@homeflare/alchemy 0.11.0 → 0.13.0

package/dist/forgejo/index.js.map

@@ -2,18 +2,18 @@
   "version": 3,
   "sources": ["../src/forgejo/branch-protection.ts", "../src/forgejo/branch-protection-form.ts", "../src/forgejo/resource.ts", "../src/forgejo/client.ts", "../src/forgejo/values.ts", "../src/forgejo/org-actions-secrets.ts", "../src/forgejo/org-label.ts", "../src/forgejo/org-team.ts", "../src/forgejo/repo-webhook.ts", "../src/forgejo/repo-webhook-form.ts", "../src/forgejo/repository.ts", "../src/forgejo/team-member.ts"],
   "sourcesContent": [
-    "/**\n * `Forgejo.BranchProtection` — one rule at `/repos/{owner}/{repo}/branch_protections/{name}`.\n *\n * ★ READ OFF `house/mcp-servers/docs/api/upstream/forgejo.json`: create is POST collection;\n *   read/update/delete use the branch/rule name in the path segment `{name}`. Response carries\n *   `rule_name` (preferred) and deprecated `branch_name`.\n *\n * ⛔ `defaultRemovalPolicy: 'retain'` — dropping a protection rule from the stack must not silently\n *   unprotect a branch; opt into `.pipe(RemovalPolicy.destroy())` to DELETE.\n *\n * ⛔ TOKEN NEEDS `write:repository` TO CREATE OR PATCH — get needs `read:repository`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { branchProtectionForm } from './branch-protection-form.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, int, stringArray, text } from './values.ts';\n\nexport interface BranchProtectionProps {\n  owner: string;\n  repo: string;\n  /** Branch or rule name — path key and `rule_name` on the wire. */\n  branchName: string;\n  requiredApprovals?: number;\n  enablePush?: boolean;\n  enableStatusCheck?: boolean;\n  requireSignedCommits?: boolean;\n  dismissStaleApprovals?: boolean;\n  ignoreStaleApprovals?: boolean;\n  applyToAdmins?: boolean;\n  statusCheckContexts?: string[];\n}\n\nexport interface BranchProtectionAttributes {\n  owner: string;\n  repo: string;\n  branchName: string;\n  requiredApprovals: number;\n  enablePush: boolean;\n  enableStatusCheck: boolean;\n  requireSignedCommits: boolean;\n  dismissStaleApprovals: boolean;\n  ignoreStaleApprovals: boolean;\n  applyToAdmins: boolean;\n  statusCheckContexts: string[];\n}\n\nexport interface ForgejoBranchProtection extends Resource<\n  'Forgejo.BranchProtection',\n  BranchProtectionProps,\n  BranchProtectionAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoBranchProtection = Resource<ForgejoBranchProtection>(\n  'Forgejo.BranchProtection',\n  { defaultRemovalPolicy: 'retain' },\n);\n\nconst handlers = forgejoHandlers<BranchProtectionProps, BranchProtectionAttributes>({\n  attributes: (live, props) => {\n    const ruleName = text(live['rule_name'], text(live['branch_name']));\n    if (ruleName === '') return undefined;\n    return {\n      applyToAdmins: bool(live['apply_to_admins']),\n      branchName: props.branchName,\n      dismissStaleApprovals: bool(live['dismiss_stale_approvals']),\n      enablePush: bool(live['enable_push'], true),\n      enableStatusCheck: bool(live['enable_status_check']),\n      ignoreStaleApprovals: bool(live['ignore_stale_approvals']),\n      owner: props.owner,\n      repo: props.repo,\n      requireSignedCommits: bool(live['require_signed_commits']),\n      requiredApprovals: int(live['required_approvals']),\n      statusCheckContexts: stringArray(live['status_check_contexts']),\n    };\n  },\n  collection: (props) => `repos/${props.owner}/${props.repo}/branch_protections`,\n  createForm: branchProtectionForm,\n  matches: (attributes, props) =>\n    attributes.requiredApprovals === (props.requiredApprovals ?? 0) &&\n    attributes.enablePush === (props.enablePush ?? true) &&\n    attributes.enableStatusCheck === (props.enableStatusCheck ?? false) &&\n    attributes.requireSignedCommits === (props.requireSignedCommits ?? false) &&\n    attributes.dismissStaleApprovals === (props.dismissStaleApprovals ?? false) &&\n    attributes.ignoreStaleApprovals === (props.ignoreStaleApprovals ?? false) &&\n    attributes.applyToAdmins === (props.applyToAdmins ?? false) &&\n    (props.statusCheckContexts === undefined ||\n      stringArray(props.statusCheckContexts).join('\\0') ===\n        attributes.statusCheckContexts.join('\\0')),\n  path: (props) => `repos/${props.owner}/${props.repo}/branch_protections/${props.branchName}`,\n  updateForm: branchProtectionForm,\n});\n\nexport const ForgejoBranchProtectionProvider = () =>\n  Provider.effect(\n    ForgejoBranchProtection,\n    Effect.succeed(ForgejoBranchProtection.Provider.of(handlers)),\n  );\n",
-    "/**\n * Create/PATCH bodies for `Forgejo.BranchProtection` — extracted for the 250-line cap.\n *\n * ★ READ OFF `house/mcp-servers/docs/api/upstream/forgejo.json` — create posts\n *   `CreateBranchProtectionOption`; update sends `EditBranchProtectionOption` fields only.\n */\nimport type { BranchProtectionProps } from './branch-protection.ts';\n\nexport const branchProtectionForm = (props: BranchProtectionProps) => ({\n  ...(props.applyToAdmins === undefined ? {} : { apply_to_admins: props.applyToAdmins }),\n  ...(props.dismissStaleApprovals === undefined\n    ? {}\n    : { dismiss_stale_approvals: props.dismissStaleApprovals }),\n  ...(props.enablePush === undefined ? {} : { enable_push: props.enablePush }),\n  ...(props.enableStatusCheck === undefined\n    ? {}\n    : { enable_status_check: props.enableStatusCheck }),\n  ...(props.ignoreStaleApprovals === undefined\n    ? {}\n    : { ignore_stale_approvals: props.ignoreStaleApprovals }),\n  ...(props.requireSignedCommits === undefined\n    ? {}\n    : { require_signed_commits: props.requireSignedCommits }),\n  ...(props.requiredApprovals === undefined ? {} : { required_approvals: props.requiredApprovals }),\n  ...(props.statusCheckContexts === undefined\n    ? {}\n    : { status_check_contexts: props.statusCheckContexts }),\n  rule_name: props.branchName,\n});\n",
-    "/**\n * One shape for every Forgejo object — the same four operations, different path and JSON body.\n *\n * ⛔ THE ALTERNATIVE IS COPYING THE SAME HANDLERS PER RESOURCE. Repositories, org labels, teams,\n *   runners, branch protection and package settings are all create / read / update / delete over\n *   `/api/v1` with JSON bodies. Hand-rolling the fourth copy is where someone drops the read-back\n *   or the isResolved guard and the plan lies.\n *\n * ★ SO THE FOUR OPERATIONS LIVE HERE, ONCE. A new Forgejo object should be a spec plus ~forty\n *   lines, not a hundred and thirty.\n *\n * ⚠️ GITEA ANSWERS WITH THE OBJECT DIRECTLY — NOT `{\"data\": ...}`. See client.ts. reconcile still\n *   READS BACK after every write rather than trusting the status code alone.\n *\n * ★ WHY `Forgejo.Repository` DECLARES `defaultRemovalPolicy: 'retain'`, WRITTEN ONCE HERE.\n *   Alchemy's own `GitHub.Repository` defaults to retain \"because their contents are\n *   irreplaceable\". A git repository is the most irreplaceable object on this estate. `retain`\n *   means the engine skips `provider.delete` when a resource is orphaned unless the caller opted\n *   into `.pipe(RemovalPolicy.destroy())`. The `delete` handler is FULLY IMPLEMENTED anyway — a\n *   stub that silently does nothing lies to whoever reads the plan.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\nimport { ForgejoError, forgejo } from './client.ts';\n\n/**\n * ★ WHAT EVERY OPERATION HERE NEEDS FROM THE RUNTIME — and it is NOT what the first draft said.\n *\n *   These resources declared `ChildProcessSpawner`, copied from house/proxmox, where it is there\n *   because a PVE credential is minted by shelling out to `bao`. Nothing in this package shells\n *   out: the token comes from `FORGEJO_TOKEN` in the environment. Declaring a service you never\n *   use is not harmless — it makes a stack provide a layer for nothing, and it hides the one\n *   service you DO need.\n *\n *   What is actually required is `HttpClient`, for the reason in client.ts: Alchemy's own\n *   providers call through Effect's client rather than the global `fetch`.\n */\nexport type ForgejoRequirements = HttpClient.HttpClient;\n\nexport type ForgejoSpec<Props extends object, Attributes> = {\n  /** `repos/HomeFlare/homeflare`, `orgs/homeflare/labels/40` — one object. */\n  readonly path: (props: Props) => string;\n  /** `orgs/HomeFlare/repos`, `orgs/homeflare/labels` — where a new one is POSTed. */\n  readonly collection: (props: Props) => string;\n  readonly attributes: (live: Record<string, unknown>, props: Props) => Attributes | undefined;\n  /** JSON body on create. ⚠️ Gitea takes JSON, not form encoding. */\n  readonly createForm: (props: Props) => Record<string, unknown>;\n  readonly updateForm?: (props: Props) => Record<string, unknown>;\n  readonly matches: (attributes: Attributes, props: Props) => boolean;\n  /**\n   * When the stable key is not enough for the wire path — org labels are addressed by numeric id.\n   * `locate` lists or searches; `wirePath` builds update/delete paths from the live row.\n   */\n  readonly locate?: (\n    props: Props,\n  ) => Effect.Effect<Record<string, unknown> | undefined, ForgejoError, ForgejoRequirements>;\n  readonly wirePath?: (props: Props, live: Record<string, unknown>) => string;\n  /**\n   * When create is PUT upsert rather than POST — org actions secrets have no POST and no GET-by-name.\n   * `before === undefined` means absent; the callback decides whether to write. Existence-only families\n   * noop when `before` is set because the API never returns the value for comparison.\n   */\n  readonly upsert?: (\n    props: Props,\n    before: Record<string, unknown> | undefined,\n  ) => Effect.Effect<void, ForgejoError, ForgejoRequirements>;\n};\n\n/** ⚠️ Only 404 folds to \"absent\". A 403 is a real failure — folding it would plan a create over an existing object. */\nconst absentOn404 = <A>(io: Effect.Effect<A, ForgejoError, ForgejoRequirements>) =>\n  io.pipe(\n    Effect.catchIf(\n      (cause): cause is ForgejoError => cause instanceof ForgejoError && cause.status === 404,\n      () => Effect.succeed(undefined as A),\n    ),\n  );\n\nexport const forgejoOperations = <Props extends object, Attributes>(\n  spec: ForgejoSpec<Props, Attributes>,\n) => {\n  const fetchLive = (props: Props) =>\n    absentOn404(\n      spec.locate !== undefined\n        ? spec.locate(props)\n        : forgejo<Record<string, unknown>>('GET', spec.path(props)),\n    );\n\n  const objectPath = (props: Props, live: Record<string, unknown>) =>\n    spec.wirePath === undefined ? spec.path(props) : spec.wirePath(props, live);\n\n  const read = (props: Props) =>\n    fetchLive(props).pipe(\n      Effect.map((data) => (data === undefined ? undefined : spec.attributes(data, props))),\n    );\n\n  return {\n    read,\n\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        if (output === undefined || !isResolved(news)) return undefined;\n        const live = yield* read(news);\n        if (live === undefined) return { action: 'update' } as const;\n        if (spec.matches(live, news)) return { action: 'noop' } as const;\n        return spec.updateForm === undefined\n          ? ({ action: 'replace' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const before = yield* fetchLive(news);\n        if (spec.upsert !== undefined) {\n          yield* spec.upsert(news, before);\n        } else if (before === undefined) {\n          yield* forgejo('POST', spec.collection(news), spec.createForm(news));\n        } else if (spec.updateForm !== undefined) {\n          const mapped = spec.attributes(before, news);\n          if (mapped === undefined || spec.matches(mapped, news)) {\n            /* adoption or already converged — no PATCH */\n          } else {\n            const form = spec.updateForm(news);\n            if (Object.keys(form).length > 0) {\n              yield* forgejo('PATCH', objectPath(news, before), form);\n            }\n          }\n        }\n        const after = yield* read(news);\n        if (after === undefined) {\n          return yield* Effect.die(\n            new Error(\n              `${spec.path(news)}: the write returned no error but the object is still absent. ` +\n                'Gitea returns the object directly — read back rather than trusting the status code.',\n            ),\n          );\n        }\n        return after;\n      }),\n\n    destroy: (olds: Props) =>\n      Effect.gen(function* () {\n        const live = yield* fetchLive(olds);\n        if (live === undefined) return;\n        yield* forgejo('DELETE', objectPath(olds, live));\n      }),\n  };\n};\n\n/**\n * The five provider handlers for a spec'd Forgejo object, wired once.\n *\n * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER — same reasoning as pveHandlers in\n *   house/proxmox: wrapping `Provider.effect` here needs casts against Alchemy's `Props<R>`.\n *\n * ⚠️ `list` answers empty — Forgejo index endpoints return the whole org; adoption stays explicit.\n */\nexport const forgejoHandlers = <Props extends object, Attributes extends object>(\n  spec: ForgejoSpec<Props, Attributes>,\n) => {\n  const ops = forgejoOperations(spec);\n  return {\n    list: () => Effect.succeed([]),\n    read: ({ olds }: { olds: Props }) => ops.read(olds),\n    diff: ({ news, output }: { news: Input<Props>; output: Attributes | undefined }) =>\n      ops.diff(news, output),\n    reconcile: ({ news }: { news: Props }) => ops.reconcile(news),\n    delete: ({ olds }: { olds: Props }) => ops.destroy(olds),\n  };\n};\n",
