@vivswan/github-settings-as-code 2.0.1-main.699.20261005.g2b5d2ff → 2.0.1-main.703.20261005.g009d788

package/lib/pkg/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { F as failRun, Ht as countNoun, Q as maskRegistry, a as RENDER_INPUTS, c as SNAPSHOT_INPUTS, d as parseConfig, et as redactRanges, f as parseSnapshotFileConfig, h as GitHubApi, it as skippedSectionKeys, j as readSettingsFile, kt as sectionGrant, l as SNAPSHOT_ONLY_INPUTS, mt as SECTIONS, o as RENDER_ONLY_INPUTS, p as snapshotFileDestination, r as INPUT_DECLS, st as describeProblem, w as writeReplacing } from "./inputs-ClH-MkXs.js";
-import { a as snapshotRepository, o as validateSettings, s as executeRun } from "./src-Gr_Qvisc.js";
+import { F as failRun, Ht as countNoun, Q as maskRegistry, c as RENDER_INPUTS, d as SNAPSHOT_INPUTS, et as redactRanges, f as SNAPSHOT_ONLY_INPUTS, h as GitHubApi, it as skippedSectionKeys, j as readSettingsFile, kt as sectionGrant, l as RENDER_ONLY_INPUTS, mt as SECTIONS, n as parseSnapshotFileConfig, o as INPUT_DECLS, r as snapshotFileDestination, st as describeProblem, t as parseConfig, w as writeReplacing } from "./run-config-D5tGjVQP.js";
+import { a as snapshotRepository, o as validateSettings, s as executeRun } from "./src-C3hEOTns.js";
 import { appendFileSync, existsSync } from "node:fs";
 import { ResultAsync, err } from "neverthrow";
 import { randomUUID } from "node:crypto";

package/lib/pkg/index.d.ts

@@ -1,4 +1,4 @@
-import { $n as RepoRef, A as SingleConfig, An as GitHubApi, At as TaggedEndpoint, B as runMulti, Bn as OutputName, Bt as ValidatedInput, Cn as DiscoveryFilters, D as SnapshotConfig, Dn as discoverRepos, Dt as SectionSelection, Ft as SectionInput, G as failRun, Gn as silentIo, Hn as maskRegistry, I as MultiConfig, In as AnnotationLevel, Jt as OnMissingPermission, Kn as ApiError, Kt as DenialPolicy, Ln as CollectedLine, Lt as SectionModule, M as runSingle, Mn as GitHubClient, Mt as allGraphqlOps, N as RenderConfig, Nn as GraphqlOp, Nt as sectionModule, O as concludeSnapshot, On as ClientAnswer, Ot as SettingsSource, P as runRender, Pn as RequestMark, Qn as RemoteTarget, Qt as SnapshotContext, Rn as Io, Rt as SectionSnapshot, S as parseConfig, Sn as DEFAULT_DISCOVERY_FILTERS, St as ValidatedSettings, T as FinishedSnapshot, U as concludeRender, Un as prefixedIo, Ut as sectionGrant, V as FinishedRender, Vn as collectingIo, W as concludeRun, Wn as redactRanges, Xn as isRateLimitError, Y as TargetOutcome, Yn as isPermissionError, Yt as PlanContext, Zn as CentralTarget, Zt as SectionPlan, _ as RunConfig, _r as SettingsFile, _t as worstOf, an as EndpointDecl, ar as Problem, at as deliverArtifactReport, br as Layering, bt as RepoRunResult, cn as endpointPath, cr as SettingsFileRole, dr as describeProblem, dt as SectionSnapshotOutcome, er as Target, fn as FoldOptions, ft as SnapshotResult, g as RunCapabilities, gr as SectionKey, gt as RunOutcome, hn as describeRemoval, hr as SECTION_KEYS, ht as RUN_RESULTS, i as ConfigEnv, in as SectionFailure, ir as LayerProblem, it as ArtifactUploader, j as SingleOutcome, jn as GitHubApiOptions, jt as allEndpoints, k as runSnapshot, kn as DEFAULT_API_VERSION, kt as SECTIONS, lr as SettingsProblem, mn as RemovalNotice, nn as snapshotContext, nr as parseRepoSlug, on as Route, or as ProblemOf, ot as encryptReport, pn as Layer, r as readLayerFiles, rn as GraphqlOpDecl, rt as openReportChannel, sn as endpointMethod, st as parseRecipient, tn as planContext, tr as dedupeTargets, tt as PrivateReportChannel, u as InputReader, ut as RenderableSnapshot, vn as UndeclaredPolicy, vr as UNDECLARED_POLICY_SECTIONS, xt as SectionOutcome, yr as UndeclaredPolicySection, yt as RepoRunOptions, zn as MaskPair, zt as ValidatedBrand } from "./layers-DcnaJxRg.js";
+import { $n as CentralTarget, An as GitHubApi, At as TaggedEndpoint, Bn as OutputName, Bt as ValidatedInput, Cn as DiscoveryFilters, Dn as discoverRepos, Dt as SectionSelection, E as ConfigEnv, Ft as SectionInput, G as failRun, Gn as silentIo, Hn as maskRegistry, In as AnnotationLevel, Jt as OnMissingPermission, Kn as ApiError, Kt as DenialPolicy, Ln as CollectedLine, Lt as SectionModule, M as InputReader, Mn as GitHubClient, Mt as allGraphqlOps, Nn as GraphqlOp, Nt as sectionModule, On as ClientAnswer, Ot as SettingsSource, Pn as RequestMark, Qn as isRateLimitError, Qt as SnapshotContext, Rn as Io, Rt as SectionSnapshot, Sn as DEFAULT_DISCOVERY_FILTERS, Sr as Layering, St as ValidatedSettings, T as runMulti, U as concludeRender, Un as prefixedIo, Ut as sectionGrant, V as FinishedRender, Vn as collectingIo, W as concludeRun, Wn as redactRanges, Xn as classifyApiError, Y as TargetOutcome, Yt as PlanContext, Zn as isPermissionError, Zt as SectionPlan, _ as runSingle, _r as SECTION_KEYS, _t as worstOf, a as RunConfig, an as EndpointDecl, at as deliverArtifactReport, br as UNDECLARED_POLICY_SECTIONS, bt as RepoRunResult, cn as endpointPath, cr as ProblemOf, dr as SettingsProblem, dt as SectionSnapshotOutcome, er as RemoteTarget, f as SnapshotConfig, fn as FoldOptions, ft as SnapshotResult, g as SingleOutcome, gt as RunOutcome, h as SingleConfig, hn as describeRemoval, ht as RUN_RESULTS, i as RunCapabilities, in as SectionFailure, ir as parseRepoSlug, it as ArtifactUploader, jn as GitHubApiOptions, jt as allEndpoints, kn as DEFAULT_API_VERSION, kt as SECTIONS, m as runSnapshot, mn as RemovalNotice, nn as snapshotContext, nr as Target, on as Route, or as LayerProblem, ot as encryptReport, p as concludeSnapshot, pn as Layer, pr as describeProblem, qn as ApiErrorKind, r as readLayerFiles, rn as GraphqlOpDecl, rr as dedupeTargets, rt as openReportChannel, s as parseConfig, sn as endpointMethod, sr as Problem, st as parseRecipient, tn as planContext, tr as RepoRef, tt as PrivateReportChannel, u as FinishedSnapshot, ur as SettingsFileRole, ut as RenderableSnapshot, v as RenderConfig, vn as UndeclaredPolicy, vr as SectionKey, x as MultiConfig, xr as UndeclaredPolicySection, xt as SectionOutcome, y as runRender, yr as SettingsFile, yt as RepoRunOptions, zn as MaskPair, zt as ValidatedBrand } from "./layers-Ha0DTLXD.js";
