@chisquare-tech/origine-ngx-apps-code 0.11.3 → 0.13.0

package/fesm2022/chisquare-tech-origine-ngx-apps-code.mjs

@@ -1,12 +1,13 @@
 import * as i0 from '@angular/core';
 import { inject, Injectable, signal, computed, effect, untracked, Directive, ElementRef, input, output, HostListener, ChangeDetectionStrategy, Component, DestroyRef } from '@angular/core';
 import { ApiService } from '@thescaffold/ngx-core';
-import { map, forkJoin, of } from 'rxjs';
+import { map, catchError, of, forkJoin } from 'rxjs';
 import * as i1 from '@angular/forms';
 import { FormsModule } from '@angular/forms';
 import { ActivatedRoute, RouterLink, Router } from '@angular/router';
 import { NgTemplateOutlet } from '@angular/common';
-import { map as map$1, catchError } from 'rxjs/operators';
+import { DomSanitizer } from '@angular/platform-browser';
+import { map as map$1, catchError as catchError$1 } from 'rxjs/operators';
 import { marked } from 'marked';
 
 /**
@@ -29,6 +30,17 @@ class CodeApi {
     repoPath(project, name) {
         return `${C}/project/${enc(project)}/repo/${enc(name)}`;
     }
+    /**
+     * Whether this installation signs the commits it makes (DEV-31, D-67): GET /signing-key answers.
+     * A web edit is then signed, so a rule that only asks for signed commits takes it directly.
+     */
+    platformSigns() {
+        return this.api.get(`${C}/signing-key`).pipe(map((r) => !!data(r)), catchError(() => of(false)));
+    }
+    /** The organization's custom roles (V4-01), for the bypass list of a branch rule. */
+    customRoles() {
+        return this.api.get('v1/projects/roles').pipe(map((r) => (data(r)?.custom ?? []).map((c) => ({ id: c.id, name: c.name }))));
+    }
     repos(project) {
         return this.api.get(`${C}/project/${enc(project)}/repo`).pipe(map((r) => data(r) ?? []));
     }
@@ -38,6 +50,21 @@ class CodeApi {
     import(project, body) {
         return this.api.post(`${C}/project/${enc(project)}/repo/import`, body).pipe(map((r) => data(r)));
     }
+    /** A repository's pull mirror (V6-01). */
+    mirror(project, name) {
+        return this.api.get(`${this.repoPath(project, name)}/mirror`).pipe(map((r) => data(r)));
+    }
+    /** Changes the mirror's source, credentials or interval; the saver becomes whom it syncs as. */
+    updateMirror(project, name, body) {
+        return this.api.patch(`${this.repoPath(project, name)}/mirror`, body).pipe(map((r) => data(r)));
+    }
+    syncMirror(project, name) {
+        return this.api.post(`${this.repoPath(project, name)}/mirror/sync`, {}).pipe(map((r) => data(r)));
+    }
+    /** Stops mirroring: an ordinary repository that takes pushes. */
+    stopMirror(project, name) {
+        return this.api.delete(`${this.repoPath(project, name)}/mirror`).pipe(map((r) => data(r)));
+    }
     repo(project, name) {
         return this.api.get(this.repoPath(project, name)).pipe(map((r) => data(r)));
     }
@@ -211,6 +238,14 @@ class CodeApi {
     merge(project, name, n, body) {
         return this.api.post(`${this.repoPath(project, name)}/pulls/${n}/merge`, body).pipe(map((r) => data(r)));
     }
+    /** A pull request's conflicts with its target, for the resolver (V6-03). */
+    conflicts(project, name, n) {
+        return this.api.get(`${this.repoPath(project, name)}/pulls/${n}/conflicts`).pipe(map((r) => data(r)));
+    }
+    /** Commits a resolution of the conflicts (V6-03). */
+    resolveConflicts(project, name, n, body) {
+        return this.api.post(`${this.repoPath(project, name)}/pulls/${n}/resolve`, body).pipe(map((r) => data(r)));
+    }
     conversation(project, name, n) {
         return this.api.get(`${this.repoPath(project, name)}/pulls/${n}/conversation`).pipe(map((r) => data(r) ?? { comments: [], reviews: [], threads: [] }));
     }
@@ -356,6 +391,18 @@ const TOKEN_CSS = `
   :host ::ng-deep .tk-nb, :host ::ng-deep .tk-nt, :host ::ng-deep .tk-bp{color:var(--o-tk-p)}
   :host ::ng-deep .tk-gi{color:var(--o-add)} :host ::ng-deep .tk-gd{color:var(--o-bad-tx)}
 `;
+/** A commit's verification badge (DEV-31, V6-04): commits Origine made read "Verified · Origine". */
+function verifyLabel(v) {
+    if (!v.verified)
+        return 'Unverified';
+    return v.signer === 'origine' ? 'Verified · Origine' : 'Verified';
+}
+/** The badge's hover text: whose key signed it, or why it is not verified. */
+function verifyTitle(v, name) {
+    if (!v.verified)
+        return verifyWhy(v.reason);
+    return v.signer === 'origine' ? 'Made and signed by Origine, with the signing key of its region' : 'Signed with a key of ' + name(v.signer ?? '');
+}
 /** Why a signed commit is not verified (DEV-31). */
 function verifyWhy(reason) {
     return { unknown_key: 'Signed with a key that is not the committer’s signing key', bad_signature: 'The signature does not match the commit' }[reason] ?? 'Not verified';
@@ -367,6 +414,13 @@ function verifyWhy(reason) {
  * their own data in onRepo().
  */
 class RepoPage {
+    verifyTitle(v) {
+        return verifyTitle(v, (id) => this.people().name(id));
+    }
+    /** Whether the caller holds code capability id on this repository (V4-01): its caps, a collaborator row included. */
+    can(id) {
+        return (this.repo()?.caps ?? []).includes(id);
+    }
     constructor() {
         this.host = inject(CodeHost);
         this.api = inject(CodeApi);
@@ -378,11 +432,20 @@ class RepoPage {
         this.note = signal('', ...(ngDevMode ? [{ debugName: "note" }] : /* istanbul ignore next */ []));
         this.people = computed(() => new People(this.host.people()), ...(ngDevMode ? [{ debugName: "people" }] : /* istanbul ignore next */ []));
         this.verifyWhy = verifyWhy;
-        this.canWrite = computed(() => !this.repo()?.archivedAt && (this.repo()?.capabilities ?? []).includes('code.write'), ...(ngDevMode ? [{ debugName: "canWrite" }] : /* istanbul ignore next */ []));
-        this.canAdmin = computed(() => (this.repo()?.capabilities ?? []).includes('resources.manage'), ...(ngDevMode ? [{ debugName: "canAdmin" }] : /* istanbul ignore next */ []));
-        /** Repository settings short of a rename, the visibility and deletion: Maintainers, and maintain collaborators. */
-        this.canMaintain = computed(() => this.canAdmin() || (this.repo()?.capabilities ?? []).includes('repo.maintain'), ...(ngDevMode ? [{ debugName: "canMaintain" }] : /* istanbul ignore next */ []));
-        this.canProtect = computed(() => (this.repo()?.capabilities ?? []).includes('protection.manage'), ...(ngDevMode ? [{ debugName: "canProtect" }] : /* istanbul ignore next */ []));
+        this.verifyLabel = verifyLabel;
+        /** Takes writes: not archived, and not a pull mirror (V6-01). */
+        this.live = computed(() => !!this.repo() && !this.repo()?.archivedAt && !this.repo()?.mirror, ...(ngDevMode ? [{ debugName: "live" }] : /* istanbul ignore next */ []));
+        this.canWrite = computed(() => this.live() && this.can('code.push'), ...(ngDevMode ? [{ debugName: "canWrite" }] : /* istanbul ignore next */ []));
+        /** Every repository setting, a rename and the visibility included. */
+        this.canSettings = computed(() => this.can('code.repo.settings'), ...(ngDevMode ? [{ debugName: "canSettings" }] : /* istanbul ignore next */ []));
+        /** Repository settings short of a rename and the visibility: the above, and maintain collaborators. */
+        this.canMaintain = computed(() => this.canSettings() || this.repo()?.collaborator === 'maintain', ...(ngDevMode ? [{ debugName: "canMaintain" }] : /* istanbul ignore next */ []));
+        this.canDelete = computed(() => this.can('code.repo.delete'), ...(ngDevMode ? [{ debugName: "canDelete" }] : /* istanbul ignore next */ []));
+        this.canCollaborators = computed(() => this.can('code.collaborators.manage'), ...(ngDevMode ? [{ debugName: "canCollaborators" }] : /* istanbul ignore next */ []));
+        this.canProtect = computed(() => this.can('code.branch.protect'), ...(ngDevMode ? [{ debugName: "canProtect" }] : /* istanbul ignore next */ []));
+        this.canRelease = computed(() => this.live() && this.can('code.release.manage'), ...(ngDevMode ? [{ debugName: "canRelease" }] : /* istanbul ignore next */ []));
+        this.canOpenPull = computed(() => this.live() && this.can('code.pr.create'), ...(ngDevMode ? [{ debugName: "canOpenPull" }] : /* istanbul ignore next */ []));
+        this.canMerge = computed(() => this.live() && this.can('code.pr.merge'), ...(ngDevMode ? [{ debugName: "canMerge" }] : /* istanbul ignore next */ []));
         this.route.paramMap.subscribe((m) => this.name.set(m.get('repo') ?? ''));
         effect(() => {
             const name = this.name();
@@ -960,7 +1023,7 @@ class ReposPage {
         this.ago = (s) => ago(s);
         this.canWrite = computed(() => {
             const p = this.host.project();
-            return !!p && !p.archivedAt && p.capabilities.includes('code.write');
+            return !!p && !p.archivedAt && this.host.can('code.repo.create');
         }, ...(ngDevMode ? [{ debugName: "canWrite" }] : /* istanbul ignore next */ []));
         effect(() => {
             const p = this.host.project();
@@ -1072,6 +1135,8 @@ class NewRepoPage {
         this.url_ = '';
         this.user = '';
         this.token = '';
+        this.mirror = false;
+        this.interval = 60;
         this.route.queryParamMap.subscribe((q) => this.mode.set(q.get('import') ? 'import' : 'create'));
     }
     nameFromUrl() {
@@ -1101,7 +1166,7 @@ class NewRepoPage {
             return;
         this.busy.set(true);
         this.error.set('');
-        this.api.import(p.id, { name: this.repoName.trim(), url: this.url_.trim(), username: this.user.trim() || undefined, token: this.token || undefined, visibility: this.vis }).subscribe({
+        this.api.import(p.id, { name: this.repoName.trim(), url: this.url_.trim(), username: this.user.trim() || undefined, token: this.token || undefined, visibility: this.vis, mirror: this.mirror || undefined, intervalMinutes: this.mirror ? Number(this.interval) || undefined : undefined }).subscribe({
             next: (r) => { this.busy.set(false); this.token = ''; this.made.set(r); },
             error: (e) => { this.busy.set(false); this.error.set(apiMessage(e, 'Could not start the import.')); },
         });
@@ -1159,11 +1224,15 @@ class NewRepoPage {
             <div class="o-fld"><label for="ir-user">Username <span class="o-faint">(private repos)</span></label><input id="ir-user" class="o-in" name="user" [(ngModel)]="user" autocomplete="off" /></div>
             <div class="o-fld"><label for="ir-tok">Access token</label><input id="ir-tok" class="o-in" type="password" name="token" [(ngModel)]="token" autocomplete="off" /></div>
           </div>
-          <div class="o-flex"><span class="o-faint o-sm">Imports run in the background; you'll get an inbox message when done.</span><button type="submit" class="o-btn o-dark o-r" [disabled]="busy() || !url_.trim() || !repoName.trim()">Import</button></div>
+          <div class="o-g2">
+            <div class="o-fld"><span class="o-lbl" style="padding:0" id="ir-mirror">Keep in sync with the source</span><button type="button" class="o-tog" role="switch" aria-labelledby="ir-mirror" [class.o-on]="mirror" [attr.aria-checked]="mirror" (click)="mirror = !mirror" data-testid="import-mirror"></button><span class="o-hint">A mirror fetches new commits on a schedule and refuses pushes. The token is kept encrypted for its syncs.</span></div>
+            @if (mirror) {<div class="o-fld"><label for="ir-int">Sync every (minutes)</label><input id="ir-int" class="o-in" type="number" min="1" name="interval" [(ngModel)]="interval" data-testid="import-interval" /></div>}
