@vivswan/github-settings-as-code 2.0.1-main.1083.g04d8d35 → 2.0.1-main.1090.g15ef0c9

package/LICENSE.md

@@ -557,5 +557,5 @@ software incorporates into what it produces are output. The software's
 **Use** means anything you do with the software requiring one of your
 licenses.
 
-<!-- The license text between the BEGIN/END markers is managed by Vivswan/repo-platform and replaced on every sync. Repository-specific license notices (third-party components, differently licensed paths) go below the END marker; they are this repository's own and survive every sync. -->
+<!-- The license text between the BEGIN/END markers is managed by the platform and replaced on every sync. Repository-specific license notices (third-party components, differently licensed paths) go below the END marker; they are this repository's own and survive every sync. -->
 <!-- END REPO-PLATFORM MANAGED -->

package/lib/pkg/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as SNAPSHOT_ONLY_INPUTS, E as parseSnapshotFileConfig, F as concludeMerge, I as concludeRun, Kt as redactRanges, L as failRun, Rt as GithubApi, S as SNAPSHOT_INPUTS, T as parseConfig, U as PRIVATE_REPORT_CHANNELS, Wt as maskRegistry, _ as INPUT_DECLS, d as runSnapshot, f as runSingle, j as readSettingsFile, k as runMulti, o as snapshotRepository, pt as SECTIONS, s as validateSettings, t as runMerge, tt as describeProblem, u as concludeSnapshot, v as MERGE_INPUTS, y as MERGE_ONLY_INPUTS, yt as sectionGrant } from "./src-L_4G-LmP.js";
+import { C as SNAPSHOT_ONLY_INPUTS, E as parseSnapshotFileConfig, F as concludeMerge, I as concludeRun, Kt as redactRanges, L as failRun, Rt as GithubApi, S as SNAPSHOT_INPUTS, T as parseConfig, U as PRIVATE_REPORT_CHANNELS, Wt as maskRegistry, _ as INPUT_DECLS, d as runSnapshot, f as runSingle, j as readSettingsFile, k as runMulti, o as snapshotRepository, pt as SECTIONS, s as validateSettings, t as runMerge, tt as describeProblem, u as concludeSnapshot, v as MERGE_INPUTS, y as MERGE_ONLY_INPUTS, yt as sectionGrant } from "./src-BhuD5Ycj.js";
 import { appendFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { ResultAsync, err, ok } from "neverthrow";

package/lib/pkg/index.d.ts

@@ -1461,6 +1461,8 @@ interface UndeclaredPolicyList<E> {
   _layering?: "merge" | "replace";
 }
 type MustBeNever<T extends never> = T;
+/** Readonly through every nested object and array; functions pass untouched. The type twin of a deep Object.freeze. */
+type DeepReadonly<T> = T extends ((...args: never[]) => unknown) ? T : T extends object ? { readonly [P in keyof T]: DeepReadonly<T[P]>; } : T;
 //#endregion
 //#region src/sections/contract/module.d.ts
 type EndpointDict = Readonly<Record<string, EndpointDecl>>;
@@ -2012,12 +2014,15 @@ type Address<Ends extends ListEndpoints> = Ends extends {
     readonly route: infer U extends string;
   };
 } ? SameParams<U, Ends["remove"]["route"]> : Readonly<Record<PathParams<Ends["remove"]["route"]>, string>>;
-/** Declared fields only: an omitted optional stays OUT (never undefined), so it is neither written nor compared. */
-type Write<F extends string> = { readonly [P in F]: string; } & {
+/**
+ * Declared fields only: an omitted optional stays OUT (never undefined), so it is neither written nor compared.
+ * A section narrows it to pin a folded field's brand on its lens (labels' HexColor).