-    "/**\n * One authenticated call to the Forgejo (Gitea) API at `/api/v1`.\n *\n * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH — your Forgejo host serves a real certificate on :443,\n *   and the local daemon on :3000 is loopback. There is no `rejectUnauthorized` switch to leave\n *   on by accident elsewhere.\n *\n * ⚠️ GITEA DOES NOT WRAP ANSWERS IN `{\"data\": ...}` THE WAY PVE DOES. MEASURED 2026-09-13 on\n *   the live daemon: `GET /api/v1/version` returns `{\"version\":\"16.0.3\"}`; `GET /api/v1/user`\n *   returns the user object; `GET /api/v1/orgs/HomeFlare/repos` returns a JSON array. A caller\n *   that unwraps a non-existent envelope sees `undefined` and calls a healthy object \"absent\".\n *\n * ⛔ THE TOKEN IS NEVER A PROP. Read `FORGEJO_TOKEN` from the environment at call time only.\n *   Alchemy persists attributes unencrypted and this estate's state store is Postgres dumped\n *   nightly — nothing stored may be a credential.\n */\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\n\nconst PATH_PREFIX = '/api/v1';\n\n/**\n * The Forgejo instance, from `FORGEJO_URL`. Trailing slash stripped.\n *\n * ⛔ NO DEFAULT HOSTNAME. This used to fall back to the author's own instance, which is\n *   fine inside one estate and wrong in a published package: a consumer who forgets the\n *   variable would silently point at someone else's server rather than being told.\n * ⚠️ Read at CALL time, never at module scope — a value captured at import is pinned to\n *   whatever the first isolate saw.\n */\nexport const apiBase = (): string => {\n  const raw = process.env['FORGEJO_URL'];\n  if (raw === undefined || raw.trim() === '') {\n    throw new Error(\n      'FORGEJO_URL is not set. Point it at your Forgejo instance, e.g. https://git.example.com',\n    );\n  }\n  return raw.trim().replace(/\\/$/, '');\n};\n\nconst token = (): Effect.Effect<string, ForgejoError> =>\n  Effect.gen(function* () {\n    const raw = process.env['FORGEJO_TOKEN'];\n    if (raw === undefined || raw.trim() === '') {\n      return yield* Effect.fail(\n        new ForgejoError(\n          0,\n          'GET',\n          '',\n          'FORGEJO_TOKEN is unset. Mint a scoped token and export it — never store it in Alchemy props.',\n        ),\n      );\n    }\n    return raw.trim();\n  });\n\nexport class ForgejoError extends Error {\n  constructor(\n    readonly status: number,\n    readonly method: string,\n    readonly path: string,\n    detail: string,\n  ) {\n    super(`Forgejo ${method} ${path} -> ${String(status)}: ${detail}`);\n    this.name = 'ForgejoError';\n  }\n}\n\n/**\n * ⚠️ `Authorization: token <value>`, NOT `Bearer`. Gitea docs and MEASURED behaviour on this\n *   estate: Bearer is treated as OAuth2 and rejected; `token` is the documented API-key form.\n */\nconst authorization = (value: string) => ({ Authorization: `token ${value}` });\n\n/** One JSON call. Returns the parsed body, or `undefined` when the response is empty (DELETE). */\nexport const forgejo = <T>(\n  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',\n  path: string,\n  body?: Record<string, unknown>,\n) =>\n  Effect.gen(function* () {\n    const credential = yield* token();\n    const url = `${apiBase()}${PATH_PREFIX}/${path.replace(/^\\//, '')}`;\n    /**\n     * ★ THROUGH `HttpClient`, NOT THE GLOBAL `fetch` — the idiom Alchemy's own providers follow\n     *   (src/Hetzner/Providers.ts builds on `FetchHttpClient.layer`; there is no bare fetch in its\n     *   Docker, Kubernetes or GitHub providers). It buys a typed error channel, interruption when\n     *   a plan is cancelled, the runtime's tracing, and a client a test can replace without\n     *   monkey-patching a global. house/proxmox/src/resource.ts carries the same note.\n     */\n    const client = yield* HttpClient.HttpClient;\n    /**\n     * ⛔ THE CONTENT TYPE GOES ON `bodyText`, NOT IN THE HEADER MAP, AND PUTTING IT IN BOTH IS HOW\n     *   THIS PACKAGE SHIPPED UNABLE TO WRITE AT ALL.\n     *\n     * 🔴 THE BUG, MEASURED THE FIRST TIME A WRITE WAS EVER ATTEMPTED. The header map DID carry\n     *   `Content-Type: application/json` — and `bodyText(s)` with no second argument sets\n     *   `text/plain` and OVERWRITES it, because it is piped AFTER `setHeaders`. Forgejo answered\n     *       422 {\"message\":\"[]: Unsupported Content-Type\"}\n     *   on `PATCH orgs/homeflare/labels/1`. Every create and every update in every family here was\n     *   broken, identically, from the day the client was written.\n     *\n     * ⛔ NOTHING CAUGHT IT BECAUSE NOTHING HAD EVER WRITTEN. The only credential on the shelf was\n     *   `mcp-read`, which answers 403 before a request body is ever parsed — so read, adopt, diff\n     *   and plan all worked perfectly and the write path had literally never executed. A provider\n     *   that has never performed its own writes is not a tested provider, whatever the plan says.\n     *\n     * ⚠️ `bodyJsonUnsafe` WOULD ALSO WORK. `bodyText` with an explicit type is used instead\n     *   because it makes the content type visible at the call site, which is the thing that was\n     *   invisible before.\n     */\n    const request = HttpClientRequest.make(method)(url).pipe(\n      HttpClientRequest.setHeaders({ ...authorization(credential), Accept: 'application/json' }),\n      body === undefined\n        ? (self) => self\n        : HttpClientRequest.bodyText(JSON.stringify(body), 'application/json'),\n    );\n    const response = yield* client\n      .execute(request)\n      .pipe(Effect.mapError((cause) => new ForgejoError(0, method, path, String(cause))));\n    // ⛔ Status first, body once — a Gitea error body is JSON but a proxy's 502 is not.\n    if (response.status < 200 || response.status >= 300) {\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(\n        new ForgejoError(response.status, method, path, detail.slice(0, 300)),\n      );\n    }\n    // ⚠️ 204 AND AN EMPTY BODY ARE REAL: a label DELETE answers no content, and `json` on an empty\n    //   body fails. Read text once and parse only when there is something to parse.\n    const text = yield* response.text.pipe(\n      Effect.mapError((cause) => new ForgejoError(0, method, path, String(cause))),\n    );\n    // ⚠️ PUT/DELETE on actions secrets and hooks often answer 201/204 with no body — same trap as DELETE.\n    return (text === '' ? undefined : JSON.parse(text)) as T;\n  });\n",
+    "/**\n * `Forgejo.BranchProtection` — one rule at `/repos/{owner}/{repo}/branch_protections/{name}`.\n *\n * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json`: create is POST collection;\n *   read/update/delete use the branch/rule name in the path segment `{name}`. Response carries\n *   `rule_name` (preferred) and deprecated `branch_name`.\n *\n * ⛔ `defaultRemovalPolicy: 'retain'` — dropping a protection rule from the stack must not silently\n *   unprotect a branch; opt into `.pipe(RemovalPolicy.destroy())` to DELETE.\n *\n * ⛔ TOKEN NEEDS `write:repository` TO CREATE OR PATCH — get needs `read:repository`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { branchProtectionForm } from './branch-protection-form.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, int, stringArray, text } from './values.ts';\n\nexport interface BranchProtectionProps {\n  owner: string;\n  repo: string;\n  /** Branch or rule name — path key and `rule_name` on the wire. */\n  branchName: string;\n  requiredApprovals?: number;\n  enablePush?: boolean;\n  enableStatusCheck?: boolean;\n  requireSignedCommits?: boolean;\n  dismissStaleApprovals?: boolean;\n  ignoreStaleApprovals?: boolean;\n  applyToAdmins?: boolean;\n  statusCheckContexts?: string[];\n}\n\nexport interface BranchProtectionAttributes {\n  owner: string;\n  repo: string;\n  branchName: string;\n  requiredApprovals: number;\n  enablePush: boolean;\n  enableStatusCheck: boolean;\n  requireSignedCommits: boolean;\n  dismissStaleApprovals: boolean;\n  ignoreStaleApprovals: boolean;\n  applyToAdmins: boolean;\n  statusCheckContexts: string[];\n}\n\nexport interface ForgejoBranchProtection extends Resource<\n  'Forgejo.BranchProtection',\n  BranchProtectionProps,\n  BranchProtectionAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoBranchProtection = Resource<ForgejoBranchProtection>(\n  'Forgejo.BranchProtection',\n  { defaultRemovalPolicy: 'retain' },\n);\n\nconst handlers = forgejoHandlers<BranchProtectionProps, BranchProtectionAttributes>({\n  attributes: (live, props) => {\n    const ruleName = text(live['rule_name'], text(live['branch_name']));\n    if (ruleName === '') return undefined;\n    return {\n      applyToAdmins: bool(live['apply_to_admins']),\n      branchName: props.branchName,\n      dismissStaleApprovals: bool(live['dismiss_stale_approvals']),\n      enablePush: bool(live['enable_push'], true),\n      enableStatusCheck: bool(live['enable_status_check']),\n      ignoreStaleApprovals: bool(live['ignore_stale_approvals']),\n      owner: props.owner,\n      repo: props.repo,\n      requireSignedCommits: bool(live['require_signed_commits']),\n      requiredApprovals: int(live['required_approvals']),\n      statusCheckContexts: stringArray(live['status_check_contexts']),\n    };\n  },\n  collection: (props) => `repos/${props.owner}/${props.repo}/branch_protections`,\n  createForm: branchProtectionForm,\n  matches: (attributes, props) =>\n    attributes.requiredApprovals === (props.requiredApprovals ?? 0) &&\n    attributes.enablePush === (props.enablePush ?? true) &&\n    attributes.enableStatusCheck === (props.enableStatusCheck ?? false) &&\n    attributes.requireSignedCommits === (props.requireSignedCommits ?? false) &&\n    attributes.dismissStaleApprovals === (props.dismissStaleApprovals ?? false) &&\n    attributes.ignoreStaleApprovals === (props.ignoreStaleApprovals ?? false) &&\n    attributes.applyToAdmins === (props.applyToAdmins ?? false) &&\n    (props.statusCheckContexts === undefined ||\n      stringArray(props.statusCheckContexts).join('\\0') ===\n        attributes.statusCheckContexts.join('\\0')),\n  path: (props) => `repos/${props.owner}/${props.repo}/branch_protections/${props.branchName}`,\n  updateForm: branchProtectionForm,\n});\n\nexport const ForgejoBranchProtectionProvider = () =>\n  Provider.effect(\n    ForgejoBranchProtection,\n    Effect.succeed(ForgejoBranchProtection.Provider.of(handlers)),\n  );\n",
+    "/**\n * Create/PATCH bodies for `Forgejo.BranchProtection` — extracted for the 250-line cap.\n *\n * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json` — create posts\n *   `CreateBranchProtectionOption`; update sends `EditBranchProtectionOption` fields only.\n */\nimport type { BranchProtectionProps } from './branch-protection.ts';\n\nexport const branchProtectionForm = (props: BranchProtectionProps) => ({\n  ...(props.applyToAdmins === undefined ? {} : { apply_to_admins: props.applyToAdmins }),\n  ...(props.dismissStaleApprovals === undefined\n    ? {}\n    : { dismiss_stale_approvals: props.dismissStaleApprovals }),\n  ...(props.enablePush === undefined ? {} : { enable_push: props.enablePush }),\n  ...(props.enableStatusCheck === undefined\n    ? {}\n    : { enable_status_check: props.enableStatusCheck }),\n  ...(props.ignoreStaleApprovals === undefined\n    ? {}\n    : { ignore_stale_approvals: props.ignoreStaleApprovals }),\n  ...(props.requireSignedCommits === undefined\n    ? {}\n    : { require_signed_commits: props.requireSignedCommits }),\n  ...(props.requiredApprovals === undefined ? {} : { required_approvals: props.requiredApprovals }),\n  ...(props.statusCheckContexts === undefined\n    ? {}\n    : { status_check_contexts: props.statusCheckContexts }),\n  rule_name: props.branchName,\n});\n",