+          </div>
+          <div class="o-flex"><span class="o-faint o-sm">Imports run in the background; you'll get an inbox message when done.</span><button type="submit" class="o-btn o-dark o-r" [disabled]="busy() || !url_.trim() || !repoName.trim()" data-testid="import-submit">Import</button></div>
         </form>
       }
     </div>
-  `, isInline: true, dependencies: [{ kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i1.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i1.NgSelectOption, selector: "option", inputs: ["ngValue", "value"] }, { kind: "directive", type: i1.ɵNgSelectMultipleOption, selector: "option", inputs: ["ngValue", "value"] }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.SelectControlValueAccessor, selector: "select:not([multiple])[formControlName],select:not([multiple])[formControl],select:not([multiple])[ngModel]", inputs: ["compareWith"] }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i1.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i1.NgForm, selector: "form:not([ngNoForm]):not([formGroup]):not([formArray]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }, { kind: "directive", type: RouterLink, selector: "[routerLink]", inputs: ["target", "queryParams", "fragment", "queryParamsHandling", "state", "info", "relativeTo", "preserveFragment", "skipLocationChange", "replaceUrl", "routerLink"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush }); }
+  `, isInline: true, dependencies: [{ kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i1.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i1.NgSelectOption, selector: "option", inputs: ["ngValue", "value"] }, { kind: "directive", type: i1.ɵNgSelectMultipleOption, selector: "option", inputs: ["ngValue", "value"] }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.NumberValueAccessor, selector: "input[type=number][formControlName],input[type=number][formControl],input[type=number][ngModel]" }, { kind: "directive", type: i1.SelectControlValueAccessor, selector: "select:not([multiple])[formControlName],select:not([multiple])[formControl],select:not([multiple])[ngModel]", inputs: ["compareWith"] }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i1.MinValidator, selector: "input[type=number][min][formControlName],input[type=number][min][formControl],input[type=number][min][ngModel]", inputs: ["min"] }, { kind: "directive", type: i1.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i1.NgForm, selector: "form:not([ngNoForm]):not([formGroup]):not([formArray]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }, { kind: "directive", type: RouterLink, selector: "[routerLink]", inputs: ["target", "queryParams", "fragment", "queryParamsHandling", "state", "info", "relativeTo", "preserveFragment", "skipLocationChange", "replaceUrl", "routerLink"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: NewRepoPage, decorators: [{
             type: Component,
@@ -1223,7 +1292,11 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
             <div class="o-fld"><label for="ir-user">Username <span class="o-faint">(private repos)</span></label><input id="ir-user" class="o-in" name="user" [(ngModel)]="user" autocomplete="off" /></div>
             <div class="o-fld"><label for="ir-tok">Access token</label><input id="ir-tok" class="o-in" type="password" name="token" [(ngModel)]="token" autocomplete="off" /></div>
           </div>
-          <div class="o-flex"><span class="o-faint o-sm">Imports run in the background; you'll get an inbox message when done.</span><button type="submit" class="o-btn o-dark o-r" [disabled]="busy() || !url_.trim() || !repoName.trim()">Import</button></div>
+          <div class="o-g2">
+            <div class="o-fld"><span class="o-lbl" style="padding:0" id="ir-mirror">Keep in sync with the source</span><button type="button" class="o-tog" role="switch" aria-labelledby="ir-mirror" [class.o-on]="mirror" [attr.aria-checked]="mirror" (click)="mirror = !mirror" data-testid="import-mirror"></button><span class="o-hint">A mirror fetches new commits on a schedule and refuses pushes. The token is kept encrypted for its syncs.</span></div>
+            @if (mirror) {<div class="o-fld"><label for="ir-int">Sync every (minutes)</label><input id="ir-int" class="o-in" type="number" min="1" name="interval" [(ngModel)]="interval" data-testid="import-interval" /></div>}
+          </div>
+          <div class="o-flex"><span class="o-faint o-sm">Imports run in the background; you'll get an inbox message when done.</span><button type="submit" class="o-btn o-dark o-r" [disabled]="busy() || !url_.trim() || !repoName.trim()" data-testid="import-submit">Import</button></div>
         </form>
       }
     </div>
@@ -1408,8 +1481,9 @@ class RepoHomePage extends RepoPage {
         <div class="o-ph">
           <div class="o-col">
             <span class="o-eyebrow">{{ r.projectKey }}</span>
-            <div class="o-flex"><h1 class="o-t o-mono" style="font-size:19px">{{ r.name }}</h1><span class="o-chip">{{ r.visibility === 'private' ? 'Private' : 'Org-internal' }}</span>@if (r.archivedAt) {<span class="o-chip o-amb">Archived</span>}</div>
+            <div class="o-flex"><h1 class="o-t o-mono" style="font-size:19px">{{ r.name }}</h1><span class="o-chip">{{ r.visibility === 'private' ? 'Private' : 'Org-internal' }}</span>@if (r.archivedAt) {<span class="o-chip o-amb">Archived</span>}@if (r.mirror) {<span class="o-chip o-blu" data-testid="repo-mirror">Mirror</span>}</div>
             @if (r.description) {<span class="o-mut">{{ r.description }}</span>}
+            @if (r.mirror) {<span class="o-faint o-sm">Mirror of <span class="o-mono">{{ r.importSource }}</span>, read-only.</span>}
           </div>
           @if (!r.empty) {<div class="o-acts"><button type="button" class="o-btn o-sm" (click)="archive('zip')">Download ZIP</button></div>}
         </div>
@@ -1540,8 +1614,9 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
         <div class="o-ph">
           <div class="o-col">
             <span class="o-eyebrow">{{ r.projectKey }}</span>
-            <div class="o-flex"><h1 class="o-t o-mono" style="font-size:19px">{{ r.name }}</h1><span class="o-chip">{{ r.visibility === 'private' ? 'Private' : 'Org-internal' }}</span>@if (r.archivedAt) {<span class="o-chip o-amb">Archived</span>}</div>
+            <div class="o-flex"><h1 class="o-t o-mono" style="font-size:19px">{{ r.name }}</h1><span class="o-chip">{{ r.visibility === 'private' ? 'Private' : 'Org-internal' }}</span>@if (r.archivedAt) {<span class="o-chip o-amb">Archived</span>}@if (r.mirror) {<span class="o-chip o-blu" data-testid="repo-mirror">Mirror</span>}</div>
             @if (r.description) {<span class="o-mut">{{ r.description }}</span>}
+            @if (r.mirror) {<span class="o-faint o-sm">Mirror of <span class="o-mono">{{ r.importSource }}</span>, read-only.</span>}
           </div>
           @if (!r.empty) {<div class="o-acts"><button type="button" class="o-btn o-sm" (click)="archive('zip')">Download ZIP</button></div>}
         </div>
@@ -1690,9 +1765,11 @@ function matchesPattern(pattern, branch) {
 }
 // The web editor's commit box (prototype code_file "Commit and open PR", DEV-13): a message, and
 // either the branch itself or a new branch with a pull request. A branch whose rules block direct
-// pushes only offers the second. The rules load asynchronously: until they have, nothing can be
-// committed (a quick commit straight to a protected branch was refused by the server); when they
-// cannot be loaded, the change goes to a new branch with a pull request, which any branch takes.
+// pushes only offers the second, and so does one that requires signed commits when the platform
+// does not sign what it commits (D-67: when it does, the web edit is signed and goes straight in).
+// The rules load asynchronously: until they have, nothing can be committed (a quick commit straight
+// to a protected branch was refused by the server); when they cannot be loaded, the change goes to
+// a new branch with a pull request, which any branch takes.
 class CommitBox {
     constructor() {
         this.api = inject(CodeApi);
@@ -1707,13 +1784,17 @@ class CommitBox {
         this.toNew = signal(false, ...(ngDevMode ? [{ debugName: "toNew" }] : /* istanbul ignore next */ []));
         this.newBranch = signal('', ...(ngDevMode ? [{ debugName: "newBranch" }] : /* istanbul ignore next */ []));
         this.rules = signal([], ...(ngDevMode ? [{ debugName: "rules" }] : /* istanbul ignore next */ []));
+        /** Whether the platform signs web commits (GET /signing-key answers). */
+        this.signs = signal(false, ...(ngDevMode ? [{ debugName: "signs" }] : /* istanbul ignore next */ []));
         /** Whether the branch's rules are known yet. */
         this.rulesState = signal('loading', ...(ngDevMode ? [{ debugName: "rulesState" }] : /* istanbul ignore next */ []));
         /**
          * Direct commits are refused (or may be): the rules block direct pushes, or require signed
-         * commits (a browser commit is unsigned), or they could not be loaded.
+         * commits while the platform signs nothing (a browser commit is then unsigned), or they could not
+         * be loaded.
          */
-        this.blocked = computed(() => this.rulesState() === 'failed' || this.rules().some((r) => (r.blockDirectPush || r.requireSignedCommits) && matchesPattern(r.pattern, this.branch())), ...(ngDevMode ? [{ debugName: "blocked" }] : /* istanbul ignore next */ []));
+        this.blocked = computed(() => this.rulesState() === 'failed' ||
+            this.rules().some((r) => (r.blockDirectPush || (r.requireSignedCommits && !this.signs())) && matchesPattern(r.pattern, this.branch())), ...(ngDevMode ? [{ debugName: "blocked" }] : /* istanbul ignore next */ []));
         this.rulesFor = null;
         effect(() => {
             const m = this.defaultMessage();
@@ -1737,11 +1818,12 @@ class CommitBox {
         if (!at)
             return;
         this.rulesState.set('loading');
-        this.api.protections(at.project, at.repo).subscribe({
-            next: (r) => {
+        forkJoin({ rules: this.api.protections(at.project, at.repo), signs: this.api.platformSigns() }).subscribe({
+            next: ({ rules, signs }) => {
                 if (this.rulesFor !== at)
                     return;
-                this.rules.set(r);
+                this.rules.set(rules);
+                this.signs.set(signs);
                 this.rulesState.set('loaded');
             },
             error: () => {
@@ -1810,7 +1892,8 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
         }], ctorParameters: () => [], propDecorators: { repo: [{ type: i0.Input, args: [{ isSignal: true, alias: "repo", required: true }] }], branch: [{ type: i0.Input, args: [{ isSignal: true, alias: "branch", required: true }] }], defaultMessage: [{ type: i0.Input, args: [{ isSignal: true, alias: "defaultMessage", required: false }] }], busy: [{ type: i0.Input, args: [{ isSignal: true, alias: "busy", required: false }] }], commit: [{ type: i0.Output, args: ["commit"] }], cancel: [{ type: i0.Output, args: ["cancel"] }] } });
 
 // /{org}/{project}/code/{repo}/blob?ref=&path= (prototype "code_file"): one file, highlighted, with
-// Markdown preview, blame, raw, copy and download; a line number links to that line (#L12).
+// Markdown preview, blame, raw, copy and download; a line number links to that line (#L12). A CSV
+// or TSV previews as a table of its first rows, and a PDF in the browser's own viewer (V0-21).