+ */
+type ListWrite<F extends string> = { readonly [P in F]: string; } & {
   readonly [key: string]: PlainData;
 };
 /** A live item in the same terms, each field normalized as GitHub stores it. */
-type Comparable<F extends string> = { readonly [P in F]: string; } & Readonly<Record<string, unknown>>;
+type ListComparable<F extends string> = { readonly [P in F]: string; } & Readonly<Record<string, unknown>>;
 type NoteWording = Pick<Parameters<typeof undeclaredNote>[0], "state" | "add" | "manage">;
 type DriftWording = Pick<Parameters<typeof undeclaredDrift>[1], "state" | "add" | "keep">;
 /** `unpaginated` also drives the derived mock's list handler (test/e2e/mock/list-fragment.ts). */
@@ -2027,7 +2032,11 @@ interface Listing {
   /** GitHub serves the whole list in one response and ignores page params (autolinks), so the page loop is skipped. */
   readonly unpaginated?: true;
 }
-interface ListSectionDecl<K extends ListSectionKey, Ends extends ListEndpoints, Live extends object, F extends string> {
+/**
+ * `Key` is the fold's output: the planner keys every live-versus-declared lookup by it, so an unfolded
+ * name cannot be looked up, and a section's brand (labels' NameKey) survives to `decl`.
+ */
+interface ListSectionDecl<K extends ListSectionKey, Ends extends ListEndpoints, Live extends object, F extends string, Key extends string> {
   readonly key: K;
   readonly permission: SectionPermission;
   readonly undeclaredDefault: UndeclaredPolicy;
@@ -2042,8 +2051,8 @@ interface ListSectionDecl<K extends ListSectionKey, Ends extends ListEndpoints,
   readonly identity: {
     /** The write field naming the resource, as the live item carries it ("name", "title"). */
     readonly field: F;
-    /** Folds a name to its matching key; omitted when GitHub matches exactly. */
-    readonly fold?: (name: string) => string;
+    /** Folds a name to the key GitHub matches it by; `exactName` when GitHub matches exactly. */
+    readonly fold: (name: string) => Key;
     /**
      * Names an entry also answers to (a label's pre-rename `name`), so a live item under one is this
      * entry's, renamed by the update, not undeclared.
@@ -2062,7 +2071,7 @@ interface ListSectionDecl<K extends ListSectionKey, Ends extends ListEndpoints,
   readonly address: [Address<Ends>] extends [never] ? never : (live: Live) => Address<Ends>;
   readonly lens: {
     /** The entry in wire terms: the create body, and what a converged live item reads back as. */
-    readonly toWrite: (entry: Entry<K>) => Write<F>;
+    readonly toWrite: (entry: Entry<K>) => ListWrite<F>;
     /**
      * A live item in the same terms as toWrite, so the two compare field by field.
      *
@@ -2070,7 +2079,7 @@ interface ListSectionDecl<K extends ListSectionKey, Ends extends ListEndpoints,
      *   other declared fields   -> normalized as GitHub stores them (a color lowercased without "#", a null description as "")
      *   every other live field  -> kept, so declared passthrough keys compare against what the API echoed
      */
-    readonly fromLive: (live: Live) => Comparable<F>;
+    readonly fromLive: (live: Live) => ListComparable<F>;
     /** Per entry field holding a list, the item key to pair by (see DeltaOptions.matchBy); `{}` when none does. */
     readonly matchBy: Readonly<Partial<Record<keyof Entry<K> & string, string>>>;
   };
@@ -2078,7 +2087,7 @@ interface ListSectionDecl<K extends ListSectionKey, Ends extends ListEndpoints,
    * The body recreating a drifted item of a resource GitHub cannot edit (no update role), when the
    * write alone would drop a live field the file leaves undeclared (a deploy key's read_only).
    */
-  readonly recreate?: "update" extends keyof Ends ? never : (live: Live, write: Write<F>) => Write<F>;
+  readonly recreate?: "update" extends keyof Ends ? never : (live: Live, write: ListWrite<F>) => ListWrite<F>;
   /**
    * Conflicts the identities cannot show, one line each naming the fix; any line fails the section.
