@vivswan/github-settings-as-code 2.0.1-main.651.20260922.gf374e71 → 2.0.1-main.658.20260922.gdcb742f

package/README.md

@@ -1,5 +1,7 @@
 # GitHub Settings as Code
 
+[![Socket](https://badge.socket.dev/npm/package/@vivswan/github-settings-as-code)](https://socket.dev/npm/package/@vivswan/github-settings-as-code) [![CI](https://img.shields.io/github/actions/workflow/status/Vivswan/github-settings-as-code/ci.yml?branch=main&label=CI)](https://github.com/Vivswan/github-settings-as-code/actions/workflows/ci.yml?query=branch%3Amain) [![Release](https://img.shields.io/github/v/release/Vivswan/github-settings-as-code?label=release)](https://github.com/Vivswan/github-settings-as-code/releases/latest) [![npm](https://img.shields.io/npm/v/@vivswan/github-settings-as-code?label=npm)](https://www.npmjs.com/package/@vivswan/github-settings-as-code) [![npm next](https://img.shields.io/npm/v/@vivswan/github-settings-as-code/next?label=next)](https://www.npmjs.com/package/@vivswan/github-settings-as-code?activeTab=versions)
+
 Apply declarative repository settings from `.github/settings.yml`: a loud, stateless replacement for the [Probot Settings app](https://github.com/repository-settings/app) that also manages [rulesets](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/about-rulesets) (branch, tag, and push). Every apply is a visible workflow run that fails with the API's error message; nothing happens silently. The full documentation lives in [docs/](docs/README.md).
 
 ## Quick start
@@ -64,7 +66,7 @@ Apply declarative repository settings from `.github/settings.yml`: a loud, state
 
 The same engine is the npm package `@vivswan/github-settings-as-code` (ESM, Node 22.14 or newer): validate, merge, check, and apply from your own code.
 
-- `npm install @vivswan/github-settings-as-code` installs the released version; `@next` installs the newest green `main` commit as a pre-release. The [library reference](docs/reference/library.md) has the API by group and the versioning rules.
+- `npm install @vivswan/github-settings-as-code` installs the released version; `@next` installs the pre-release of the `main` commit release-please last refreshed the release PR on ([Versioning](docs/reference/library.md#versioning)). The [library reference](docs/reference/library.md) has the API by group and the versioning rules.
 - `npx @vivswan/github-settings-as-code@next check --repository o/r --settings-file .github/settings.yml` runs the action's check from a terminal. The [command line guide](docs/start/cli.md) has every command.
 
 ## Docs

package/lib/pkg/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { Ft as countNoun, Kt as redactRanges, N as failRun, Rt as GitHubApi, S as writeReplacing, St as sectionGrant, Wt as maskRegistry, Z as skippedSectionKeys, a as RENDER_INPUTS, c as SNAPSHOT_INPUTS, d as parseConfig, et as describeProblem, f as parseSnapshotFileConfig, k as readSettingsFile, l as SNAPSHOT_ONLY_INPUTS, o as RENDER_ONLY_INPUTS, p as snapshotFileDestination, r as INPUT_DECLS, st as SECTIONS } from "./inputs-D-CiUJdj.js";
-import { a as snapshotRepository, o as validateSettings, s as executeRun } from "./src-C3x6rbTD.js";
+import { Ft as countNoun, Kt as redactRanges, N as failRun, Rt as GitHubApi, S as writeReplacing, St as sectionGrant, Wt as maskRegistry, Z as skippedSectionKeys, a as RENDER_INPUTS, c as SNAPSHOT_INPUTS, d as parseConfig, et as describeProblem, f as parseSnapshotFileConfig, k as readSettingsFile, l as SNAPSHOT_ONLY_INPUTS, o as RENDER_ONLY_INPUTS, p as snapshotFileDestination, r as INPUT_DECLS, st as SECTIONS } from "./inputs-BOuUCdpl.js";
+import { a as snapshotRepository, o as validateSettings, s as executeRun } from "./src-C2gb8QkD.js";
 import { appendFileSync, existsSync } from "node:fs";
 import { ResultAsync, err } from "neverthrow";
 import { randomUUID } from "node:crypto";