 class FilePage extends RepoPage {
     constructor() {
         super();
@@ -1822,6 +1905,12 @@ class FilePage extends RepoPage {
         this.path = signal('', ...(ngDevMode ? [{ debugName: "path" }] : /* istanbul ignore next */ []));
         this.line = signal(0, ...(ngDevMode ? [{ debugName: "line" }] : /* istanbul ignore next */ []));
         this.view = signal('preview', ...(ngDevMode ? [{ debugName: "view" }] : /* istanbul ignore next */ []));
+        this.sanitizer = inject(DomSanitizer);
+        /** The PDF's signed raw link, trusted as a frame source: the cookieless raw host serves it inline. */
+        this.pdfUrl = computed(() => {
+            const b = this.blob();
+            return b?.preview === 'pdf' && b.rawUrl ? this.sanitizer.bypassSecurityTrustResourceUrl(b.rawUrl) : null;
+        }, ...(ngDevMode ? [{ debugName: "pdfUrl" }] : /* istanbul ignore next */ []));
         this.copied = signal(false, ...(ngDevMode ? [{ debugName: "copied" }] : /* istanbul ignore next */ []));
         this.ago = (s) => ago(s);
         this.initials = initials;
@@ -1949,7 +2038,7 @@ class FilePage extends RepoPage {
         this.blame.set([]);
         this.blaming.set(false);
         this.api.blob(this.projectId(), r.name, this.ref() || r.defaultBranch, this.path()).subscribe({
-            next: (b) => { this.blob.set(b); this.view.set(b.markdown ? 'preview' : 'code'); if (this.line())
+            next: (b) => { this.blob.set(b); this.view.set(b.markdown || b.preview === 'csv' ? 'preview' : 'code'); if (this.line())
                 setTimeout(() => document.getElementById('L' + this.line())?.scrollIntoView({ block: 'center' })); },
             error: (e) => this.error.set(apiMessage(e, `Could not open ${this.path()}.`)),
         });
@@ -1982,7 +2071,7 @@ class FilePage extends RepoPage {
             <div class="o-ch">
               <span class="o-faint o-sm">{{ meta() }}</span>
               <span class="o-r o-flex" style="gap:6px">
-                @if (b.markdown) {
+                @if (b.markdown || b.preview === 'csv') {
                   <div class="o-seg" role="group" aria-label="View"><button type="button" [class.o-on]="view() === 'preview'" (click)="view.set('preview')">Preview</button><button type="button" [class.o-on]="view() === 'code'" (click)="view.set('code')">Code</button></div>
                 }
                 @if (!b.binary && !b.truncated && !b.lfs) {<button type="button" class="o-btn o-xs" [class.o-on]="blaming()" [attr.aria-pressed]="blaming()" (click)="toggleBlame()">Blame</button>}
@@ -2011,6 +2100,21 @@ class FilePage extends RepoPage {
             }
             @if (b.image && b.rawUrl) {
               <div class="o-cb" style="text-align:center"><img [src]="b.rawUrl" [alt]="b.name" style="max-width:100%" /></div>
+            } @else if (b.preview === 'pdf' && pdfUrl(); as src) {
+              <iframe [src]="src" [title]="b.name" style="display:block;width:100%;height:78vh;border:0" data-testid="pdf-preview"></iframe>
+            } @else if (b.preview === 'csv' && b.table && view() === 'preview') {
+              @let t = b.table;
+              <div style="overflow:auto;max-height:78vh" data-testid="csv-preview">
+                <div class="o-tbl" role="table" [attr.aria-label]="b.path">
+                  <div class="o-thead" role="rowgroup"><div class="o-tr" role="row"><div class="o-th o-num" role="columnheader" aria-label="Row"></div>@for (h of t.header; track $index) {<div class="o-th" role="columnheader">{{ h }}</div>}</div></div>
+                  <div class="o-tbody" role="rowgroup">
+                    @for (row of t.rows; track $index; let i = $index) {
+                      <div class="o-tr" role="row"><div class="o-td o-num o-faint" role="rowheader">{{ i + 1 }}</div>@for (c of row; track $index) {<div class="o-td" role="cell">{{ c }}</div>}</div>
+                    }
+                  </div>
+                </div>
+              </div>
+              @if (t.truncated) {<div class="o-cf o-faint o-sm" data-testid="csv-more">Showing the first {{ t.rows.length }} rows. @if (b.rawUrl) {<a [href]="b.rawUrl" target="_blank" rel="noopener">View raw</a> for the rest.}</div>}
             } @else if (b.lfs && !b.lfs.stored) {
               <div class="o-empty" data-testid="lfs-missing">This file is a Git LFS pointer to an object that was never uploaded (<span class="o-mono">{{ b.lfs.oid.slice(0, 12) }}</span>, {{ size(b.lfs.size) }}).</div>
             } @else if (b.binary || b.truncated) {
@@ -2068,7 +2172,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
             <div class="o-ch">
               <span class="o-faint o-sm">{{ meta() }}</span>
               <span class="o-r o-flex" style="gap:6px">
-                @if (b.markdown) {
+                @if (b.markdown || b.preview === 'csv') {
                   <div class="o-seg" role="group" aria-label="View"><button type="button" [class.o-on]="view() === 'preview'" (click)="view.set('preview')">Preview</button><button type="button" [class.o-on]="view() === 'code'" (click)="view.set('code')">Code</button></div>
                 }
                 @if (!b.binary && !b.truncated && !b.lfs) {<button type="button" class="o-btn o-xs" [class.o-on]="blaming()" [attr.aria-pressed]="blaming()" (click)="toggleBlame()">Blame</button>}
@@ -2097,6 +2201,21 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
             }
             @if (b.image && b.rawUrl) {
               <div class="o-cb" style="text-align:center"><img [src]="b.rawUrl" [alt]="b.name" style="max-width:100%" /></div>
+            } @else if (b.preview === 'pdf' && pdfUrl(); as src) {
+              <iframe [src]="src" [title]="b.name" style="display:block;width:100%;height:78vh;border:0" data-testid="pdf-preview"></iframe>
+            } @else if (b.preview === 'csv' && b.table && view() === 'preview') {
+              @let t = b.table;
+              <div style="overflow:auto;max-height:78vh" data-testid="csv-preview">
+                <div class="o-tbl" role="table" [attr.aria-label]="b.path">
+                  <div class="o-thead" role="rowgroup"><div class="o-tr" role="row"><div class="o-th o-num" role="columnheader" aria-label="Row"></div>@for (h of t.header; track $index) {<div class="o-th" role="columnheader">{{ h }}</div>}</div></div>
+                  <div class="o-tbody" role="rowgroup">
+                    @for (row of t.rows; track $index; let i = $index) {
+                      <div class="o-tr" role="row"><div class="o-td o-num o-faint" role="rowheader">{{ i + 1 }}</div>@for (c of row; track $index) {<div class="o-td" role="cell">{{ c }}</div>}</div>
+                    }
+                  </div>
+                </div>
+              </div>
+              @if (t.truncated) {<div class="o-cf o-faint o-sm" data-testid="csv-more">Showing the first {{ t.rows.length }} rows. @if (b.rawUrl) {<a [href]="b.rawUrl" target="_blank" rel="noopener">View raw</a> for the rest.}</div>}
             } @else if (b.lfs && !b.lfs.stored) {
               <div class="o-empty" data-testid="lfs-missing">This file is a Git LFS pointer to an object that was never uploaded (<span class="o-mono">{{ b.lfs.oid.slice(0, 12) }}</span>, {{ size(b.lfs.size) }}).</div>
             } @else if (b.binary || b.truncated) {
@@ -2200,7 +2319,7 @@ class CommitsPage extends RepoPage {
                     @for (k of c.keys; track k) {<a class="o-chip o-blu" [routerLink]="host.link('issues/' + k)">{{ k }}</a>}
                   </span>
                 </div>
-                @if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="v.verified ? 'Signed with a key of ' + people().name(v.signer) : verifyWhy(v.reason)" [attr.data-testid]="'verify-' + c.short">{{ v.verified ? 'Verified' : 'Unverified' }}</span>}
+                @if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="verifyTitle(v)" [attr.data-testid]="'verify-' + c.short">{{ verifyLabel(v) }}</span>}
                 <a class="o-btn o-sm o-mono" [routerLink]="link('commit/' + c.oid)">{{ c.short }}</a>
                 <a class="o-btn o-sm" [routerLink]="link()" [queryParams]="{ ref: c.oid }" title="Browse files at this commit" [attr.aria-label]="'Browse files at ' + c.short">‹›</a>
               </div>
@@ -2241,7 +2360,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
                     @for (k of c.keys; track k) {<a class="o-chip o-blu" [routerLink]="host.link('issues/' + k)">{{ k }}</a>}
                   </span>
                 </div>
-                @if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="v.verified ? 'Signed with a key of ' + people().name(v.signer) : verifyWhy(v.reason)" [attr.data-testid]="'verify-' + c.short">{{ v.verified ? 'Verified' : 'Unverified' }}</span>}
+                @if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="verifyTitle(v)" [attr.data-testid]="'verify-' + c.short">{{ verifyLabel(v) }}</span>}
                 <a class="o-btn o-sm o-mono" [routerLink]="link('commit/' + c.oid)">{{ c.short }}</a>
                 <a class="o-btn o-sm" [routerLink]="link()" [queryParams]="{ ref: c.oid }" title="Browse files at this commit" [attr.aria-label]="'Browse files at ' + c.short">‹›</a>
               </div>
@@ -2291,7 +2410,7 @@ class CommitPage extends RepoPage {
             @if (c.body) {<span class="o-mut o-lh" style="white-space:pre-wrap">{{ c.body }}</span>}
             <div class="o-flex o-wrap o-sm">
               <span class="o-av" aria-hidden="true">{{ initials(c.author.name) }}</span><b class="o-b5">{{ c.author.name }}</b><span class="o-faint">committed {{ ago(c.committer.when) }}</span>
-              @if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="v.verified ? 'Signed with a key of ' + people().name(v.signer) : verifyWhy(v.reason)" data-testid="commit-verified">{{ v.verified ? 'Verified' : 'Unverified' }}</span>}
+              @if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="verifyTitle(v)" data-testid="commit-verified">{{ verifyLabel(v) }}</span>}
               @for (k of c.keys; track k) {<a class="o-chip o-blu" [routerLink]="host.link('issues/' + k)">{{ k }}</a>}
               <span class="o-r o-mono o-faint">commit {{ c.oid.slice(0, 10) }}@for (p of c.parents; track p) { · parent <a [routerLink]="link('commit/' + p)">{{ p.slice(0, 7) }}</a>}</span>
             </div>
@@ -2323,7 +2442,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
             @if (c.body) {<span class="o-mut o-lh" style="white-space:pre-wrap">{{ c.body }}</span>}
             <div class="o-flex o-wrap o-sm">
               <span class="o-av" aria-hidden="true">{{ initials(c.author.name) }}</span><b class="o-b5">{{ c.author.name }}</b><span class="o-faint">committed {{ ago(c.committer.when) }}</span>
-              @if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="v.verified ? 'Signed with a key of ' + people().name(v.signer) : verifyWhy(v.reason)" data-testid="commit-verified">{{ v.verified ? 'Verified' : 'Unverified' }}</span>}
+              @if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="verifyTitle(v)" data-testid="commit-verified">{{ verifyLabel(v) }}</span>}
               @for (k of c.keys; track k) {<a class="o-chip o-blu" [routerLink]="host.link('issues/' + k)">{{ k }}</a>}
               <span class="o-r o-mono o-faint">commit {{ c.oid.slice(0, 10) }}@for (p of c.parents; track p) { · parent <a [routerLink]="link('commit/' + p)">{{ p.slice(0, 7) }}</a>}</span>
             </div>
@@ -2444,7 +2563,7 @@ class BranchesPage extends RepoPage {
                   </div>
                   <div class="o-td" role="cell">
                     @if (pullFor(b.name); as pr) {<a [class]="pr.state === 'merged' ? 'o-chip o-vio' : pr.state === 'closed' ? 'o-chip' : 'o-chip o-blu'" [routerLink]="link('pull/' + pr.number)">#{{ pr.number }} {{ pr.state }}</a>}
-                    @else if (!b.default && b.ahead > 0 && canWrite()) {<a class="o-btn o-xs" [routerLink]="link('pulls')" [queryParams]="{ new: 1, source: b.name }">New PR</a>}
+                    @else if (!b.default && b.ahead > 0 && canOpenPull()) {<a class="o-btn o-xs" [routerLink]="link('pulls')" [queryParams]="{ new: 1, source: b.name }">New PR</a>}
                   </div>
                   <div class="o-td o-num" role="cell">@if (b.canDelete && canWrite()) {<button type="button" class="o-btn o-xs o-ghost" (click)="remove(b)" [attr.aria-label]="'Delete ' + b.name">Delete</button>}</div>
                 </div>
@@ -2503,7 +2622,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
                   </div>
                   <div class="o-td" role="cell">
                     @if (pullFor(b.name); as pr) {<a [class]="pr.state === 'merged' ? 'o-chip o-vio' : pr.state === 'closed' ? 'o-chip' : 'o-chip o-blu'" [routerLink]="link('pull/' + pr.number)">#{{ pr.number }} {{ pr.state }}</a>}
-                    @else if (!b.default && b.ahead > 0 && canWrite()) {<a class="o-btn o-xs" [routerLink]="link('pulls')" [queryParams]="{ new: 1, source: b.name }">New PR</a>}
+                    @else if (!b.default && b.ahead > 0 && canOpenPull()) {<a class="o-btn o-xs" [routerLink]="link('pulls')" [queryParams]="{ new: 1, source: b.name }">New PR</a>}
                   </div>