    *
@@ -2086,8 +2095,8 @@ interface ListSectionDecl<K extends ListSectionKey, Ends extends ListEndpoints,
    *   `live`      -> runs after the read and before any write (a deploy key's material held by another key)
    */
   readonly conflicts?: {
-    readonly declared?: (writes: readonly Write<F>[]) => readonly string[];
-    readonly live?: (writes: readonly Write<F>[], live: readonly Comparable<F>[]) => readonly string[];
+    readonly declared?: (writes: readonly ListWrite<F>[]) => readonly string[];
+    readonly live?: (writes: readonly ListWrite<F>[], live: readonly ListComparable<F>[]) => readonly string[];
   };
   readonly prose: {
     /** What apply does to an undeclared live resource, as the note and drift spell it ("DELETE it"). */
@@ -2104,7 +2113,7 @@ interface ListSectionDecl<K extends ListSectionKey, Ends extends ListEndpoints,
   readonly layering?: Pick<KeyedListLayering, "combine">;
 }
 /** The module listSection() mints: SectionModule<K, Ends> at the registry, plus its declaration. */
-interface ListSectionModule<K extends ListSectionKey, Ends extends ListEndpoints, Live extends object, F extends string> {
+interface ListSectionModule<K extends ListSectionKey, Ends extends ListEndpoints, Live extends object, F extends string, Key extends string> {
   readonly key: K;
   readonly permission: SectionPermission;
   readonly undeclaredDefault: UndeclaredPolicy;
@@ -2115,9 +2124,16 @@ interface ListSectionModule<K extends ListSectionKey, Ends extends ListEndpoints
   readonly plan: (ctx: PlanContext<Ends>, desired: Declared<K>) => Promise<SectionPlan<PlannedOp<Ends>>>;
   readonly snapshot: (ctx: SnapshotContext<Ends>) => Promise<SectionSnapshot<K>>;
   /** The declaration, for the harness derivations (the mock's transformers, the fuzz witness). */
-  readonly decl: ListSectionDecl<K, Ends, Live, F>;
+  readonly decl: ListSectionDecl<K, Ends, Live, F, Key>;
 }
 //#endregion
+//#region src/sections/labels/index.d.ts
+/** Case-insensitive matching is the section's whole contract; the brand marks a name as already folded. */
+declare const labelNameKey: unique symbol;
+type NameKey = string & {
+  readonly [labelNameKey]: true;
+};
+//#endregion
 //#region src/sections/environments/endpoints.d.ts
 declare const ENDPOINTS$1: {
   readonly list: {
@@ -3502,7 +3518,7 @@ declare const byKey: {
     name: string;
     color: string;
     description: string | null;
-  }, "name">;
+  }, "name", NameKey>;
   rulesets: {
     key: "rulesets";
     undeclaredDefault: "keep";
@@ -5039,7 +5055,7 @@ declare const byKey: {
     [x: string]: unknown;
     id: number;
     key_prefix: string;
-  }, "key_prefix">;
+  }, "key_prefix", string>;
   actions: {
     key: "actions";
     undeclaredDefault: "untouched";
@@ -7259,8 +7275,8 @@ declare const byKey: {
     id: number;
     title: string;
     key: string;
-    read_only?: boolean | undefined;
-  }, "title">;
+    read_only: boolean;
+  }, "title", string>;
   secret_scanning_custom_patterns: {
     key: "secret_scanning_custom_patterns";
     undeclaredDefault: "keep";
@@ -7507,26 +7523,25 @@ type SectionGraphqlKey<K extends SectionKey = SectionKey> = { [S in SectionKey]:
 export declare const SECTIONS: readonly SectionModule[];
 /** The section module for a key (validate.ts reads shape + closedSurface). */
 export declare function sectionModule<K extends SectionKey>(key: K): SectionModule<K>;
-type TaggedEndpoint = EndpointDecl & {
+type TaggedEndpoint = DeepReadonly<EndpointDecl & {
   readonly section: SectionKey;
   readonly role: string;
-};
+}>;
 /**
  * The single view the e2e mock's route table and USED_PATHS iterate, keyed by the exact SectionEndpointKey
- * union so an undeclared lookup does not compile.
- *
- *   frozen (record, tagged entries, nested statuses/permission)  -> they reference the declarations, which must never mutate
- *   `sections` injectable                                        -> the scope-free assert is testable; an injected list keeps string keys
+ * union so an undeclared lookup does not compile. Deep-frozen, and the source declaration with it: the
+ * entries reference the declarations, which must never mutate. `sections` is injectable so the scope-free
+ * assert is testable; an injected list keeps string keys.