package/lib/pkg/index.d.ts

@@ -1,4 +1,4 @@
-import { $n as RepoRef, A as SingleConfig, An as DEFAULT_API_VERSION, At as TaggedEndpoint, B as runMulti, Bn as isRateLimitError, Bt as ValidatedInput, Cn as DiscoveryFilters, D as SnapshotConfig, Dn as discoverRepos, Dt as SectionSelection, Fn as RequestMark, Ft as SectionInput, G as failRun, Gn as OutputName, Hn as CollectedLine, I as MultiConfig, Jn as prefixedIo, Jt as OnMissingPermission, Kn as collectingIo, Kt as DenialPolicy, Lt as SectionModule, M as runSingle, Mn as GitHubApiOptions, Mt as allGraphqlOps, N as RenderConfig, Nn as GitHubClient, Nt as sectionModule, O as concludeSnapshot, On as ApiError, Ot as SettingsSource, P as runRender, Pn as GraphqlOp, Qn as RemoteTarget, Qt as SnapshotContext, Rt as SectionSnapshot, S as parseConfig, Sn as DEFAULT_DISCOVERY_FILTERS, St as ValidatedSettings, T as FinishedSnapshot, U as concludeRender, Un as Io, Ut as sectionGrant, V as FinishedRender, Vn as AnnotationLevel, W as concludeRun, Wn as MaskPair, Xn as silentIo, Y as TargetOutcome, Yn as redactRanges, Yt as PlanContext, Zn as CentralTarget, Zt as SectionPlan, _ as RunConfig, _r as SettingsFile, _t as worstOf, an as EndpointDecl, ar as Problem, at as deliverArtifactReport, br as Layering, bt as RepoRunResult, cn as endpointPath, cr as SettingsFileRole, dr as describeProblem, dt as SectionSnapshotOutcome, er as Target, fn as FoldOptions, ft as SnapshotResult, g as RunCapabilities, gr as SectionKey, gt as RunOutcome, hn as describeRemoval, hr as SECTION_KEYS, ht as RUN_RESULTS, i as ConfigEnv, in as SectionFailure, ir as LayerProblem, it as ArtifactUploader, j as SingleOutcome, jn as GitHubApi, jt as allEndpoints, k as runSnapshot, kn as ClientAnswer, kt as SECTIONS, lr as SettingsProblem, mn as RemovalNotice, nn as snapshotContext, nr as parseRepoSlug, on as Route, or as ProblemOf, ot as encryptReport, pn as Layer, qn as maskRegistry, r as readLayerFiles, rn as GraphqlOpDecl, rt as openReportChannel, sn as endpointMethod, st as parseRecipient, tn as planContext, tr as dedupeTargets, tt as PrivateReportChannel, u as InputReader, ut as RenderableSnapshot, vn as UndeclaredPolicy, vr as UNDECLARED_POLICY_SECTIONS, xt as SectionOutcome, yr as UndeclaredPolicySection, yt as RepoRunOptions, zn as isPermissionError, zt as ValidatedBrand } from "./layers-CwR6OLB_.js";
+import { $n as RepoRef, A as SingleConfig, An as DEFAULT_API_VERSION, At as TaggedEndpoint, B as runMulti, Bn as isRateLimitError, Bt as ValidatedInput, Cn as DiscoveryFilters, D as SnapshotConfig, Dn as discoverRepos, Dt as SectionSelection, Fn as RequestMark, Ft as SectionInput, G as failRun, Gn as OutputName, Hn as CollectedLine, I as MultiConfig, Jn as prefixedIo, Jt as OnMissingPermission, Kn as collectingIo, Kt as DenialPolicy, Lt as SectionModule, M as runSingle, Mn as GitHubApiOptions, Mt as allGraphqlOps, N as RenderConfig, Nn as GitHubClient, Nt as sectionModule, O as concludeSnapshot, On as ApiError, Ot as SettingsSource, P as runRender, Pn as GraphqlOp, Qn as RemoteTarget, Qt as SnapshotContext, Rt as SectionSnapshot, S as parseConfig, Sn as DEFAULT_DISCOVERY_FILTERS, St as ValidatedSettings, T as FinishedSnapshot, U as concludeRender, Un as Io, Ut as sectionGrant, V as FinishedRender, Vn as AnnotationLevel, W as concludeRun, Wn as MaskPair, Xn as silentIo, Y as TargetOutcome, Yn as redactRanges, Yt as PlanContext, Zn as CentralTarget, Zt as SectionPlan, _ as RunConfig, _r as SettingsFile, _t as worstOf, an as EndpointDecl, ar as Problem, at as deliverArtifactReport, br as Layering, bt as RepoRunResult, cn as endpointPath, cr as SettingsFileRole, dr as describeProblem, dt as SectionSnapshotOutcome, er as Target, fn as FoldOptions, ft as SnapshotResult, g as RunCapabilities, gr as SectionKey, gt as RunOutcome, hn as describeRemoval, hr as SECTION_KEYS, ht as RUN_RESULTS, i as ConfigEnv, in as SectionFailure, ir as LayerProblem, it as ArtifactUploader, j as SingleOutcome, jn as GitHubApi, jt as allEndpoints, k as runSnapshot, kn as ClientAnswer, kt as SECTIONS, lr as SettingsProblem, mn as RemovalNotice, nn as snapshotContext, nr as parseRepoSlug, on as Route, or as ProblemOf, ot as encryptReport, pn as Layer, qn as maskRegistry, r as readLayerFiles, rn as GraphqlOpDecl, rt as openReportChannel, sn as endpointMethod, st as parseRecipient, tn as planContext, tr as dedupeTargets, tt as PrivateReportChannel, u as InputReader, ut as RenderableSnapshot, vn as UndeclaredPolicy, vr as UNDECLARED_POLICY_SECTIONS, xt as SectionOutcome, yr as UndeclaredPolicySection, yt as RepoRunOptions, zn as isPermissionError, zt as ValidatedBrand } from "./layers-MA87H-hC.js";
 import { Result } from "neverthrow";
 //#region src/discovery/central.d.ts
 export declare function resolveCentralTargets(reposDir: string, adminOwner: string): Result<{