                   <div class="o-td o-num" role="cell">@if (b.canDelete && canWrite()) {<button type="button" class="o-btn o-xs o-ghost" (click)="remove(b)" [attr.aria-label]="'Delete ' + b.name">Delete</button>}</div>
                 </div>
@@ -2558,7 +2677,7 @@ class PullsPage {
         this.review = (r) => REVIEW[r] ?? r.replace(/_/g, ' ');
         this.canWrite = computed(() => {
             const p = this.host.project();
-            return !!p && !p.archivedAt && p.capabilities.includes('code.write');
+            return !!p && !p.archivedAt && this.host.can('code.pr.create');
         }, ...(ngDevMode ? [{ debugName: "canWrite" }] : /* istanbul ignore next */ []));
         this.route.paramMap.subscribe((m) => this.repoName.set(m.get('repo') ?? ''));
         this.route.queryParamMap.subscribe((q) => { if (q.get('new'))
@@ -2592,7 +2711,7 @@ class PullsPage {
             return;
         }
         this.loading.set(true);
-        forkJoin(repos.map((r) => this.api.pulls(p.id, r.name, q).pipe(map$1((ps) => ps.map((x) => ({ ...x, repo: r.name }))), catchError(() => of([]))))).subscribe({
+        forkJoin(repos.map((r) => this.api.pulls(p.id, r.name, q).pipe(map$1((ps) => ps.map((x) => ({ ...x, repo: r.name }))), catchError$1(() => of([]))))).subscribe({
             next: (lists) => {
                 this.loading.set(false);
                 this.rows.set(lists.flat().sort((a, b) => (b.updatedAt ?? '').localeCompare(a.updatedAt ?? '')));
@@ -2792,6 +2911,13 @@ class PullPage extends RepoPage {
         this.method = signal('merge', ...(ngDevMode ? [{ debugName: "method" }] : /* istanbul ignore next */ []));
         this.delBranch = signal(false, ...(ngDevMode ? [{ debugName: "delBranch" }] : /* istanbul ignore next */ []));
         this.number = 0;
+        /** The conflict resolver (V6-03): the conflicts, and each file's resolution as edited. */
+        this.resolver = signal(null, ...(ngDevMode ? [{ debugName: "resolver" }] : /* istanbul ignore next */ []));
+        this.resolved = signal({}, ...(ngDevMode ? [{ debugName: "resolved" }] : /* istanbul ignore next */ []));
+        this.resolutionReady = computed(() => {
+            const cf = this.resolver();
+            return !!cf && cf.canResolve && cf.files.every((f) => f.resolvable && !this.hasMarkers(this.resolved()[f.path]));
+        }, ...(ngDevMode ? [{ debugName: "resolutionReady" }] : /* istanbul ignore next */ []));
         this.ago = (s) => ago(s);
         this.initials = initials;
         this.dot = checkDot;
@@ -2961,6 +3087,47 @@ class PullPage extends RepoPage {
             return;
         this.run(this.api.merge(this.projectId(), this.name(), this.number, { method: this.method(), deleteBranch: this.delBranch(), expectHead: p.headSha }), 'Could not merge.', () => this.note.set(`Merged into ${p.target}.`));
     }
+    openResolver() {
+        this.busy.set(true);
+        this.error.set('');
+        this.api.conflicts(this.projectId(), this.name(), this.number).subscribe({
+            next: (cf) => {
+                this.busy.set(false);
+                const start = {};
+                for (const f of cf.files)
+                    if (f.resolvable)
+                        start[f.path] = f.merged ?? '';
+                this.resolved.set(start);
+                this.resolver.set(cf);
+            },
+            error: (e) => { this.busy.set(false); this.error.set(apiMessage(e, 'Could not load the conflicts.')); },
+        });
+    }
+    take(path, text) {
+        this.resolved.set({ ...this.resolved(), [path]: text });
+    }
+    hasMarkers(text) {
+        return /^(<{7}|>{7})( |$)|^={7}$/m.test(text ?? '');
+    }
+    conflictKind(kind) {
+        return { binary: 'Binary file', 'modify/delete': 'Changed and deleted', rename: 'Renamed', large: 'Over 1 MB', lfs: 'Git LFS file' }[kind] ?? 'Command line only';
+    }
+    commitResolution() {
+        const cf = this.resolver();
+        if (!cf)
+            return;
+        this.busy.set(true);
+        this.error.set('');
+        this.api.resolveConflicts(this.projectId(), this.name(), this.number, { files: this.resolved(), expectHead: cf.headSha, expectBase: cf.baseSha }).subscribe({
+            next: (r) => {
+                this.busy.set(false);
+                this.resolver.set(null);
+                this.note.set(r.pull ? `Committed the merge to ${r.branch} and opened pull request #${r.pull} into ${cf.source}.` : `Committed the merge to ${cf.source}.`);
+                this.load(false);
+            },
+            error: (e) => { this.busy.set(false); this.error.set(apiMessage(e, 'Could not commit the resolution.')); },
+        });
+    }
     close(reopen) {
         this.run(this.api.closePull(this.projectId(), this.name(), this.number, reopen), reopen ? 'Could not reopen.' : 'Could not close.');
     }
@@ -3089,8 +3256,8 @@ class PullPage extends RepoPage {
                       @if (p.canEdit) {<button type="button" class="o-btn o-ghost" (click)="close(false)" [disabled]="busy()">Close</button>}
                       @if (p.autoMergeBy) {
                         <span class="o-chip o-blu" data-testid="auto-merge-on">Auto-merge on · {{ methodLabel(p.autoMergeMethod || 'merge') }} · by {{ people().name(p.autoMergeBy) }}</span>
-                        @if (canWrite()) {<button type="button" class="o-btn o-sm o-ghost" (click)="setAutoMerge(null)" [disabled]="busy()" data-testid="auto-merge-off">Disable auto-merge</button>}
-                      } @else if (repo()?.allowAutoMerge && canWrite() && !p.gate.mergeable) {
+                        @if (canMerge()) {<button type="button" class="o-btn o-sm o-ghost" (click)="setAutoMerge(null)" [disabled]="busy()" data-testid="auto-merge-off">Disable auto-merge</button>}
+                      } @else if (repo()?.allowAutoMerge && canMerge() && !p.gate.mergeable) {
                         <button type="button" class="o-btn o-sm" (click)="setAutoMerge(method())" [disabled]="busy()" data-testid="auto-merge-enable" title="Merges as you once every requirement passes">Enable auto-merge</button>
                       }
                       @if (p.canMerge) {
@@ -3106,6 +3273,9 @@ class PullPage extends RepoPage {
                         </div>
                       }
                     </div>
+                    @if (p.gate.conflicts?.length && canWrite() && !resolver()) {
+                      <div class="o-flex" style="padding:10px 14px;border-top:1px solid var(--o-line-soft)"><span class="o-mut o-sm">Text conflicts can be resolved here; the result is a merge of {{ p.target }} into {{ p.source }}.</span><button type="button" class="o-btn o-sm o-r" (click)="openResolver()" [disabled]="busy()" data-testid="resolve-open">Resolve conflicts</button></div>
+                    }
                   } @else if (p.state === 'closed' && p.canEdit) {
                     <div class="o-flex" style="padding:12px 14px;background:var(--o-well)"><button type="button" class="o-btn o-r" (click)="close(true)" [disabled]="busy()">Reopen</button></div>
                   } @else if (p.state === 'merged') {
@@ -3113,6 +3283,42 @@ class PullPage extends RepoPage {
                   }
                 </div>
 
+                @if (resolver(); as cf) {
+                  <div class="o-card" data-testid="resolver" aria-label="Resolve conflicts">
+                    <div class="o-ch"><b>Resolve conflicts</b><span class="o-faint o-sm">{{ cf.source }} with {{ cf.target }}</span><button type="button" class="o-btn o-xs o-ghost o-r" (click)="resolver.set(null)">Cancel</button></div>
+                    <div class="o-cb o-col" style="gap:16px">
+                      @if (!cf.resolvable) {
+                        <div class="o-note" role="status">Some conflicts can only be resolved on the command line:
+                          <div class="o-term" style="margin-top:8px"><div>git fetch origin</div><div>git switch {{ cf.source }}</div><div>git merge origin/{{ cf.target }}</div><div># resolve, then</div><div>git commit &amp;&amp; git push</div></div>
+                        </div>
+                      }
+                      @for (f of cf.files; track f.path) {
+                        <div class="o-col" style="gap:8px" [attr.data-testid]="'conflict-' + f.path">
+                          <div class="o-flex"><b class="o-mono">{{ f.path }}</b>@if (!f.resolvable) {<span class="o-chip o-amb">{{ conflictKind(f.kind) }}</span>}</div>
+                          @if (f.resolvable) {
+                            <div class="o-g3" style="gap:8px">
+                              <div class="o-col" style="gap:4px;min-width:0"><span class="o-lbl" style="padding:0">{{ cf.source }} (this branch)</span><pre class="o-term" style="margin:0;max-height:220px;overflow:auto">{{ f.ours }}</pre><button type="button" class="o-btn o-xs" (click)="take(f.path, f.ours ?? '')" [attr.data-testid]="'take-ours-' + f.path">Use this branch's</button></div>
+                              <div class="o-col" style="gap:4px;min-width:0"><span class="o-lbl" style="padding:0">Common ancestor</span><pre class="o-term" style="margin:0;max-height:220px;overflow:auto">{{ f.base ?? '' }}</pre></div>
+                              <div class="o-col" style="gap:4px;min-width:0"><span class="o-lbl" style="padding:0">{{ cf.target }}</span><pre class="o-term" style="margin:0;max-height:220px;overflow:auto">{{ f.theirs }}</pre><button type="button" class="o-btn o-xs" (click)="take(f.path, f.theirs ?? '')" [attr.data-testid]="'take-theirs-' + f.path">Use {{ cf.target }}'s</button></div>
+                            </div>
+                            <label class="o-lbl" style="padding:0" [attr.for]="'res-' + $index">Result</label>
+                            <textarea class="o-in o-mono" style="min-height:160px;height:auto" [id]="'res-' + $index" [ngModel]="resolved()[f.path]" (ngModelChange)="take(f.path, $event)" [attr.data-testid]="'resolution-' + f.path"></textarea>
+                            @if (hasMarkers(resolved()[f.path])) {<span class="o-hint">Remove the conflict markers (&lt;&lt;&lt;&lt;&lt;&lt;&lt;, =======, &gt;&gt;&gt;&gt;&gt;&gt;&gt;) to finish this file.</span>}
+                          } @else {
+                            <span class="o-mut o-sm">{{ f.message || 'This conflict can only be resolved on the command line.' }}</span>
+                          }
+                        </div>
+                      }
+                    </div>
+                    @if (cf.canResolve) {
+                      <div class="o-cf">
+                        <span class="o-faint o-xs">{{ cf.direct ? 'Commits a merge of ' + cf.target + ' into ' + cf.source + ', signed by Origine.' : cf.source + ' takes no direct commits: the merge goes to a new branch with a pull request into ' + cf.source + '.' }}</span>
+                        <button type="button" class="o-btn o-sm o-dark o-r" (click)="commitResolution()" [disabled]="busy() || !resolutionReady()" data-testid="resolve-commit">Commit merge</button>
+                      </div>
+                    }
+                  </div>
+                }
+
                 <div class="o-card">
                   <label class="o-sr-only" for="pr-cmt">Add a comment</label>
                   <textarea id="pr-cmt" class="o-in" style="border:none;box-shadow:none;min-height:70px;height:auto;padding:10px 12px" placeholder="Add a comment. Markdown works." [ngModel]="draft()" (ngModelChange)="draft.set($event)" data-testid="pull-comment"></textarea>
@@ -3122,7 +3328,7 @@ class PullPage extends RepoPage {
               @case ('commits') {
                 <div class="o-card">
                   @for (c of cmp()?.commits ?? []; track c.oid) {
-                    <div class="o-row"><span class="o-av" aria-hidden="true">{{ initials(c.author.name) }}</span><a class="o-ell" style="flex:1;color:var(--o-tx)" [routerLink]="link('commit/' + c.oid)">{{ c.subject }}</a>@if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="v.verified ? 'Signed with a key of ' + people().name(v.signer) : verifyWhy(v.reason)" [attr.data-testid]="'verify-' + c.short">{{ v.verified ? 'Verified' : 'Unverified' }}</span>}<a class="o-mono o-sm o-faint" [routerLink]="link('commit/' + c.oid)">{{ c.short }}</a></div>
+                    <div class="o-row"><span class="o-av" aria-hidden="true">{{ initials(c.author.name) }}</span><a class="o-ell" style="flex:1;color:var(--o-tx)" [routerLink]="link('commit/' + c.oid)">{{ c.subject }}</a>@if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="verifyTitle(v)" [attr.data-testid]="'verify-' + c.short">{{ verifyLabel(v) }}</span>}<a class="o-mono o-sm o-faint" [routerLink]="link('commit/' + c.oid)">{{ c.short }}</a></div>
                   } @empty {<div class="o-empty">{{ cmp() ? 'No commits.' : 'Loading…' }}</div>}
                 </div>
               }
@@ -3272,8 +3478,8 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
                       @if (p.canEdit) {<button type="button" class="o-btn o-ghost" (click)="close(false)" [disabled]="busy()">Close</button>}
                       @if (p.autoMergeBy) {
                         <span class="o-chip o-blu" data-testid="auto-merge-on">Auto-merge on · {{ methodLabel(p.autoMergeMethod || 'merge') }} · by {{ people().name(p.autoMergeBy) }}</span>
