@vivswan/github-settings-as-code 2.0.1-main.1081.gc25bbfe → 2.0.1-main.1089.g2dd2ba5

package/LICENSE.md

@@ -557,5 +557,5 @@ software incorporates into what it produces are output. The software's
 **Use** means anything you do with the software requiring one of your
 licenses.
 
-<!-- The license text between the BEGIN/END markers is managed by Vivswan/repo-platform and replaced on every sync. Repository-specific license notices (third-party components, differently licensed paths) go below the END marker; they are this repository's own and survive every sync. -->
+<!-- The license text between the BEGIN/END markers is managed by the platform and replaced on every sync. Repository-specific license notices (third-party components, differently licensed paths) go below the END marker; they are this repository's own and survive every sync. -->
 <!-- END REPO-PLATFORM MANAGED -->

package/lib/pkg/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as SNAPSHOT_ONLY_INPUTS, E as parseSnapshotFileConfig, F as concludeMerge, I as concludeRun, Kt as redactRanges, L as failRun, Rt as GithubApi, S as SNAPSHOT_INPUTS, T as parseConfig, U as PRIVATE_REPORT_CHANNELS, Wt as maskRegistry, _ as INPUT_DECLS, d as runSnapshot, f as runSingle, j as readSettingsFile, k as runMulti, o as snapshotRepository, pt as SECTIONS, s as validateSettings, t as runMerge, tt as describeProblem, u as concludeSnapshot, v as MERGE_INPUTS, y as MERGE_ONLY_INPUTS, yt as sectionGrant } from "./src-BFMt0V_E.js";
+import { C as SNAPSHOT_ONLY_INPUTS, E as parseSnapshotFileConfig, F as concludeMerge, I as concludeRun, Kt as redactRanges, L as failRun, Rt as GithubApi, S as SNAPSHOT_INPUTS, T as parseConfig, U as PRIVATE_REPORT_CHANNELS, Wt as maskRegistry, _ as INPUT_DECLS, d as runSnapshot, f as runSingle, j as readSettingsFile, k as runMulti, o as snapshotRepository, pt as SECTIONS, s as validateSettings, t as runMerge, tt as describeProblem, u as concludeSnapshot, v as MERGE_INPUTS, y as MERGE_ONLY_INPUTS, yt as sectionGrant } from "./src-L_4G-LmP.js";
 import { appendFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { ResultAsync, err, ok } from "neverthrow";

package/lib/pkg/index.d.ts

@@ -1619,12 +1619,12 @@ interface SectionSnapshot<K extends SectionKey = SectionKey> {
  * repository; the engine renders them as drift in check mode and executes them in apply mode.
  * Modules register in ../registry.ts.
  *
- *   snapshot() present  -> reads through the same port, so it cannot write either
+ *   snapshot() present  -> reads through the same port (plus the run's denial policy), so it cannot write either
  *   snapshot() absent   -> the section is unsupported by snapshot (snapshotUnsupportedNote)
  */
 interface SectionModule<K extends SectionKey = SectionKey, E extends EndpointDict = EndpointDict, G extends GraphqlDict = GraphqlDict> extends SectionModuleBase<K, E, G> {
   plan(ctx: PlanContext<E, G>, desired: SectionInput<K>): Promise<SectionPlan<PlannedOp<E, G>>>;
-  snapshot?(ctx: PlanContext<E, G>): Promise<SectionSnapshot<K>>;
+  snapshot?(ctx: SnapshotContext<E, G>): Promise<SectionSnapshot<K>>;
   /** Pinned so a non-literal object carrying a run() handler is not assignable either. */
   run?: never;
 }
@@ -1799,6 +1799,24 @@ interface PlanContext<E extends EndpointDict = EndpointDict, G extends GraphqlDi
   readonly repo: RepoRef;
   readonly read: BoundReads<E, G>;
 }
+/**
+ * The policy as a snapshot() sees it. Only snapshotContext() mints one: the constructor is private
+ * and the class nominal, so a section cannot hand readOrNote a literal "warn" and turn a denial the
+ * run should fail on into a note.
+ */
+declare class DenialPolicy {
+  private readonly input;
+  private constructor();
+  /** Under warn a denied sub-read is noted and left out; under fail it propagates. */
+  get notesDenials(): boolean;
+}
+/**
+ * What snapshot() reads through: the plan port plus the run's denial policy, so a helper over one
+ * sub-read (readOrNote) classifies a denial where it happens instead of noting it under both.