+    "/**\n * One shape for every Forgejo object — the same four operations, different path and JSON body.\n *\n * ⛔ THE ALTERNATIVE IS COPYING THE SAME HANDLERS PER RESOURCE. Repositories, org labels, teams,\n *   runners, branch protection and package settings are all create / read / update / delete over\n *   `/api/v1` with JSON bodies. Hand-rolling the fourth copy is where someone drops the read-back\n *   or the isResolved guard and the plan lies.\n *\n * ★ SO THE FOUR OPERATIONS LIVE HERE, ONCE. A new Forgejo object should be a spec plus ~forty\n *   lines, not a hundred and thirty.\n *\n * ⚠️ GITEA ANSWERS WITH THE OBJECT DIRECTLY — NOT `{\"data\": ...}`. See client.ts. reconcile still\n *   READS BACK after every write rather than trusting the status code alone.\n *\n * ★ WHY `Forgejo.Repository` DECLARES `defaultRemovalPolicy: 'retain'`, WRITTEN ONCE HERE.\n *   Alchemy's own `GitHub.Repository` defaults to retain \"because their contents are\n *   irreplaceable\". A git repository is the most irreplaceable object on this estate. `retain`\n *   means the engine skips `provider.delete` when a resource is orphaned unless the caller opted\n *   into `.pipe(RemovalPolicy.destroy())`. The `delete` handler is FULLY IMPLEMENTED anyway — a\n *   stub that silently does nothing lies to whoever reads the plan.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\nimport { ForgejoError, forgejo } from './client.ts';\n\n/**\n * ★ WHAT EVERY OPERATION HERE NEEDS FROM THE RUNTIME — and it is NOT what the first draft said.\n *\n *   These resources declared `ChildProcessSpawner`, copied from <estate>/proxmox, where it is there\n *   because a PVE credential is minted by shelling out to `bao`. Nothing in this package shells\n *   out: the token comes from `FORGEJO_TOKEN` in the environment. Declaring a service you never\n *   use is not harmless — it makes a stack provide a layer for nothing, and it hides the one\n *   service you DO need.\n *\n *   What is actually required is `HttpClient`, for the reason in client.ts: Alchemy's own\n *   providers call through Effect's client rather than the global `fetch`.\n */\nexport type ForgejoRequirements = HttpClient.HttpClient;\n\nexport type ForgejoSpec<Props extends object, Attributes> = {\n  /** `repos/HomeFlare/homeflare`, `orgs/homeflare/labels/40` — one object. */\n  readonly path: (props: Props) => string;\n  /** `orgs/HomeFlare/repos`, `orgs/homeflare/labels` — where a new one is POSTed. */\n  readonly collection: (props: Props) => string;\n  readonly attributes: (live: Record<string, unknown>, props: Props) => Attributes | undefined;\n  /** JSON body on create. ⚠️ Gitea takes JSON, not form encoding. */\n  readonly createForm: (props: Props) => Record<string, unknown>;\n  readonly updateForm?: (props: Props) => Record<string, unknown>;\n  readonly matches: (attributes: Attributes, props: Props) => boolean;\n  /**\n   * When the stable key is not enough for the wire path — org labels are addressed by numeric id.\n   * `locate` lists or searches; `wirePath` builds update/delete paths from the live row.\n   */\n  readonly locate?: (\n    props: Props,\n  ) => Effect.Effect<Record<string, unknown> | undefined, ForgejoError, ForgejoRequirements>;\n  readonly wirePath?: (props: Props, live: Record<string, unknown>) => string;\n  /**\n   * When create is PUT upsert rather than POST — org actions secrets have no POST and no GET-by-name.\n   * `before === undefined` means absent; the callback decides whether to write. Existence-only families\n   * noop when `before` is set because the API never returns the value for comparison.\n   */\n  readonly upsert?: (\n    props: Props,\n    before: Record<string, unknown> | undefined,\n  ) => Effect.Effect<void, ForgejoError, ForgejoRequirements>;\n};\n\n/** ⚠️ Only 404 folds to \"absent\". A 403 is a real failure — folding it would plan a create over an existing object. */\nconst absentOn404 = <A>(io: Effect.Effect<A, ForgejoError, ForgejoRequirements>) =>\n  io.pipe(\n    Effect.catchIf(\n      (cause): cause is ForgejoError => cause instanceof ForgejoError && cause.status === 404,\n      () => Effect.succeed(undefined as A),\n    ),\n  );\n\nexport const forgejoOperations = <Props extends object, Attributes>(\n  spec: ForgejoSpec<Props, Attributes>,\n) => {\n  const fetchLive = (props: Props) =>\n    absentOn404(\n      spec.locate !== undefined\n        ? spec.locate(props)\n        : forgejo<Record<string, unknown>>('GET', spec.path(props)),\n    );\n\n  const objectPath = (props: Props, live: Record<string, unknown>) =>\n    spec.wirePath === undefined ? spec.path(props) : spec.wirePath(props, live);\n\n  const read = (props: Props) =>\n    fetchLive(props).pipe(\n      Effect.map((data) => (data === undefined ? undefined : spec.attributes(data, props))),\n    );\n\n  return {\n    read,\n\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        if (output === undefined || !isResolved(news)) return undefined;\n        const live = yield* read(news);\n        if (live === undefined) return { action: 'update' } as const;\n        if (spec.matches(live, news)) return { action: 'noop' } as const;\n        return spec.updateForm === undefined\n          ? ({ action: 'replace' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const before = yield* fetchLive(news);\n        if (spec.upsert !== undefined) {\n          yield* spec.upsert(news, before);\n        } else if (before === undefined) {\n          yield* forgejo('POST', spec.collection(news), spec.createForm(news));\n        } else if (spec.updateForm !== undefined) {\n          const mapped = spec.attributes(before, news);\n          if (mapped === undefined || spec.matches(mapped, news)) {\n            /* adoption or already converged — no PATCH */\n          } else {\n            const form = spec.updateForm(news);\n            if (Object.keys(form).length > 0) {\n              yield* forgejo('PATCH', objectPath(news, before), form);\n            }\n          }\n        }\n        const after = yield* read(news);\n        if (after === undefined) {\n          return yield* Effect.die(\n            new Error(\n              `${spec.path(news)}: the write returned no error but the object is still absent. ` +\n                'Gitea returns the object directly — read back rather than trusting the status code.',\n            ),\n          );\n        }\n        return after;\n      }),\n\n    destroy: (olds: Props) =>\n      Effect.gen(function* () {\n        const live = yield* fetchLive(olds);\n        if (live === undefined) return;\n        yield* forgejo('DELETE', objectPath(olds, live));\n      }),\n  };\n};\n\n/**\n * The five provider handlers for a spec'd Forgejo object, wired once.\n *\n * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER — same reasoning as pveHandlers in\n *   <estate>/proxmox: wrapping `Provider.effect` here needs casts against Alchemy's `Props<R>`.\n *\n * ⚠️ `list` answers empty — Forgejo index endpoints return the whole org; adoption stays explicit.\n */\nexport const forgejoHandlers = <Props extends object, Attributes extends object>(\n  spec: ForgejoSpec<Props, Attributes>,\n) => {\n  const ops = forgejoOperations(spec);\n  return {\n    list: () => Effect.succeed([]),\n    read: ({ olds }: { olds: Props }) => ops.read(olds),\n    diff: ({ news, output }: { news: Input<Props>; output: Attributes | undefined }) =>\n      ops.diff(news, output),\n    reconcile: ({ news }: { news: Props }) => ops.reconcile(news),\n    delete: ({ olds }: { olds: Props }) => ops.destroy(olds),\n  };\n};\n",
+    "/**\n * One authenticated call to the Forgejo (Gitea) API at `/api/v1`.\n *\n * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH — your Forgejo host serves a real certificate on :443,\n *   and the local daemon on :3000 is loopback. There is no `rejectUnauthorized` switch to leave\n *   on by accident elsewhere.\n *\n * ⚠️ GITEA DOES NOT WRAP ANSWERS IN `{\"data\": ...}` THE WAY PVE DOES. MEASURED 2026-09-13 on\n *   the live daemon: `GET /api/v1/version` returns `{\"version\":\"16.0.3\"}`; `GET /api/v1/user`\n *   returns the user object; `GET /api/v1/orgs/HomeFlare/repos` returns a JSON array. A caller\n *   that unwraps a non-existent envelope sees `undefined` and calls a healthy object \"absent\".\n *\n * ⛔ THE TOKEN IS NEVER A PROP. Read `FORGEJO_TOKEN` from the environment at call time only.\n *   Alchemy persists attributes unencrypted and this estate's state store is Postgres dumped\n *   nightly — nothing stored may be a credential.\n */\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\n\nconst PATH_PREFIX = '/api/v1';\n\n/**\n * The Forgejo instance, from `FORGEJO_URL`. Trailing slash stripped.\n *\n * ⛔ NO DEFAULT HOSTNAME. This used to fall back to the author's own instance, which is\n *   fine inside one estate and wrong in a published package: a consumer who forgets the\n *   variable would silently point at someone else's server rather than being told.\n * ⚠️ Read at CALL time, never at module scope — a value captured at import is pinned to\n *   whatever the first isolate saw.\n */\nexport const apiBase = (): string => {\n  const raw = process.env['FORGEJO_URL'];\n  if (raw === undefined || raw.trim() === '') {\n    throw new Error(\n      'FORGEJO_URL is not set. Point it at your Forgejo instance, e.g. https://git.example.com',\n    );\n  }\n  return raw.trim().replace(/\\/$/, '');\n};\n\nconst token = (): Effect.Effect<string, ForgejoError> =>\n  Effect.gen(function* () {\n    const raw = process.env['FORGEJO_TOKEN'];\n    if (raw === undefined || raw.trim() === '') {\n      return yield* Effect.fail(\n        new ForgejoError(\n          0,\n          'GET',\n          '',\n          'FORGEJO_TOKEN is unset. Mint a scoped token and export it — never store it in Alchemy props.',\n        ),\n      );\n    }\n    return raw.trim();\n  });\n\nexport class ForgejoError extends Error {\n  constructor(\n    readonly status: number,\n    readonly method: string,\n    readonly path: string,\n    detail: string,\n  ) {\n    super(`Forgejo ${method} ${path} -> ${String(status)}: ${detail}`);\n    this.name = 'ForgejoError';\n  }\n}\n\n/**\n * ⚠️ `Authorization: token <value>`, NOT `Bearer`. Gitea docs and MEASURED behaviour on this\n *   estate: Bearer is treated as OAuth2 and rejected; `token` is the documented API-key form.\n */\nconst authorization = (value: string) => ({ Authorization: `token ${value}` });\n\n/** One JSON call. Returns the parsed body, or `undefined` when the response is empty (DELETE). */\nexport const forgejo = <T>(\n  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',\n  path: string,\n  body?: Record<string, unknown>,\n) =>\n  Effect.gen(function* () {\n    const credential = yield* token();\n    const url = `${apiBase()}${PATH_PREFIX}/${path.replace(/^\\//, '')}`;\n    /**\n     * ★ THROUGH `HttpClient`, NOT THE GLOBAL `fetch` — the idiom Alchemy's own providers follow\n     *   (src/Hetzner/Providers.ts builds on `FetchHttpClient.layer`; there is no bare fetch in its\n     *   Docker, Kubernetes or GitHub providers). It buys a typed error channel, interruption when\n     *   a plan is cancelled, the runtime's tracing, and a client a test can replace without\n     *   monkey-patching a global. <estate>/proxmox/src/resource.ts carries the same note.\n     */\n    const client = yield* HttpClient.HttpClient;\n    /**\n     * ⛔ THE CONTENT TYPE GOES ON `bodyText`, NOT IN THE HEADER MAP, AND PUTTING IT IN BOTH IS HOW\n     *   THIS PACKAGE SHIPPED UNABLE TO WRITE AT ALL.\n     *\n     * 🔴 THE BUG, MEASURED THE FIRST TIME A WRITE WAS EVER ATTEMPTED. The header map DID carry\n     *   `Content-Type: application/json` — and `bodyText(s)` with no second argument sets\n     *   `text/plain` and OVERWRITES it, because it is piped AFTER `setHeaders`. Forgejo answered\n     *       422 {\"message\":\"[]: Unsupported Content-Type\"}\n     *   on `PATCH orgs/homeflare/labels/1`. Every create and every update in every family here was\n     *   broken, identically, from the day the client was written.\n     *\n     * ⛔ NOTHING CAUGHT IT BECAUSE NOTHING HAD EVER WRITTEN. The only credential on the shelf was\n     *   `mcp-read`, which answers 403 before a request body is ever parsed — so read, adopt, diff\n     *   and plan all worked perfectly and the write path had literally never executed. A provider\n     *   that has never performed its own writes is not a tested provider, whatever the plan says.\n     *\n     * ⚠️ `bodyJsonUnsafe` WOULD ALSO WORK. `bodyText` with an explicit type is used instead\n     *   because it makes the content type visible at the call site, which is the thing that was\n     *   invisible before.\n     */\n    const request = HttpClientRequest.make(method)(url).pipe(\n      HttpClientRequest.setHeaders({ ...authorization(credential), Accept: 'application/json' }),\n      body === undefined\n        ? (self) => self\n        : HttpClientRequest.bodyText(JSON.stringify(body), 'application/json'),\n    );\n    const response = yield* client\n      .execute(request)\n      .pipe(Effect.mapError((cause) => new ForgejoError(0, method, path, String(cause))));\n    // ⛔ Status first, body once — a Gitea error body is JSON but a proxy's 502 is not.\n    if (response.status < 200 || response.status >= 300) {\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(\n        new ForgejoError(response.status, method, path, detail.slice(0, 300)),\n      );\n    }\n    // ⚠️ 204 AND AN EMPTY BODY ARE REAL: a label DELETE answers no content, and `json` on an empty\n    //   body fails. Read text once and parse only when there is something to parse.\n    const text = yield* response.text.pipe(\n      Effect.mapError((cause) => new ForgejoError(0, method, path, String(cause))),\n    );\n    // ⚠️ PUT/DELETE on actions secrets and hooks often answer 201/204 with no body — same trap as DELETE.\n    return (text === '' ? undefined : JSON.parse(text)) as T;\n  });\n",