-                        @if (canWrite()) {<button type="button" class="o-btn o-sm o-ghost" (click)="setAutoMerge(null)" [disabled]="busy()" data-testid="auto-merge-off">Disable auto-merge</button>}
-                      } @else if (repo()?.allowAutoMerge && canWrite() && !p.gate.mergeable) {
+                        @if (canMerge()) {<button type="button" class="o-btn o-sm o-ghost" (click)="setAutoMerge(null)" [disabled]="busy()" data-testid="auto-merge-off">Disable auto-merge</button>}
+                      } @else if (repo()?.allowAutoMerge && canMerge() && !p.gate.mergeable) {
                         <button type="button" class="o-btn o-sm" (click)="setAutoMerge(method())" [disabled]="busy()" data-testid="auto-merge-enable" title="Merges as you once every requirement passes">Enable auto-merge</button>
                       }
                       @if (p.canMerge) {
@@ -3289,6 +3495,9 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
                         </div>
                       }
                     </div>
+                    @if (p.gate.conflicts?.length && canWrite() && !resolver()) {
+                      <div class="o-flex" style="padding:10px 14px;border-top:1px solid var(--o-line-soft)"><span class="o-mut o-sm">Text conflicts can be resolved here; the result is a merge of {{ p.target }} into {{ p.source }}.</span><button type="button" class="o-btn o-sm o-r" (click)="openResolver()" [disabled]="busy()" data-testid="resolve-open">Resolve conflicts</button></div>
+                    }
                   } @else if (p.state === 'closed' && p.canEdit) {
                     <div class="o-flex" style="padding:12px 14px;background:var(--o-well)"><button type="button" class="o-btn o-r" (click)="close(true)" [disabled]="busy()">Reopen</button></div>
                   } @else if (p.state === 'merged') {
@@ -3296,6 +3505,42 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
                   }
                 </div>
 
+                @if (resolver(); as cf) {
+                  <div class="o-card" data-testid="resolver" aria-label="Resolve conflicts">
+                    <div class="o-ch"><b>Resolve conflicts</b><span class="o-faint o-sm">{{ cf.source }} with {{ cf.target }}</span><button type="button" class="o-btn o-xs o-ghost o-r" (click)="resolver.set(null)">Cancel</button></div>
+                    <div class="o-cb o-col" style="gap:16px">
+                      @if (!cf.resolvable) {
+                        <div class="o-note" role="status">Some conflicts can only be resolved on the command line:
+                          <div class="o-term" style="margin-top:8px"><div>git fetch origin</div><div>git switch {{ cf.source }}</div><div>git merge origin/{{ cf.target }}</div><div># resolve, then</div><div>git commit &amp;&amp; git push</div></div>
+                        </div>
+                      }
+                      @for (f of cf.files; track f.path) {
+                        <div class="o-col" style="gap:8px" [attr.data-testid]="'conflict-' + f.path">
+                          <div class="o-flex"><b class="o-mono">{{ f.path }}</b>@if (!f.resolvable) {<span class="o-chip o-amb">{{ conflictKind(f.kind) }}</span>}</div>
+                          @if (f.resolvable) {
+                            <div class="o-g3" style="gap:8px">
+                              <div class="o-col" style="gap:4px;min-width:0"><span class="o-lbl" style="padding:0">{{ cf.source }} (this branch)</span><pre class="o-term" style="margin:0;max-height:220px;overflow:auto">{{ f.ours }}</pre><button type="button" class="o-btn o-xs" (click)="take(f.path, f.ours ?? '')" [attr.data-testid]="'take-ours-' + f.path">Use this branch's</button></div>
+                              <div class="o-col" style="gap:4px;min-width:0"><span class="o-lbl" style="padding:0">Common ancestor</span><pre class="o-term" style="margin:0;max-height:220px;overflow:auto">{{ f.base ?? '' }}</pre></div>
+                              <div class="o-col" style="gap:4px;min-width:0"><span class="o-lbl" style="padding:0">{{ cf.target }}</span><pre class="o-term" style="margin:0;max-height:220px;overflow:auto">{{ f.theirs }}</pre><button type="button" class="o-btn o-xs" (click)="take(f.path, f.theirs ?? '')" [attr.data-testid]="'take-theirs-' + f.path">Use {{ cf.target }}'s</button></div>
+                            </div>
+                            <label class="o-lbl" style="padding:0" [attr.for]="'res-' + $index">Result</label>
+                            <textarea class="o-in o-mono" style="min-height:160px;height:auto" [id]="'res-' + $index" [ngModel]="resolved()[f.path]" (ngModelChange)="take(f.path, $event)" [attr.data-testid]="'resolution-' + f.path"></textarea>
+                            @if (hasMarkers(resolved()[f.path])) {<span class="o-hint">Remove the conflict markers (&lt;&lt;&lt;&lt;&lt;&lt;&lt;, =======, &gt;&gt;&gt;&gt;&gt;&gt;&gt;) to finish this file.</span>}
+                          } @else {
+                            <span class="o-mut o-sm">{{ f.message || 'This conflict can only be resolved on the command line.' }}</span>
+                          }
+                        </div>
+                      }
+                    </div>
+                    @if (cf.canResolve) {
+                      <div class="o-cf">
+                        <span class="o-faint o-xs">{{ cf.direct ? 'Commits a merge of ' + cf.target + ' into ' + cf.source + ', signed by Origine.' : cf.source + ' takes no direct commits: the merge goes to a new branch with a pull request into ' + cf.source + '.' }}</span>
+                        <button type="button" class="o-btn o-sm o-dark o-r" (click)="commitResolution()" [disabled]="busy() || !resolutionReady()" data-testid="resolve-commit">Commit merge</button>
+                      </div>
+                    }
+                  </div>
+                }
+
                 <div class="o-card">
                   <label class="o-sr-only" for="pr-cmt">Add a comment</label>
                   <textarea id="pr-cmt" class="o-in" style="border:none;box-shadow:none;min-height:70px;height:auto;padding:10px 12px" placeholder="Add a comment. Markdown works." [ngModel]="draft()" (ngModelChange)="draft.set($event)" data-testid="pull-comment"></textarea>
@@ -3305,7 +3550,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
               @case ('commits') {
                 <div class="o-card">
                   @for (c of cmp()?.commits ?? []; track c.oid) {
-                    <div class="o-row"><span class="o-av" aria-hidden="true">{{ initials(c.author.name) }}</span><a class="o-ell" style="flex:1;color:var(--o-tx)" [routerLink]="link('commit/' + c.oid)">{{ c.subject }}</a>@if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="v.verified ? 'Signed with a key of ' + people().name(v.signer) : verifyWhy(v.reason)" [attr.data-testid]="'verify-' + c.short">{{ v.verified ? 'Verified' : 'Unverified' }}</span>}<a class="o-mono o-sm o-faint" [routerLink]="link('commit/' + c.oid)">{{ c.short }}</a></div>
+                    <div class="o-row"><span class="o-av" aria-hidden="true">{{ initials(c.author.name) }}</span><a class="o-ell" style="flex:1;color:var(--o-tx)" [routerLink]="link('commit/' + c.oid)">{{ c.subject }}</a>@if (c.verification; as v) {<span class="o-chip" [class.o-grn]="v.verified" [attr.title]="verifyTitle(v)" [attr.data-testid]="'verify-' + c.short">{{ verifyLabel(v) }}</span>}<a class="o-mono o-sm o-faint" [routerLink]="link('commit/' + c.oid)">{{ c.short }}</a></div>
                   } @empty {<div class="o-empty">{{ cmp() ? 'No commits.' : 'Loading…' }}</div>}
                 </div>
               }
@@ -3420,7 +3665,12 @@ class RepoSettingsPage extends RepoPage {
             { key: 'requireSignedCommits', label: 'Require signed commits', hint: 'Verified against members’ signing keys, on push and at merge.' },
             { key: 'requireLinearHistory', label: 'Require linear history', hint: 'No merge commits: squash or rebase only.' },
         ];
-        this.bypassRoles = [{ id: 'owner', label: 'Owners' }, { id: 'admin', label: 'Admins' }, { id: 'maintainer', label: 'Maintainers' }];
+        /** Who may bypass a rule: the built-in Owner, Admin and Maintainer, and the organization's custom roles. */
+        this.customRoles = signal([], ...(ngDevMode ? [{ debugName: "customRoles" }] : /* istanbul ignore next */ []));
+        this.bypassRoles = computed(() => [{ id: 'owner', label: 'Owners' }, { id: 'admin', label: 'Admins' }, { id: 'maintainer', label: 'Maintainers' }, ...this.customRoles()], ...(ngDevMode ? [{ debugName: "bypassRoles" }] : /* istanbul ignore next */ []));
+        this.ago = ago;
+        this.mirror = signal(null, ...(ngDevMode ? [{ debugName: "mirror" }] : /* istanbul ignore next */ []));
+        this.mf = { url: '', username: '', token: '', interval: 60 };
         this.collabs = signal([], ...(ngDevMode ? [{ debugName: "collabs" }] : /* istanbul ignore next */ []));
         this.perms = [{ id: 'read', label: 'Read' }, { id: 'write', label: 'Write' }, { id: 'maintain', label: 'Maintain' }];
         this.addable = computed(() => this.host.people().filter((p) => !this.collabs().some((c) => c.userId === p.id)), ...(ngDevMode ? [{ debugName: "addable" }] : /* istanbul ignore next */ []));
@@ -3428,11 +3678,62 @@ class RepoSettingsPage extends RepoPage {
         this.newPerm = 'write';
         this.route.queryParamMap.subscribe((q) => this.section.set(q.get('section') || 'general'));
     }
+    loadMirror(r) {
+        if (!r.mirror)
+            return this.mirror.set(null);
+        this.api.mirror(this.projectId(), r.name).subscribe({
+            next: (m) => {
+                this.mirror.set(m);
+                this.mf = { url: m.source, username: '', token: '', interval: m.intervalMinutes };
+                if (m.syncing)
+                    setTimeout(() => this.loadMirror(r), 1500);
+            },
+            error: (e) => this.error.set(apiMessage(e, 'Could not load the mirror.')),
+        });
+    }
+    syncNow() {
+        const r = this.repo();
+        if (!r)
+            return;
+        this.api.syncMirror(this.projectId(), r.name).subscribe({
+            next: (m) => { this.mirror.set(m); this.note.set('Syncing with the source.'); setTimeout(() => this.loadMirror(r), 1000); },
+            error: (e) => this.error.set(apiMessage(e, 'Could not start the sync.')),
+        });
+    }
+    saveMirror() {
+        const r = this.repo();
+        const m = this.mirror();
+        if (!r || !m)
+            return;
+        const body = { intervalMinutes: Number(this.mf.interval) || m.intervalMinutes };
+        if (this.mf.url.trim() && this.mf.url.trim() !== m.source)
+            body.url = this.mf.url.trim();
+        if (this.mf.token) {
+            body.token = this.mf.token;
+            body.username = this.mf.username.trim();
+        }
+        this.busy.set(true);
+        this.error.set('');
+        this.api.updateMirror(this.projectId(), r.name, body).subscribe({
+            next: (n) => { this.busy.set(false); this.mirror.set(n); this.mf.token = ''; this.note.set('Mirror saved. It syncs as you now.'); },
+            error: (e) => { this.busy.set(false); this.error.set(apiMessage(e, 'Could not save the mirror.')); },
+        });
+    }
+    stopMirror() {
+        const r = this.repo();
+        if (!r)
+            return;
+        this.busy.set(true);
+        this.api.stopMirror(this.projectId(), r.name).subscribe({
+            next: (n) => { this.busy.set(false); this.repo.set({ ...r, ...n, mirror: false }); this.mirror.set(null); this.note.set(`${r.name} is an ordinary repository now.`); this.go('general'); },
+            error: (e) => { this.busy.set(false); this.error.set(apiMessage(e, 'Could not stop mirroring.')); },
+        });
+    }
     roleLabel(r) {
         return r ? r[0].toUpperCase() + r.slice(1) : 'Not in the project';
     }
     loadCollabs(r) {
-        if (!this.canAdmin())
+        if (!this.canCollaborators())
             return;
         this.api.collaborators(this.projectId(), r.name).subscribe({ next: (l) => this.collabs.set(l), error: () => undefined });
     }
@@ -3461,10 +3762,14 @@ class RepoSettingsPage extends RepoPage {
     }
     onRepo(r) {
         this.loadCollabs(r);
+        this.loadMirror(r);
         this.g = { name: r.name, description: r.description, visibility: r.visibility, defaultBranch: r.defaultBranch, mergeMethods: [...(r.mergeMethods ?? [])], deleteBranchOnMerge: r.deleteBranchOnMerge, allowAutoMerge: !!r.allowAutoMerge };
         if (!r.empty)
             this.api.refs(this.projectId(), r.name, 'branch').subscribe({ next: (b) => this.branches.set(b), error: () => undefined });
         this.api.protections(this.projectId(), r.name).subscribe({ next: (p) => this.rules.set(p), error: () => undefined });
+        if (this.canProtect() && !this.customRoles().length) {
+            this.api.customRoles().subscribe({ next: (l) => this.customRoles.set(l.map((c) => ({ id: c.id, label: c.name }))), error: () => undefined });
+        }
     }
     go(s) {