+ */
+interface SnapshotContext<E extends EndpointDict = EndpointDict, G extends GraphqlDict = GraphqlDict> extends PlanContext<E, G> {
+  readonly onMissingPermission: DenialPolicy;
+}
 /**
  * `D` is the drift type its arm demands: an ordinary operation must justify itself with at least one
  * drift line (DriftFor), so "check reported clean while apply mutated" is unrepresentable.
@@ -2095,7 +2113,7 @@ interface ListSectionModule<K extends ListSectionKey, Ends extends ListEndpoints
   readonly secretValues?: (declared: Declared<K>) => DeclaredSecretValue[];
   readonly layering?: KeyedListLayering;
   readonly plan: (ctx: PlanContext<Ends>, desired: Declared<K>) => Promise<SectionPlan<PlannedOp<Ends>>>;
-  readonly snapshot: (ctx: PlanContext<Ends>) => Promise<SectionSnapshot<K>>;
+  readonly snapshot: (ctx: SnapshotContext<Ends>) => Promise<SectionSnapshot<K>>;
   /** The declaration, for the harness derivations (the mock's transformers, the fuzz witness). */
   readonly decl: ListSectionDecl<K, Ends, Live, F>;
 }
@@ -2626,7 +2644,7 @@ interface RepoSecretsSectionModule<K extends RepoSecretsKey> {
   readonly secretValues: typeof listSecretValues;
   readonly closedSurface: typeof CLOSED_SURFACE;
   readonly plan: RepoSecretsPlan<K>;
-  readonly snapshot: (ctx: PlanContext<RepoSecretsEndpoints<SecretsSegment<K>>>) => Promise<SectionSnapshot<K>>;
+  readonly snapshot: (ctx: SnapshotContext<RepoSecretsEndpoints<SecretsSegment<K>>>) => Promise<SectionSnapshot<K>>;
 }
 //#endregion
 //#region src/sections/shared/setup-section.d.ts
@@ -2721,7 +2739,7 @@ interface SetupSectionModule<K extends SetupKey> {
   readonly endpoints: SetupEndpoints<K>;
   readonly shape: z.ZodType;
   readonly plan: SetupPlan<K>;
-  readonly snapshot: (ctx: PlanContext<SetupEndpoints<K>>) => Promise<SectionSnapshot<K>>;
+  readonly snapshot: (ctx: SnapshotContext<SetupEndpoints<K>>) => Promise<SectionSnapshot<K>>;
 }
 //#endregion
 //#region src/sections/shared/repo-variables.d.ts
@@ -2788,7 +2806,7 @@ interface RepoVariablesSectionModule<K extends RepoVariablesKey> {
   readonly endpoints: RepoVariablesEndpoints<VariablesSegment<K>>;
   readonly shape: z.ZodType;
   readonly plan: RepoVariablesPlan<K>;
-  readonly snapshot: (ctx: PlanContext<RepoVariablesEndpoints<VariablesSegment<K>>>) => Promise<SectionSnapshot<K>>;
+  readonly snapshot: (ctx: SnapshotContext<RepoVariablesEndpoints<VariablesSegment<K>>>) => Promise<SectionSnapshot<K>>;
 }
 //#endregion
 //#region src/sections/registry.d.ts
@@ -3296,7 +3314,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly get: {
         readonly route: "GET /repos/{owner}/{repo}";
         readonly statuses: {
@@ -3663,7 +3681,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly list: {
         readonly route: "GET /repos/{owner}/{repo}/rulesets";
         readonly statuses: {
@@ -4179,7 +4197,7 @@ declare const byKey: {
         }[];
       } | undefined;
     }[]): Promise<EnvironmentsPlan>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly list: {
         readonly route: "GET /repos/{owner}/{repo}/environments";
         readonly statuses: {
@@ -4802,7 +4820,7 @@ declare const byKey: {
         } | null | undefined;
       } | null;
     }[]): Promise<BranchesPlan>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly getProtection: {
         readonly route: "GET /repos/{owner}/{repo}/branches/{branch}/protection";