     "/**\n * Wire coercions shared across Forgejo resources.\n *\n * ★ GITEA/ FORGEJO JSON USES snake_case ON THE WIRE and camelCase in props — each resource\n *   translates at the form boundary; these helpers only normalise values for comparison.\n */\n\nexport const text = (value: unknown, fallback = '') =>\n  typeof value === 'string' ? value : fallback;\n\n/** Forgejo returns label colours without `#`; declarations may include it. */\nexport const color = (value: unknown) => text(value).replace(/^#/, '').toLowerCase();\n\nexport const bool = (value: unknown, fallback = false) =>\n  value === undefined || value === null ? fallback : value === true || value === 1 || value === '1';\n\nexport const int = (value: unknown, fallback = 0) => {\n  if (typeof value === 'number' && Number.isFinite(value)) return Math.trunc(value);\n  if (typeof value === 'string' && value.trim() !== '') {\n    const parsed = Number.parseInt(value, 10);\n    if (Number.isFinite(parsed)) return parsed;\n  }\n  return fallback;\n};\n\n/** Wire arrays compared in sorted order — Gitea reshuffles nothing but callers should not depend on order. */\nexport const stringArray = (value: unknown) =>\n  Array.isArray(value)\n    ? value.filter((entry): entry is string => typeof entry === 'string').toSorted()\n    : [];\n\nexport const stringRecord = (value: unknown): Record<string, string> => {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return {};\n  const out: Record<string, string> = {};\n  for (const [key, entry] of Object.entries(value)) {\n    if (typeof entry === 'string') out[key] = entry;\n  }\n  return out;\n};\n\nexport const recordEqual = (left: Record<string, string>, right: Record<string, string>) => {\n  const leftKeys = Object.keys(left).toSorted();\n  const rightKeys = Object.keys(right).toSorted();\n  if (leftKeys.length !== rightKeys.length) return false;\n  return leftKeys.every((key, index) => rightKeys[index] === key && left[key] === right[key]);\n};\n\n/** Hook `config` without `secret` — the value must never land in Alchemy attributes. */\nexport const hookConfigPublic = (value: unknown) => {\n  const config = stringRecord(value);\n  const { secret: _secret, ...rest } = config;\n  return rest;\n};\n\n/** Env key for a write-only org actions secret — value read at PUT time only, never stored. */\nexport const orgSecretEnvKey = (org: string, name: string) =>\n  `FORGEJO_ORG_SECRET_${org}_${name}`.replace(/[^A-Za-z0-9_]/g, '_').toUpperCase();\n\n/** Env key for a write-only repo webhook HMAC secret — omitted from attributes and props. */\nexport const hookSecretEnvKey = (owner: string, repo: string, name: string) =>\n  `FORGEJO_HOOK_SECRET_${owner}_${repo}_${name}`.replace(/[^A-Za-z0-9_]/g, '_').toUpperCase();\n",
-    "/**\n * `Forgejo.OrgSecret` — org-level Actions secret metadata at `/orgs/{org}/actions/secrets/{name}`.\n *\n * ★ CHOICE: AUTHORED WITH WRITE-ONLY VALUE VIA ENV, NOT REFUSED. The OpenAPI in\n *   `house/mcp-servers/docs/api/upstream/forgejo.json` shows `Secret` returns only `name` and\n *   `created_at` — never the `data` field — so attributes stay metadata-only. Create/update is PUT\n *   with body `{ data }`, which does not fit POST/PATCH; this family uses the `upsert` seam on\n *   `ForgejoSpec` instead of hand-rolling provider handlers.\n *\n * ⛔ THE SECRET VALUE IS NEVER A PROP OR AN ATTRIBUTE. It is read from `FORGEJO_ORG_SECRET_{org}_{name}`\n *   (see orgSecretEnvKey) at PUT time when the name is absent from the list. Once present, reconcile\n *   noops — the API cannot confirm the value matches, and re-PUT on every deploy would rotate\n *   unintentionally. Rotate by destroy-then-create or a manual PUT outside Alchemy.\n *\n * ⚠️ PUT ANSWERS 201/204 WITH NO BODY — client.ts treats empty responses as `undefined`; read-back\n *   uses the list endpoint, not the PUT response.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO PUT — list needs `read:organization`.\n *\n * ⛔ THE FILE NAME IS PLURAL ON PURPOSE AND MUST STAY THAT WAY. `.gitignore:198` carries\n *   `*-secret.*` — the rule that stops `client-secret.json` and friends being committed — and it\n *   matches a SOURCE file called `org-secret.ts` just as happily. This family was first authored\n *   under that name: it existed on disk, typechecked, passed oxlint, was imported by alchemy.run.ts\n *   and appeared in NO `git status`. It would have been committed as a broken import for everyone\n *   else, with the local tree green the whole time. `scripts/husky/ignored-imports.ts` is the gate\n *   that now catches the class; this comment is for whoever is tempted to rename it back.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { ForgejoError, forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { orgSecretEnvKey, text } from './values.ts';\n\nexport interface OrgSecretProps {\n  org: string;\n  /** Secret name — path key; value lives in env, not here. */\n  name: string;\n}\n\nexport interface OrgSecretAttributes {\n  org: string;\n  name: string;\n  createdAt: string;\n}\n\nexport interface ForgejoOrgSecret extends Resource<\n  'Forgejo.OrgSecret',\n  OrgSecretProps,\n  OrgSecretAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgSecret = Resource<ForgejoOrgSecret>('Forgejo.OrgSecret');\n\nconst secretData = (org: string, name: string) =>\n  Effect.gen(function* () {\n    const key = orgSecretEnvKey(org, name);\n    const raw = process.env[key];\n    if (raw === undefined || raw.trim() === '') {\n      return yield* Effect.fail(\n        new ForgejoError(\n          0,\n          'PUT',\n          `orgs/${org}/actions/secrets/${name}`,\n          `${key} is unset. Export the secret value there — never as an Alchemy prop.`,\n        ),\n      );\n    }\n    return raw.trim();\n  });\n\nconst handlers = forgejoHandlers<OrgSecretProps, OrgSecretAttributes>({\n  attributes: (live, props) => ({\n    createdAt: text(live['created_at']),\n    name: props.name,\n    org: props.org,\n  }),\n  collection: (props) => `orgs/${props.org}/actions/secrets/${props.name}`,\n  createForm: () => ({}),\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>('GET', `orgs/${props.org}/actions/secrets?limit=200`).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows) ? rows.find((row) => row['name'] === props.name) : undefined,\n      ),\n    ),\n  matches: () => true,\n  path: (props) => `orgs/${props.org}/actions/secrets/${props.name}`,\n  upsert: (props, before) =>\n    Effect.gen(function* () {\n      if (before !== undefined) return;\n      const data = yield* secretData(props.org, props.name);\n      yield* forgejo('PUT', `orgs/${props.org}/actions/secrets/${props.name}`, { data });\n    }),\n});\n\nexport const ForgejoOrgSecretProvider = () =>\n  Provider.effect(ForgejoOrgSecret, Effect.succeed(ForgejoOrgSecret.Provider.of(handlers)));\n",
-    "/**\n * `Forgejo.OrgLabel` — one org-level issue label shared across every repository in the org.\n *\n * ★ RETIRES `house/nix/homeflare-config/hosts/macmini/forgejo/labels-reconcile.sh`, which\n *   converged the whole `labels.yaml` file in one shot. That script CREATED and PATCHED labels\n *   from the spec and REPORTED `EXTRA` labels present live but absent from the file — it never\n *   deleted them, because removing a label strips it from every issue that carries it.\n *\n * ★ THIS RESOURCE DOES NOT REMOVE EXTRA LABELS EITHER. Alchemy manages only labels you declare;\n *   labels on the org that nobody declared stay untouched — the same boundary as the script's\n *   `EXTRA … NOT deleted` lines. Removing a declaration defaults to `retain`, so dropping a label\n *   from the stack does not DELETE it unless the caller opts into `.pipe(RemovalPolicy.destroy())`.\n *   That matches the script's never-delete posture while still allowing a deliberate destroy.\n *\n * ⚠️ THE WIRE PATH USES NUMERIC ID, NOT NAME — measured on live org labels: PATCH and DELETE are\n *   `/orgs/{org}/labels/{id}`. `locate` lists by name; `wirePath` uses the id from that row.\n *\n * ⛔ TOKEN NEEDS `write:organization` FOR RECONCILE — the mcp-read token lacks it (POST 403\n *   measured 2026-09-13). Plan/deploy needs a provision-scoped credential in `FORGEJO_TOKEN`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, color, text } from './values.ts';\n\nexport interface OrgLabelProps {\n  /** Organization login — `homeflare` / `HomeFlare` must match the live org. */\n  org: string;\n  /** Label name — primary key for locate; immutable on update. */\n  name: string;\n  /** Six-digit hex, with or without `#`. */\n  color: string;\n  description?: string;\n  exclusive?: boolean;\n}\n\nexport interface OrgLabelAttributes {\n  org: string;\n  name: string;\n  labelId: number;\n  color: string;\n  description: string;\n  exclusive: boolean;\n}\n\nexport interface ForgejoOrgLabel extends Resource<\n  'Forgejo.OrgLabel',\n  OrgLabelProps,\n  OrgLabelAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgLabel = Resource<ForgejoOrgLabel>('Forgejo.OrgLabel', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst handlers = forgejoHandlers<OrgLabelProps, OrgLabelAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    return {\n      color: color(live['color']),\n      description: text(live['description']),\n      exclusive: bool(live['exclusive']),\n      labelId: id,\n      name: props.name,\n      org: props.org,\n    };\n  },\n  collection: (props) => `orgs/${props.org}/labels`,\n  createForm: (props) => ({\n    color: color(props.color),\n    description: props.description ?? '',\n    exclusive: props.exclusive ?? false,\n    name: props.name,\n  }),\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>('GET', `orgs/${props.org}/labels?limit=200`).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows) ? rows.find((row) => row['name'] === props.name) : undefined,\n      ),\n    ),\n  matches: (attributes, props) =>\n    attributes.color === color(props.color) &&\n    attributes.description === (props.description ?? '') &&\n    attributes.exclusive === (props.exclusive ?? false),\n  path: (props) => `orgs/${props.org}/labels/${props.name}`,\n  updateForm: (props) => ({\n    color: color(props.color),\n    description: props.description ?? '',\n    exclusive: props.exclusive ?? false,\n  }),\n  wirePath: (props, live) => `orgs/${props.org}/labels/${String(live['id'])}`,\n});\n\nexport const ForgejoOrgLabelProvider = () =>\n  Provider.effect(ForgejoOrgLabel, Effect.succeed(ForgejoOrgLabel.Provider.of(handlers)));\n",