package/lib/pkg/index.js

@@ -1,3 +1,3 @@
-import { D as runMulti, Dt as endpointPath, Et as endpointMethod, G as composeReport, Gt as prefixedIo, Ht as isRateLimitError, J as parseRecipient, Jt as resolveCentralTargets, K as deliverArtifactReport, Kt as redactRanges, Lt as DEFAULT_API_VERSION, M as concludeRun, N as failRun, O as parseSettingsDoc, Ot as parseReposInput, Pt as discoverRepos, Rt as GitHubApi, St as sectionGrant, Ut as collectingIo, V as openReportChannel, Vt as isPermissionError, Wt as maskRegistry, Xt as parseRepoSlug, Yt as dedupeTargets, _t as SECTION_KEYS, at as describeRemoval, ct as allEndpoints, d as parseConfig, et as describeProblem, g as runSnapshot, h as concludeSnapshot, it as worstOf, j as concludeRender, jt as DEFAULT_DISCOVERY_FILTERS, k as readSettingsFile, lt as allGraphqlOps, mt as snapshotContext, nt as SectionSelection, pt as planContext, q as encryptReport, qt as silentIo, rt as RUN_RESULTS, st as SECTIONS, ut as sectionModule, vt as SettingsFile, w as readLayerFiles, y as runSingle, yt as UNDECLARED_POLICY_SECTIONS } from "./inputs-D-CiUJdj.js";
-import { a as snapshotRepository, c as runRender, i as snapshotRepositories, n as checkRepository, o as validateSettings, r as mergeSettings, s as executeRun, t as applyRepository } from "./src-C3x6rbTD.js";
+import { D as runMulti, Dt as endpointPath, Et as endpointMethod, G as composeReport, Gt as prefixedIo, Ht as isRateLimitError, J as parseRecipient, Jt as resolveCentralTargets, K as deliverArtifactReport, Kt as redactRanges, Lt as DEFAULT_API_VERSION, M as concludeRun, N as failRun, O as parseSettingsDoc, Ot as parseReposInput, Pt as discoverRepos, Rt as GitHubApi, St as sectionGrant, Ut as collectingIo, V as openReportChannel, Vt as isPermissionError, Wt as maskRegistry, Xt as parseRepoSlug, Yt as dedupeTargets, _t as SECTION_KEYS, at as describeRemoval, ct as allEndpoints, d as parseConfig, et as describeProblem, g as runSnapshot, h as concludeSnapshot, it as worstOf, j as concludeRender, jt as DEFAULT_DISCOVERY_FILTERS, k as readSettingsFile, lt as allGraphqlOps, mt as snapshotContext, nt as SectionSelection, pt as planContext, q as encryptReport, qt as silentIo, rt as RUN_RESULTS, st as SECTIONS, ut as sectionModule, vt as SettingsFile, w as readLayerFiles, y as runSingle, yt as UNDECLARED_POLICY_SECTIONS } from "./inputs-BOuUCdpl.js";
+import { a as snapshotRepository, c as runRender, i as snapshotRepositories, n as checkRepository, o as validateSettings, r as mergeSettings, s as executeRun, t as applyRepository } from "./src-C2gb8QkD.js";
 export { DEFAULT_API_VERSION, DEFAULT_DISCOVERY_FILTERS, GitHubApi, RUN_RESULTS, SECTIONS, SECTION_KEYS, SectionSelection, SettingsFile, UNDECLARED_POLICY_SECTIONS, allEndpoints, allGraphqlOps, applyRepository, checkRepository, collectingIo, composeReport, concludeRender, concludeRun, concludeSnapshot, dedupeTargets, deliverArtifactReport, describeProblem, describeRemoval, discoverRepos, encryptReport, endpointMethod, endpointPath, executeRun, failRun, isPermissionError, isRateLimitError, maskRegistry, mergeSettings, openReportChannel, parseConfig, parseRecipient, parseRepoSlug, parseReposInput, parseSettingsDoc, planContext, prefixedIo, readLayerFiles, readSettingsFile, redactRanges, resolveCentralTargets, runMulti, runRender, runSingle, runSnapshot, sectionGrant, sectionModule, silentIo, snapshotContext, snapshotRepositories, snapshotRepository, validateSettings, worstOf };