         readonly statuses: {
@@ -5517,7 +5535,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly getPermissions: {
         readonly route: "GET /repos/{owner}/{repo}/actions/permissions";
         readonly statuses: {
@@ -5770,7 +5788,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly list: {
         readonly route: "GET /repos/{owner}/{repo}/actions/workflows";
         readonly statuses: {
@@ -5961,7 +5979,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly get: {
         readonly route: "GET /repos/{owner}/{repo}/pages";
         readonly statuses: {
@@ -6172,7 +6190,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly list: {
         readonly route: "GET /repos/{owner}/{repo}/collaborators";
         readonly statuses: {
@@ -6321,7 +6339,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     }>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly org: {
         readonly route: "GET /orgs/{org}";
         readonly statuses: {
@@ -6474,7 +6492,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly list: {
         readonly route: "GET /repos/{owner}/{repo}/milestones";
         readonly statuses: {
@@ -6760,7 +6778,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly get: {
         readonly route: "GET /repos/{owner}/{repo}/interaction-limits";
         readonly statuses: {
@@ -7012,7 +7030,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly list: {
         readonly route: "GET /repos/{owner}/{repo}/hooks";
         readonly statuses: {
@@ -7171,7 +7189,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     }>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly org: {
         readonly route: "GET /orgs/{org}";
         readonly statuses: {
@@ -7420,7 +7438,7 @@ declare const byKey: {
       }> | undefined;
       readonly variables?: never;
     })>>;
-    snapshot(ctx: PlanContext<{
+    snapshot(ctx: SnapshotContext<{
       readonly list: {
         readonly route: "GET /repos/{owner}/{repo}/secret-scanning/custom-patterns";
         readonly statuses: {

package/lib/pkg/index.js

@@ -1,2 +1,2 @@
-import { $ as renderSnapshotYaml, A as parseSettingsDoc, At as parseReposInput, B as planRedaction, Bt as SECRET_TRANSPORT_WITHHELD, C as SNAPSHOT_ONLY_INPUTS, Ct as endpointMethod, D as DEFAULT_SETTINGS_FILE, Dt as SECTION_KEYS, E as parseSnapshotFileConfig, Et as PROBOT_PARITY_KEYS, F as concludeMerge, Ft as VISIBILITY_FILTERS, G as openReportChannel, Gt as prefixedIo, H as toPublicView, Ht as isRateLimitError, I as concludeRun, It as discoverRepos, J as MARKER_LABEL_CONFIG, Jt as resolveCentralTargets, K as ISSUE_TITLE, Kt as redactRanges, L as failRun, Lt as DEFAULT_API_VERSION, M as createVisibilityResolver, Mt as ARCHIVED_FILTERS, N as getRepoFile, Nt as DEFAULT_DISCOVERY_FILTERS, O as resolveTargets, Ot as SettingsFile, P as MERGE_RESULT, Pt as FORKS_FILTERS, Q as parseRecipient, R as PRIVATE_REPOS_POLICIES, Rt as GithubApi, S as SNAPSHOT_INPUTS, St as grantFor, T as parseConfig, Tt as DOCUMENT_DIRECTIVE_KEYS, U as PRIVATE_REPORT_CHANNELS, Ut as collectingIo, V as publicDetail, Vt as isPermissionError, W as applyMarkerInjection, Wt as maskRegistry, X as deliverArtifactReport, Xt as parseRepoSlug, Y as composeReport, Yt as dedupeTargets, Z as encryptReport, _ as INPUT_DECLS, _t as denialPosture, a as snapshotRepositories, at as preflightProbe, b as MERGE_REJECTED_INPUTS, bt as sectionOperations, c as SNAPSHOT_RESULTS, ct