-    "/**\n * `Forgejo.OrgTeam` — one organization team under `/orgs/{org}/teams`.\n *\n * ★ READ OFF `house/mcp-servers/docs/api/upstream/forgejo.json` (Forgejo 16.x OpenAPI): create is\n *   `POST /orgs/{org}/teams`; read/update/delete use numeric id at `/teams/{id}` — not the name.\n *\n * ⚠️ PATCH AND DELETE USE `/teams/{id}` — same seam as org labels. `locate` lists by name;\n *   `wirePath` carries the id from that row.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO CREATE OR PATCH — read list/get needs `read:organization`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, recordEqual, stringArray, stringRecord, text } from './values.ts';\n\nexport type TeamPermission = 'read' | 'write' | 'admin';\n\nexport interface OrgTeamProps {\n  org: string;\n  /** Team name — primary locate key; sent on every PATCH body. */\n  name: string;\n  description?: string;\n  permission?: TeamPermission;\n  units?: string[];\n  unitsMap?: Record<string, string>;\n  includesAllRepositories?: boolean;\n  canCreateOrgRepo?: boolean;\n}\n\nexport interface OrgTeamAttributes {\n  org: string;\n  name: string;\n  teamId: number;\n  description: string;\n  permission: TeamPermission;\n  units: string[];\n  unitsMap: Record<string, string>;\n  includesAllRepositories: boolean;\n  canCreateOrgRepo: boolean;\n}\n\nexport interface ForgejoOrgTeam extends Resource<\n  'Forgejo.OrgTeam',\n  OrgTeamProps,\n  OrgTeamAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgTeam = Resource<ForgejoOrgTeam>('Forgejo.OrgTeam');\n\nconst teamForm = (props: OrgTeamProps) => ({\n  can_create_org_repo: props.canCreateOrgRepo ?? false,\n  description: props.description ?? '',\n  includes_all_repositories: props.includesAllRepositories ?? false,\n  name: props.name,\n  ...(props.permission === undefined ? {} : { permission: props.permission }),\n  ...(props.units === undefined ? {} : { units: props.units }),\n  ...(props.unitsMap === undefined ? {} : { units_map: props.unitsMap }),\n});\n\nconst handlers = forgejoHandlers<OrgTeamProps, OrgTeamAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    const permission = text(live['permission'], 'read');\n    if (permission !== 'read' && permission !== 'write' && permission !== 'admin') return undefined;\n    return {\n      canCreateOrgRepo: bool(live['can_create_org_repo']),\n      description: text(live['description']),\n      includesAllRepositories: bool(live['includes_all_repositories']),\n      name: props.name,\n      org: props.org,\n      permission,\n      teamId: id,\n      units: stringArray(live['units']),\n      unitsMap: stringRecord(live['units_map']),\n    };\n  },\n  collection: (props) => `orgs/${props.org}/teams`,\n  createForm: teamForm,\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>('GET', `orgs/${props.org}/teams?limit=200`).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows) ? rows.find((row) => row['name'] === props.name) : undefined,\n      ),\n    ),\n  matches: (attributes, props) =>\n    attributes.description === (props.description ?? '') &&\n    attributes.permission === (props.permission ?? 'read') &&\n    attributes.includesAllRepositories === (props.includesAllRepositories ?? false) &&\n    attributes.canCreateOrgRepo === (props.canCreateOrgRepo ?? false) &&\n    (props.units === undefined ||\n      stringArray(props.units).join('\\0') === attributes.units.join('\\0')) &&\n    (props.unitsMap === undefined || recordEqual(attributes.unitsMap, props.unitsMap)),\n  path: (props) => `orgs/${props.org}/teams/${props.name}`,\n  updateForm: teamForm,\n  wirePath: (_props, live) => `teams/${String(live['id'])}`,\n});\n\nexport const ForgejoOrgTeamProvider = () =>\n  Provider.effect(ForgejoOrgTeam, Effect.succeed(ForgejoOrgTeam.Provider.of(handlers)));\n",
-    "/**\n * `Forgejo.RepoWebhook` — one repository webhook under `/repos/{owner}/{repo}/hooks`.\n *\n * ★ READ OFF `house/mcp-servers/docs/api/upstream/forgejo.json`: create is POST collection; read/update/delete\n *   use numeric hook id at `/repos/{owner}/{repo}/hooks/{id}`. `locate` lists and matches on `name`.\n *\n * ⛔ NO WEBHOOK `secret` IN PROPS OR ATTRIBUTES. Optional HMAC material is env-only at write time\n *   (`FORGEJO_HOOK_SECRET_*` — see repo-webhook-form.ts). `hookConfigPublic` strips `secret` on read.\n *\n * ⛔ TOKEN NEEDS `write:repository` TO CREATE OR PATCH — list/get needs `read:repository`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { forgejo } from './client.ts';\nimport { createHookForm, hookUrl, updateHookForm } from './repo-webhook-form.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, hookConfigPublic, stringArray, text } from './values.ts';\n\nexport type RepoWebhookType =\n  | 'dingtalk'\n  | 'discord'\n  | 'feishu'\n  | 'forgejo'\n  | 'gitea'\n  | 'gogs'\n  | 'msteams'\n  | 'packagist'\n  | 'slack'\n  | 'telegram'\n  | 'wechatwork';\n\nexport interface RepoWebhookProps {\n  owner: string;\n  repo: string;\n  /** Stable locate key — also sent as Hook.name on create. */\n  name: string;\n  type: RepoWebhookType;\n  url: string;\n  events: string[];\n  contentType?: 'json' | 'form';\n  active?: boolean;\n  branchFilter?: string;\n  authorizationHeader?: string;\n}\n\nexport interface RepoWebhookAttributes {\n  owner: string;\n  repo: string;\n  name: string;\n  hookId: number;\n  type: RepoWebhookType;\n  url: string;\n  contentType: string;\n  events: string[];\n  active: boolean;\n  branchFilter: string;\n  authorizationHeader: string;\n}\n\nexport interface ForgejoRepoWebhook extends Resource<\n  'Forgejo.RepoWebhook',\n  RepoWebhookProps,\n  RepoWebhookAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoRepoWebhook = Resource<ForgejoRepoWebhook>('Forgejo.RepoWebhook');\n\nconst handlers = forgejoHandlers<RepoWebhookProps, RepoWebhookAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    const config = hookConfigPublic(live['config']);\n    const type = text(live['type']);\n    return {\n      active: bool(live['active'], true),\n      authorizationHeader: text(live['authorization_header']),\n      branchFilter: text(live['branch_filter']),\n      contentType: text(config['content_type'], text(live['content_type'], 'json')),\n      events: stringArray(live['events']),\n      hookId: id,\n      name: props.name,\n      owner: props.owner,\n      repo: props.repo,\n      type: type as RepoWebhookType,\n      url: hookUrl(live),\n    };\n  },\n  collection: (props) => `repos/${props.owner}/${props.repo}/hooks`,\n  createForm: createHookForm,\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>(\n      'GET',\n      `repos/${props.owner}/${props.repo}/hooks?limit=200`,\n    ).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows)\n          ? rows.find((row) => text(row['name']) === props.name || hookUrl(row) === props.url)\n          : undefined,\n      ),\n    ),\n  matches: (attributes, props) =>\n    attributes.type === props.type &&\n    attributes.url === props.url &&\n    attributes.active === (props.active ?? true) &&\n    attributes.contentType === (props.contentType ?? 'json') &&\n    attributes.branchFilter === (props.branchFilter ?? '') &&\n    attributes.authorizationHeader === (props.authorizationHeader ?? '') &&\n    stringArray(props.events).join('\\0') === attributes.events.join('\\0'),\n  path: (props) => `repos/${props.owner}/${props.repo}/hooks/${props.name}`,\n  updateForm: updateHookForm,\n  wirePath: (props, live) => `repos/${props.owner}/${props.repo}/hooks/${String(live['id'])}`,\n});\n\nexport const ForgejoRepoWebhookProvider = () =>\n  Provider.effect(ForgejoRepoWebhook, Effect.succeed(ForgejoRepoWebhook.Provider.of(handlers)));\n",
+    "/**\n * `Forgejo.OrgSecret` — org-level Actions secret metadata at `/orgs/{org}/actions/secrets/{name}`.\n *\n * ★ CHOICE: AUTHORED WITH WRITE-ONLY VALUE VIA ENV, NOT REFUSED. The OpenAPI in\n *   `<estate>/mcp-servers/docs/api/upstream/forgejo.json` shows `Secret` returns only `name` and\n *   `created_at` — never the `data` field — so attributes stay metadata-only. Create/update is PUT\n *   with body `{ data }`, which does not fit POST/PATCH; this family uses the `upsert` seam on\n *   `ForgejoSpec` instead of hand-rolling provider handlers.\n *\n * ⛔ THE SECRET VALUE IS NEVER A PROP OR AN ATTRIBUTE. It is read from `FORGEJO_ORG_SECRET_{org}_{name}`\n *   (see orgSecretEnvKey) at PUT time when the name is absent from the list. Once present, reconcile\n *   noops — the API cannot confirm the value matches, and re-PUT on every deploy would rotate\n *   unintentionally. Rotate by destroy-then-create or a manual PUT outside Alchemy.\n *\n * ⚠️ PUT ANSWERS 201/204 WITH NO BODY — client.ts treats empty responses as `undefined`; read-back\n *   uses the list endpoint, not the PUT response.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO PUT — list needs `read:organization`.\n *\n * ⛔ THE FILE NAME IS PLURAL ON PURPOSE AND MUST STAY THAT WAY. `.gitignore:198` carries\n *   `*-secret.*` — the rule that stops `client-secret.json` and friends being committed — and it\n *   matches a SOURCE file called `org-secret.ts` just as happily. This family was first authored\n *   under that name: it existed on disk, typechecked, passed oxlint, was imported by alchemy.run.ts\n *   and appeared in NO `git status`. It would have been committed as a broken import for everyone\n *   else, with the local tree green the whole time. `scripts/husky/ignored-imports.ts` is the gate\n *   that now catches the class; this comment is for whoever is tempted to rename it back.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { ForgejoError, forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { orgSecretEnvKey, text } from './values.ts';\n\nexport interface OrgSecretProps {\n  org: string;\n  /** Secret name — path key; value lives in env, not here. */\n  name: string;\n}\n\nexport interface OrgSecretAttributes {\n  org: string;\n  name: string;\n  createdAt: string;\n}\n\nexport interface ForgejoOrgSecret extends Resource<\n  'Forgejo.OrgSecret',\n  OrgSecretProps,\n  OrgSecretAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgSecret = Resource<ForgejoOrgSecret>('Forgejo.OrgSecret');\n\nconst secretData = (org: string, name: string) =>\n  Effect.gen(function* () {\n    const key = orgSecretEnvKey(org, name);\n    const raw = process.env[key];\n    if (raw === undefined || raw.trim() === '') {\n      return yield* Effect.fail(\n        new ForgejoError(\n          0,\n          'PUT',\n          `orgs/${org}/actions/secrets/${name}`,\n          `${key} is unset. Export the secret value there — never as an Alchemy prop.`,\n        ),\n      );\n    }\n    return raw.trim();\n  });\n\nconst handlers = forgejoHandlers<OrgSecretProps, OrgSecretAttributes>({\n  attributes: (live, props) => ({\n    createdAt: text(live['created_at']),\n    name: props.name,\n    org: props.org,\n  }),\n  collection: (props) => `orgs/${props.org}/actions/secrets/${props.name}`,\n  createForm: () => ({}),\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>('GET', `orgs/${props.org}/actions/secrets?limit=200`).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows) ? rows.find((row) => row['name'] === props.name) : undefined,\n      ),\n    ),\n  matches: () => true,\n  path: (props) => `orgs/${props.org}/actions/secrets/${props.name}`,\n  upsert: (props, before) =>\n    Effect.gen(function* () {\n      if (before !== undefined) return;\n      const data = yield* secretData(props.org, props.name);\n      yield* forgejo('PUT', `orgs/${props.org}/actions/secrets/${props.name}`, { data });\n    }),\n});\n\nexport const ForgejoOrgSecretProvider = () =>\n  Provider.effect(ForgejoOrgSecret, Effect.succeed(ForgejoOrgSecret.Provider.of(handlers)));\n",