  */
 export declare function allEndpoints(): Readonly<Record<SectionEndpointKey, TaggedEndpoint>>;
 export declare function allEndpoints(sections: ReadonlyArray<Pick<SectionModule, "key" | "endpoints">>): Readonly<Record<string, TaggedEndpoint>>;
-type TaggedGraphqlOp = GraphqlOpDecl & {
+type TaggedGraphqlOp = DeepReadonly<GraphqlOpDecl & {
   readonly section: SectionKey;
   readonly role: string;
-};
+}>;
 /**
  * The allEndpoints() sibling for the mock's dispatch table, the coverage tripwire, and the fault-key
- * universe; frozen for the same reason. Operation NAMES must be globally unique (the wire dispatch key),
+ * universe; deep-frozen for the same reason. Operation NAMES must be globally unique (the wire dispatch key),
  * and a role never collides with a REST role in the same section (fault directives share one "section.role" key space).
  */
 export declare function allGraphqlOps(): Readonly<Record<SectionGraphqlKey, TaggedGraphqlOp>>;

package/lib/pkg/index.js

@@ -1,2 +1,2 @@
-import { $ as renderSnapshotYaml, A as parseSettingsDoc, At as parseReposInput, B as planRedaction, Bt as SECRET_TRANSPORT_WITHHELD, C as SNAPSHOT_ONLY_INPUTS, Ct as endpointMethod, D as DEFAULT_SETTINGS_FILE, Dt as SECTION_KEYS, E as parseSnapshotFileConfig, Et as PROBOT_PARITY_KEYS, F as concludeMerge, Ft as VISIBILITY_FILTERS, G as openReportChannel, Gt as prefixedIo, H as toPublicView, Ht as isRateLimitError, I as concludeRun, It as discoverRepos, J as MARKER_LABEL_CONFIG, Jt as resolveCentralTargets, K as ISSUE_TITLE, Kt as redactRanges, L as failRun, Lt as DEFAULT_API_VERSION, M as createVisibilityResolver, Mt as ARCHIVED_FILTERS, N as getRepoFile, Nt as DEFAULT_DISCOVERY_FILTERS, O as resolveTargets, Ot as SettingsFile, P as MERGE_RESULT, Pt as FORKS_FILTERS, Q as parseRecipient, R as PRIVATE_REPOS_POLICIES, Rt as GithubApi, S as SNAPSHOT_INPUTS, St as grantFor, T as parseConfig, Tt as DOCUMENT_DIRECTIVE_KEYS, U as PRIVATE_REPORT_CHANNELS, Ut as collectingIo, V as publicDetail, Vt as isPermissionError, W as applyMarkerInjection, Wt as maskRegistry, X as deliverArtifactReport, Xt as parseRepoSlug, Y as composeReport, Yt as dedupeTargets, Z as encryptReport, _ as INPUT_DECLS, _t as denialPosture, a as snapshotRepositories, at as preflightProbe, b as MERGE_REJECTED_INPUTS, bt as sectionOperations, c as SNAPSHOT_RESULTS, ct as validateSettingsDoc, d as runSnapshot, dt as mergeLayers, et as RERUN_ADVICE, f as runSingle, ft as stripNulls, g as FILTER_INPUTS, gt as sectionModule, h as DEFAULT_PRIVATE_REPOS, ht as allGraphqlOps, i as renderMergedYaml, it as REPO_RESULTS, j as readSettingsFile, jt as AFFILIATIONS, k as runMulti, kt as UNDECLARED_POLICY_SECTIONS, l as SNAPSHOT_SCHEMA_URL, lt as worstOf, m as readLayerFiles, mt as allEndpoints, n as applyRepository, nt as quoteList, o as snapshotRepository, ot as runForRepo, p as foldLayers, pt as SECTIONS, q as MARKER_LABEL, qt as silentIo, r as checkRepository, rt as SectionSelection, s as validateSettings, st as skippedSectionKeys, t as runMerge, tt as describeProblem, u as concludeSnapshot, ut as describeOptOut, v as MERGE_INPUTS, vt as readGating, w as SNAPSHOT_REJECTED_INPUTS, wt as endpointPath, x as MODES, xt as writeGatedReads, y as MERGE_ONLY_INPUTS, yt as sectionGrant, z as capturingIo, zt as SECRET_RESPONSE_WITHHELD } from "./src-L_4G-LmP.js";
