"""
``_finding`` — per-finding apply pipeline.

Split into three private submodules:

* ``_helpers``      — pure helpers (``_legitimate_role_ids_for``,
                      ``_arrange_kick_handoff``, ``_strip_managed_roles``,
                      ``_skipped_action``).
* ``_executor``     — ``_ApplyFindingExecutor`` + phase-result
                      discriminated unions.
* ``_orchestrator`` — ``_apply_finding`` orchestrator + the three
                      unit-test entry-point shims (``_emit_skipped`` /
                      ``_emit_failed`` / ``_phase1_lock_reclassify``).

External callers (``_apply.py``, ``_resume.py``, tests) import via this
package surface and never reach into the submodules directly. Tests
that ``mock.patch`` symbols imported INSIDE a submodule (e.g.
``persist_finding_skipped``, ``derive_managed_role_ids``,
``_arrange_kick_handoff``, ``AA_DISCORD_AUDIT_USE_BULK_ROLE_STRIP``)
must patch the submodule attribute — not the package attribute —
because ``mock.patch`` operates on the module that imports the name.
"""

from ._executor import (
    _ApplyFindingExecutor,
    _Phase1Done,
    _Phase1Skipped,
    _Phase2Done,
    _Phase2Skipped,
)
from ._helpers import (
    _arrange_kick_handoff,
    _legitimate_role_ids_for,
    _skipped_action,
    _strip_managed_roles,
)
from ._orchestrator import (
    _apply_finding,
    _emit_failed,
    _emit_skipped,
    _phase1_lock_reclassify,
    preload_users_for_findings,
)

# Underscore-prefixed names in ``__all__`` look unusual on first read
# but are the package's intentional contract: every member is an in-
# repo private API (apply pipeline internals + a handful of named
# test entry points). The submodule-private prefix is preserved on
# the package surface to keep the "this is not external API" signal
# visible at every import site. The three "shim" entries
# (``_emit_skipped`` / ``_emit_failed`` / ``_phase1_lock_reclassify``)
# are imported directly by ``tests/test_audit_apply_plan.py`` as
# isolated phase entry points — they delegate to executor methods
# and exist purely so a single phase or emit branch can be exercised
# without rebuilding the surrounding ``execute()`` pipeline.
__all__ = [
    "_ApplyFindingExecutor",
    "_Phase1Done",
    "_Phase1Skipped",
    "_Phase2Done",
    "_Phase2Skipped",
    "_apply_finding",
    "_arrange_kick_handoff",
    "_emit_failed",
    "_emit_skipped",
    "_legitimate_role_ids_for",
    "_phase1_lock_reclassify",
    "_skipped_action",
    "_strip_managed_roles",
    "preload_users_for_findings",
]