+    "/**\n * `Forgejo.OrgLabel` — one org-level issue label shared across every repository in the org.\n *\n * ★ RETIRES the estate's hand-run `labels-reconcile.sh`, which\n *   converged the whole `labels.yaml` file in one shot. That script CREATED and PATCHED labels\n *   from the spec and REPORTED `EXTRA` labels present live but absent from the file — it never\n *   deleted them, because removing a label strips it from every issue that carries it.\n *\n * ★ THIS RESOURCE DOES NOT REMOVE EXTRA LABELS EITHER. Alchemy manages only labels you declare;\n *   labels on the org that nobody declared stay untouched — the same boundary as the script's\n *   `EXTRA … NOT deleted` lines. Removing a declaration defaults to `retain`, so dropping a label\n *   from the stack does not DELETE it unless the caller opts into `.pipe(RemovalPolicy.destroy())`.\n *   That matches the script's never-delete posture while still allowing a deliberate destroy.\n *\n * ⚠️ THE WIRE PATH USES NUMERIC ID, NOT NAME — measured on live org labels: PATCH and DELETE are\n *   `/orgs/{org}/labels/{id}`. `locate` lists by name; `wirePath` uses the id from that row.\n *\n * ⛔ TOKEN NEEDS `write:organization` FOR RECONCILE — the mcp-read token lacks it (POST 403\n *   measured 2026-09-13). Plan/deploy needs a provision-scoped credential in `FORGEJO_TOKEN`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, color, text } from './values.ts';\n\nexport interface OrgLabelProps {\n  /** Organization login — `homeflare` / `HomeFlare` must match the live org. */\n  org: string;\n  /** Label name — primary key for locate; immutable on update. */\n  name: string;\n  /** Six-digit hex, with or without `#`. */\n  color: string;\n  description?: string;\n  exclusive?: boolean;\n}\n\nexport interface OrgLabelAttributes {\n  org: string;\n  name: string;\n  labelId: number;\n  color: string;\n  description: string;\n  exclusive: boolean;\n}\n\nexport interface ForgejoOrgLabel extends Resource<\n  'Forgejo.OrgLabel',\n  OrgLabelProps,\n  OrgLabelAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgLabel = Resource<ForgejoOrgLabel>('Forgejo.OrgLabel', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst handlers = forgejoHandlers<OrgLabelProps, OrgLabelAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    return {\n      color: color(live['color']),\n      description: text(live['description']),\n      exclusive: bool(live['exclusive']),\n      labelId: id,\n      name: props.name,\n      org: props.org,\n    };\n  },\n  collection: (props) => `orgs/${props.org}/labels`,\n  createForm: (props) => ({\n    color: color(props.color),\n    description: props.description ?? '',\n    exclusive: props.exclusive ?? false,\n    name: props.name,\n  }),\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>('GET', `orgs/${props.org}/labels?limit=200`).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows) ? rows.find((row) => row['name'] === props.name) : undefined,\n      ),\n    ),\n  matches: (attributes, props) =>\n    attributes.color === color(props.color) &&\n    attributes.description === (props.description ?? '') &&\n    attributes.exclusive === (props.exclusive ?? false),\n  path: (props) => `orgs/${props.org}/labels/${props.name}`,\n  updateForm: (props) => ({\n    color: color(props.color),\n    description: props.description ?? '',\n    exclusive: props.exclusive ?? false,\n  }),\n  wirePath: (props, live) => `orgs/${props.org}/labels/${String(live['id'])}`,\n});\n\nexport const ForgejoOrgLabelProvider = () =>\n  Provider.effect(ForgejoOrgLabel, Effect.succeed(ForgejoOrgLabel.Provider.of(handlers)));\n",
+    "/**\n * `Forgejo.OrgTeam` — one organization team under `/orgs/{org}/teams`.\n *\n * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json` (Forgejo 16.x OpenAPI): create is\n *   `POST /orgs/{org}/teams`; read/update/delete use numeric id at `/teams/{id}` — not the name.\n *\n * ⚠️ PATCH AND DELETE USE `/teams/{id}` — same seam as org labels. `locate` lists by name;\n *   `wirePath` carries the id from that row.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO CREATE OR PATCH — read list/get needs `read:organization`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, recordEqual, stringArray, stringRecord, text } from './values.ts';\n\nexport type TeamPermission = 'read' | 'write' | 'admin';\n\nexport interface OrgTeamProps {\n  org: string;\n  /** Team name — primary locate key; sent on every PATCH body. */\n  name: string;\n  description?: string;\n  permission?: TeamPermission;\n  units?: string[];\n  unitsMap?: Record<string, string>;\n  includesAllRepositories?: boolean;\n  canCreateOrgRepo?: boolean;\n}\n\nexport interface OrgTeamAttributes {\n  org: string;\n  name: string;\n  teamId: number;\n  description: string;\n  permission: TeamPermission;\n  units: string[];\n  unitsMap: Record<string, string>;\n  includesAllRepositories: boolean;\n  canCreateOrgRepo: boolean;\n}\n\nexport interface ForgejoOrgTeam extends Resource<\n  'Forgejo.OrgTeam',\n  OrgTeamProps,\n  OrgTeamAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgTeam = Resource<ForgejoOrgTeam>('Forgejo.OrgTeam');\n\nconst teamForm = (props: OrgTeamProps) => ({\n  can_create_org_repo: props.canCreateOrgRepo ?? false,\n  description: props.description ?? '',\n  includes_all_repositories: props.includesAllRepositories ?? false,\n  name: props.name,\n  ...(props.permission === undefined ? {} : { permission: props.permission }),\n  ...(props.units === undefined ? {} : { units: props.units }),\n  ...(props.unitsMap === undefined ? {} : { units_map: props.unitsMap }),\n});\n\nconst handlers = forgejoHandlers<OrgTeamProps, OrgTeamAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    const permission = text(live['permission'], 'read');\n    if (permission !== 'read' && permission !== 'write' && permission !== 'admin') return undefined;\n    return {\n      canCreateOrgRepo: bool(live['can_create_org_repo']),\n      description: text(live['description']),\n      includesAllRepositories: bool(live['includes_all_repositories']),\n      name: props.name,\n      org: props.org,\n      permission,\n      teamId: id,\n      units: stringArray(live['units']),\n      unitsMap: stringRecord(live['units_map']),\n    };\n  },\n  collection: (props) => `orgs/${props.org}/teams`,\n  createForm: teamForm,\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>('GET', `orgs/${props.org}/teams?limit=200`).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows) ? rows.find((row) => row['name'] === props.name) : undefined,\n      ),\n    ),\n  matches: (attributes, props) =>\n    attributes.description === (props.description ?? '') &&\n    attributes.permission === (props.permission ?? 'read') &&\n    attributes.includesAllRepositories === (props.includesAllRepositories ?? false) &&\n    attributes.canCreateOrgRepo === (props.canCreateOrgRepo ?? false) &&\n    (props.units === undefined ||\n      stringArray(props.units).join('\\0') === attributes.units.join('\\0')) &&\n    (props.unitsMap === undefined || recordEqual(attributes.unitsMap, props.unitsMap)),\n  path: (props) => `orgs/${props.org}/teams/${props.name}`,\n  updateForm: teamForm,\n  wirePath: (_props, live) => `teams/${String(live['id'])}`,\n});\n\nexport const ForgejoOrgTeamProvider = () =>\n  Provider.effect(ForgejoOrgTeam, Effect.succeed(ForgejoOrgTeam.Provider.of(handlers)));\n",
+    "/**\n * `Forgejo.RepoWebhook` — one repository webhook under `/repos/{owner}/{repo}/hooks`.\n *\n * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json`: create is POST collection; read/update/delete\n *   use numeric hook id at `/repos/{owner}/{repo}/hooks/{id}`. `locate` lists and matches on `name`.\n *\n * ⛔ NO WEBHOOK `secret` IN PROPS OR ATTRIBUTES. Optional HMAC material is env-only at write time\n *   (`FORGEJO_HOOK_SECRET_*` — see repo-webhook-form.ts). `hookConfigPublic` strips `secret` on read.\n *\n * ⛔ TOKEN NEEDS `write:repository` TO CREATE OR PATCH — list/get needs `read:repository`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { forgejo } from './client.ts';\nimport { createHookForm, hookUrl, updateHookForm } from './repo-webhook-form.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, hookConfigPublic, stringArray, text } from './values.ts';\n\nexport type RepoWebhookType =\n  | 'dingtalk'\n  | 'discord'\n  | 'feishu'\n  | 'forgejo'\n  | 'gitea'\n  | 'gogs'\n  | 'msteams'\n  | 'packagist'\n  | 'slack'\n  | 'telegram'\n  | 'wechatwork';\n\nexport interface RepoWebhookProps {\n  owner: string;\n  repo: string;\n  /** Stable locate key — also sent as Hook.name on create. */\n  name: string;\n  type: RepoWebhookType;\n  url: string;\n  events: string[];\n  contentType?: 'json' | 'form';\n  active?: boolean;\n  branchFilter?: string;\n  authorizationHeader?: string;\n}\n\nexport interface RepoWebhookAttributes {\n  owner: string;\n  repo: string;\n  name: string;\n  hookId: number;\n  type: RepoWebhookType;\n  url: string;\n  contentType: string;\n  events: string[];\n  active: boolean;\n  branchFilter: string;\n  authorizationHeader: string;\n}\n\nexport interface ForgejoRepoWebhook extends Resource<\n  'Forgejo.RepoWebhook',\n  RepoWebhookProps,\n  RepoWebhookAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoRepoWebhook = Resource<ForgejoRepoWebhook>('Forgejo.RepoWebhook');\n\nconst handlers = forgejoHandlers<RepoWebhookProps, RepoWebhookAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    const config = hookConfigPublic(live['config']);\n    const type = text(live['type']);\n    return {\n      active: bool(live['active'], true),\n      authorizationHeader: text(live['authorization_header']),\n      branchFilter: text(live['branch_filter']),\n      contentType: text(config['content_type'], text(live['content_type'], 'json')),\n      events: stringArray(live['events']),\n      hookId: id,\n      name: props.name,\n      owner: props.owner,\n      repo: props.repo,\n      type: type as RepoWebhookType,\n      url: hookUrl(live),\n    };\n  },\n  collection: (props) => `repos/${props.owner}/${props.repo}/hooks`,\n  createForm: createHookForm,\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>(\n      'GET',\n      `repos/${props.owner}/${props.repo}/hooks?limit=200`,\n    ).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows)\n          ? rows.find((row) => text(row['name']) === props.name || hookUrl(row) === props.url)\n          : undefined,\n      ),\n    ),\n  matches: (attributes, props) =>\n    attributes.type === props.type &&\n    attributes.url === props.url &&\n    attributes.active === (props.active ?? true) &&\n    attributes.contentType === (props.contentType ?? 'json') &&\n    attributes.branchFilter === (props.branchFilter ?? '') &&\n    attributes.authorizationHeader === (props.authorizationHeader ?? '') &&\n    stringArray(props.events).join('\\0') === attributes.events.join('\\0'),\n  path: (props) => `repos/${props.owner}/${props.repo}/hooks/${props.name}`,\n  updateForm: updateHookForm,\n  wirePath: (props, live) => `repos/${props.owner}/${props.repo}/hooks/${String(live['id'])}`,\n});\n\nexport const ForgejoRepoWebhookProvider = () =>\n  Provider.effect(ForgejoRepoWebhook, Effect.succeed(ForgejoRepoWebhook.Provider.of(handlers)));\n",
     "/**\n * JSON bodies for `Forgejo.RepoWebhook` — split to keep repo-webhook.ts under the line cap.\n *\n * ⛔ `config.secret` IS NEVER A PROP. When present it is read from `FORGEJO_HOOK_SECRET_*` at\n *   create/update time only (see hookSecretEnvKey in values.ts). Alchemy attributes are Postgres\n *   plaintext — a webhook HMAC secret must not be stored there.\n */\nimport type { RepoWebhookProps } from './repo-webhook.ts';\nimport { hookSecretEnvKey, stringRecord, text } from './values.ts';\n\nexport const hookUrl = (live: Record<string, unknown>) =>\n  text(live['url']) || text(stringRecord(live['config'])['url']);\n\nexport const hookConfigForm = (props: RepoWebhookProps, includeSecret: boolean) => {\n  const config: Record<string, string> = {\n    content_type: props.contentType ?? 'json',\n    url: props.url,\n  };\n  if (includeSecret) {\n    const key = hookSecretEnvKey(props.owner, props.repo, props.name);\n    const secret = process.env[key]?.trim();\n    if (secret !== undefined && secret !== '') config['secret'] = secret;\n  }\n  return config;\n};\n\nexport const createHookForm = (props: RepoWebhookProps) => ({\n  active: props.active ?? true,\n  ...(props.authorizationHeader === undefined\n    ? {}\n    : { authorization_header: props.authorizationHeader }),\n  ...(props.branchFilter === undefined ? {} : { branch_filter: props.branchFilter }),\n  config: hookConfigForm(props, true),\n  events: props.events,\n  name: props.name,\n  type: props.type,\n});\n\nexport const updateHookForm = (props: RepoWebhookProps) => ({\n  active: props.active ?? true,\n  ...(props.authorizationHeader === undefined\n    ? {}\n    : { authorization_header: props.authorizationHeader }),\n  ...(props.branchFilter === undefined ? {} : { branch_filter: props.branchFilter }),\n  config: hookConfigForm(props, false),\n  events: props.events,\n});\n",