package/lib/pkg/{inputs-D-CiUJdj.js → inputs-BOuUCdpl.js}

@@ -2811,7 +2811,7 @@ const PermissionSchema = z.string().regex(PERMISSION_PATTERN, { error: (issue) =
 /**
 * The GET reports this enum and the PATCH accepts nothing else, so a declared custom org role can never be
 * verified on (or set on) a pending invitation; the PUT applies it once accepted. The e2e mock's stored
-* invitations must stay inside it; a lockstep test pins it to the trimmed OpenAPI spec.
+* invitations must stay inside it; a lockstep test pins it to GitHub's OpenAPI descriptor.
 */
 const INVITATION_ROLES = /* @__PURE__ */ new Set([
 	"read",
@@ -4237,10 +4237,11 @@ const TeamConfig = z.object({
 //#endregion
 //#region src/sections/webhooks/events.ts
 /**
-* GENERATED by gen-webhook-events.ts - do not edit. The events GitHub delivers to repository webhooks, from
-* GitHub's webhooks OpenAPI description as @octokit/openapi-webhooks ships it (generated/api.github.com.json):
-* every webhook whose supported-webhook-types names "repository", spelled as the wire event name. Regenerate
-* with `bun .github/scripts/gen-webhook-events.ts` after a package bump.
+* The events GitHub delivers to repository webhooks, spelled as the wire event name: every webhook in GitHub's
+* webhooks OpenAPI description, as @octokit/openapi-webhooks ships it (generated/api.github.com.json), whose
+* supported-webhook-types names "repository". The list is committed, not imported: bundling the descriptor would
+* double lib/index.js. test/sections/webhooks-events.test.ts recomputes it from the package and fails with the
+* names added and dropped when a bump moves the list; the fix is to edit this file to match.
 */
 /** GitHub's reference page for the events, the externalDocs url the descriptor's entries point at. */
 const WEBHOOK_EVENTS_REFERENCE = "https://docs.github.com/webhooks/webhook-events-and-payloads";