 import { Result } from "neverthrow";
 //#region src/discovery/central.d.ts
 export declare function resolveCentralTargets(reposDir: string, adminOwner: string): Result<{
@@ -154,4 +154,4 @@ interface ReportInput {
 }
 export declare function composeReport(input: ReportInput): string;
 //#endregion
-export { type AnnotationLevel, type ApiError, type ApplyOptions, type ApplyReport, type ArtifactUploader, type CentralTarget, type CheckOptions, type CheckReport, type ClientAnswer, type CollectedLine, type ConfigEnv, DEFAULT_API_VERSION, DEFAULT_DISCOVERY_FILTERS, type DenialPolicy, type DiscoveryFilters, type EndpointDecl, type FinishedRender, type FinishedSnapshot, GitHubApi, type GitHubApiOptions, type GitHubClient, type GraphqlOp, type GraphqlOpDecl, type InputReader, type Io, type Layer, type Layering, type MaskPair, type MergeOptions, type MergeReport, type MultiConfig, type OnMissingPermission, type OutputName, type PlanContext, type PrivateReportChannel, type Problem, RUN_RESULTS, type RemoteTarget, type RemovalNotice, type RenderConfig, type RepoRef, type ReportInput, type RequestMark, type Route, type RunCapabilities, type RunConfig, type RunDeps, type RunEnd, type RunOutcome, SECTIONS, SECTION_KEYS, type SectionFailure, type SectionInput, type SectionKey, type SectionModule, type SectionOutcome, type SectionPlan, SectionSelection, type SectionSnapshot, type SectionSnapshotOutcome, SettingsFile, type SettingsFileRole, type SingleConfig, type SingleOutcome, type SnapshotConfig, type SnapshotContext, type SnapshotOptions, type SnapshotReport, type TaggedEndpoint, type Target, type TargetOutcome, UNDECLARED_POLICY_SECTIONS, type UndeclaredPolicySection, type ValidateOptions, type ValidateReport, type ValidatedBrand, type ValidatedInput, type ValidatedSettings, allEndpoints, allGraphqlOps, collectingIo, concludeRender, concludeRun, concludeSnapshot, dedupeTargets, deliverArtifactReport, describeProblem, describeRemoval, discoverRepos, encryptReport, endpointMethod, endpointPath, failRun, isPermissionError, isRateLimitError, maskRegistry, openReportChannel, parseConfig, parseRecipient, parseRepoSlug, planContext, prefixedIo, readLayerFiles, redactRanges, runMulti, runRender, runSingle, runSnapshot, sectionGrant, sectionModule, silentIo, snapshotContext, worstOf };
+export { type AnnotationLevel, type ApiError, type ApiErrorKind, type ApplyOptions, type ApplyReport, type ArtifactUploader, type CentralTarget, type CheckOptions, type CheckReport, type ClientAnswer, type CollectedLine, type ConfigEnv, DEFAULT_API_VERSION, DEFAULT_DISCOVERY_FILTERS, type DenialPolicy, type DiscoveryFilters, type EndpointDecl, type FinishedRender, type FinishedSnapshot, GitHubApi, type GitHubApiOptions, type GitHubClient, type GraphqlOp, type GraphqlOpDecl, type InputReader, type Io, type Layer, type Layering, type MaskPair, type MergeOptions, type MergeReport, type MultiConfig, type OnMissingPermission, type OutputName, type PlanContext, type PrivateReportChannel, type Problem, RUN_RESULTS, type RemoteTarget, type RemovalNotice, type RenderConfig, type RepoRef, type ReportInput, type RequestMark, type Route, type RunCapabilities, type RunConfig, type RunDeps, type RunEnd, type RunOutcome, SECTIONS, SECTION_KEYS, type SectionFailure, type SectionInput, type SectionKey, type SectionModule, type SectionOutcome, type SectionPlan, SectionSelection, type SectionSnapshot, type SectionSnapshotOutcome, SettingsFile, type SettingsFileRole, type SingleConfig, type SingleOutcome, type SnapshotConfig, type SnapshotContext, type SnapshotOptions, type SnapshotReport, type TaggedEndpoint, type Target, type TargetOutcome, UNDECLARED_POLICY_SECTIONS, type UndeclaredPolicySection, type ValidateOptions, type ValidateReport, type ValidatedBrand, type ValidatedInput, type ValidatedSettings, allEndpoints, allGraphqlOps, classifyApiError, collectingIo, concludeRender, concludeRun, concludeSnapshot, dedupeTargets, deliverArtifactReport, describeProblem, describeRemoval, discoverRepos, encryptReport, endpointMethod, endpointPath, failRun, isPermissionError, isRateLimitError, maskRegistry, openReportChannel, parseConfig, parseRecipient, parseRepoSlug, planContext, prefixedIo, readLayerFiles, redactRanges, runMulti, runRender, runSingle, runSnapshot, sectionGrant, sectionModule, silentIo, snapshotContext, worstOf };

package/lib/pkg/index.js

@@ -1,3 +1,3 @@
-import { $ as prefixedIo, A as parseSettingsDoc, E as readLayerFiles, Et as UNDECLARED_POLICY_SECTIONS, F as failRun, Ft as parseReposInput, J as deliverArtifactReport, Jt as resolveCentralTargets, Kt as isPermissionError, N as concludeRender, Nt as endpointMethod, P as concludeRun, Pt as endpointPath, Q as maskRegistry, Rt as DEFAULT_DISCOVERY_FILTERS, Tt as SettingsFile, U as openReportChannel, Vt as discoverRepos, X as parseRecipient, Xt as parseRepoSlug, Y as encryptReport, Yt as dedupeTargets, Z as collectingIo, _ as concludeSnapshot, _t as sectionModule, bt as planContext, d as parseConfig, dt as worstOf, et as redactRanges, ft as describeRemoval, gt as allGraphqlOps, h as GitHubApi, ht as allEndpoints, j as readSettingsFile, k as runMulti, kt as sectionGrant, lt as SectionSelection, m as DEFAULT_API_VERSION, mt as SECTIONS, q as composeReport, qt as isRateLimitError, st as describeProblem, tt as silentIo, ut as RUN_RESULTS, v as runSnapshot, wt as SECTION_KEYS, x as runSingle, xt as snapshotContext } from "./inputs-ClH-MkXs.js";