-    "/**\n * `Forgejo.Repository` — an organization-owned git repository.\n *\n * ★ MEASURED 2026-09-13 against the live daemon (`GET /api/v1/repos/HomeFlare/homeflare-config`):\n *   responses are flat JSON with `private`, `has_issues`, `default_branch`, etc. Create is\n *   `POST /orgs/{org}/repos`; read/update/delete use `/repos/{owner}/{repo}`.\n *\n * ⛔ `defaultRemovalPolicy: 'retain'` — history, issues and packages in a repo are irreplaceable.\n *   Opt into deletion with `.pipe(RemovalPolicy.destroy())`; `delete` below is fully implemented.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, text } from './values.ts';\n\nexport interface RepositoryProps {\n  /** Organization login — the owner segment in `HomeFlare/homeflare-config`. */\n  org: string;\n  /** Repository name. Changing it is a replace, not an update. */\n  name: string;\n  description?: string;\n  private?: boolean;\n  hasIssues?: boolean;\n  hasWiki?: boolean;\n  hasProjects?: boolean;\n  /** Only applied when the repository already has at least one branch. */\n  defaultBranch?: string;\n  /** Create an initial commit with a README when the repository is new. */\n  autoInit?: boolean;\n}\n\nexport interface RepositoryAttributes {\n  org: string;\n  name: string;\n  repoId: number;\n  description: string;\n  private: boolean;\n  hasIssues: boolean;\n  hasWiki: boolean;\n  hasProjects: boolean;\n  defaultBranch: string;\n  empty: boolean;\n}\n\nexport interface ForgejoRepository extends Resource<\n  'Forgejo.Repository',\n  RepositoryProps,\n  RepositoryAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoRepository = Resource<ForgejoRepository>('Forgejo.Repository', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst handlers = forgejoHandlers<RepositoryProps, RepositoryAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    return {\n      defaultBranch: text(live['default_branch'], 'main'),\n      description: text(live['description']),\n      empty: bool(live['empty']),\n      hasIssues: bool(live['has_issues'], true),\n      hasProjects: bool(live['has_projects'], true),\n      hasWiki: bool(live['has_wiki'], true),\n      name: props.name,\n      org: props.org,\n      private: bool(live['private'], true),\n      repoId: id,\n    };\n  },\n  collection: (props) => `orgs/${props.org}/repos`,\n  createForm: (props) => ({\n    auto_init: props.autoInit ?? false,\n    description: props.description ?? '',\n    has_issues: props.hasIssues ?? true,\n    has_projects: props.hasProjects ?? true,\n    has_wiki: props.hasWiki ?? true,\n    name: props.name,\n    private: props.private ?? true,\n  }),\n  /**\n   * ⛔ AN UNDECLARED FIELD IS NEITHER COMPARED NOR SENT — the rule every other family in this\n   *   estate follows (storage.ts, backup-job.ts, and all four Pbs.* families say it in those\n   *   words), and this file was the exception.\n   *\n   * 🔴 WHAT THE EXCEPTION DID. Five fields were compared against a DEFAULT rather than skipped:\n   *   `description ?? ''`, and `?? true` for private, hasIssues, hasWiki and hasProjects. So a\n   *   declaration that simply did not mention `hasWiki` asserted \"the wiki is ON\", and one that\n   *   did not mention `description` asserted \"the description is EMPTY\" — and `updateForm` sent\n   *   both. Declaring a repo you only wanted to rename would have wiped its description and\n   *   switched features on, reported as a plain `update`. Only `defaultBranch` was written\n   *   correctly, on the line below, which is what the other five now copy.\n   *\n   * ⚠️ THE PRICE, STATED: dropping a line no longer resets a field. Clear one out of band in the\n   *   Forgejo UI or with a direct PATCH. It costs no forever-diff, because an undeclared field is\n   *   not compared either.\n   *\n   * ⚠️ `private` IS THE ONE WORTH DECLARING ANYWAY ON EVERY REPO. Leaving it undeclared now means\n   *   Alchemy will not notice a repository being made public. That is the correct trade for a\n   *   generic family — undeclared is unmanaged, not assumed — but it is a real gap, so say it\n   *   explicitly in each declaration rather than relying on a default that no longer exists.\n   */\n  matches: (attributes, props) =>\n    (props.description === undefined || attributes.description === props.description) &&\n    (props.private === undefined || attributes.private === props.private) &&\n    (props.hasIssues === undefined || attributes.hasIssues === props.hasIssues) &&\n    (props.hasWiki === undefined || attributes.hasWiki === props.hasWiki) &&\n    (props.hasProjects === undefined || attributes.hasProjects === props.hasProjects) &&\n    (props.defaultBranch === undefined || attributes.defaultBranch === props.defaultBranch),\n  path: (props) => `repos/${props.org}/${props.name}`,\n  updateForm: (props) => ({\n    ...(props.defaultBranch === undefined ? {} : { default_branch: props.defaultBranch }),\n    ...(props.description === undefined ? {} : { description: props.description }),\n    ...(props.hasIssues === undefined ? {} : { has_issues: props.hasIssues }),\n    ...(props.hasProjects === undefined ? {} : { has_projects: props.hasProjects }),\n    ...(props.hasWiki === undefined ? {} : { has_wiki: props.hasWiki }),\n    ...(props.private === undefined ? {} : { private: props.private }),\n  }),\n});\n\nexport const ForgejoRepositoryProvider = () =>\n  Provider.effect(ForgejoRepository, Effect.succeed(ForgejoRepository.Provider.of(handlers)));\n",
-    "/**\n * `Forgejo.TeamMember` — one user in one organization team.\n *\n * ★ WHY IT EXISTS: forgejo-provision, the service account the Forgejo engine mints as, belongs to the\n *   HomeFlare Owners team — Tim, 2026-09-14. Membership is what its tokens can reach; the role's\n *   scopes only cap it (house/openbao/src/forgejo-bootstrap.ts).\n *\n * ★ READ OFF THE LIVE 16.0.3 SWAGGER (127.0.0.1:3000/swagger.v1.json, 2026-09-14): GET, PUT and\n *   DELETE `/teams/{id}/members/{username}` answer 200, 204 and 204, and 404 when absent. The team\n *   is addressed by numeric id, so it is found by name first — the same seam as org-team.ts.\n *\n * ⚠️ EXISTENCE IS THE WHOLE OBJECT. Nothing about a membership can be updated, so `matches` is\n *   always true; a different team or user is a different resource id in alchemy.run.ts.\n *\n * ⚠️ THE TEAM ITSELF IS ONLY LOCATED HERE, NEVER MANAGED. A missing team fails the plan by name\n *   instead of folding into \"absent\", because a PUT can add a member but cannot create a team.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO ADD OR REMOVE, and an identity allowed to manage the team.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { ForgejoError, forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\n\nexport interface TeamMemberProps {\n  org: string;\n  /** Team name as Forgejo shows it, e.g. `Owners`. */\n  team: string;\n  username: string;\n}\n\nexport interface TeamMemberAttributes {\n  org: string;\n  team: string;\n  teamId: number;\n  username: string;\n}\n\nexport interface ForgejoTeamMember extends Resource<\n  'Forgejo.TeamMember',\n  TeamMemberProps,\n  TeamMemberAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoTeamMember = Resource<ForgejoTeamMember>('Forgejo.TeamMember');\n\n/** Where `locate` leaves the team id on the live row, for `attributes` and `wirePath`. */\nconst TEAM_ID = '__team_id';\n\nconst teamIdOf = (props: TeamMemberProps) =>\n  Effect.gen(function* () {\n    const path = `orgs/${props.org}/teams?limit=200`;\n    const rows = yield* forgejo<Record<string, unknown>[]>('GET', path);\n    const id = (Array.isArray(rows) ? rows : []).find((row) => row['name'] === props.team)?.['id'];\n    if (typeof id !== 'number') {\n      return yield* Effect.fail(\n        new ForgejoError(0, 'GET', path, `no team named ${props.team} in org ${props.org}`),\n      );\n    }\n    return id;\n  });\n\nconst memberPath = (id: number, props: TeamMemberProps) =>\n  `teams/${String(id)}/members/${props.username}`;\n\nconst handlers = forgejoHandlers<TeamMemberProps, TeamMemberAttributes>({\n  attributes: (live, props) => {\n    const id = live[TEAM_ID];\n    const login = live['login'];\n    if (typeof id !== 'number' || typeof login !== 'string') return undefined;\n    if (login.toLowerCase() !== props.username.toLowerCase()) return undefined;\n    return { org: props.org, team: props.team, teamId: id, username: props.username };\n  },\n  collection: (props) => `orgs/${props.org}/teams`,\n  createForm: () => ({}),\n  locate: (props) =>\n    Effect.gen(function* () {\n      const id = yield* teamIdOf(props);\n      const user = yield* forgejo<Record<string, unknown>>('GET', memberPath(id, props));\n      return user === undefined ? undefined : { ...user, [TEAM_ID]: id };\n    }),\n  matches: () => true,\n  path: (props) => `orgs/${props.org}/teams/${props.team}/members/${props.username}`,\n  upsert: (props, before) =>\n    before !== undefined\n      ? Effect.void\n      : Effect.flatMap(teamIdOf(props), (id) =>\n          Effect.asVoid(forgejo('PUT', memberPath(id, props))),\n        ),\n  wirePath: (props, live) => memberPath(Number(live[TEAM_ID]), props),\n});\n\nexport const ForgejoTeamMemberProvider = () =>\n  Provider.effect(ForgejoTeamMember, Effect.succeed(ForgejoTeamMember.Provider.of(handlers)));\n"
+    "/**\n * `Forgejo.Repository` — an organization-owned git repository.\n *\n * ★ MEASURED 2026-09-13 against the live daemon (`GET /api/v1/repos/<org>/<repo>`):\n *   responses are flat JSON with `private`, `has_issues`, `default_branch`, etc. Create is\n *   `POST /orgs/{org}/repos`; read/update/delete use `/repos/{owner}/{repo}`.\n *\n * ⛔ `defaultRemovalPolicy: 'retain'` — history, issues and packages in a repo are irreplaceable.\n *   Opt into deletion with `.pipe(RemovalPolicy.destroy())`; `delete` below is fully implemented.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, text } from './values.ts';\n\nexport interface RepositoryProps {\n  /** Organization login — the owner segment in `<org>/<repo>`. */\n  org: string;\n  /** Repository name. Changing it is a replace, not an update. */\n  name: string;\n  description?: string;\n  private?: boolean;\n  hasIssues?: boolean;\n  hasWiki?: boolean;\n  hasProjects?: boolean;\n  /** Only applied when the repository already has at least one branch. */\n  defaultBranch?: string;\n  /** Create an initial commit with a README when the repository is new. */\n  autoInit?: boolean;\n}\n\nexport interface RepositoryAttributes {\n  org: string;\n  name: string;\n  repoId: number;\n  description: string;\n  private: boolean;\n  hasIssues: boolean;\n  hasWiki: boolean;\n  hasProjects: boolean;\n  defaultBranch: string;\n  empty: boolean;\n}\n\nexport interface ForgejoRepository extends Resource<\n  'Forgejo.Repository',\n  RepositoryProps,\n  RepositoryAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoRepository = Resource<ForgejoRepository>('Forgejo.Repository', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst handlers = forgejoHandlers<RepositoryProps, RepositoryAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    return {\n      defaultBranch: text(live['default_branch'], 'main'),\n      description: text(live['description']),\n      empty: bool(live['empty']),\n      hasIssues: bool(live['has_issues'], true),\n      hasProjects: bool(live['has_projects'], true),\n      hasWiki: bool(live['has_wiki'], true),\n      name: props.name,\n      org: props.org,\n      private: bool(live['private'], true),\n      repoId: id,\n    };\n  },\n  collection: (props) => `orgs/${props.org}/repos`,\n  createForm: (props) => ({\n    auto_init: props.autoInit ?? false,\n    description: props.description ?? '',\n    has_issues: props.hasIssues ?? true,\n    has_projects: props.hasProjects ?? true,\n    has_wiki: props.hasWiki ?? true,\n    name: props.name,\n    private: props.private ?? true,\n  }),\n  /**\n   * ⛔ AN UNDECLARED FIELD IS NEITHER COMPARED NOR SENT — the rule every other family in this\n   *   estate follows (storage.ts, backup-job.ts, and all four Pbs.* families say it in those\n   *   words), and this file was the exception.\n   *\n   * 🔴 WHAT THE EXCEPTION DID. Five fields were compared against a DEFAULT rather than skipped:\n   *   `description ?? ''`, and `?? true` for private, hasIssues, hasWiki and hasProjects. So a\n   *   declaration that simply did not mention `hasWiki` asserted \"the wiki is ON\", and one that\n   *   did not mention `description` asserted \"the description is EMPTY\" — and `updateForm` sent\n   *   both. Declaring a repo you only wanted to rename would have wiped its description and\n   *   switched features on, reported as a plain `update`. Only `defaultBranch` was written\n   *   correctly, on the line below, which is what the other five now copy.\n   *\n   * ⚠️ THE PRICE, STATED: dropping a line no longer resets a field. Clear one out of band in the\n   *   Forgejo UI or with a direct PATCH. It costs no forever-diff, because an undeclared field is\n   *   not compared either.\n   *\n   * ⚠️ `private` IS THE ONE WORTH DECLARING ANYWAY ON EVERY REPO. Leaving it undeclared now means\n   *   Alchemy will not notice a repository being made public. That is the correct trade for a\n   *   generic family — undeclared is unmanaged, not assumed — but it is a real gap, so say it\n   *   explicitly in each declaration rather than relying on a default that no longer exists.\n   */\n  matches: (attributes, props) =>\n    (props.description === undefined || attributes.description === props.description) &&\n    (props.private === undefined || attributes.private === props.private) &&\n    (props.hasIssues === undefined || attributes.hasIssues === props.hasIssues) &&\n    (props.hasWiki === undefined || attributes.hasWiki === props.hasWiki) &&\n    (props.hasProjects === undefined || attributes.hasProjects === props.hasProjects) &&\n    (props.defaultBranch === undefined || attributes.defaultBranch === props.defaultBranch),\n  path: (props) => `repos/${props.org}/${props.name}`,\n  updateForm: (props) => ({\n    ...(props.defaultBranch === undefined ? {} : { default_branch: props.defaultBranch }),\n    ...(props.description === undefined ? {} : { description: props.description }),\n    ...(props.hasIssues === undefined ? {} : { has_issues: props.hasIssues }),\n    ...(props.hasProjects === undefined ? {} : { has_projects: props.hasProjects }),\n    ...(props.hasWiki === undefined ? {} : { has_wiki: props.hasWiki }),\n    ...(props.private === undefined ? {} : { private: props.private }),\n  }),\n});\n\nexport const ForgejoRepositoryProvider = () =>\n  Provider.effect(ForgejoRepository, Effect.succeed(ForgejoRepository.Provider.of(handlers)));\n",