package/lib/pkg/internal.d.ts

@@ -1,4 +1,4 @@
-import { $ as toPublicView, $t as Tolerance, C as parseSnapshotFileConfig, Ct as preflightProbe, E as SNAPSHOT_SCHEMA_URL, En as VISIBILITY_FILTERS, Et as validateSettingsDoc, F as DEFAULT_SETTINGS_FILE, Gt as writeGatedReads, H as RunFlowConfig, Ht as readGating, In as SECRET_RESPONSE_WITHHELD, It as SectionMeta, J as PublicTargetView, K as PRIVATE_REPOS_POLICIES, L as ResolvedTargets, Ln as SECRET_TRANSPORT_WITHHELD, Nn as GitHubClient, On as ApiError, Pt as KeyedListLayering, Q as publicDetail, R as TargetsConfig, Rn as TraceIo, Tn as FORKS_FILTERS, Tt as skippedSectionKeys, Vt as denialPosture, Wt as sectionOperations, X as capturingIo, Xt as PlannedOpBase, Z as planRedaction, _n as MustBeNever, a as DEFAULT_PRIVATE_REPOS, b as SNAPSHOT_REJECTED_INPUTS, bn as AFFILIATIONS, bt as RepoRunResult, c as InputDecl, ct as RepoVisibility, d as MODES, dn as grantFor, en as Unverifiable, et as PRIVATE_REPORT_CHANNELS, f as Mode, fr as quoteList, ft as SnapshotResult, gn as mergeLayers, h as RENDER_REJECTED_INPUTS, ir as LayerProblem, l as InputName, ln as PatResource, lr as SettingsProblem, lt as createVisibilityResolver, m as RENDER_ONLY_INPUTS, mr as PROBOT_PARITY_KEYS, mt as renderSnapshotYaml, n as foldLayers, nt as applyMarkerInjection, o as FILTER_INPUTS, or as ProblemOf, p as RENDER_INPUTS, pr as DOCUMENT_DIRECTIVE_KEYS, pt as SnapshotRunOptions, q as PrivateReposPolicy, qt as Justification, rr as CentralFileProblem, s as INPUT_DECLS, sr as RERUN_ADVICE, t as FoldedLayers, un as SectionPermission, ur as TopLevelShape, ut as RenderableSnapshot, v as SNAPSHOT_INPUTS, vn as UndeclaredPolicy, vt as RepoResult, w as snapshotFileDestination, wn as DiscoveryProblem, wt as runForRepo, x as SnapshotFileConfig, xn as ARCHIVED_FILTERS, y as SNAPSHOT_ONLY_INPUTS, yn as UndeclaredPolicyList, yt as RepoRunOptions, z as resolveTargets } from "./layers-CwR6OLB_.js";
+import { $ as toPublicView, $t as Tolerance, C as parseSnapshotFileConfig, Ct as preflightProbe, E as SNAPSHOT_SCHEMA_URL, En as VISIBILITY_FILTERS, Et as validateSettingsDoc, F as DEFAULT_SETTINGS_FILE, Gt as writeGatedReads, H as RunFlowConfig, Ht as readGating, In as SECRET_RESPONSE_WITHHELD, It as SectionMeta, J as PublicTargetView, K as PRIVATE_REPOS_POLICIES, L as ResolvedTargets, Ln as SECRET_TRANSPORT_WITHHELD, Nn as GitHubClient, On as ApiError, Pt as KeyedListLayering, Q as publicDetail, R as TargetsConfig, Rn as TraceIo, Tn as FORKS_FILTERS, Tt as skippedSectionKeys, Vt as denialPosture, Wt as sectionOperations, X as capturingIo, Xt as PlannedOpBase, Z as planRedaction, _n as MustBeNever, a as DEFAULT_PRIVATE_REPOS, b as SNAPSHOT_REJECTED_INPUTS, bn as AFFILIATIONS, bt as RepoRunResult, c as InputDecl, ct as RepoVisibility, d as MODES, dn as grantFor, en as Unverifiable, et as PRIVATE_REPORT_CHANNELS, f as Mode, fr as quoteList, ft as SnapshotResult, gn as mergeLayers, h as RENDER_REJECTED_INPUTS, ir as LayerProblem, l as InputName, ln as PatResource, lr as SettingsProblem, lt as createVisibilityResolver, m as RENDER_ONLY_INPUTS, mr as PROBOT_PARITY_KEYS, mt as renderSnapshotYaml, n as foldLayers, nt as applyMarkerInjection, o as FILTER_INPUTS, or as ProblemOf, p as RENDER_INPUTS, pr as DOCUMENT_DIRECTIVE_KEYS, pt as SnapshotRunOptions, q as PrivateReposPolicy, qt as Justification, rr as CentralFileProblem, s as INPUT_DECLS, sr as RERUN_ADVICE, t as FoldedLayers, un as SectionPermission, ur as TopLevelShape, ut as RenderableSnapshot, v as SNAPSHOT_INPUTS, vn as UndeclaredPolicy, vt as RepoResult, w as snapshotFileDestination, wn as DiscoveryProblem, wt as runForRepo, x as SnapshotFileConfig, xn as ARCHIVED_FILTERS, y as SNAPSHOT_ONLY_INPUTS, yn as UndeclaredPolicyList, yt as RepoRunOptions, z as resolveTargets } from "./layers-MA87H-hC.js";
 import { Result } from "neverthrow";
 //#region src/engine/canonical.d.ts
 /** The document as a fresh tree in the canonical order; the input is left as it was. */