         void this.router.navigate([], { relativeTo: this.route, queryParams: { section: s === 'general' ? null : s }, replaceUrl: true });
@@ -3523,7 +3828,7 @@ class RepoSettingsPage extends RepoPage {
         this.busy.set(true);
         const renamed = this.g.name.trim() !== r.name;
         // a maintain collaborator sends what they may change; the name and visibility stay a Maintainer's
-        const body = this.canAdmin()
+        const body = this.canSettings()
             ? { name: this.g.name.trim(), description: this.g.description, visibility: this.g.visibility, defaultBranch: this.g.defaultBranch, mergeMethods: this.g.mergeMethods, deleteBranchOnMerge: this.g.deleteBranchOnMerge, allowAutoMerge: this.g.allowAutoMerge }
             : { description: this.g.description, defaultBranch: this.g.defaultBranch, mergeMethods: this.g.mergeMethods, deleteBranchOnMerge: this.g.deleteBranchOnMerge, allowAutoMerge: this.g.allowAutoMerge };
         this.api.update(this.projectId(), r.name, body).subscribe({
@@ -3590,6 +3895,7 @@ class RepoSettingsPage extends RepoPage {
           <nav class="o-setnav" aria-label="Repository settings">
             <span class="o-lbl" style="padding-top:0">{{ r.name }}</span>
             <button type="button" [class.o-on]="section() === 'general'" (click)="go('general')">General</button>
+            @if (r.mirror) {<button type="button" [class.o-on]="section() === 'mirror'" (click)="go('mirror')" data-testid="settings-mirror">Mirror</button>}
             <button type="button" [class.o-on]="section() === 'protect'" (click)="go('protect')">Branch protection</button>
             <button type="button" [class.o-on]="section() === 'collab'" (click)="go('collab')">Collaborators</button>
             <button type="button" [class.o-on]="section() === 'danger'" (click)="go('danger')">Danger zone</button>
@@ -3602,14 +3908,14 @@ class RepoSettingsPage extends RepoPage {
                 <h1 class="o-t">General</h1>
                 <form class="o-card o-cb o-form" (ngSubmit)="saveGeneral()">
                   <div class="o-g2">
-                    <div class="o-fld"><label for="rs-name">Repository name</label><input id="rs-name" class="o-in o-mono" name="name" [(ngModel)]="g.name" [disabled]="!canAdmin()" /><span class="o-hint">Renaming keeps the old clone URL working as a redirect.</span></div>
+                    <div class="o-fld"><label for="rs-name">Repository name</label><input id="rs-name" class="o-in o-mono" name="name" [(ngModel)]="g.name" [disabled]="!canSettings()" /><span class="o-hint">Renaming keeps the old clone URL working as a redirect.</span></div>
                     <div class="o-fld"><label for="rs-def">Default branch</label><select id="rs-def" class="o-in" name="def" [(ngModel)]="g.defaultBranch" [disabled]="!canMaintain()">@for (b of branches(); track b.name) {<option [value]="b.name">{{ b.name }}</option>}@if (!branches().length) {<option [value]="r.defaultBranch">{{ r.defaultBranch }}</option>}</select></div>
                   </div>
                   <div class="o-fld"><label for="rs-desc">Description</label><input id="rs-desc" class="o-in" name="desc" [(ngModel)]="g.description" [disabled]="!canMaintain()" /></div>
                   <div class="o-fld"><span class="o-lbl" style="padding:0">Visibility</span>
                     <div class="o-g2">
-                      <button type="button" class="o-opt" [class.o-on]="g.visibility === 'private'" (click)="g.visibility = 'private'" [disabled]="!canAdmin()"><span class="o-rad" [class.o-on]="g.visibility === 'private'"></span><span class="o-col" style="gap:2px"><b>Private</b><span class="o-faint o-sm">Project members only</span></span></button>
-                      <button type="button" class="o-opt" [class.o-on]="g.visibility === 'internal'" (click)="g.visibility = 'internal'" [disabled]="!canAdmin()"><span class="o-rad" [class.o-on]="g.visibility === 'internal'"></span><span class="o-col" style="gap:2px"><b>Org-internal</b><span class="o-faint o-sm">Everyone in the organization can read</span></span></button>
+                      <button type="button" class="o-opt" [class.o-on]="g.visibility === 'private'" (click)="g.visibility = 'private'" [disabled]="!canSettings()"><span class="o-rad" [class.o-on]="g.visibility === 'private'"></span><span class="o-col" style="gap:2px"><b>Private</b><span class="o-faint o-sm">Project members only</span></span></button>
+                      <button type="button" class="o-opt" [class.o-on]="g.visibility === 'internal'" (click)="g.visibility = 'internal'" [disabled]="!canSettings()"><span class="o-rad" [class.o-on]="g.visibility === 'internal'"></span><span class="o-col" style="gap:2px"><b>Org-internal</b><span class="o-faint o-sm">Everyone in the organization can read</span></span></button>
                     </div>
                   </div>
                   <div class="o-fld"><span class="o-lbl" style="padding:0">Allowed merge methods</span>
@@ -3617,9 +3923,41 @@ class RepoSettingsPage extends RepoPage {
                   </div>
                   <div class="o-flex"><button type="button" class="o-tog" role="switch" aria-labelledby="rs-del" [class.o-on]="g.deleteBranchOnMerge" [attr.aria-checked]="g.deleteBranchOnMerge" (click)="g.deleteBranchOnMerge = !g.deleteBranchOnMerge" [disabled]="!canMaintain()"></button><span id="rs-del">Delete head branches after merge</span></div>
                   <div class="o-flex"><button type="button" class="o-tog" role="switch" aria-labelledby="rs-auto" [class.o-on]="g.allowAutoMerge" [attr.aria-checked]="g.allowAutoMerge" (click)="g.allowAutoMerge = !g.allowAutoMerge" [disabled]="!canMaintain()" data-testid="allow-auto-merge"></button><span id="rs-auto">Allow auto-merge when all requirements pass</span></div>
-                  @if (canMaintain()) {<div class="o-flex">@if (!canAdmin()) {<span class="o-faint o-sm">As a maintain collaborator you change these settings; a project Maintainer renames the repository or changes its visibility.</span>}<button type="submit" class="o-btn o-dark o-r" [disabled]="busy() || !g.mergeMethods.length" data-testid="settings-save">Save</button></div>}
+                  @if (canMaintain()) {<div class="o-flex">@if (!canSettings()) {<span class="o-faint o-sm">As a maintain collaborator you change these settings; a project Maintainer renames the repository or changes its visibility.</span>}<button type="submit" class="o-btn o-dark o-r" [disabled]="busy() || !g.mergeMethods.length" data-testid="settings-save">Save</button></div>}
                 </form>
               }
+              @case ('mirror') {
+                <h1 class="o-t">Mirror</h1>
+                @if (mirror(); as m) {
+                  <div class="o-card" data-testid="mirror-status">
+                    <div class="o-row"><span class="o-mut" style="width:140px">Source</span><span class="o-mono o-ell">{{ m.source }}</span></div>
+                    <div class="o-row"><span class="o-mut" style="width:140px">Syncs</span><span>every {{ m.intervalMinutes }} minutes, as {{ people().name(m.setBy) }}</span></div>
+                    <div class="o-row"><span class="o-mut" style="width:140px">Last sync</span><span data-testid="mirror-last">{{ m.syncing ? 'Syncing now…' : m.lastSyncAt ? ago(m.lastSyncAt) : 'Not yet' }}</span>@if (!m.lastError && m.lastSuccessAt) {<span class="o-chip o-grn">Up to date</span>}</div>
+                    @if (m.lastError) {<div class="o-row"><span class="o-mut" style="width:140px">Problem</span><span class="o-red" role="alert" data-testid="mirror-error">{{ m.lastError }}</span></div>}
+                    @if (m.lfsMissing) {<div class="o-row"><span class="o-mut" style="width:140px">Git LFS</span><span>{{ m.lfsMissing }} files the source could not supply stay pointers.</span></div>}
+                    <div class="o-cf">
+                      <button type="button" class="o-btn o-sm" (click)="syncNow()" [disabled]="!can('code.push') || m.syncing || busy()" data-testid="mirror-sync">Sync now</button>
+                      <span class="o-faint o-xs">Pushes to this repository are refused while it mirrors its source.</span>
+                    </div>
+                  </div>
+                  @if (canSettings()) {
+                    <form class="o-card o-cb o-form" (ngSubmit)="saveMirror()" aria-label="Mirror settings">
+                      <div class="o-fld"><label for="mi-url">Source URL</label><input id="mi-url" class="o-in o-mono" name="murl" [(ngModel)]="mf.url" /></div>
+                      <div class="o-g2">
+                        <div class="o-fld"><label for="mi-user">Username</label><input id="mi-user" class="o-in" name="muser" [(ngModel)]="mf.username" autocomplete="off" /></div>
+                        <div class="o-fld"><label for="mi-tok">New access token</label><input id="mi-tok" class="o-in" type="password" name="mtok" [(ngModel)]="mf.token" autocomplete="off" [placeholder]="m.hasCredentials ? 'A token is kept, encrypted' : 'None'" /></div>
+                      </div>
+                      <div class="o-fld"><label for="mi-int">Sync every (minutes)</label><input id="mi-int" class="o-in" type="number" min="1" name="mint" [(ngModel)]="mf.interval" style="width:140px" /></div>
+                      <div class="o-flex"><span class="o-faint o-sm">Saving makes the mirror sync as you.</span><button type="submit" class="o-btn o-dark o-r" [disabled]="busy()" data-testid="mirror-save">Save</button></div>
+                    </form>
+                    <div class="o-card" style="border-color:var(--o-bad-line)">
+                      <div class="o-row" style="padding:14px"><div class="o-col" style="gap:2px;flex:1"><b>Stop mirroring</b><span class="o-hint">The repository keeps its history and takes pushes; the kept token is deleted.</span></div><button type="button" class="o-btn o-sm" (click)="stopMirror()" [disabled]="busy()" data-testid="mirror-stop">Stop mirroring</button></div>
+                    </div>
+                  }
+                } @else {
+                  <div class="o-card"><div class="o-empty">Loading…</div></div>
+                }
+              }
               @case ('protect') {
                 <div class="o-flex"><h1 class="o-t">Branch protection</h1>@if (canProtect()) {<button type="button" class="o-btn o-sm o-r" (click)="edit(null)" data-testid="add-rule">+ Add rule</button>}</div>
                 <div class="o-card">
@@ -3642,7 +3980,7 @@ class RepoSettingsPage extends RepoPage {
                         </div>
                       </div>
                       <div class="o-fld"><span class="o-lbl" style="padding:0">Allowed to bypass</span><div class="o-flex o-wrap">
-                        @for (b of bypassRoles; track b.id) {<button type="button" class="o-chip" style="cursor:pointer;border:none" [class.o-blu]="f.bypass.includes(b.id)" [attr.aria-pressed]="f.bypass.includes(b.id)" (click)="flipBypass(f, b.id)" [attr.data-testid]="'bypass-' + b.id">{{ b.label }}</button>}
+                        @for (b of bypassRoles(); track b.id) {<button type="button" class="o-chip" style="cursor:pointer;border:none" [class.o-blu]="f.bypass.includes(b.id)" [attr.aria-pressed]="f.bypass.includes(b.id)" (click)="flipBypass(f, b.id)" [attr.data-testid]="'bypass-' + b.id">{{ b.label }}</button>}
                         <span class="o-hint">Pushes by these roles go through this rule; every bypass is written to the audit log.</span></div></div>
                       <div class="o-fld"><span class="o-lbl" style="padding:0">What a blocked push sees</span><div class="o-term" style="font-size:11.5px"><div>$ git push origin {{ f.pattern || 'main' }}</div><div>remote: ✕ {{ f.pattern || 'main' }} is protected by rule “{{ f.pattern || 'main' }}”: direct pushes are blocked.</div><div>remote:   Open a pull request instead.</div></div></div>
                       <div class="o-flex">
@@ -3657,7 +3995,7 @@ class RepoSettingsPage extends RepoPage {
               @case ('collab') {
                 <h1 class="o-t">Collaborators</h1>
                 <span class="o-mut">Access beyond the project role, for this repository only.</span>
-                @if (canAdmin()) {
+                @if (canCollaborators()) {
                   <div class="o-card" style="overflow-x:auto" data-testid="collaborators">
                     <div class="o-tbl" role="table" aria-label="Collaborators" style="min-width:560px">
                       <div class="o-thead" role="rowgroup"><div class="o-tr" role="row"><div class="o-th" role="columnheader">Person</div><div class="o-th" role="columnheader">Project role</div><div class="o-th" role="columnheader">Repository access</div><div class="o-th" role="columnheader"></div></div></div>
@@ -3688,10 +4026,10 @@ class RepoSettingsPage extends RepoPage {
               @case ('danger') {
                 <h1 class="o-t">Danger zone</h1>
                 <div class="o-card" style="border-color:var(--o-bad-line)">
-                  <div class="o-row" style="padding:14px"><div class="o-col" style="gap:2px;flex:1"><b>{{ r.archivedAt ? 'Unarchive' : 'Archive' }}</b><span class="o-hint">{{ r.archivedAt ? 'Pushes are accepted again.' : 'Read-only. Pushes are rejected; pipelines stop triggering.' }}</span></div><button type="button" class="o-btn o-sm" (click)="archive(!r.archivedAt)" [disabled]="!canAdmin() || busy()">{{ r.archivedAt ? 'Unarchive' : 'Archive' }}</button></div>