-import { a as snapshotRepository, c as runRender, i as snapshotRepositories, n as checkRepository, o as validateSettings, r as mergeSettings, s as executeRun, t as applyRepository } from "./src-Gr_Qvisc.js";
-export { DEFAULT_API_VERSION, DEFAULT_DISCOVERY_FILTERS, GitHubApi, RUN_RESULTS, SECTIONS, SECTION_KEYS, SectionSelection, SettingsFile, UNDECLARED_POLICY_SECTIONS, allEndpoints, allGraphqlOps, applyRepository, checkRepository, collectingIo, composeReport, concludeRender, concludeRun, concludeSnapshot, dedupeTargets, deliverArtifactReport, describeProblem, describeRemoval, discoverRepos, encryptReport, endpointMethod, endpointPath, executeRun, failRun, isPermissionError, isRateLimitError, maskRegistry, mergeSettings, openReportChannel, parseConfig, parseRecipient, parseRepoSlug, parseReposInput, parseSettingsDoc, planContext, prefixedIo, readLayerFiles, readSettingsFile, redactRanges, resolveCentralTargets, runMulti, runRender, runSingle, runSnapshot, sectionGrant, sectionModule, silentIo, snapshotContext, snapshotRepositories, snapshotRepository, validateSettings, worstOf };
+import { $ as prefixedIo, A as parseSettingsDoc, E as readLayerFiles, Et as UNDECLARED_POLICY_SECTIONS, F as failRun, Ft as parseReposInput, J as deliverArtifactReport, Jt as isRateLimitError, Kt as classifyApiError, N as concludeRender, Nt as endpointMethod, P as concludeRun, Pt as endpointPath, Q as maskRegistry, Rt as DEFAULT_DISCOVERY_FILTERS, Tt as SettingsFile, U as openReportChannel, Vt as discoverRepos, X as parseRecipient, Xt as dedupeTargets, Y as encryptReport, Yt as resolveCentralTargets, Z as collectingIo, Zt as parseRepoSlug, _ as concludeSnapshot, _t as sectionModule, bt as planContext, dt as worstOf, et as redactRanges, ft as describeRemoval, gt as allGraphqlOps, h as GitHubApi, ht as allEndpoints, j as readSettingsFile, k as runMulti, kt as sectionGrant, lt as SectionSelection, m as DEFAULT_API_VERSION, mt as SECTIONS, q as composeReport, qt as isPermissionError, st as describeProblem, t as parseConfig, tt as silentIo, ut as RUN_RESULTS, v as runSnapshot, wt as SECTION_KEYS, x as runSingle, xt as snapshotContext } from "./run-config-D5tGjVQP.js";
+import { a as snapshotRepository, c as runRender, i as snapshotRepositories, n as checkRepository, o as validateSettings, r as mergeSettings, s as executeRun, t as applyRepository } from "./src-C3hEOTns.js";
+export { DEFAULT_API_VERSION, DEFAULT_DISCOVERY_FILTERS, GitHubApi, RUN_RESULTS, SECTIONS, SECTION_KEYS, SectionSelection, SettingsFile, UNDECLARED_POLICY_SECTIONS, allEndpoints, allGraphqlOps, applyRepository, checkRepository, classifyApiError, collectingIo, composeReport, concludeRender, concludeRun, concludeSnapshot, dedupeTargets, deliverArtifactReport, describeProblem, describeRemoval, discoverRepos, encryptReport, endpointMethod, endpointPath, executeRun, failRun, isPermissionError, isRateLimitError, maskRegistry, mergeSettings, openReportChannel, parseConfig, parseRecipient, parseRepoSlug, parseReposInput, parseSettingsDoc, planContext, prefixedIo, readLayerFiles, readSettingsFile, redactRanges, resolveCentralTargets, runMulti, runRender, runSingle, runSnapshot, sectionGrant, sectionModule, silentIo, snapshotContext, snapshotRepositories, snapshotRepository, validateSettings, worstOf };

package/lib/pkg/internal.d.ts

@@ -1,4 +1,4 @@
-import { $ as toPublicView, $t as Tolerance, C as parseSnapshotFileConfig, Ct as preflightProbe, E as SNAPSHOT_SCHEMA_URL, En as VISIBILITY_FILTERS, Et as validateSettingsDoc, F as DEFAULT_SETTINGS_FILE, Fn as TraceIo, Gt as writeGatedReads, H as RunFlowConfig, Ht as readGating, It as SectionMeta, J as PublicTargetView, Jn as SECRET_TRANSPORT_WITHHELD, K as PRIVATE_REPOS_POLICIES, Kn as ApiError, L as ResolvedTargets, Mn as GitHubClient, Pt as KeyedListLayering, Q as publicDetail, R as TargetsConfig, Tn as FORKS_FILTERS, Tt as skippedSectionKeys, Vt as denialPosture, Wt as sectionOperations, X as capturingIo, Xt as PlannedOpBase, Z as planRedaction, _n as MustBeNever, a as DEFAULT_PRIVATE_REPOS, b as SNAPSHOT_REJECTED_INPUTS, bn as AFFILIATIONS, bt as RepoRunResult, c as InputDecl, ct as RepoVisibility, d as MODES, dn as grantFor, en as Unverifiable, et as PRIVATE_REPORT_CHANNELS, f as Mode, fr as quoteList, ft as SnapshotResult, gn as mergeLayers, h as RENDER_REJECTED_INPUTS, ir as LayerProblem, l as InputName, ln as PatResource, lr as SettingsProblem, lt as createVisibilityResolver, m as RENDER_ONLY_INPUTS, mr as PROBOT_PARITY_KEYS, mt as renderSnapshotYaml, n as foldLayers, nt as applyMarkerInjection, o as FILTER_INPUTS, or as ProblemOf, p as RENDER_INPUTS, pr as DOCUMENT_DIRECTIVE_KEYS, pt as SnapshotRunOptions, q as PrivateReposPolicy, qn as SECRET_RESPONSE_WITHHELD, qt as Justification, rr as CentralFileProblem, s as INPUT_DECLS, sr as RERUN_ADVICE, t as FoldedLayers, un as SectionPermission, ur as TopLevelShape, ut as RenderableSnapshot, v as SNAPSHOT_INPUTS, vn as UndeclaredPolicy, vt as RepoResult, w as snapshotFileDestination, wn as DiscoveryProblem, wt as runForRepo, x as SnapshotFileConfig, xn as ARCHIVED_FILTERS, y as SNAPSHOT_ONLY_INPUTS, yn as UndeclaredPolicyList, yt as RepoRunOptions, z as resolveTargets } from "./layers-DcnaJxRg.js";
