listAll()).filter((r) => (r.source_type ?? "Repository") === "Repository");
+		const repoRulesets = parseLive(this, ENDPOINTS$4.list, z.array(LiveRulesetSummary), await ctx.read.list.listAll()).filter(notInherited);
 		const idByName = new Map(repoRulesets.map((r) => [r.name, r.id]));
 		const plan = {
 			ops: [],
@@ -7629,7 +7809,7 @@ const rulesetsSection = {
 			}
 			const live = await ctx.read.get.call({ params: { ruleset_id: String(id) } });
 			const compared = observableRuleset(ruleset, live);
-			if (compared !== ruleset) plan.notes.push(`rulesets[${ruleset.name}]: bypass_actors is not visible to this token (GitHub returns it only to a token with write access to the ruleset), so drift on it cannot be judged here; grant Administration write to check it`);
+			if (compared !== ruleset) plan.notes.push(`rulesets[${ruleset.name}]: ${BYPASS_HIDDEN}, so drift on it cannot be judged here; grant Administration write to check it`);
 			const drift = subsetDiff(compared, live, `rulesets[${ruleset.name}]`);
 			if (!hasDrift(drift)) continue;
 			const phantom = phantomKeys(compared, live);
@@ -7669,6 +7849,29 @@ const rulesetsSection = {
 			}));
 		}
 		return plan;
+	},
+	async snapshot(ctx) {
+		const summaries = parseLive(this, ENDPOINTS$4.list, z.array(LiveRulesetSummary), await ctx.read.list.listAll());
+		const notes = summaries.filter((summary) => !notInherited(summary)).map((summary) => `rulesets[${summary.name}]: inherited from the ${String(summary.source_type).toLowerCase()} (source_type "${summary.source_type}"), so it is not part of the repository's snapshot; manage it where it is defined`);
+		const manageable = summaries.filter(notInherited);
+		rejectLiveDuplicates(this, "ruleset", manageable, (summary) => summary.name, (summary) => `${summary.name} (id ${summary.id})`);
+		const entries = [];
+		for (const summary of manageable) {
+			const live = await ctx.read.get.call({ params: { ruleset_id: String(summary.id) } });
+			if (!bypassActorsVisible(live)) {
+				notes.push(`rulesets[${summary.name}]: ${BYPASS_HIDDEN}, and an entry without it would clear the bypass list on the next update, so the ruleset is left out of the snapshot (kept undeclared); grant Administration write to read it back`);
+				continue;
+			}
+			entries.push(projectOntoSchema(RulesetConfig, live));
+		}
+		if (manageable.length === 0) return {
+			value: void 0,
+			notes
+		};
+		return {
+			value: knobbedSnapshot(this, entries),
+			notes
+		};
 	}
 };
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vivswan/github-settings-as-code",
-  "version": "2.0.1-main.0.g3fad2b2",
+  "version": "2.0.1-main.1072.gfded5f5",
   "description": "GitHub Action applying declarative repository settings: rulesets, labels, branch protection, and more.",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",