package/lib/pkg/internal.js

@@ -1,3 +1,3 @@
-import { $ as RERUN_ADVICE, A as getRepoFile, At as ARCHIVED_FILTERS, B as applyMarkerInjection, Bt as SECRET_TRANSPORT_WITHHELD, C as foldLayers, Ct as sectionOperations, E as resolveTargets, F as capturingIo, Ft as countNoun, H as ISSUE_TITLE, I as planRedaction, It as createVisibilityResolver, L as publicDetail, Mt as FORKS_FILTERS, Nt as VISIBILITY_FILTERS, P as PRIVATE_REPOS_POLICIES, Q as validateSettingsDoc, R as toPublicView, S as writeReplacing, T as DEFAULT_SETTINGS_FILE, Tt as grantFor, U as MARKER_LABEL, W as MARKER_LABEL_CONFIG, X as runForRepo, Y as preflightProbe, Z as skippedSectionKeys, _ as renderSnapshotYaml, a as RENDER_INPUTS, bt as denialPosture, c as SNAPSHOT_INPUTS, dt as canonicalDocument, f as parseSnapshotFileConfig, ft as renderCanonicalYaml, gt as PROBOT_PARITY_KEYS, ht as DOCUMENT_DIRECTIVE_KEYS, i as MODES, kt as AFFILIATIONS, l as SNAPSHOT_ONLY_INPUTS, m as SNAPSHOT_SCHEMA_URL, n as FILTER_INPUTS, o as RENDER_ONLY_INPUTS, ot as mergeLayers, p as snapshotFileDestination, r as INPUT_DECLS, s as RENDER_REJECTED_INPUTS, t as DEFAULT_PRIVATE_REPOS, tt as quoteList, u as SNAPSHOT_REJECTED_INPUTS, wt as writeGatedReads, xt as readGating, z as PRIVATE_REPORT_CHANNELS, zt as SECRET_RESPONSE_WITHHELD } from "./inputs-D-CiUJdj.js";
+import { $ as RERUN_ADVICE, A as getRepoFile, At as ARCHIVED_FILTERS, B as applyMarkerInjection, Bt as SECRET_TRANSPORT_WITHHELD, C as foldLayers, Ct as sectionOperations, E as resolveTargets, F as capturingIo, Ft as countNoun, H as ISSUE_TITLE, I as planRedaction, It as createVisibilityResolver, L as publicDetail, Mt as FORKS_FILTERS, Nt as VISIBILITY_FILTERS, P as PRIVATE_REPOS_POLICIES, Q as validateSettingsDoc, R as toPublicView, S as writeReplacing, T as DEFAULT_SETTINGS_FILE, Tt as grantFor, U as MARKER_LABEL, W as MARKER_LABEL_CONFIG, X as runForRepo, Y as preflightProbe, Z as skippedSectionKeys, _ as renderSnapshotYaml, a as RENDER_INPUTS, bt as denialPosture, c as SNAPSHOT_INPUTS, dt as canonicalDocument, f as parseSnapshotFileConfig, ft as renderCanonicalYaml, gt as PROBOT_PARITY_KEYS, ht as DOCUMENT_DIRECTIVE_KEYS, i as MODES, kt as AFFILIATIONS, l as SNAPSHOT_ONLY_INPUTS, m as SNAPSHOT_SCHEMA_URL, n as FILTER_INPUTS, o as RENDER_ONLY_INPUTS, ot as mergeLayers, p as snapshotFileDestination, r as INPUT_DECLS, s as RENDER_REJECTED_INPUTS, t as DEFAULT_PRIVATE_REPOS, tt as quoteList, u as SNAPSHOT_REJECTED_INPUTS, wt as writeGatedReads, xt as readGating, z as PRIVATE_REPORT_CHANNELS, zt as SECRET_RESPONSE_WITHHELD } from "./inputs-BOuUCdpl.js";
 import "./internal-la_KkjCS.js";
 export { AFFILIATIONS, ARCHIVED_FILTERS, DEFAULT_PRIVATE_REPOS, DEFAULT_SETTINGS_FILE, DOCUMENT_DIRECTIVE_KEYS, FILTER_INPUTS, FORKS_FILTERS, INPUT_DECLS, ISSUE_TITLE, MARKER_LABEL, MARKER_LABEL_CONFIG, MODES, PRIVATE_REPORT_CHANNELS, PRIVATE_REPOS_POLICIES, PROBOT_PARITY_KEYS, RENDER_INPUTS, RENDER_ONLY_INPUTS, RENDER_REJECTED_INPUTS, RERUN_ADVICE, SECRET_RESPONSE_WITHHELD, SECRET_TRANSPORT_WITHHELD, SNAPSHOT_INPUTS, SNAPSHOT_ONLY_INPUTS, SNAPSHOT_REJECTED_INPUTS, SNAPSHOT_SCHEMA_URL, VISIBILITY_FILTERS, applyMarkerInjection, canonicalDocument, capturingIo, countNoun, createVisibilityResolver, denialPosture, foldLayers, getRepoFile, grantFor, mergeLayers, parseSnapshotFileConfig, planRedaction, preflightProbe, publicDetail, quoteList, readGating, renderCanonicalYaml, renderSnapshotYaml, resolveTargets, runForRepo, sectionOperations, skippedSectionKeys, snapshotFileDestination, toPublicView, validateSettingsDoc, writeGatedReads, writeReplacing };