+import { $ as toPublicView, $t as Tolerance, A as InputDecl, B as SNAPSHOT_REJECTED_INPUTS, C as TargetsConfig, Ct as preflightProbe, D as DEFAULT_PRIVATE_REPOS, En as VISIBILITY_FILTERS, Et as validateSettingsDoc, F as RENDER_INPUTS, Fn as TraceIo, Gt as writeGatedReads, H as RunFlowConfig, Ht as readGating, I as RENDER_ONLY_INPUTS, It as SectionMeta, J as PublicTargetView, Jn as SECRET_RESPONSE_WITHHELD, K as PRIVATE_REPOS_POLICIES, Kn as ApiError, L as RENDER_REJECTED_INPUTS, Mn as GitHubClient, N as MODES, O as FILTER_INPUTS, P as Mode, Pt as KeyedListLayering, Q as publicDetail, R as SNAPSHOT_INPUTS, S as ResolvedTargets, Tn as FORKS_FILTERS, Tt as skippedSectionKeys, Vt as denialPosture, Wt as sectionOperations, X as capturingIo, Xt as PlannedOpBase, Yn as SECRET_TRANSPORT_WITHHELD, Z as planRedaction, _n as MustBeNever, ar as CentralFileProblem, b as DEFAULT_SETTINGS_FILE, bn as AFFILIATIONS, bt as RepoRunResult, c as parseSnapshotFileConfig, cr as ProblemOf, ct as RepoVisibility, d as SNAPSHOT_SCHEMA_URL, dn as grantFor, dr as SettingsProblem, en as Unverifiable, et as PRIVATE_REPORT_CHANNELS, fr as TopLevelShape, ft as SnapshotResult, gn as mergeLayers, gr as PROBOT_PARITY_KEYS, hr as DOCUMENT_DIRECTIVE_KEYS, j as InputName, k as INPUT_DECLS, l as snapshotFileDestination, ln as PatResource, lr as RERUN_ADVICE, lt as createVisibilityResolver, mr as quoteList, mt as renderSnapshotYaml, n as foldLayers, nt as applyMarkerInjection, o as SnapshotFileConfig, or as LayerProblem, pt as SnapshotRunOptions, q as PrivateReposPolicy, qt as Justification, t as FoldedLayers, un as SectionPermission, ut as RenderableSnapshot, vn as UndeclaredPolicy, vt as RepoResult, w as resolveTargets, wn as DiscoveryProblem, wt as runForRepo, xn as ARCHIVED_FILTERS, yn as UndeclaredPolicyList, yt as RepoRunOptions, z as SNAPSHOT_ONLY_INPUTS } from "./layers-Ha0DTLXD.js";
 import { Result } from "neverthrow";
 //#region src/engine/canonical.d.ts
 /** The document as a fresh tree in the canonical order; the input is left as it was. */

package/lib/pkg/internal.js

@@ -1,3 +1,3 @@
-import { At as sectionOperations, B as toPublicView, Bt as VISIBILITY_FILTERS, Ct as PROBOT_PARITY_KEYS, D as DEFAULT_SETTINGS_FILE, Dt as denialPosture, G as MARKER_LABEL, Gt as SECRET_TRANSPORT_WITHHELD, H as applyMarkerInjection, Ht as countNoun, I as PRIVATE_REPOS_POLICIES, It as AFFILIATIONS, K as MARKER_LABEL_CONFIG, L as capturingIo, Lt as ARCHIVED_FILTERS, M as getRepoFile, Mt as grantFor, O as resolveTargets, Ot as readGating, R as planRedaction, St as DOCUMENT_DIRECTIVE_KEYS, T as foldLayers, Ut as createVisibilityResolver, V as PRIVATE_REPORT_CHANNELS, W as ISSUE_TITLE, Wt as SECRET_RESPONSE_WITHHELD, a as RENDER_INPUTS, at as validateSettingsDoc, c as SNAPSHOT_INPUTS, ct as quoteList, f as parseSnapshotFileConfig, g as SNAPSHOT_SCHEMA_URL, i as MODES, it as skippedSectionKeys, jt as writeGatedReads, l as SNAPSHOT_ONLY_INPUTS, n as FILTER_INPUTS, nt as preflightProbe, o as RENDER_ONLY_INPUTS, ot as RERUN_ADVICE, p as snapshotFileDestination, pt as mergeLayers, r as INPUT_DECLS, rt as runForRepo, s as RENDER_REJECTED_INPUTS, t as DEFAULT_PRIVATE_REPOS, u as SNAPSHOT_REJECTED_INPUTS, vt as canonicalDocument, w as writeReplacing, y as renderSnapshotYaml, yt as renderCanonicalYaml, z as publicDetail, zt as FORKS_FILTERS } from "./inputs-ClH-MkXs.js";
+import { At as sectionOperations, B as toPublicView, Bt as VISIBILITY_FILTERS, Ct as PROBOT_PARITY_KEYS, D as DEFAULT_SETTINGS_FILE, Dt as denialPosture, G as MARKER_LABEL, Gt as SECRET_TRANSPORT_WITHHELD, H as applyMarkerInjection, Ht as countNoun, I as PRIVATE_REPOS_POLICIES, It as AFFILIATIONS, K as MARKER_LABEL_CONFIG, L as capturingIo, Lt as ARCHIVED_FILTERS, M as getRepoFile, Mt as grantFor, O as resolveTargets, Ot as readGating, R as planRedaction, St as DOCUMENT_DIRECTIVE_KEYS, T as foldLayers, Ut as createVisibilityResolver, V as PRIVATE_REPORT_CHANNELS, W as ISSUE_TITLE, Wt as SECRET_RESPONSE_WITHHELD, a as FILTER_INPUTS, at as validateSettingsDoc, c as RENDER_INPUTS, ct as quoteList, d as SNAPSHOT_INPUTS, f as SNAPSHOT_ONLY_INPUTS, g as SNAPSHOT_SCHEMA_URL, i as DEFAULT_PRIVATE_REPOS, it as skippedSectionKeys, jt as writeGatedReads, l as RENDER_ONLY_INPUTS, n as parseSnapshotFileConfig, nt as preflightProbe, o as INPUT_DECLS, ot as RERUN_ADVICE, p as SNAPSHOT_REJECTED_INPUTS, pt as mergeLayers, r as snapshotFileDestination, rt as runForRepo, s as MODES, u as RENDER_REJECTED_INPUTS, vt as canonicalDocument, w as writeReplacing, y as renderSnapshotYaml, yt as renderCanonicalYaml, z as publicDetail, zt as FORKS_FILTERS } from "./run-config-D5tGjVQP.js";
 import "./internal-la_KkjCS.js";
 export { AFFILIATIONS, ARCHIVED_FILTERS, DEFAULT_PRIVATE_REPOS, DEFAULT_SETTINGS_FILE, DOCUMENT_DIRECTIVE_KEYS, FILTER_INPUTS, FORKS_FILTERS, INPUT_DECLS, ISSUE_TITLE, MARKER_LABEL, MARKER_LABEL_CONFIG, MODES, PRIVATE_REPORT_CHANNELS, PRIVATE_REPOS_POLICIES, PROBOT_PARITY_KEYS, RENDER_INPUTS, RENDER_ONLY_INPUTS, RENDER_REJECTED_INPUTS, RERUN_ADVICE, SECRET_RESPONSE_WITHHELD, SECRET_TRANSPORT_WITHHELD, SNAPSHOT_INPUTS, SNAPSHOT_ONLY_INPUTS, SNAPSHOT_REJECTED_INPUTS, SNAPSHOT_SCHEMA_URL, VISIBILITY_FILTERS, applyMarkerInjection, canonicalDocument, capturingIo, countNoun, createVisibilityResolver, denialPosture, foldLayers, getRepoFile, grantFor, mergeLayers, parseSnapshotFileConfig, planRedaction, preflightProbe, publicDetail, quoteList, readGating, renderCanonicalYaml, renderSnapshotYaml, resolveTargets, runForRepo, sectionOperations, skippedSectionKeys, snapshotFileDestination, toPublicView, validateSettingsDoc, writeGatedReads, writeReplacing };

package/lib/pkg/{layers-DcnaJxRg.d.ts → layers-Ha0DTLXD.d.ts}

@@ -1778,6 +1778,13 @@ interface ApiError {
  */
 declare const SECRET_RESPONSE_WITHHELD = "response body withheld: the request carried a secret field and an error body may echo its value";
 declare const SECRET_TRANSPORT_WITHHELD = "the transport failed before an HTTP response arrived (details withheld: the request carried a secret field)";
+/**
+ * Decided in classifyApiError alone; consumers switch on it and never re-read the status or message for the answer.
+ * A 404 folds into "permission" because fine-grained tokens answer 404 on an endpoint they deny, so an absent
+ * resource lands there too (failureFor's prose says so).