as validateSettingsDoc, d as runSnapshot, dt as mergeLayers, et as RERUN_ADVICE, f as runSingle, ft as stripNulls, g as FILTER_INPUTS, gt as sectionModule, h as DEFAULT_PRIVATE_REPOS, ht as allGraphqlOps, i as renderMergedYaml, it as REPO_RESULTS, j as readSettingsFile, jt as AFFILIATIONS, k as runMulti, kt as UNDECLARED_POLICY_SECTIONS, l as SNAPSHOT_SCHEMA_URL, lt as worstOf, m as readLayerFiles, mt as allEndpoints, n as applyRepository, nt as quoteList, o as snapshotRepository, ot as runForRepo, p as foldLayers, pt as SECTIONS, q as MARKER_LABEL, qt as silentIo, r as checkRepository, rt as SectionSelection, s as validateSettings, st as skippedSectionKeys, t as runMerge, tt as describeProblem, u as concludeSnapshot, ut as describeOptOut, v as MERGE_INPUTS, vt as readGating, w as SNAPSHOT_REJECTED_INPUTS, wt as endpointPath, x as MODES, xt as writeGatedReads, y as MERGE_ONLY_INPUTS, yt as sectionGrant, z as capturingIo, zt as SECRET_RESPONSE_WITHHELD } from "./src-BFMt0V_E.js";
+import { $ as renderSnapshotYaml, A as parseSettingsDoc, At as parseReposInput, B as planRedaction, Bt as SECRET_TRANSPORT_WITHHELD, C as SNAPSHOT_ONLY_INPUTS, Ct as endpointMethod, D as DEFAULT_SETTINGS_FILE, Dt as SECTION_KEYS, E as parseSnapshotFileConfig, Et as PROBOT_PARITY_KEYS, F as concludeMerge, Ft as VISIBILITY_FILTERS, G as openReportChannel, Gt as prefixedIo, H as toPublicView, Ht as isRateLimitError, I as concludeRun, It as discoverRepos, J as MARKER_LABEL_CONFIG, Jt as resolveCentralTargets, K as ISSUE_TITLE, Kt as redactRanges, L as failRun, Lt as DEFAULT_API_VERSION, M as createVisibilityResolver, Mt as ARCHIVED_FILTERS, N as getRepoFile, Nt as DEFAULT_DISCOVERY_FILTERS, O as resolveTargets, Ot as SettingsFile, P as MERGE_RESULT, Pt as FORKS_FILTERS, Q as parseRecipient, R as PRIVATE_REPOS_POLICIES, Rt as GithubApi, S as SNAPSHOT_INPUTS, St as grantFor, T as parseConfig, Tt as DOCUMENT_DIRECTIVE_KEYS, U as PRIVATE_REPORT_CHANNELS, Ut as collectingIo, V as publicDetail, Vt as isPermissionError, W as applyMarkerInjection, Wt as maskRegistry, X as deliverArtifactReport, Xt as parseRepoSlug, Y as composeReport, Yt as dedupeTargets, Z as encryptReport, _ as INPUT_DECLS, _t as denialPosture, a as snapshotRepositories, at as preflightProbe, b as MERGE_REJECTED_INPUTS, bt as sectionOperations, c as SNAPSHOT_RESULTS, ct as validateSettingsDoc, d as runSnapshot, dt as mergeLayers, et as RERUN_ADVICE, f as runSingle, ft as stripNulls, g as FILTER_INPUTS, gt as sectionModule, h as DEFAULT_PRIVATE_REPOS, ht as allGraphqlOps, i as renderMergedYaml, it as REPO_RESULTS, j as readSettingsFile, jt as AFFILIATIONS, k as runMulti, kt as UNDECLARED_POLICY_SECTIONS, l as SNAPSHOT_SCHEMA_URL, lt as worstOf, m as readLayerFiles, mt as allEndpoints, n as applyRepository, nt as quoteList, o as snapshotRepository, ot as runForRepo, p as foldLayers, pt as SECTIONS, q as MARKER_LABEL, qt as silentIo, r as checkRepository, rt as SectionSelection, s as validateSettings, st as skippedSectionKeys, t as runMerge, tt as describeProblem, u as concludeSnapshot, ut as describeOptOut, v as MERGE_INPUTS, vt as readGating, w as SNAPSHOT_REJECTED_INPUTS, wt as endpointPath, x as MODES, xt as writeGatedReads, y as MERGE_ONLY_INPUTS, yt as sectionGrant, z as capturingIo, zt as SECRET_RESPONSE_WITHHELD } from "./src-L_4G-LmP.js";