+                  <div class="o-row" style="padding:14px"><div class="o-col" style="gap:2px;flex:1"><b>{{ r.archivedAt ? 'Unarchive' : 'Archive' }}</b><span class="o-hint">{{ r.archivedAt ? 'Pushes are accepted again.' : 'Read-only. Pushes are rejected; pipelines stop triggering.' }}</span></div><button type="button" class="o-btn o-sm" (click)="archive(!r.archivedAt)" [disabled]="!canDelete() || busy()">{{ r.archivedAt ? 'Unarchive' : 'Archive' }}</button></div>
                   <div class="o-row" style="padding:14px;flex-wrap:wrap"><div class="o-col" style="gap:2px;flex:1;min-width:240px"><b>Delete this repository</b><span class="o-hint">Recoverable for 7 days, then gone for good. Type <b class="o-mono">{{ r.name }}</b> to confirm.</span></div>
-                    <input class="o-in o-sm o-mono" style="width:180px" aria-label="Type the repository name to confirm" [ngModel]="confirm()" (ngModelChange)="confirm.set($event)" [disabled]="!canAdmin()" />
-                    <button type="button" class="o-btn o-sm o-red" (click)="remove()" [disabled]="!canAdmin() || confirm() !== r.name || busy()">Delete</button>
+                    <input class="o-in o-sm o-mono" style="width:180px" aria-label="Type the repository name to confirm" [ngModel]="confirm()" (ngModelChange)="confirm.set($event)" [disabled]="!canDelete()" />
+                    <button type="button" class="o-btn o-sm o-red" (click)="remove()" [disabled]="!canDelete() || confirm() !== r.name || busy()">Delete</button>
                   </div>
                 </div>
               }
@@ -3702,7 +4040,7 @@ class RepoSettingsPage extends RepoPage {
         <div class="o-card o-empty"><p>{{ error() }}</p></div>
       }
     </div>
-  `, isInline: true, dependencies: [{ kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i1.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i1.NgSelectOption, selector: "option", inputs: ["ngValue", "value"] }, { kind: "directive", type: i1.ɵNgSelectMultipleOption, selector: "option", inputs: ["ngValue", "value"] }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.SelectControlValueAccessor, selector: "select:not([multiple])[formControlName],select:not([multiple])[formControl],select:not([multiple])[ngModel]", inputs: ["compareWith"] }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i1.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i1.NgForm, selector: "form:not([ngNoForm]):not([formGroup]):not([formArray]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush }); }
+  `, isInline: true, dependencies: [{ kind: "ngmodule", type: FormsModule }, { kind: "directive", type: i1.ɵNgNoValidate, selector: "form:not([ngNoForm]):not([ngNativeValidate])" }, { kind: "directive", type: i1.NgSelectOption, selector: "option", inputs: ["ngValue", "value"] }, { kind: "directive", type: i1.ɵNgSelectMultipleOption, selector: "option", inputs: ["ngValue", "value"] }, { kind: "directive", type: i1.DefaultValueAccessor, selector: "input:not([type=checkbox])[formControlName],textarea[formControlName],input:not([type=checkbox])[formControl],textarea[formControl],input:not([type=checkbox])[ngModel],textarea[ngModel],[ngDefaultControl]" }, { kind: "directive", type: i1.NumberValueAccessor, selector: "input[type=number][formControlName],input[type=number][formControl],input[type=number][ngModel]" }, { kind: "directive", type: i1.SelectControlValueAccessor, selector: "select:not([multiple])[formControlName],select:not([multiple])[formControl],select:not([multiple])[ngModel]", inputs: ["compareWith"] }, { kind: "directive", type: i1.NgControlStatus, selector: "[formControlName],[ngModel],[formControl]" }, { kind: "directive", type: i1.NgControlStatusGroup, selector: "[formGroupName],[formArrayName],[ngModelGroup],[formGroup],[formArray],form:not([ngNoForm]),[ngForm]" }, { kind: "directive", type: i1.MinValidator, selector: "input[type=number][min][formControlName],input[type=number][min][formControl],input[type=number][min][ngModel]", inputs: ["min"] }, { kind: "directive", type: i1.NgModel, selector: "[ngModel]:not([formControlName]):not([formControl])", inputs: ["name", "disabled", "ngModel", "ngModelOptions"], outputs: ["ngModelChange"], exportAs: ["ngModel"] }, { kind: "directive", type: i1.NgForm, selector: "form:not([ngNoForm]):not([formGroup]):not([formArray]),ng-form,[ngForm]", inputs: ["ngFormOptions"], outputs: ["ngSubmit"], exportAs: ["ngForm"] }], changeDetection: i0.ChangeDetectionStrategy.OnPush }); }
 }
 i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImport: i0, type: RepoSettingsPage, decorators: [{
             type: Component,
@@ -3717,6 +4055,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
           <nav class="o-setnav" aria-label="Repository settings">
             <span class="o-lbl" style="padding-top:0">{{ r.name }}</span>
             <button type="button" [class.o-on]="section() === 'general'" (click)="go('general')">General</button>
+            @if (r.mirror) {<button type="button" [class.o-on]="section() === 'mirror'" (click)="go('mirror')" data-testid="settings-mirror">Mirror</button>}
             <button type="button" [class.o-on]="section() === 'protect'" (click)="go('protect')">Branch protection</button>
             <button type="button" [class.o-on]="section() === 'collab'" (click)="go('collab')">Collaborators</button>
             <button type="button" [class.o-on]="section() === 'danger'" (click)="go('danger')">Danger zone</button>
@@ -3729,14 +4068,14 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
                 <h1 class="o-t">General</h1>
                 <form class="o-card o-cb o-form" (ngSubmit)="saveGeneral()">
                   <div class="o-g2">
-                    <div class="o-fld"><label for="rs-name">Repository name</label><input id="rs-name" class="o-in o-mono" name="name" [(ngModel)]="g.name" [disabled]="!canAdmin()" /><span class="o-hint">Renaming keeps the old clone URL working as a redirect.</span></div>
+                    <div class="o-fld"><label for="rs-name">Repository name</label><input id="rs-name" class="o-in o-mono" name="name" [(ngModel)]="g.name" [disabled]="!canSettings()" /><span class="o-hint">Renaming keeps the old clone URL working as a redirect.</span></div>
                     <div class="o-fld"><label for="rs-def">Default branch</label><select id="rs-def" class="o-in" name="def" [(ngModel)]="g.defaultBranch" [disabled]="!canMaintain()">@for (b of branches(); track b.name) {<option [value]="b.name">{{ b.name }}</option>}@if (!branches().length) {<option [value]="r.defaultBranch">{{ r.defaultBranch }}</option>}</select></div>
                   </div>
                   <div class="o-fld"><label for="rs-desc">Description</label><input id="rs-desc" class="o-in" name="desc" [(ngModel)]="g.description" [disabled]="!canMaintain()" /></div>
                   <div class="o-fld"><span class="o-lbl" style="padding:0">Visibility</span>
                     <div class="o-g2">
-                      <button type="button" class="o-opt" [class.o-on]="g.visibility === 'private'" (click)="g.visibility = 'private'" [disabled]="!canAdmin()"><span class="o-rad" [class.o-on]="g.visibility === 'private'"></span><span class="o-col" style="gap:2px"><b>Private</b><span class="o-faint o-sm">Project members only</span></span></button>
-                      <button type="button" class="o-opt" [class.o-on]="g.visibility === 'internal'" (click)="g.visibility = 'internal'" [disabled]="!canAdmin()"><span class="o-rad" [class.o-on]="g.visibility === 'internal'"></span><span class="o-col" style="gap:2px"><b>Org-internal</b><span class="o-faint o-sm">Everyone in the organization can read</span></span></button>
+                      <button type="button" class="o-opt" [class.o-on]="g.visibility === 'private'" (click)="g.visibility = 'private'" [disabled]="!canSettings()"><span class="o-rad" [class.o-on]="g.visibility === 'private'"></span><span class="o-col" style="gap:2px"><b>Private</b><span class="o-faint o-sm">Project members only</span></span></button>
+                      <button type="button" class="o-opt" [class.o-on]="g.visibility === 'internal'" (click)="g.visibility = 'internal'" [disabled]="!canSettings()"><span class="o-rad" [class.o-on]="g.visibility === 'internal'"></span><span class="o-col" style="gap:2px"><b>Org-internal</b><span class="o-faint o-sm">Everyone in the organization can read</span></span></button>
                     </div>
                   </div>
                   <div class="o-fld"><span class="o-lbl" style="padding:0">Allowed merge methods</span>
@@ -3744,9 +4083,41 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
                   </div>
                   <div class="o-flex"><button type="button" class="o-tog" role="switch" aria-labelledby="rs-del" [class.o-on]="g.deleteBranchOnMerge" [attr.aria-checked]="g.deleteBranchOnMerge" (click)="g.deleteBranchOnMerge = !g.deleteBranchOnMerge" [disabled]="!canMaintain()"></button><span id="rs-del">Delete head branches after merge</span></div>
                   <div class="o-flex"><button type="button" class="o-tog" role="switch" aria-labelledby="rs-auto" [class.o-on]="g.allowAutoMerge" [attr.aria-checked]="g.allowAutoMerge" (click)="g.allowAutoMerge = !g.allowAutoMerge" [disabled]="!canMaintain()" data-testid="allow-auto-merge"></button><span id="rs-auto">Allow auto-merge when all requirements pass</span></div>
-                  @if (canMaintain()) {<div class="o-flex">@if (!canAdmin()) {<span class="o-faint o-sm">As a maintain collaborator you change these settings; a project Maintainer renames the repository or changes its visibility.</span>}<button type="submit" class="o-btn o-dark o-r" [disabled]="busy() || !g.mergeMethods.length" data-testid="settings-save">Save</button></div>}
+                  @if (canMaintain()) {<div class="o-flex">@if (!canSettings()) {<span class="o-faint o-sm">As a maintain collaborator you change these settings; a project Maintainer renames the repository or changes its visibility.</span>}<button type="submit" class="o-btn o-dark o-r" [disabled]="busy() || !g.mergeMethods.length" data-testid="settings-save">Save</button></div>}
                 </form>
               }
+              @case ('mirror') {
+                <h1 class="o-t">Mirror</h1>
+                @if (mirror(); as m) {
+                  <div class="o-card" data-testid="mirror-status">
+                    <div class="o-row"><span class="o-mut" style="width:140px">Source</span><span class="o-mono o-ell">{{ m.source }}</span></div>
+                    <div class="o-row"><span class="o-mut" style="width:140px">Syncs</span><span>every {{ m.intervalMinutes }} minutes, as {{ people().name(m.setBy) }}</span></div>
+                    <div class="o-row"><span class="o-mut" style="width:140px">Last sync</span><span data-testid="mirror-last">{{ m.syncing ? 'Syncing now…' : m.lastSyncAt ? ago(m.lastSyncAt) : 'Not yet' }}</span>@if (!m.lastError && m.lastSuccessAt) {<span class="o-chip o-grn">Up to date</span>}</div>
+                    @if (m.lastError) {<div class="o-row"><span class="o-mut" style="width:140px">Problem</span><span class="o-red" role="alert" data-testid="mirror-error">{{ m.lastError }}</span></div>}
+                    @if (m.lfsMissing) {<div class="o-row"><span class="o-mut" style="width:140px">Git LFS</span><span>{{ m.lfsMissing }} files the source could not supply stay pointers.</span></div>}
+                    <div class="o-cf">
+                      <button type="button" class="o-btn o-sm" (click)="syncNow()" [disabled]="!can('code.push') || m.syncing || busy()" data-testid="mirror-sync">Sync now</button>
+                      <span class="o-faint o-xs">Pushes to this repository are refused while it mirrors its source.</span>
+                    </div>
+                  </div>
+                  @if (canSettings()) {
+                    <form class="o-card o-cb o-form" (ngSubmit)="saveMirror()" aria-label="Mirror settings">
+                      <div class="o-fld"><label for="mi-url">Source URL</label><input id="mi-url" class="o-in o-mono" name="murl" [(ngModel)]="mf.url" /></div>
+                      <div class="o-g2">
+                        <div class="o-fld"><label for="mi-user">Username</label><input id="mi-user" class="o-in" name="muser" [(ngModel)]="mf.username" autocomplete="off" /></div>
+                        <div class="o-fld"><label for="mi-tok">New access token</label><input id="mi-tok" class="o-in" type="password" name="mtok" [(ngModel)]="mf.token" autocomplete="off" [placeholder]="m.hasCredentials ? 'A token is kept, encrypted' : 'None'" /></div>
+                      </div>
+                      <div class="o-fld"><label for="mi-int">Sync every (minutes)</label><input id="mi-int" class="o-in" type="number" min="1" name="mint" [(ngModel)]="mf.interval" style="width:140px" /></div>
+                      <div class="o-flex"><span class="o-faint o-sm">Saving makes the mirror sync as you.</span><button type="submit" class="o-btn o-dark o-r" [disabled]="busy()" data-testid="mirror-save">Save</button></div>
+                    </form>