+ */
+type ApiErrorKind = "rate-limit" | "permission" | "other";
+declare function classifyApiError(error: ApiError): ApiErrorKind;
 /** The library's named views of classifyApiError (src/index.ts, docs/reference/library.md); internal code switches on the kind itself. */
 declare function isRateLimitError(error: ApiError): boolean;
 declare function isPermissionError(error: ApiError): boolean;
@@ -3709,7 +3716,7 @@ declare const ENDPOINTS: {
   };
 };
 //#endregion
-//#region src/sections/branches/graphql-rules.d.ts
+//#region src/sections/branches/graphql-ops.d.ts
 declare const GRAPHQL: {
   readonly rulesQuery: {
     readonly name: "BranchProtectionRules";
@@ -6909,7 +6916,58 @@ declare const byKey: {
         };
       };
     };
-    shape: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+    shape: z.ZodObject<{
+      enabled: z.ZodOptional<z.ZodBoolean>;
+      allowed_actions: z.ZodOptional<z.ZodEnum<{
+        all: "all";
+        local_only: "local_only";
+        selected: "selected";
+      }>>;
+      sha_pinning_required: z.ZodOptional<z.ZodBoolean>;
+      selected_actions: z.ZodOptional<z.ZodObject<{
+        github_owned_allowed: z.ZodOptional<z.ZodBoolean>;
+        verified_allowed: z.ZodOptional<z.ZodBoolean>;
+        patterns_allowed: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      }, z.core.$strict>>;
+      default_workflow_permissions: z.ZodOptional<z.ZodEnum<{
+        read: "read";
+        write: "write";
+      }>>;
+      can_approve_pull_request_reviews: z.ZodOptional<z.ZodBoolean>;
+      access_level: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        organization: "organization";
+        user: "user";
+      }>>;
+      artifact_and_log_retention: z.ZodOptional<z.ZodObject<{
+        days: z.ZodInt;
+      }, z.core.$strip>>;
+      cache: z.ZodOptional<z.ZodObject<{
+        max_cache_retention_days: z.ZodOptional<z.ZodInt>;
+        max_cache_size_gb: z.ZodOptional<z.ZodInt>;
+      }, z.core.$strict>>;
+      oidc_customization_sub: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        use_default: z.ZodLiteral<true>;
+        use_immutable_subject: z.ZodOptional<z.ZodBoolean>;
+      }, z.core.$strip>, z.ZodObject<{
+        use_default: z.ZodLiteral<false>;
+        include_claim_keys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        use_immutable_subject: z.ZodOptional<z.ZodBoolean>;
+      }, z.core.$strip>], "use_default">>;
+      fork_pr_contributor_approval: z.ZodOptional<z.ZodObject<{
+        approval_policy: z.ZodEnum<{
+          all_external_contributors: "all_external_contributors";
+          first_time_contributors: "first_time_contributors";
+          first_time_contributors_new_to_github: "first_time_contributors_new_to_github";
+        }>;
+      }, z.core.$strip>>;
+      fork_pr_workflows_private_repos: z.ZodOptional<z.ZodObject<{
+        run_workflows_from_fork_pull_requests: z.ZodBoolean;
+        send_write_tokens_to_workflows: z.ZodOptional<z.ZodBoolean>;
+        send_secrets_and_variables: z.ZodOptional<z.ZodBoolean>;
+        require_approval_for_fork_pr_workflows: z.ZodOptional<z.ZodBoolean>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>;
     plan(ctx: PlanContext<{
       readonly getPermissions: {
         readonly route: "GET /repos/{owner}/{repo}/actions/permissions";
@@ -7557,7 +7615,12 @@ declare const byKey: {
         readonly alwaysRewrite: true;
       };
     };
-    shape: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+    shape: z.ZodObject<{
+      auto_trigger_checks: z.ZodArray<z.ZodObject<{
+        app_id: z.ZodInt;
+        setting: z.ZodBoolean;
+      }, z.core.$strip>>;
+    }, z.core.$catchall<z.ZodUnknown>>;
     plan(_ctx: PlanContext<{
       readonly update: {
         readonly route: "PATCH /repos/{owner}/{repo}/check-suites/preferences";
@@ -7622,7 +7685,22 @@ declare const byKey: {
         };
       };
     };
-    shape: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+    shape: z.ZodNullable<z.ZodObject<{
+      build_type: z.ZodOptional<z.ZodEnum<{
+        legacy: "legacy";
+        workflow: "workflow";
+      }>>;
+      source: z.ZodOptional<z.ZodObject<{
+        branch: z.ZodString;
+        path: z.ZodOptional<z.ZodEnum<{
+          "/": "/";
+          "/docs": "/docs";
+        }>>;
+      }, z.core.$strip>>;
+      cname: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+      https_enforced: z.ZodOptional<z.ZodBoolean>;
+      public: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
     plan(ctx: PlanContext<{
       readonly get: {
         readonly route: "GET /repos/{owner}/{repo}/pages";
@@ -9380,126 +9458,12 @@ interface FinishedRender {
 }
 declare function concludeRender(io: Io, run: FinishedRender): number;
 //#endregion
-//#region src/flows/multi.d.ts
-/** The single source for the action.yml `settings-file` default, the multi-repo override guard in src/flows/inputs.ts, and the prose below. */
-declare const DEFAULT_SETTINGS_FILE = ".github/settings.yml";
-/**
- * Where a multi-repo run's targets come from and how their slugs may appear:
- * the inputs resolveTargets reads. Apply, check, and snapshot share it, so
- * the three modes name the same fleet from the same inputs.
- */
-interface TargetsConfig extends Pick<RunFlowConfig, "privateRepos" | "selfSlug"> {
-  reposDir: string;
-  reposInput: string;
-  /** The owner a bare `<name>.yml` file under repos-dir belongs to. */
-  adminOwner: string;
-  discoveryFilters: DiscoveryFilters;
-  /** Filter inputs the user explicitly set, for the misuse rejections. */
-  discoveryFiltersSet: string[];
-}
-interface MultiConfig extends RunFlowConfig, TargetsConfig {
-  defaultsFile: string;
-}
-/** The fleet a run acts on, with the redaction decision every target reports under. */
-interface ResolvedTargets {
-  /** Deduped, central first, in the order the run processes them. */
-  targets: Target[];
-  plan: RedactionPlan;
-  /** A slug's resolved visibility; "unknown" for a slug never resolved. */
-  visibilityOf: (slug: string) => RepoVisibility;
-}
-/**
- * Resolve the run's targets (repos-dir files, explicit repos, "*" discovery),
- * decide redaction, and register every masked slug BEFORE the first line is
- * emitted. A config problem (bad repos input, discovery failure, misplaced
- * filters, no targets) comes back as the error; nothing has been emitted about
- * a target when it does.
- */
-declare function resolveTargets(api: GitHubClient, cfg: TargetsConfig, io: Io): ResultAsync<ResolvedTargets, Problem>;
-/**
- * Multi-repo orchestration. Config-level problems (bad defaults file, no
- * targets, duplicate definitions, discovery failure) come back as the error
- * before any target executes; per-target problems mark that target failed or
- * skipped and never stop the others.