 export { AFFILIATIONS, ARCHIVED_FILTERS, DEFAULT_API_VERSION, DEFAULT_DISCOVERY_FILTERS, DEFAULT_PRIVATE_REPOS, DEFAULT_SETTINGS_FILE, DOCUMENT_DIRECTIVE_KEYS, FILTER_INPUTS, FORKS_FILTERS, GithubApi, INPUT_DECLS, ISSUE_TITLE, MARKER_LABEL, MARKER_LABEL_CONFIG, MERGE_INPUTS, MERGE_ONLY_INPUTS, MERGE_REJECTED_INPUTS, MERGE_RESULT, MODES, PRIVATE_REPORT_CHANNELS, PRIVATE_REPOS_POLICIES, PROBOT_PARITY_KEYS, REPO_RESULTS, RERUN_ADVICE, SECRET_RESPONSE_WITHHELD, SECRET_TRANSPORT_WITHHELD, SECTIONS, SECTION_KEYS, SNAPSHOT_INPUTS, SNAPSHOT_ONLY_INPUTS, SNAPSHOT_REJECTED_INPUTS, SNAPSHOT_RESULTS, SNAPSHOT_SCHEMA_URL, SectionSelection, SettingsFile, UNDECLARED_POLICY_SECTIONS, VISIBILITY_FILTERS, allEndpoints, allGraphqlOps, applyMarkerInjection, applyRepository, capturingIo, checkRepository, collectingIo, composeReport, concludeMerge, concludeRun, concludeSnapshot, createVisibilityResolver, dedupeTargets, deliverArtifactReport, denialPosture, describeOptOut, describeProblem, discoverRepos, encryptReport, endpointMethod, endpointPath, failRun, foldLayers, getRepoFile, grantFor, isPermissionError, isRateLimitError, maskRegistry, mergeLayers, openReportChannel, parseConfig, parseRecipient, parseRepoSlug, parseReposInput, parseSettingsDoc, parseSnapshotFileConfig, planRedaction, prefixedIo, preflightProbe, publicDetail, quoteList, readGating, readLayerFiles, readSettingsFile, redactRanges, renderMergedYaml, renderSnapshotYaml, resolveCentralTargets, resolveTargets, runForRepo, runMerge, runMulti, runSingle, runSnapshot, sectionGrant, sectionModule, sectionOperations, silentIo, skippedSectionKeys, snapshotRepositories, snapshotRepository, stripNulls, toPublicView, validateSettings, validateSettingsDoc, worstOf, writeGatedReads };

package/lib/pkg/{src-BFMt0V_E.js → src-L_4G-LmP.js}

@@ -2635,6 +2635,20 @@ function plainData(value) {
 function gated(bound) {
 	return Object.fromEntries(Object.entries(bound).map(([name, helper]) => [name, typeof helper === "function" ? (_exec, ...args) => helper(...args) : helper]));
 }
+let mintPolicy;
+(class DenialPolicy {
+	input;
+	constructor(input) {
+		this.input = input;
+	}
+	static {
+		mintPolicy = (input) => new DenialPolicy(input);
+	}
+	/** Under warn a denied sub-read is noted and left out; under fail it propagates. */
+	get notesDenials() {
+		return this.input === "warn";
+	}
+});
 function driftOf(op) {
 	return "unverifiable" in op.drift ? op.drift.lines : op.drift;
 }
@@ -2698,6 +2712,12 @@ function planContext(meta, api, repo) {
 		read: boundReads(meta, api, repo)
 	};
 }
+function snapshotContext(meta, api, repo, onMissingPermission) {
+	return {
+		...planContext(meta, api, repo),
+		onMissingPermission: mintPolicy(onMissingPermission)
+	};
+}
 //#endregion
 //#region src/sections/shared/snapshot-helpers.ts
 function defOf(schema) {
@@ -2770,15 +2790,17 @@ function rejectLiveDuplicates(section, noun, items, keyOf, describe) {
 	if (collisions.length > 0) throw new Error(`${section.key}: GitHub holds ${noun}s that resolve to one identity: ${collisions.join("; ")}. This section manages one ${noun} per identity, so the snapshot cannot declare them; delete all but one of each on GitHub, then snapshot again`);
 }
 /**
-* One read of a snapshot that a denial may take out without failing the section: a
-* PermissionDenied becomes a note naming the key left out and the grant advice, anything else
-* propagates. For a section whose keys sit behind different grants (repository, actions).