+import { $ as renderSnapshotYaml, A as parseSettingsDoc, At as parseReposInput, B as planRedaction, Bt as SECRET_TRANSPORT_WITHHELD, C as SNAPSHOT_ONLY_INPUTS, Ct as endpointMethod, D as DEFAULT_SETTINGS_FILE, Dt as SECTION_KEYS, E as parseSnapshotFileConfig, Et as PROBOT_PARITY_KEYS, F as concludeMerge, Ft as VISIBILITY_FILTERS, G as openReportChannel, Gt as prefixedIo, H as toPublicView, Ht as isRateLimitError, I as concludeRun, It as discoverRepos, J as MARKER_LABEL_CONFIG, Jt as resolveCentralTargets, K as ISSUE_TITLE, Kt as redactRanges, L as failRun, Lt as DEFAULT_API_VERSION, M as createVisibilityResolver, Mt as ARCHIVED_FILTERS, N as getRepoFile, Nt as DEFAULT_DISCOVERY_FILTERS, O as resolveTargets, Ot as SettingsFile, P as MERGE_RESULT, Pt as FORKS_FILTERS, Q as parseRecipient, R as PRIVATE_REPOS_POLICIES, Rt as GithubApi, S as SNAPSHOT_INPUTS, St as grantFor, T as parseConfig, Tt as DOCUMENT_DIRECTIVE_KEYS, U as PRIVATE_REPORT_CHANNELS, Ut as collectingIo, V as publicDetail, Vt as isPermissionError, W as applyMarkerInjection, Wt as maskRegistry, X as deliverArtifactReport, Xt as parseRepoSlug, Y as composeReport, Yt as dedupeTargets, Z as encryptReport, _ as INPUT_DECLS, _t as denialPosture, a as snapshotRepositories, at as preflightProbe, b as MERGE_REJECTED_INPUTS, bt as sectionOperations, c as SNAPSHOT_RESULTS, ct as validateSettingsDoc, d as runSnapshot, dt as mergeLayers, et as RERUN_ADVICE, f as runSingle, ft as stripNulls, g as FILTER_INPUTS, gt as sectionModule, h as DEFAULT_PRIVATE_REPOS, ht as allGraphqlOps, i as renderMergedYaml, it as REPO_RESULTS, j as readSettingsFile, jt as AFFILIATIONS, k as runMulti, kt as UNDECLARED_POLICY_SECTIONS, l as SNAPSHOT_SCHEMA_URL, lt as worstOf, m as readLayerFiles, mt as allEndpoints, n as applyRepository, nt as quoteList, o as snapshotRepository, ot as runForRepo, p as foldLayers, pt as SECTIONS, q as MARKER_LABEL, qt as silentIo, r as checkRepository, rt as SectionSelection, s as validateSettings, st as skippedSectionKeys, t as runMerge, tt as describeProblem, u as concludeSnapshot, ut as describeOptOut, v as MERGE_INPUTS, vt as readGating, w as SNAPSHOT_REJECTED_INPUTS, wt as endpointPath, x as MODES, xt as writeGatedReads, y as MERGE_ONLY_INPUTS, yt as sectionGrant, z as capturingIo, zt as SECRET_RESPONSE_WITHHELD } from "./src-BhuD5Ycj.js";
 export { AFFILIATIONS, ARCHIVED_FILTERS, DEFAULT_API_VERSION, DEFAULT_DISCOVERY_FILTERS, DEFAULT_PRIVATE_REPOS, DEFAULT_SETTINGS_FILE, DOCUMENT_DIRECTIVE_KEYS, FILTER_INPUTS, FORKS_FILTERS, GithubApi, INPUT_DECLS, ISSUE_TITLE, MARKER_LABEL, MARKER_LABEL_CONFIG, MERGE_INPUTS, MERGE_ONLY_INPUTS, MERGE_REJECTED_INPUTS, MERGE_RESULT, MODES, PRIVATE_REPORT_CHANNELS, PRIVATE_REPOS_POLICIES, PROBOT_PARITY_KEYS, REPO_RESULTS, RERUN_ADVICE, SECRET_RESPONSE_WITHHELD, SECRET_TRANSPORT_WITHHELD, SECTIONS, SECTION_KEYS, SNAPSHOT_INPUTS, SNAPSHOT_ONLY_INPUTS, SNAPSHOT_REJECTED_INPUTS, SNAPSHOT_RESULTS, SNAPSHOT_SCHEMA_URL, SectionSelection, SettingsFile, UNDECLARED_POLICY_SECTIONS, VISIBILITY_FILTERS, allEndpoints, allGraphqlOps, applyMarkerInjection, applyRepository, capturingIo, checkRepository, collectingIo, composeReport, concludeMerge, concludeRun, concludeSnapshot, createVisibilityResolver, dedupeTargets, deliverArtifactReport, denialPosture, describeOptOut, describeProblem, discoverRepos, encryptReport, endpointMethod, endpointPath, failRun, foldLayers, getRepoFile, grantFor, isPermissionError, isRateLimitError, maskRegistry, mergeLayers, openReportChannel, parseConfig, parseRecipient, parseRepoSlug, parseReposInput, parseSettingsDoc, parseSnapshotFileConfig, planRedaction, prefixedIo, preflightProbe, publicDetail, quoteList, readGating, readLayerFiles, readSettingsFile, redactRanges, renderMergedYaml, renderSnapshotYaml, resolveCentralTargets, resolveTargets, runForRepo, runMerge, runMulti, runSingle, runSnapshot, sectionGrant, sectionModule, sectionOperations, silentIo, skippedSectionKeys, snapshotRepositories, snapshotRepository, stripNulls, toPublicView, validateSettings, validateSettingsDoc, worstOf, writeGatedReads };

package/lib/pkg/{src-L_4G-LmP.js → src-BhuD5Ycj.js}

@@ -3609,8 +3609,8 @@ const LiveVariable = z.looseObject({
 	name: z.string(),
 	value: z.string()
 });
-function missingVariableDrift(scope, label) {
-	return `${label}: missing - declared in the settings file but not on ${scope.home ?? "the repo"}; apply will create it`;
+function missingVariableDrift(label) {
+	return `${label}: missing - declared in the settings file but not on the repo; apply will create it`;
 }
 function valueDriftLine(label, declared, live) {
 	return `${label}.value: declared ${JSON.stringify(declared)} != live ${JSON.stringify(live)}; apply will set the declared value`;
@@ -3618,7 +3618,7 @@ function valueDriftLine(label, declared, live) {
 function undeclaredVariableNote(scope, liveName) {
 	return undeclaredNote({
 		subject: `${scope.noun} "${liveName}"`,
-		state: `exists on ${scope.keepHome ?? "the repo"} but is not declared`,
+		state: "exists on the repo but is not declared",
 		action: "DELETE it"
 	});
 }
@@ -3635,8 +3635,6 @@ function liveVariablesByKey(live) {
 }
 async function planVariables$1(scope, opts) {
 	const { entries, policy, defaultPolicy } = opts;
-	const changeSuffix = scope.changeSuffix ?? "";
-	const removeSuffix = scope.removeSuffix ?? "";
 	const plan = {
 		ops: [],
 		notes: [],
@@ -3650,14 +3648,13 @@ async function planVariables$1(scope, opts) {
 		const { name: _name, value: _value, ...extraKeys } = variable;
 		if (!existing) {
 			plan.ops.push(scope.create({
-				name: variable.name,
 				payload: {
 					name: variable.name,
 					value: variable.value,
 					...extraKeys
 				},
-				drift: [missingVariableDrift(scope, label)],
-				change: `created ${scope.noun} "${variable.name}"${changeSuffix}`
+				drift: [missingVariableDrift(label)],
+				change: `created ${scope.noun} "${variable.name}"`
 			}));
 			continue;
 		}
@@ -3666,16 +3663,13 @@ async function planVariables$1(scope, opts) {
 		const phantom = phantomKeys(extraKeys, existing);
 		if (phantom.length > 0) plan.notes.push(phantomNote(label, phantom, "variable", "this update will re-run"));
 		plan.ops.push(scope.update({
-			names: {
-				declared: variable.name,
-				live: existing.name
-			},
+			liveName: existing.name,
 			payload: {
 				value: variable.value,
 				...extraKeys
 			},
 			drift: [first, ...rest],
-			change: `updated ${scope.noun} "${variable.name}"${changeSuffix}`
+			change: `updated ${scope.noun} "${variable.name}"`
 		}));
 	}
 	for (const variable of liveByKey.values()) {
@@ -3684,7 +3678,7 @@ async function planVariables$1(scope, opts) {
 		else plan.ops.push(scope.remove({