- */
-declare function runMulti(api: GitHubClient, cfg: MultiConfig, io: Io, uploader?: ArtifactUploader): ResultAsync<TargetOutcome[], Problem>;
-//#endregion
-//#region src/flows/render.d.ts
-interface RenderConfig extends FoldOptions {
-  settingsFiles: string[];
-  renderedFile: string;
-}
-declare function runRender(cfg: RenderConfig, io: Io): Result<FinishedRender, Problem>;
-//#endregion
-//#region src/flows/single.d.ts
-interface SingleConfig extends RunFlowConfig {
-  repo: RepoRef;
-  settingsFile: string;
-}
-type SingleOutcome = Omit<TargetOutcome, "source">;
-declare function runSingle(api: GitHubClient, cfg: SingleConfig, io: Io, uploader?: ArtifactUploader): ResultAsync<SingleOutcome, Problem>;
-//#endregion
-//#region src/flows/snapshot.d.ts
-/**
- * The schema the written file's editor hint points at: the schema of this
- * release line, spelled as the README's quick start spells it. The marker
- * lets a major release rewrite the tag here (release-please-config.json lists
- * this file); test/docs/readme.test.ts pins it to the README's hint.
- */
-declare const SNAPSHOT_SCHEMA_URL = "https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v2/lib/settings.schema.json";
-interface SnapshotConfigBase {
-  onMissingPermission: "fail" | "warn";
-  /** The allowlist; its required set is unused, since a snapshot never writes. */
-  sections: SectionSelection;
-  /** Whether to hide private/internal targets from the public view. */
-  privateRepos: PrivateReposPolicy;
-  /** The repository the run acts for; a target equal to it is never redacted. */
-  selfSlug: string;
-}
-/**
- * A mode: snapshot run: one repository written to `snapshotFile`, or the
- * multi-repo targets (resolved exactly as apply resolves them) written under
- * `snapshotDir` as `<owner>/<name>.yml` each. No settings file, no report
- * channel: a snapshot reads and writes a file, and the type carries that.
- */
-type SnapshotConfig = (SnapshotConfigBase & {
-  form: "file";
-  repo: RepoRef;
-  snapshotFile: string;
-}) | (SnapshotConfigBase & TargetsConfig & {
-  form: "dir";
-  snapshotDir: string;
-});
-/**
- * A finished mode: snapshot run as runSnapshot hands it over: every target
- * closed through its channel, so a redacted one is sealed with its transcript
- * and concludeSnapshot opens only the public view. `takenAt` is the run's one
- * moment (an ISO-8601 UTC instant), which the summary states and no file carries.
- */
-type FinishedSnapshot = {
-  form: "file";
-  takenAt: string;
-  target: Omit<TargetOutcome, "source">;
-} | {
-  form: "dir";
-  takenAt: string;
-  snapshotDir: string;
-  targets: TargetOutcome[];
-};
+//#region src/flows/inputs.d.ts
 /**
- * Execute a mode: snapshot run. A destination that would overwrite an authored
- * file, or a fleet that cannot be resolved, comes back as the error before any
- * target is read; otherwise every target's closed outcome, which
- * concludeSnapshot turns into the summary, the outputs, and the exit code.
+ * The input declarations: INPUT_DECLS is the single source action.yml and the inputs reference are generated from,
+ * and the per-mode lists beside it say which declared inputs each mode reads, so a CLI reads the same declarations
+ * the action does.
  */
-declare function runSnapshot(api: GitHubClient, cfg: SnapshotConfig, io: Io): ResultAsync<FinishedSnapshot, Problem>;
-/**
- * A finished mode: snapshot run: the public view is projected first, so nothing below carries a redacted slug; then
- * the summary, the outputs, the result line, and the exit code as every mode ends.
- */
-declare function concludeSnapshot(io: Io, finished: FinishedSnapshot): number;
-//#endregion
-//#region src/flows/inputs.d.ts
 /** Default `private-repos`, pinned against action.yml by the contract test. */
 declare const DEFAULT_PRIVATE_REPOS = "redact";
 /**
@@ -9655,20 +9619,6 @@ type Mode = (typeof MODES)[number];
  */
 declare const RENDER_ONLY_INPUTS: readonly ["rendered-file", "layering"];
 declare const SNAPSHOT_ONLY_INPUTS: readonly ["snapshot-file", "snapshot-dir"];
-/** selfSlug (GITHUB_REPOSITORY) and runUrl are read from the environment once here, so the run flows stay env-free. */
-interface CommonConfig extends RunFlowConfig {
-  token: string;
-  apiVersion: string;
-}
-type RunConfig = (CommonConfig & (({
-  kind: "single";
-} & SingleConfig) | ({
-  kind: "multi";
-} & MultiConfig))) | ({
-  kind: "render";
-} & RenderConfig) | ({
-  kind: "snapshot";
-} & Pick<CommonConfig, "token" | "apiVersion"> & SnapshotConfig);
 /**
  * `token` is tolerated unread (a workflow commonly sets it on every step). Every declared input NOT listed here is an
  * apply/check control, so the merge rejects it unless it holds its declared default, which the runner supplies whether
@@ -9690,6 +9640,141 @@ declare const SNAPSHOT_INPUTS: readonly ["token", "repository", "mode", "snapsho
  * exported so the snapshot guide's table is pinned to the whole set.
  */
 declare const SNAPSHOT_REJECTED_INPUTS: readonly InputName[];
+//#endregion
+//#region src/flows/multi.d.ts
+/** The single source for the action.yml `settings-file` default, the multi-repo override guard in src/flows/run-config.ts, and the prose below. */
+declare const DEFAULT_SETTINGS_FILE = ".github/settings.yml";
+/**
+ * Where a multi-repo run's targets come from and how their slugs may appear:
+ * the inputs resolveTargets reads. Apply, check, and snapshot share it, so
+ * the three modes name the same fleet from the same inputs.
+ */
+interface TargetsConfig extends Pick<RunFlowConfig, "privateRepos" | "selfSlug"> {
+  reposDir: string;
+  reposInput: string;
+  /** The owner a bare `<name>.yml` file under repos-dir belongs to. */
+  adminOwner: string;
+  discoveryFilters: DiscoveryFilters;
+  /** Filter inputs the user explicitly set, for the misuse rejections. */
+  discoveryFiltersSet: string[];
+}
+interface MultiConfig extends RunFlowConfig, TargetsConfig {
+  defaultsFile: string;
+}
+/** The fleet a run acts on, with the redaction decision every target reports under. */
+interface ResolvedTargets {
+  /** Deduped, central first, in the order the run processes them. */
+  targets: Target[];
+  plan: RedactionPlan;
+  /** A slug's resolved visibility; "unknown" for a slug never resolved. */
+  visibilityOf: (slug: string) => RepoVisibility;
+}
+/**
+ * Resolve the run's targets (repos-dir files, explicit repos, "*" discovery),
+ * decide redaction, and register every masked slug BEFORE the first line is
+ * emitted. A config problem (bad repos input, discovery failure, misplaced
+ * filters, no targets) comes back as the error; nothing has been emitted about
+ * a target when it does.
+ */
+declare function resolveTargets(api: GitHubClient, cfg: TargetsConfig, io: Io): ResultAsync<ResolvedTargets, Problem>;
+/**
+ * Multi-repo orchestration. Config-level problems (bad defaults file, no
+ * targets, duplicate definitions, discovery failure) come back as the error
+ * before any target executes; per-target problems mark that target failed or
+ * skipped and never stop the others.