package/lib/pkg/{layers-CwR6OLB_.d.ts → layers-MA87H-hC.d.ts}

@@ -2083,20 +2083,20 @@ declare function mergeLayers(layers: readonly Layer[], options: FoldOptions): Re
 }, LayerProblem>;
 //#endregion
 //#region src/upstream-gaps/index.d.ts
-/**
- * GENERATED by gen-gaps-index.ts - do not edit. Every pending upstream gap,
- * aggregated in sorted file order; regenerate with
- * `bun .github/scripts/gen-gaps-index.ts` after adding, deleting, or
- * transforming a gap file. The derivations below degrade gracefully to an
- * empty gaps set, so this file survives an empty directory.
- */
-declare const GAPS: readonly [{
-  readonly routes: readonly ["PUT /repos/{owner}/{repo}/lfs", "DELETE /repos/{owner}/{repo}/lfs"];
-  readonly documentedInSpec: false;
-} & {
-  readonly kind: "octokit";
-}];
-type GapUnion = (typeof GAPS)[number];
+declare const GAPS: {
+  readonly "issue-creation-policy": {
+    readonly sdl: "\n    enum IssueCreationPolicy {\n      ALL\n      COLLABORATORS_ONLY\n    }\n    extend type Repository {\n      issueCreationPolicy: IssueCreationPolicy\n    }\n    extend input UpdateRepositoryInput {\n      issueCreationPolicy: IssueCreationPolicy\n    }\n  ";
+  } & {
+    readonly kind: "graphql-schema";
+  };
+  readonly lfs: {
+    readonly routes: readonly ["PUT /repos/{owner}/{repo}/lfs", "DELETE /repos/{owner}/{repo}/lfs"];
+    readonly documentedInSpec: false;
+  } & {
+    readonly kind: "octokit";
+  };
+};
+type GapUnion = (typeof GAPS)[keyof typeof GAPS];
 /**
  * Routes GitHub documents but the pinned @octokit/types release does not
  * carry yet: the octokit-kind gaps' routes (spec-only gaps are keyof