+                    <div class="o-card" style="border-color:var(--o-bad-line)">
+                      <div class="o-row" style="padding:14px"><div class="o-col" style="gap:2px;flex:1"><b>Stop mirroring</b><span class="o-hint">The repository keeps its history and takes pushes; the kept token is deleted.</span></div><button type="button" class="o-btn o-sm" (click)="stopMirror()" [disabled]="busy()" data-testid="mirror-stop">Stop mirroring</button></div>
+                    </div>
+                  }
+                } @else {
+                  <div class="o-card"><div class="o-empty">Loading…</div></div>
+                }
+              }
               @case ('protect') {
                 <div class="o-flex"><h1 class="o-t">Branch protection</h1>@if (canProtect()) {<button type="button" class="o-btn o-sm o-r" (click)="edit(null)" data-testid="add-rule">+ Add rule</button>}</div>
                 <div class="o-card">
@@ -3769,7 +4140,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
                         </div>
                       </div>
                       <div class="o-fld"><span class="o-lbl" style="padding:0">Allowed to bypass</span><div class="o-flex o-wrap">
-                        @for (b of bypassRoles; track b.id) {<button type="button" class="o-chip" style="cursor:pointer;border:none" [class.o-blu]="f.bypass.includes(b.id)" [attr.aria-pressed]="f.bypass.includes(b.id)" (click)="flipBypass(f, b.id)" [attr.data-testid]="'bypass-' + b.id">{{ b.label }}</button>}
+                        @for (b of bypassRoles(); track b.id) {<button type="button" class="o-chip" style="cursor:pointer;border:none" [class.o-blu]="f.bypass.includes(b.id)" [attr.aria-pressed]="f.bypass.includes(b.id)" (click)="flipBypass(f, b.id)" [attr.data-testid]="'bypass-' + b.id">{{ b.label }}</button>}
                         <span class="o-hint">Pushes by these roles go through this rule; every bypass is written to the audit log.</span></div></div>
                       <div class="o-fld"><span class="o-lbl" style="padding:0">What a blocked push sees</span><div class="o-term" style="font-size:11.5px"><div>$ git push origin {{ f.pattern || 'main' }}</div><div>remote: ✕ {{ f.pattern || 'main' }} is protected by rule “{{ f.pattern || 'main' }}”: direct pushes are blocked.</div><div>remote:   Open a pull request instead.</div></div></div>
                       <div class="o-flex">
@@ -3784,7 +4155,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
               @case ('collab') {
                 <h1 class="o-t">Collaborators</h1>
                 <span class="o-mut">Access beyond the project role, for this repository only.</span>
-                @if (canAdmin()) {
+                @if (canCollaborators()) {
                   <div class="o-card" style="overflow-x:auto" data-testid="collaborators">
                     <div class="o-tbl" role="table" aria-label="Collaborators" style="min-width:560px">
                       <div class="o-thead" role="rowgroup"><div class="o-tr" role="row"><div class="o-th" role="columnheader">Person</div><div class="o-th" role="columnheader">Project role</div><div class="o-th" role="columnheader">Repository access</div><div class="o-th" role="columnheader"></div></div></div>
@@ -3815,10 +4186,10 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
               @case ('danger') {
                 <h1 class="o-t">Danger zone</h1>
                 <div class="o-card" style="border-color:var(--o-bad-line)">
-                  <div class="o-row" style="padding:14px"><div class="o-col" style="gap:2px;flex:1"><b>{{ r.archivedAt ? 'Unarchive' : 'Archive' }}</b><span class="o-hint">{{ r.archivedAt ? 'Pushes are accepted again.' : 'Read-only. Pushes are rejected; pipelines stop triggering.' }}</span></div><button type="button" class="o-btn o-sm" (click)="archive(!r.archivedAt)" [disabled]="!canAdmin() || busy()">{{ r.archivedAt ? 'Unarchive' : 'Archive' }}</button></div>
+                  <div class="o-row" style="padding:14px"><div class="o-col" style="gap:2px;flex:1"><b>{{ r.archivedAt ? 'Unarchive' : 'Archive' }}</b><span class="o-hint">{{ r.archivedAt ? 'Pushes are accepted again.' : 'Read-only. Pushes are rejected; pipelines stop triggering.' }}</span></div><button type="button" class="o-btn o-sm" (click)="archive(!r.archivedAt)" [disabled]="!canDelete() || busy()">{{ r.archivedAt ? 'Unarchive' : 'Archive' }}</button></div>
                   <div class="o-row" style="padding:14px;flex-wrap:wrap"><div class="o-col" style="gap:2px;flex:1;min-width:240px"><b>Delete this repository</b><span class="o-hint">Recoverable for 7 days, then gone for good. Type <b class="o-mono">{{ r.name }}</b> to confirm.</span></div>
-                    <input class="o-in o-sm o-mono" style="width:180px" aria-label="Type the repository name to confirm" [ngModel]="confirm()" (ngModelChange)="confirm.set($event)" [disabled]="!canAdmin()" />
-                    <button type="button" class="o-btn o-sm o-red" (click)="remove()" [disabled]="!canAdmin() || confirm() !== r.name || busy()">Delete</button>
+                    <input class="o-in o-sm o-mono" style="width:180px" aria-label="Type the repository name to confirm" [ngModel]="confirm()" (ngModelChange)="confirm.set($event)" [disabled]="!canDelete()" />
+                    <button type="button" class="o-btn o-sm o-red" (click)="remove()" [disabled]="!canDelete() || confirm() !== r.name || busy()">Delete</button>
                   </div>
                 </div>
               }
@@ -3989,7 +4360,7 @@ class ReleasesPage extends RepoPage {
     <div class="o-page o-narrow">
       <div class="o-ph">
         <div class="o-col"><span class="o-eyebrow">{{ name() }}</span><h1 class="o-t">Releases and tags</h1></div>
-        @if (canWrite()) {
+        @if (canRelease()) {
           <div class="o-acts">
             <button type="button" class="o-btn o-sm" (click)="tagging.set(!tagging()); draft.set(null)" data-testid="tag-new">New tag</button>
             <button type="button" class="o-btn o-sm o-dark" (click)="startRelease()" data-testid="release-new">Draft release</button>
@@ -4060,11 +4431,11 @@ class ReleasesPage extends RepoPage {
             <span>Assets</span>
             @for (a of r.assets; track a.id) {
               <button type="button" class="o-lnk o-mono" (click)="download(r, a.id, a.name)" [attr.aria-label]="'Download ' + a.name">{{ a.name }}</button>
-              @if (canWrite()) {<button type="button" class="o-lnk" style="color:var(--o-mut)" (click)="removeAsset(r, a.id)" [attr.aria-label]="'Remove ' + a.name">×</button>}
+              @if (canRelease()) {<button type="button" class="o-lnk" style="color:var(--o-mut)" (click)="removeAsset(r, a.id)" [attr.aria-label]="'Remove ' + a.name">×</button>}
             }
             <button type="button" class="o-lnk" (click)="archive(r, 'zip')">Source (zip)</button>
             <button type="button" class="o-lnk" (click)="archive(r, 'tar.gz')">Source (tar.gz)</button>
-            @if (canWrite()) {
+            @if (canRelease()) {
               <span class="o-r o-flex" style="gap:10px">
                 <label class="o-lnk" style="cursor:pointer">Add file<input type="file" class="o-sr-only" (change)="upload(r, $event)" [attr.aria-label]="'Add a file to ' + r.tag" /></label>
                 <button type="button" class="o-lnk" (click)="edit(r)" [attr.aria-label]="'Edit ' + r.tag">Edit</button>
@@ -4079,7 +4450,7 @@ class ReleasesPage extends RepoPage {
           </div>
         </div>
       } @empty {
-        <div class="o-card"><div class="o-empty">{{ loaded() ? 'No releases yet.' + (canWrite() ? ' Draft one from a tag; its notes can come from the issues it finishes.' : '') : 'Loading…' }}</div></div>
+        <div class="o-card"><div class="o-empty">{{ loaded() ? 'No releases yet.' + (canRelease() ? ' Draft one from a tag; its notes can come from the issues it finishes.' : '') : 'Loading…' }}</div></div>
       }
 
       <div class="o-card" data-testid="tags">
@@ -4088,7 +4459,7 @@ class ReleasesPage extends RepoPage {
           <div class="o-row" [attr.data-testid]="'tag-' + t.name">
             <span class="o-mono o-sm o-b5">{{ t.name }}</span><span class="o-faint o-sm o-mono">{{ t.commit?.short }}</span>
             <span class="o-r o-faint o-sm">{{ ago(t.commit?.committer?.when) }}</span>
-            @if (canWrite() && !used(t.name)) {<button type="button" class="o-lnk" style="color:var(--o-mut)" (click)="removeTag(t)" [attr.aria-label]="'Delete tag ' + t.name">Delete</button>}
+            @if (canRelease() && !used(t.name)) {<button type="button" class="o-lnk" style="color:var(--o-mut)" (click)="removeTag(t)" [attr.aria-label]="'Delete tag ' + t.name">Delete</button>}
           </div>
         } @empty {<div class="o-empty o-sm">No tags yet.</div>}
       </div>
@@ -4101,7 +4472,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
     <div class="o-page o-narrow">
       <div class="o-ph">
         <div class="o-col"><span class="o-eyebrow">{{ name() }}</span><h1 class="o-t">Releases and tags</h1></div>
-        @if (canWrite()) {
+        @if (canRelease()) {
           <div class="o-acts">
             <button type="button" class="o-btn o-sm" (click)="tagging.set(!tagging()); draft.set(null)" data-testid="tag-new">New tag</button>
             <button type="button" class="o-btn o-sm o-dark" (click)="startRelease()" data-testid="release-new">Draft release</button>
@@ -4172,11 +4543,11 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
             <span>Assets</span>
             @for (a of r.assets; track a.id) {
               <button type="button" class="o-lnk o-mono" (click)="download(r, a.id, a.name)" [attr.aria-label]="'Download ' + a.name">{{ a.name }}</button>
-              @if (canWrite()) {<button type="button" class="o-lnk" style="color:var(--o-mut)" (click)="removeAsset(r, a.id)" [attr.aria-label]="'Remove ' + a.name">×</button>}
+              @if (canRelease()) {<button type="button" class="o-lnk" style="color:var(--o-mut)" (click)="removeAsset(r, a.id)" [attr.aria-label]="'Remove ' + a.name">×</button>}
             }
             <button type="button" class="o-lnk" (click)="archive(r, 'zip')">Source (zip)</button>
             <button type="button" class="o-lnk" (click)="archive(r, 'tar.gz')">Source (tar.gz)</button>
-            @if (canWrite()) {
+            @if (canRelease()) {
               <span class="o-r o-flex" style="gap:10px">
                 <label class="o-lnk" style="cursor:pointer">Add file<input type="file" class="o-sr-only" (change)="upload(r, $event)" [attr.aria-label]="'Add a file to ' + r.tag" /></label>
                 <button type="button" class="o-lnk" (click)="edit(r)" [attr.aria-label]="'Edit ' + r.tag">Edit</button>
@@ -4191,7 +4562,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
           </div>
         </div>
       } @empty {
-        <div class="o-card"><div class="o-empty">{{ loaded() ? 'No releases yet.' + (canWrite() ? ' Draft one from a tag; its notes can come from the issues it finishes.' : '') : 'Loading…' }}</div></div>
+        <div class="o-card"><div class="o-empty">{{ loaded() ? 'No releases yet.' + (canRelease() ? ' Draft one from a tag; its notes can come from the issues it finishes.' : '') : 'Loading…' }}</div></div>
       }
 
       <div class="o-card" data-testid="tags">
@@ -4200,7 +4571,7 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
           <div class="o-row" [attr.data-testid]="'tag-' + t.name">
             <span class="o-mono o-sm o-b5">{{ t.name }}</span><span class="o-faint o-sm o-mono">{{ t.commit?.short }}</span>
             <span class="o-r o-faint o-sm">{{ ago(t.commit?.committer?.when) }}</span>
-            @if (canWrite() && !used(t.name)) {<button type="button" class="o-lnk" style="color:var(--o-mut)" (click)="removeTag(t)" [attr.aria-label]="'Delete tag ' + t.name">Delete</button>}
+            @if (canRelease() && !used(t.name)) {<button type="button" class="o-lnk" style="color:var(--o-mut)" (click)="removeTag(t)" [attr.aria-label]="'Delete tag ' + t.name">Delete</button>}
           </div>
         } @empty {<div class="o-empty o-sm">No tags yet.</div>}
       </div>
@@ -4495,5 +4866,5 @@ i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "21.2.12", ngImpo
  * Generated bundle index. Do not edit.
  */
 
-export { BranchesPage, CodeApi, CodeHost, CodeSearchPage, CommitBox, CommitPage, CommitsPage, CurrentRepo, CurrentRepoPage, DiffView, FilePage, NewFilePage, NewRepoPage, People, PullPage, PullsPage, RefPicker, ReleasesPage, RepoHomePage, RepoPage, RepoSettingsPage, ReposPage, TOKEN_CSS, ago, apiMessage, checkDot, copy, dayLabel, initials, langColour, matchesPattern, pair, shortDate, size, verifyWhy };
+export { BranchesPage, CodeApi, CodeHost, CodeSearchPage, CommitBox, CommitPage, CommitsPage, CurrentRepo, CurrentRepoPage, DiffView, FilePage, NewFilePage, NewRepoPage, People, PullPage, PullsPage, RefPicker, ReleasesPage, RepoHomePage, RepoPage, RepoSettingsPage, ReposPage, TOKEN_CSS, ago, apiMessage, checkDot, copy, dayLabel, initials, langColour, matchesPattern, pair, shortDate, size, verifyLabel, verifyTitle, verifyWhy };
 //# sourceMappingURL=chisquare-tech-origine-ngx-apps-code.mjs.map