+ */
+declare function runMulti(api: GitHubClient, cfg: MultiConfig, io: Io, uploader?: ArtifactUploader): ResultAsync<TargetOutcome[], Problem>;
+//#endregion
+//#region src/flows/render.d.ts
+interface RenderConfig extends FoldOptions {
+  settingsFiles: string[];
+  renderedFile: string;
+}
+declare function runRender(cfg: RenderConfig, io: Io): Result<FinishedRender, Problem>;
+//#endregion
+//#region src/flows/single.d.ts
+interface SingleConfig extends RunFlowConfig {
+  repo: RepoRef;
+  settingsFile: string;
+}
+type SingleOutcome = Omit<TargetOutcome, "source">;
+declare function runSingle(api: GitHubClient, cfg: SingleConfig, io: Io, uploader?: ArtifactUploader): ResultAsync<SingleOutcome, Problem>;
+//#endregion
+//#region src/flows/snapshot.d.ts
+/**
+ * The schema the written file's editor hint points at: the schema of this
+ * release line, spelled as the README's quick start spells it. The marker
+ * lets a major release rewrite the tag here (release-please-config.json lists
+ * this file); test/docs/readme.test.ts pins it to the README's hint.
+ */
+declare const SNAPSHOT_SCHEMA_URL = "https://raw.githubusercontent.com/Vivswan/github-settings-as-code/v2/lib/settings.schema.json";
+interface SnapshotConfigBase {
+  onMissingPermission: "fail" | "warn";
+  /** The allowlist; its required set is unused, since a snapshot never writes. */
+  sections: SectionSelection;
+  /** Whether to hide private/internal targets from the public view. */
+  privateRepos: PrivateReposPolicy;
+  /** The repository the run acts for; a target equal to it is never redacted. */
+  selfSlug: string;
+}
+/**
+ * A mode: snapshot run: one repository written to `snapshotFile`, or the
+ * multi-repo targets (resolved exactly as apply resolves them) written under
+ * `snapshotDir` as `<owner>/<name>.yml` each. No settings file, no report
+ * channel: a snapshot reads and writes a file, and the type carries that.
+ */
+type SnapshotConfig = (SnapshotConfigBase & {
+  form: "file";
+  repo: RepoRef;
+  snapshotFile: string;
+}) | (SnapshotConfigBase & TargetsConfig & {
+  form: "dir";
+  snapshotDir: string;
+});
+/**
+ * A finished mode: snapshot run as runSnapshot hands it over: every target
+ * closed through its channel, so a redacted one is sealed with its transcript
+ * and concludeSnapshot opens only the public view. `takenAt` is the run's one
+ * moment (an ISO-8601 UTC instant), which the summary states and no file carries.
+ */
+type FinishedSnapshot = {
+  form: "file";
+  takenAt: string;
+  target: Omit<TargetOutcome, "source">;
+} | {
+  form: "dir";
+  takenAt: string;
+  snapshotDir: string;
+  targets: TargetOutcome[];
+};
+/**
+ * Execute a mode: snapshot run. A destination that would overwrite an authored
+ * file, or a fleet that cannot be resolved, comes back as the error before any
+ * target is read; otherwise every target's closed outcome, which
+ * concludeSnapshot turns into the summary, the outputs, and the exit code.
+ */
+declare function runSnapshot(api: GitHubClient, cfg: SnapshotConfig, io: Io): ResultAsync<FinishedSnapshot, Problem>;
+/**
+ * A finished mode: snapshot run: the public view is projected first, so nothing below carries a redacted slug; then
+ * the summary, the outputs, the result line, and the exit code as every mode ends.
+ */
+declare function concludeSnapshot(io: Io, finished: FinishedSnapshot): number;
+//#endregion
+//#region src/flows/run-config.d.ts
+/** selfSlug (GITHUB_REPOSITORY) and runUrl are read from the environment once here, so the run flows stay env-free. */
+interface CommonConfig extends RunFlowConfig {
+  token: string;
+  apiVersion: string;
+}
+type RunConfig = (CommonConfig & (({
+  kind: "single";
+} & SingleConfig) | ({
+  kind: "multi";
+} & MultiConfig))) | ({
+  kind: "render";
+} & RenderConfig) | ({
+  kind: "snapshot";
+} & Pick<CommonConfig, "token" | "apiVersion"> & SnapshotConfig);
 /** The file form of a mode: snapshot run: one repository written to snapshotFile. */
 type SnapshotFileConfig = Extract<RunConfig, {
   kind: "snapshot";
@@ -9732,4 +9817,4 @@ interface FoldedLayers {
  */
 declare function foldLayers(layers: readonly Layer[], sourceLabel: string, options: FoldOptions, io: Io): Result<FoldedLayers, SettingsProblem | LayerProblem>;
 //#endregion
-export { toPublicView as $, RepoRef as $n, Tolerance as $t, SingleConfig as A, GitHubApi as An, TaggedEndpoint as At, runMulti as B, OutputName as Bn, ValidatedInput as Bt, parseSnapshotFileConfig as C, DiscoveryFilters as Cn, preflightProbe as Ct, SnapshotConfig as D, discoverRepos as Dn, SectionSelection as Dt, SNAPSHOT_SCHEMA_URL as E, VISIBILITY_FILTERS as En, validateSettingsDoc as Et, DEFAULT_SETTINGS_FILE as F, TraceIo as Fn, SectionInput as Ft, failRun as G, silentIo as Gn, writeGatedReads as Gt, RunFlowConfig as H, maskRegistry as Hn, readGating as Ht, MultiConfig as I, AnnotationLevel as In, SectionMeta as It, PublicTargetView as J, SECRET_TRANSPORT_WITHHELD as Jn, OnMissingPermission as Jt, PRIVATE_REPOS_POLICIES as K, ApiError as Kn, DenialPolicy as Kt, ResolvedTargets as L, CollectedLine as Ln, SectionModule as Lt, runSingle as M, GitHubClient as Mn, allGraphqlOps as Mt, RenderConfig as N, GraphqlOp as Nn, sectionModule as Nt, concludeSnapshot as O, ClientAnswer as On, SettingsSource as Ot, runRender as P, RequestMark as Pn, KeyedListLayering as Pt, publicDetail as Q, RemoteTarget as Qn, SnapshotContext as Qt, TargetsConfig as R, Io as Rn, SectionSnapshot as Rt, parseConfig as S, DEFAULT_DISCOVERY_FILTERS as Sn, ValidatedSettings as St, FinishedSnapshot as T, FORKS_FILTERS as Tn, skippedSectionKeys as Tt, concludeRender as U, prefixedIo as Un, sectionGrant as Ut, FinishedRender as V, collectingIo as Vn, denialPosture as Vt, concludeRun as W, redactRanges as Wn, sectionOperations as Wt, capturingIo as X, isRateLimitError as Xn, PlannedOpBase as Xt, TargetOutcome as Y, isPermissionError as Yn, PlanContext as Yt, planRedaction as Z, CentralTarget as Zn, SectionPlan as Zt, RunConfig as _, MustBeNever as _n, SettingsFile as _r, worstOf as _t, DEFAULT_PRIVATE_REPOS as a, EndpointDecl as an, Problem as ar, deliverArtifactReport as at, SNAPSHOT_REJECTED_INPUTS as b, AFFILIATIONS as bn, Layering as br, RepoRunResult as bt, InputDecl as c, endpointPath as cn, SettingsFileRole as cr, RepoVisibility as ct, MODES as d, grantFor as dn, describeProblem as dr, SectionSnapshotOutcome as dt, Unverifiable as en, Target as er, PRIVATE_REPORT_CHANNELS as et, Mode as f, FoldOptions as fn, quoteList as fr, SnapshotResult as ft, RunCapabilities as g, mergeLayers as gn, SectionKey as gr, RunOutcome as gt, RENDER_REJECTED_INPUTS as h, describeRemoval as hn, SECTION_KEYS as hr, RUN_RESULTS as ht, ConfigEnv as i, SectionFailure as in, LayerProblem as ir, ArtifactUploader as it, SingleOutcome as j, GitHubApiOptions as jn, allEndpoints as jt, runSnapshot as k, DEFAULT_API_VERSION as kn, SECTIONS as kt, InputName as l, PatResource as ln, SettingsProblem as lr, createVisibilityResolver as lt, RENDER_ONLY_INPUTS as m, RemovalNotice as mn, PROBOT_PARITY_KEYS as mr, renderSnapshotYaml as mt, foldLayers as n, snapshotContext as nn, parseRepoSlug as nr, applyMarkerInjection as nt, FILTER_INPUTS as o, Route as on, ProblemOf as or, encryptReport as ot, RENDER_INPUTS as p, Layer as pn, DOCUMENT_DIRECTIVE_KEYS as pr, SnapshotRunOptions as pt, PrivateReposPolicy as q, SECRET_RESPONSE_WITHHELD as qn, Justification as qt, readLayerFiles as r, GraphqlOpDecl as rn, CentralFileProblem as rr, openReportChannel as rt, INPUT_DECLS as s, endpointMethod as sn, RERUN_ADVICE as sr, parseRecipient as st, FoldedLayers as t, planContext as tn, dedupeTargets as tr, PrivateReportChannel as tt, InputReader as u, SectionPermission as un, TopLevelShape as ur, RenderableSnapshot as ut, SNAPSHOT_INPUTS as v, UndeclaredPolicy as vn, UNDECLARED_POLICY_SECTIONS as vr, RepoResult as vt, snapshotFileDestination as w, DiscoveryProblem as wn, runForRepo as wt, SnapshotFileConfig as x, ARCHIVED_FILTERS as xn, SectionOutcome as xt, SNAPSHOT_ONLY_INPUTS as y, UndeclaredPolicyList as yn, UndeclaredPolicySection as yr, RepoRunOptions as yt, resolveTargets as z, MaskPair as zn, ValidatedBrand as zt };
+export { toPublicView as $, CentralTarget as $n, Tolerance as $t, InputDecl as A, GitHubApi as An, TaggedEndpoint as At, SNAPSHOT_REJECTED_INPUTS as B, OutputName as Bn, ValidatedInput as Bt, TargetsConfig as C, DiscoveryFilters as Cn, preflightProbe as Ct, DEFAULT_PRIVATE_REPOS as D, discoverRepos as Dn, SectionSelection as Dt, ConfigEnv as E, VISIBILITY_FILTERS as En, validateSettingsDoc as Et, RENDER_INPUTS as F, TraceIo as Fn, SectionInput as Ft, failRun as G, silentIo as Gn, writeGatedReads as Gt, RunFlowConfig as H, maskRegistry as Hn, readGating as Ht, RENDER_ONLY_INPUTS as I, AnnotationLevel as In, SectionMeta as It, PublicTargetView as J, SECRET_RESPONSE_WITHHELD as Jn, OnMissingPermission as Jt, PRIVATE_REPOS_POLICIES as K, ApiError as Kn, DenialPolicy as Kt, RENDER_REJECTED_INPUTS as L, CollectedLine as Ln, SectionModule as Lt, InputReader as M, GitHubClient as Mn, allGraphqlOps as Mt, MODES as N, GraphqlOp as Nn, sectionModule as Nt, FILTER_INPUTS as O, ClientAnswer as On, SettingsSource as Ot, Mode as P, RequestMark as Pn, KeyedListLayering as Pt, publicDetail as Q, isRateLimitError as Qn, SnapshotContext as Qt, SNAPSHOT_INPUTS as R, Io as Rn, SectionSnapshot as Rt, ResolvedTargets as S, DEFAULT_DISCOVERY_FILTERS as Sn, Layering as Sr, ValidatedSettings as St, runMulti as T, FORKS_FILTERS as Tn, skippedSectionKeys as Tt, concludeRender as U, prefixedIo as Un, sectionGrant as Ut, FinishedRender as V, collectingIo as Vn, denialPosture as Vt, concludeRun as W, redactRanges as Wn, sectionOperations as Wt, capturingIo as X, classifyApiError as Xn, PlannedOpBase as Xt, TargetOutcome as Y, SECRET_TRANSPORT_WITHHELD as Yn, PlanContext as Yt, planRedaction as Z, isPermissionError as Zn, SectionPlan as Zt, runSingle as _, MustBeNever as _n, SECTION_KEYS as _r, worstOf as _t, RunConfig as a, EndpointDecl as an, CentralFileProblem as ar, deliverArtifactReport as at, DEFAULT_SETTINGS_FILE as b, AFFILIATIONS as bn, UNDECLARED_POLICY_SECTIONS as br, RepoRunResult as bt, parseSnapshotFileConfig as c, endpointPath as cn, ProblemOf as cr, RepoVisibility as ct, SNAPSHOT_SCHEMA_URL as d, grantFor as dn, SettingsProblem as dr, SectionSnapshotOutcome as dt, Unverifiable as en, RemoteTarget as er, PRIVATE_REPORT_CHANNELS as et, SnapshotConfig as f, FoldOptions as fn, TopLevelShape as fr, SnapshotResult as ft, SingleOutcome as g, mergeLayers as gn, PROBOT_PARITY_KEYS as gr, RunOutcome as gt, SingleConfig as h, describeRemoval as hn, DOCUMENT_DIRECTIVE_KEYS as hr, RUN_RESULTS as ht, RunCapabilities as i, SectionFailure as in, parseRepoSlug as ir, ArtifactUploader as it, InputName as j, GitHubApiOptions as jn, allEndpoints as jt, INPUT_DECLS as k, DEFAULT_API_VERSION as kn, SECTIONS as kt, snapshotFileDestination as l, PatResource as ln, RERUN_ADVICE as lr, createVisibilityResolver as lt, runSnapshot as m, RemovalNotice as mn, quoteList as mr, renderSnapshotYaml as mt, foldLayers as n, snapshotContext as nn, Target as nr, applyMarkerInjection as nt, SnapshotFileConfig as o, Route as on, LayerProblem as or, encryptReport as ot, concludeSnapshot as p, Layer as pn, describeProblem as pr, SnapshotRunOptions as pt, PrivateReposPolicy as q, ApiErrorKind as qn, Justification as qt, readLayerFiles as r, GraphqlOpDecl as rn, dedupeTargets as rr, openReportChannel as rt, parseConfig as s, endpointMethod as sn, Problem as sr, parseRecipient as st, FoldedLayers as t, planContext as tn, RepoRef as tr, PrivateReportChannel as tt, FinishedSnapshot as u, SectionPermission as un, SettingsFileRole as ur, RenderableSnapshot as ut, RenderConfig as v, UndeclaredPolicy as vn, SectionKey as vr, RepoResult as vt, resolveTargets as w, DiscoveryProblem as wn, runForRepo as wt, MultiConfig as x, ARCHIVED_FILTERS as xn, UndeclaredPolicySection as xr, SectionOutcome as xt, runRender as y, UndeclaredPolicyList as yn, SettingsFile as yr, RepoRunOptions as yt, SNAPSHOT_ONLY_INPUTS as z, MaskPair as zn, ValidatedBrand as zt };