 			name: variable.name,
 			drift: [undeclaredVariableDrift(scope, defaultPolicy, variable.name)],
-			change: `DELETED undeclared ${scope.noun} "${variable.name}"${removeSuffix}`
+			change: `DELETED undeclared ${scope.noun} "${variable.name}"`
 		}));
 	}
 	return plan;
@@ -3760,7 +3754,7 @@ function repoVariablesSection(family) {
 			}),
 			update: (write) => ({
 				role: "update",
-				params: { name: write.names.live },
+				params: { name: write.liveName },
 				payload: write.payload,
 				drift: write.drift,
 				change: write.change
@@ -3841,6 +3835,10 @@ const agentsVariablesSection = repoVariablesSection({
 function updateRole(endpoints) {
 	return "update" in endpoints ? endpoints.update : void 0;
 }
+/** The fold of a section GitHub matches exactly: the key IS the name. */
+function exactName(name) {
+	return name;
+}
 const UPDATE_REMEDIES = {
 	value: "; apply will set the declared value",
 	rename: "apply will rename it",
@@ -3857,7 +3855,7 @@ const RECREATE_REMEDIES = {
 * which the merge refuses and a validated entry never is.
 */
 function identityClaims(identity, entry) {
-	const { field, renameKey, fold = (name) => name } = identity;
+	const { field, renameKey, fold } = identity;
 	const names = [(renameKey === void 0 ? void 0 : entry[renameKey]) ?? entry[field], ...identity.aliases?.(entry) ?? []];
 	if (!names.every((name) => typeof name === "string")) return null;
 	return [...new Set(names.map(fold))];
@@ -3895,7 +3893,7 @@ async function readList(decl, ctx) {
 }
 async function planList(decl, section, ctx, declared) {
 	const { key, noun, identity, lens, prose, endpoints } = decl;
-	const fold = identity.fold ?? ((name) => name);
+	const { fold } = identity;
 	const update = updateRole(endpoints);
 	const remedies = update === void 0 ? RECREATE_REMEDIES : UPDATE_REMEDIES;
 	const defaultPolicy = defaultUndeclaredPolicy(section);
@@ -4019,10 +4017,9 @@ async function snapshotList(decl, section, ctx) {
 		value: void 0,
 		notes: []
 	};
-	const fold = decl.identity.fold ?? ((name) => name);
 	const comparable = live.map((item) => decl.lens.fromLive(item));
 	const nameOfItem = (item) => nameOf(item, decl.identity.field);
-	rejectLiveDuplicates(section, decl.noun, comparable, (item) => fold(nameOfItem(item)), nameOfItem);
+	rejectLiveDuplicates(section, decl.noun, comparable, (item) => decl.identity.fold(nameOfItem(item)), nameOfItem);
 	return {
 		value: knobbedSnapshot(section, comparable.map((item) => projectOntoSchema(decl.entry, item))),
 		notes: []
@@ -4083,7 +4080,10 @@ const autolinksSection = listSection({
 		}
 	},
 	listing: { unpaginated: true },
-	identity: { field: "key_prefix" },
+	identity: {
+		field: "key_prefix",
+		fold: exactName
+	},
 	address: (live) => ({ autolink_id: String(live.id) }),
 	lens: {
 		toWrite: ({ key_prefix, url_template, is_alphanumeric, ...passthrough }) => ({
@@ -5608,7 +5608,7 @@ const LiveDeployKey = z.looseObject({
 	id: z.number(),
 	title: z.string(),
 	key: z.string(),
-	read_only: z.boolean().optional()
+	read_only: z.boolean()
 });
 const ENDPOINTS$11 = {
 	list: {
@@ -5652,7 +5652,10 @@ const deployKeysSection = listSection({
 	entry: DeployKeyConfig,
 	live: LiveDeployKey,
 	endpoints: ENDPOINTS$11,
-	identity: { field: "title" },
+	identity: {
+		field: "title",
+		fold: exactName
+	},