package/lib/pkg/{src-C3x6rbTD.js → src-C2gb8QkD.js}

@@ -1,4 +1,4 @@
-import { C as foldLayers, D as runMulti, M as concludeRun, N as failRun, Q as validateSettingsDoc, S as writeReplacing, Ut as collectingIo, X as runForRepo, _ as renderSnapshotYaml, at as describeRemoval, b as readEntries, g as runSnapshot, h as concludeSnapshot, j as concludeRender, m as SNAPSHOT_SCHEMA_URL, nt as SectionSelection, v as snapshotRepository$1, w as readLayerFiles, x as renameEntry, y as runSingle } from "./inputs-D-CiUJdj.js";
+import { C as foldLayers, D as runMulti, M as concludeRun, N as failRun, Q as validateSettingsDoc, S as writeReplacing, Ut as collectingIo, X as runForRepo, _ as renderSnapshotYaml, at as describeRemoval, b as readEntries, g as runSnapshot, h as concludeSnapshot, j as concludeRender, m as SNAPSHOT_SCHEMA_URL, nt as SectionSelection, v as snapshotRepository$1, w as readLayerFiles, x as renameEntry, y as runSingle } from "./inputs-BOuUCdpl.js";
 import { err, ok } from "neverthrow";
 //#region src/flows/render.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vivswan/github-settings-as-code",
-  "version": "2.0.1-main.651.20260922.gf374e71",
+  "version": "2.0.1-main.658.20260922.gdcb742f",
   "description": "GitHub Action applying declarative repository settings: rulesets, labels, branch protection, and more.",
   "license": "SEE LICENSE IN LICENSE.md",
   "type": "module",
@@ -47,18 +47,16 @@
     "lint:package": "bun x publint --strict && bun x attw --pack . --profile esm-only",
     "typecheck": "bun x tsc -p .",
     "knip": "knip",
-    "test": "bun run test:artifacts && bun test",
-    "test:artifacts": "bun .github/scripts/trim-openapi.ts --when-stale && bun .github/scripts/fetch-graphql-schema.ts --when-stale",
-    "test:e2e": "bun run test:artifacts && bun test/e2e/run.ts",
-    "fuzz": "bun run test:artifacts && bun test/e2e/fuzz.ts",
-    "build": "bun run build:events && bun run build:bundle && bun run build:lib && bun run build:schema && bun run build:docs && bun run build:action-docs",
+    "test": "bun test",
+    "test:e2e": "bun test/e2e/run.ts",
+    "fuzz": "bun test/e2e/fuzz.ts",
+    "build": "bun run build:bundle && bun run build:lib && bun run build:schema && bun run build:docs && bun run build:action-docs",
     "build:bundle": "bun build src/main.ts --target=node --outfile lib/index.js",
     "build:lib": "bun x tsdown",
-    "build:events": "bun .github/scripts/gen-webhook-events.ts",
     "build:schema": "bun .github/scripts/gen-settings-schema.ts",
-    "build:docs": "bun run test:artifacts && bun .github/scripts/gen-docs.ts",
+    "build:docs": "bun .github/scripts/gen-docs.ts",
     "build:action-docs": "bun .github/scripts/gen-action-docs.ts",
-    "build:check": "bun run test:artifacts && bun .github/scripts/generated.ts"
+    "build:check": "bun .github/scripts/generated.ts"
   },
   "dependencies": {
     "@noble/ciphers": "2.4.0",
@@ -84,6 +82,8 @@
     "@actions/core": "3.0.1",
     "@arethetypeswrong/cli": "0.18.5",
     "@biomejs/biome": "2.5.11",
+    "@octokit/graphql-schema": "15.26.1",
+    "@octokit/openapi": "23.0.2",
     "@octokit/openapi-webhooks": "12.1.0",
     "@types/bun": "1.4.0",
     "@types/node": "26.4.1",