+* One read of a snapshot whose denial is that read's alone, for a section whose keys sit behind
+* different grants (repository, actions, environments). Under `warn` a PermissionDenied becomes a
+* note naming the key left out and the grant advice; under `fail` it propagates, so the engine
+* fails the section exactly as it does a primary read's denial. Anything else propagates. The
+* policy arrives as the carrier only snapshotContext() mints, so a section cannot pick "warn".
 */
-async function readOrNote(notes, label, read) {
+async function readOrNote(ctx, notes, label, read) {
 	try {
 		return { value: await read() };
 	} catch (error) {
-		if (error instanceof PermissionDenied) {
+		if (error instanceof PermissionDenied && ctx.onMissingPermission.notesDenials) {
 			notes.push(`${label}: left out of the snapshot - ${error.detail}`);
 			return { denied: true };
 		}
@@ -3002,7 +3024,7 @@ const KEY_DESTINATION = {
 		snapshot: async (ctx, _section, _base, notes) => {
 			const limits = {};
 			for (const [key, wiring] of Object.entries(CACHE_ENDPOINT_BY_KEY)) {
-				const read = await readOrNote(notes, `actions.cache.${key}`, () => ctx.read[wiring.get].call());
+				const read = await readOrNote(ctx, notes, `actions.cache.${key}`, () => ctx.read[wiring.get].call());
 				if (!("denied" in read)) Object.assign(limits, read.value);
 			}
 			return Object.keys(limits).length === 0 ? void 0 : sliceOf("cache")(limits);
@@ -3054,7 +3076,7 @@ async function planRouted(key, ctx, section, desired, plan) {
 }
 /** Read one routed key back; generic so the handler and the value stay correlated to one key. */
 async function snapshotRouted(key, ctx, section, base, notes) {
-	const read = await readOrNote(notes, `actions.${key}`, () => ROUTED_DESTINATIONS[key].snapshot(ctx, section, base, notes));
+	const read = await readOrNote(ctx, notes, `actions.${key}`, () => ROUTED_DESTINATIONS[key].snapshot(ctx, section, base, notes));
 	return "denied" in read ? void 0 : read.value;
 }
 function keysTo(destination) {
@@ -3114,7 +3136,7 @@ const actionsSection = {
 		const notes = [];
 		const base = projectOntoSchema(ActionsConfig, await ctx.read.getPermissions.call());
 		const value = { ...base };
-		const workflow = await readOrNote(notes, `actions.${[...WORKFLOW_KEYS].join("/")}`, () => ctx.read.getWorkflow.call());
+		const workflow = await readOrNote(ctx, notes, `actions.${[...WORKFLOW_KEYS].join("/")}`, () => ctx.read.getWorkflow.call());
 		if (!("denied" in workflow)) Object.assign(value, projectOntoSchema(ActionsConfig, workflow.value));
 		for (const key of ROUTED_KEYS) {
 			const read = await snapshotRouted(key, ctx, this, base, notes);
@@ -5936,10 +5958,7 @@ function liveRuleId(rule, envName) {
 * spec, so an ABSENT list reads as empty, while a PRESENT off-shape value fails loudly in parseLive.
 */
 async function listProtectionRules(ctx, section, envName) {
-	return parseLive(section, ENDPOINTS$10.listProtectionRules, z.looseObject({ custom_deployment_protection_rules: z.array(LiveProtectionRule).optional() }).nullable(), await ctx.read.listProtectionRules.call({
-		params: { environment_name: envName },
-		describe: `listing deployment protection rules of environment "${envName}"`
-	}), `environment "${envName}"`)?.custom_deployment_protection_rules ?? [];
+	return parseLive(section, ENDPOINTS$10.listProtectionRules, z.looseObject({ custom_deployment_protection_rules: z.array(LiveProtectionRule).optional() }).nullable(), await ctx.read.listProtectionRules.call({ params: { environment_name: envName } }), `environment "${envName}"`)?.custom_deployment_protection_rules ?? [];
 }
 /** An unlisted slug means the App is not installed, which nothing this section may call can change. */
 function resolveIntegrationId(apps, slug, envName) {
@@ -6498,7 +6517,7 @@ function wrapped(key, entries) {
 * flag enables them (the endpoint 404s otherwise); a disabled protection rule is not an active
 * gate, so it is not declared. Each secret becomes a `$NAME` reference with a note asking for it.
 * The policy and rule lists sit behind the Actions grant, not the section's, so a denial there
-* leaves that key out with a note instead of taking the whole section down.