 	address: (live) => ({ key_id: String(live.id) }),
 	lens: {
 		toWrite: ({ title, key, read_only, ...passthrough }) => ({
@@ -5663,13 +5666,20 @@ const deployKeysSection = listSection({
 		}),
 		fromLive: (live) => ({
 			...live,
-			key: liveMaterial(live),
-			read_only: live.read_only ?? false
+			key: liveMaterial(live)
 		}),
 		matchBy: {}
 	},
+	/**
+	* GitHub creates a key READ/WRITE when the body omits read_only, and this file does not manage an
+	* undeclared flag, so the flag reaches a create body only from a source that holds it:
+	*
+	*   declared              -> the declared value, on a create and a recreate alike (the write is spread last)
+	*   undeclared, create    -> omitted: GitHub's default, never compared afterwards
+	*   undeclared, recreate  -> the LIVE flag re-sent, so rotating a read-only key never widens its access
+	*/
 	recreate: (live, write) => ({
-		read_only: live.read_only ?? false,
+		read_only: live.read_only,
 		...write
 	}),
 	conflicts: {
@@ -8629,19 +8639,25 @@ function sectionModule(key) {
 function assertScopeFree(kind, value) {
 	if (value.includes(":")) throw new Error(`BUG: ${kind} "${value}" contains ":", which the "section.role" key space reserves for a future scope prefix ("<scope>:<section>.<role>"); rename it without a colon`);
 }
+/**
+* Freezes in place through every nested object and array, so the declarations the tagged views share
+* cannot mutate under any consumer; functions are left as they are (nothing reads their properties).
+*/
+function deepFreeze(value) {
+	if (typeof value === "object" && value !== null) {
+		Object.freeze(value);
+		for (const child of Object.values(value)) deepFreeze(child);
+	}
+	return value;
+}
 function allEndpoints(sections = SECTIONS) {
 	const out = {};
 	for (const section of sections) {
 		assertScopeFree("section key", section.key);
 		for (const [role, endpoint] of Object.entries(section.endpoints)) {
 			assertScopeFree("role", role);
-			Object.freeze(endpoint.statuses);
-			if (endpoint.permission && typeof endpoint.permission === "object") {
-				Object.freeze(endpoint.permission);
-				Object.freeze(endpoint.permission.repo);
-			}
-			out[`${section.key}.${role}`] = Object.freeze({
-				...endpoint,
+			out[`${section.key}.${role}`] = deepFreeze({
+				...deepFreeze(endpoint),
 				section: section.key,
 				role
 			});
@@ -8661,13 +8677,8 @@ function allGraphqlOps(sections = SECTIONS) {
 			const holder = byName.get(op.name);
 			if (holder !== void 0) throw new Error(`BUG: GraphQL operation name "${op.name}" is declared by both ${holder} and ${key}; operation names are the wire dispatch key and must be globally unique`);
 			byName.set(op.name, key);
-			Object.freeze(op.outcomes);
-			if (op.permission && typeof op.permission === "object") {
-				Object.freeze(op.permission);
-				Object.freeze(op.permission.repo);
-			}
-			out[key] = Object.freeze({
-				...op,
+			out[key] = deepFreeze({
+				...deepFreeze(op),
 				section: section.key,
 				role
 			});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vivswan/github-settings-as-code",
-  "version": "2.0.1-main.1083.g04d8d35",
+  "version": "2.0.1-main.1090.g15ef0c9",
   "description": "GitHub Action applying declarative repository settings: rulesets, labels, branch protection, and more.",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",