+* is the key's own: a note under the warn policy, the section's failure under fail.
 */
 async function snapshotNested(ctx, section, envName, liveEnv) {
 	const nested = {};
@@ -6518,10 +6537,10 @@ async function snapshotNested(ctx, section, envName, liveEnv) {
 		for (const { name, variable } of references) notes.push(`environments[${envName}].secrets[${name}]: value of ${name} is not readable; export it into the environment as ${variable} before apply`);
 	}
 	if (liveEnv.deployment_branch_policy?.custom_branch_policies === true) {
-		const policies = await readOrNote(notes, `environments[${envName}].deployment_branch_policies`, () => listBranchPolicies(ctx, section, envName));
+		const policies = await readOrNote(ctx, notes, `environments[${envName}].deployment_branch_policies`, () => listBranchPolicies(ctx, section, envName));
 		if ("value" in policies && policies.value.length > 0) nested.deployment_branch_policies = wrapped("deployment_branch_policies", policies.value.map((policy) => projectOntoSchema(DeploymentBranchPolicyConfig, policy)));
 	}
-	const rules = await readOrNote(notes, `environments[${envName}].deployment_protection_rules`, () => listProtectionRules(ctx, section, envName));
+	const rules = await readOrNote(ctx, notes, `environments[${envName}].deployment_protection_rules`, () => listProtectionRules(ctx, section, envName));
 	if ("value" in rules) {
 		const enabled = rules.value.filter((rule) => rule.enabled !== false);
 		if (enabled.length > 0) nested.deployment_protection_rules = wrapped("deployment_protection_rules", enabled.map((rule) => ({ app: liveRuleSlug(rule, envName) })));
@@ -7647,7 +7666,7 @@ const repositorySection = {
 		if (live.topics !== void 0 && live.topics !== null && live.topics.length > 0) value.topics = [...live.topics];
 		const probes = [];
 		for (const toggle of READABLE_TOGGLES) {
-			const read = await readOrNote(notes, `repository.${toggle.key}`, async () => {
+			const read = await readOrNote(ctx, notes, `repository.${toggle.key}`, async () => {
 				const answer = await ctx.read[toggle.get].tryCall();
 				if ("error" in answer) return {
 					live: void 0,
@@ -7670,7 +7689,7 @@ const repositorySection = {
 			if (live !== void 0 && toggle.isEnforced?.(live) === true) notes.push(`repository.${toggle.key}: ${OWNER_ENFORCED}, so it reads back as ${enabled} but cannot be changed from the repository`);
 		}
 		for (const toggle of WRITE_ONLY_TOGGLES) notes.push(`repository.${toggle.key}: GitHub exposes no endpoint to read ${toggle.label} back, so the snapshot leaves it out; declare it yourself to manage it`);
-		const routed = await readOrNote(notes, GRAPHQL_ROUTED_KEYS.map((entry) => `repository.${entry.key}`).join(" and "), () => ctx.read.featuresQuery.call(repoVariables(ctx)));
+		const routed = await readOrNote(ctx, notes, GRAPHQL_ROUTED_KEYS.map((entry) => `repository.${entry.key}`).join(" and "), () => ctx.read.featuresQuery.call(repoVariables(ctx)));
 		if (!("denied" in routed)) {
 			const repository = repositoryNode(routed.value);
 			for (const entry of GRAPHQL_ROUTED_KEYS) {
@@ -9719,7 +9738,7 @@ async function snapshotRepository$1(api, opts, io) {
 		const seen = { notFound: false };
 		let snapshot;
 		try {
-			snapshot = await section.snapshot(planContext(section, watchingNotFound(api, absentRead, seen), opts.repo));
+			snapshot = await section.snapshot(snapshotContext(section, watchingNotFound(api, absentRead, seen), opts.repo, opts.onMissingPermission));
 		} catch (error) {
 			if (error instanceof PermissionDenied) {
 				const status = opts.onMissingPermission === "warn" ? "skipped" : "failed";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vivswan/github-settings-as-code",
-  "version": "2.0.1-main.1081.gc25bbfe",
+  "version": "2.0.1-main.1089.g2dd2ba5",
   "description": "GitHub Action applying declarative repository settings: rulesets, labels, branch protection, and more.",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",