+    "/**\n * `Forgejo.TeamMember` — one user in one organization team.\n *\n * ★ WHY IT EXISTS: forgejo-provision, the service account the Forgejo engine mints as, belongs to the\n *   HomeFlare Owners team — Tim, 2026-09-14. Membership is what its tokens can reach; the role's\n *   scopes only cap it (<estate>/openbao/src/forgejo-bootstrap.ts).\n *\n * ★ READ OFF THE LIVE 16.0.3 SWAGGER (127.0.0.1:3000/swagger.v1.json, 2026-09-14): GET, PUT and\n *   DELETE `/teams/{id}/members/{username}` answer 200, 204 and 204, and 404 when absent. The team\n *   is addressed by numeric id, so it is found by name first — the same seam as org-team.ts.\n *\n * ⚠️ EXISTENCE IS THE WHOLE OBJECT. Nothing about a membership can be updated, so `matches` is\n *   always true; a different team or user is a different resource id in alchemy.run.ts.\n *\n * ⚠️ THE TEAM ITSELF IS ONLY LOCATED HERE, NEVER MANAGED. A missing team fails the plan by name\n *   instead of folding into \"absent\", because a PUT can add a member but cannot create a team.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO ADD OR REMOVE, and an identity allowed to manage the team.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { ForgejoError, forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\n\nexport interface TeamMemberProps {\n  org: string;\n  /** Team name as Forgejo shows it, e.g. `Owners`. */\n  team: string;\n  username: string;\n}\n\nexport interface TeamMemberAttributes {\n  org: string;\n  team: string;\n  teamId: number;\n  username: string;\n}\n\nexport interface ForgejoTeamMember extends Resource<\n  'Forgejo.TeamMember',\n  TeamMemberProps,\n  TeamMemberAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoTeamMember = Resource<ForgejoTeamMember>('Forgejo.TeamMember');\n\n/** Where `locate` leaves the team id on the live row, for `attributes` and `wirePath`. */\nconst TEAM_ID = '__team_id';\n\nconst teamIdOf = (props: TeamMemberProps) =>\n  Effect.gen(function* () {\n    const path = `orgs/${props.org}/teams?limit=200`;\n    const rows = yield* forgejo<Record<string, unknown>[]>('GET', path);\n    const id = (Array.isArray(rows) ? rows : []).find((row) => row['name'] === props.team)?.['id'];\n    if (typeof id !== 'number') {\n      return yield* Effect.fail(\n        new ForgejoError(0, 'GET', path, `no team named ${props.team} in org ${props.org}`),\n      );\n    }\n    return id;\n  });\n\nconst memberPath = (id: number, props: TeamMemberProps) =>\n  `teams/${String(id)}/members/${props.username}`;\n\nconst handlers = forgejoHandlers<TeamMemberProps, TeamMemberAttributes>({\n  attributes: (live, props) => {\n    const id = live[TEAM_ID];\n    const login = live['login'];\n    if (typeof id !== 'number' || typeof login !== 'string') return undefined;\n    if (login.toLowerCase() !== props.username.toLowerCase()) return undefined;\n    return { org: props.org, team: props.team, teamId: id, username: props.username };\n  },\n  collection: (props) => `orgs/${props.org}/teams`,\n  createForm: () => ({}),\n  locate: (props) =>\n    Effect.gen(function* () {\n      const id = yield* teamIdOf(props);\n      const user = yield* forgejo<Record<string, unknown>>('GET', memberPath(id, props));\n      return user === undefined ? undefined : { ...user, [TEAM_ID]: id };\n    }),\n  matches: () => true,\n  path: (props) => `orgs/${props.org}/teams/${props.team}/members/${props.username}`,\n  upsert: (props, before) =>\n    before !== undefined\n      ? Effect.void\n      : Effect.flatMap(teamIdOf(props), (id) =>\n          Effect.asVoid(forgejo('PUT', memberPath(id, props))),\n        ),\n  wirePath: (props, live) => memberPath(Number(live[TEAM_ID]), props),\n});\n\nexport const ForgejoTeamMemberProvider = () =>\n  Provider.effect(ForgejoTeamMember, Effect.succeed(ForgejoTeamMember.Provider.of(handlers)));\n"
   ],
   "mappings": ";AAYA;AACA;AACA;;;ACNO,IAAM,uBAAuB,CAAC,WAAkC;AAAA,KACjE,MAAM,kBAAkB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,cAAc;AAAA,KAChF,MAAM,0BAA0B,YAChC,CAAC,IACD,EAAE,yBAAyB,MAAM,sBAAsB;AAAA,KACvD,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,WAAW;AAAA,KACtE,MAAM,sBAAsB,YAC5B,CAAC,IACD,EAAE,qBAAqB,MAAM,kBAAkB;AAAA,KAC/C,MAAM,yBAAyB,YAC/B,CAAC,IACD,EAAE,wBAAwB,MAAM,qBAAqB;AAAA,KACrD,MAAM,yBAAyB,YAC/B,CAAC,IACD,EAAE,wBAAwB,MAAM,qBAAqB;AAAA,KACrD,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,oBAAoB,MAAM,kBAAkB;AAAA,KAC3F,MAAM,wBAAwB,YAC9B,CAAC,IACD,EAAE,uBAAuB,MAAM,oBAAoB;AAAA,EACvD,WAAW,MAAM;AACnB;;;ACPA;AAEA;;;ACPA;AACA;AACA;AAEA,IAAM,cAAc;AAWb,IAAM,UAAU,MAAc;AAAA,EACnC,MAAM,MAAM,QAAQ,IAAI;AAAA,EACxB,IAAI,QAAQ,aAAa,IAAI,KAAK,MAAM,IAAI;AAAA,IAC1C,MAAM,IAAI,MACR,yFACF;AAAA,EACF;AAAA,EACA,OAAO,IAAI,KAAK,EAAE,QAAQ,OAAO,EAAE;AAAA;AAGrC,IAAM,QAAQ,MACL,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,QAAQ,IAAI;AAAA,EACxB,IAAI,QAAQ,aAAa,IAAI,KAAK,MAAM,IAAI;AAAA,IAC1C,OAAO,OAAc,YACnB,IAAI,aACF,GACA,OACA,IACA,8FACF,CACF;AAAA,EACF;AAAA,EACA,OAAO,IAAI,KAAK;AAAA,CACjB;AAAA;AAEI,MAAM,qBAAqB,MAAM;AAAA,EAE3B;AAAA,EACA;AAAA,EACA;AAAA,EAHX,WAAW,CACA,QACA,QACA,MACT,QACA;AAAA,IACA,MAAM,WAAW,UAAU,WAAW,OAAO,MAAM,MAAM,QAAQ;AAAA,IALxD;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAMA,IAAM,gBAAgB,CAAC,WAAmB,EAAE,eAAe,SAAS,QAAQ;AAGrE,IAAM,UAAU,CACrB,QACA,MACA,SAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,MAAM;AAAA,EAChC,MAAM,MAAM,GAAG,QAAQ,IAAI,eAAe,KAAK,QAAQ,OAAO,EAAE;AAAA,EAQhE,MAAM,SAAS,OAAkB;AAAA,EAqBjC,MAAM,UAA4B,uBAAK,MAAM,EAAE,GAAG,EAAE,KAChC,6BAAW,KAAK,cAAc,UAAU,GAAG,QAAQ,mBAAmB,CAAC,GACzF,SAAS,YACL,CAAC,SAAS,OACQ,2BAAS,KAAK,UAAU,IAAI,GAAG,kBAAkB,CACzE;AAAA,EACA,MAAM,WAAW,OAAO,OACrB,QAAQ,OAAO,EACf,KAAY,gBAAS,CAAC,UAAU,IAAI,aAAa,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,EAEpF,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IACnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,qBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,YACnB,IAAI,aAAa,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CACtE;AAAA,EACF;AAAA,EAGA,MAAM,OAAO,OAAO,SAAS,KAAK,KACzB,gBAAS,CAAC,UAAU,IAAI,aAAa,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CAC7E;AAAA,EAEA,OAAQ,SAAS,KAAK,YAAY,KAAK,MAAM,IAAI;AAAA,CAClD;;;ADhEH,IAAM,cAAc,CAAI,OACtB,GAAG,KACM,gBACL,CAAC,UAAiC,iBAAiB,gBAAgB,MAAM,WAAW,KACpF,MAAa,gBAAQ,SAAc,CACrC,CACF;AAEK,IAAM,oBAAoB,CAC/B,SACG;AAAA,EACH,MAAM,YAAY,CAAC,UACjB,YACE,KAAK,WAAW,YACZ,KAAK,OAAO,KAAK,IACjB,QAAiC,OAAO,KAAK,KAAK,KAAK,CAAC,CAC9D;AAAA,EAEF,MAAM,aAAa,CAAC,OAAc,SAChC,KAAK,aAAa,YAAY,KAAK,KAAK,KAAK,IAAI,KAAK,SAAS,OAAO,IAAI;AAAA,EAE5E,MAAM,OAAO,CAAC,UACZ,UAAU,KAAK,EAAE,KACR,YAAI,CAAC,SAAU,SAAS,YAAY,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,CACtF;AAAA,EAEF,OAAO;AAAA,IACL;AAAA,IAEA,MAAM,CAAC,MAAoB,WAClB,YAAI,UAAU,GAAG;AAAA,MACtB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,QAAG;AAAA,MAC/C,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAC7B,IAAI,SAAS;AAAA,QAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,MAClD,IAAI,KAAK,QAAQ,MAAM,IAAI;AAAA,QAAG,OAAO,EAAE,QAAQ,OAAO;AAAA,MACtD,OAAO,KAAK,eAAe,YACtB,EAAE,QAAQ,UAAU,IACpB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAEH,WAAW,CAAC,SACH,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,SAAS,OAAO,UAAU,IAAI;AAAA,MACpC,IAAI,KAAK,WAAW,WAAW;AAAA,QAC7B,OAAO,KAAK,OAAO,MAAM,MAAM;AAAA,MACjC,EAAO,SAAI,WAAW,WAAW;AAAA,QAC/B,OAAO,QAAQ,QAAQ,KAAK,WAAW,IAAI,GAAG,KAAK,WAAW,IAAI,CAAC;AAAA,MACrE,EAAO,SAAI,KAAK,eAAe,WAAW;AAAA,QACxC,MAAM,SAAS,KAAK,WAAW,QAAQ,IAAI;AAAA,QAC3C,IAAI,WAAW,aAAa,KAAK,QAAQ,QAAQ,IAAI,GAAG,CAExD,EAAO;AAAA,UACL,MAAM,OAAO,KAAK,WAAW,IAAI;AAAA,UACjC,IAAI,OAAO,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,YAChC,OAAO,QAAQ,SAAS,WAAW,MAAM,MAAM,GAAG,IAAI;AAAA,UACxD;AAAA;AAAA,MAEJ;AAAA,MACA,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU,WAAW;AAAA,QACvB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,KAAK,IAAI,oEACf,qFACJ,CACF;AAAA,MACF;AAAA,MACA,OAAO;AAAA,KACR;AAAA,IAEH,SAAS,CAAC,SACD,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,OAAO,OAAO,UAAU,IAAI;AAAA,MAClC,IAAI,SAAS;AAAA,QAAW;AAAA,MACxB,OAAO,QAAQ,UAAU,WAAW,MAAM,IAAI,CAAC;AAAA,KAChD;AAAA,EACL;AAAA;AAWK,IAAM,kBAAkB,CAC7B,SACG;AAAA,EACH,MAAM,MAAM,kBAAkB,IAAI;AAAA,EAClC,OAAO;AAAA,IACL,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,WAA4B,IAAI,KAAK,IAAI;AAAA,IAClD,MAAM,GAAG,MAAM,aACb,IAAI,KAAK,MAAM,MAAM;AAAA,IACvB,WAAW,GAAG,WAA4B,IAAI,UAAU,IAAI;AAAA,IAC5D,QAAQ,GAAG,WAA4B,IAAI,QAAQ,IAAI;AAAA,EACzD;AAAA;;;AElKK,IAAM,OAAO,CAAC,OAAgB,WAAW,OAC9C,OAAO,UAAU,WAAW,QAAQ;AAG/B,IAAM,QAAQ,CAAC,UAAmB,KAAK,KAAK,EAAE,QAAQ,MAAM,EAAE,EAAE,YAAY;AAE5E,IAAM,OAAO,CAAC,OAAgB,WAAW,UAC9C,UAAU,aAAa,UAAU,OAAO,WAAW,UAAU,QAAQ,UAAU,KAAK,UAAU;AAEzF,IAAM,MAAM,CAAC,OAAgB,WAAW,MAAM;AAAA,EACnD,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAAA,IAAG,OAAO,KAAK,MAAM,KAAK;AAAA,EAChF,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAAI;AAAA,IACpD,MAAM,SAAS,OAAO,SAAS,OAAO,EAAE;AAAA,IACxC,IAAI,OAAO,SAAS,MAAM;AAAA,MAAG,OAAO;AAAA,EACtC;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAc,CAAC,UAC1B,MAAM,QAAQ,KAAK,IACf,MAAM,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,EAAE,SAAS,IAC7E,CAAC;AAEA,IAAM,eAAe,CAAC,UAA2C;AAAA,EACtE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,CAAC;AAAA,EACjF,MAAM,MAA8B,CAAC;AAAA,EACrC,YAAY,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;AAAA,IAChD,IAAI,OAAO,UAAU;AAAA,MAAU,IAAI,OAAO;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,cAAc,CAAC,MAA8B,UAAkC;AAAA,EAC1F,MAAM,WAAW,OAAO,KAAK,IAAI,EAAE,SAAS;AAAA,EAC5C,MAAM,YAAY,OAAO,KAAK,KAAK,EAAE,SAAS;AAAA,EAC9C,IAAI,SAAS,WAAW,UAAU;AAAA,IAAQ,OAAO;AAAA,EACjD,OAAO,SAAS,MAAM,CAAC,KAAK,UAAU,UAAU,WAAW,OAAO,KAAK,SAAS,MAAM,IAAI;AAAA;AAIrF,IAAM,mBAAmB,CAAC,UAAmB;AAAA,EAClD,MAAM,SAAS,aAAa,KAAK;AAAA,EACjC,QAAQ,QAAQ,YAAY,SAAS;AAAA,EACrC,OAAO;AAAA;AAIF,IAAM,kBAAkB,CAAC,KAAa,SAC3C,sBAAsB,OAAO,OAAO,QAAQ,kBAAkB,GAAG,EAAE,YAAY;AAG1E,IAAM,mBAAmB,CAAC,OAAe,MAAc,SAC5D,uBAAuB,SAAS,QAAQ,OAAO,QAAQ,kBAAkB,GAAG,EAAE,YAAY;;;AJJrF,IAAM,0BAA0B,SACrC,4BACA,EAAE,sBAAsB,SAAS,CACnC;AAEA,IAAM,WAAW,gBAAmE;AAAA,EAClF,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,WAAW,KAAK,KAAK,cAAc,KAAK,KAAK,cAAc,CAAC;AAAA,IAClE,IAAI,aAAa;AAAA,MAAI;AAAA,IACrB,OAAO;AAAA,MACL,eAAe,KAAK,KAAK,kBAAkB;AAAA,MAC3C,YAAY,MAAM;AAAA,MAClB,uBAAuB,KAAK,KAAK,0BAA0B;AAAA,MAC3D,YAAY,KAAK,KAAK,gBAAgB,IAAI;AAAA,MAC1C,mBAAmB,KAAK,KAAK,sBAAsB;AAAA,MACnD,sBAAsB,KAAK,KAAK,yBAAyB;AAAA,MACzD,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,sBAAsB,KAAK,KAAK,yBAAyB;AAAA,MACzD,mBAAmB,IAAI,KAAK,qBAAqB;AAAA,MACjD,qBAAqB,YAAY,KAAK,wBAAwB;AAAA,IAChE;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,SAAS,MAAM,SAAS,MAAM;AAAA,EACrD,YAAY;AAAA,EACZ,SAAS,CAAC,YAAY,UACpB,WAAW,uBAAuB,MAAM,qBAAqB,MAC7D,WAAW,gBAAgB,MAAM,cAAc,SAC/C,WAAW,uBAAuB,MAAM,qBAAqB,UAC7D,WAAW,0BAA0B,MAAM,wBAAwB,UACnE,WAAW,2BAA2B,MAAM,yBAAyB,UACrE,WAAW,0BAA0B,MAAM,wBAAwB,UACnE,WAAW,mBAAmB,MAAM,iBAAiB,WACpD,MAAM,wBAAwB,aAC7B,YAAY,MAAM,mBAAmB,EAAE,KAAK,MAAI,MAC9C,WAAW,oBAAoB,KAAK,MAAI;AAAA,EAC9C,MAAM,CAAC,UAAU,SAAS,MAAM,SAAS,MAAM,2BAA2B,MAAM;AAAA,EAChF,YAAY;AACd,CAAC;AAEM,IAAM,kCAAkC,MACpC,gBACP,yBACO,gBAAQ,wBAAwB,SAAS,GAAG,QAAQ,CAAC,CAC9D;;AKzEF,qBAAS;AACT;AACA;AAyBO,IAAM,mBAAmB,UAA2B,mBAAmB;AAE9E,IAAM,aAAa,CAAC,KAAa,SACxB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,gBAAgB,KAAK,IAAI;AAAA,EACrC,MAAM,MAAM,QAAQ,IAAI;AAAA,EACxB,IAAI,QAAQ,aAAa,IAAI,KAAK,MAAM,IAAI;AAAA,IAC1C,OAAO,OAAc,aACnB,IAAI,aACF,GACA,OACA,QAAQ,uBAAuB,QAC/B,GAAG,yEACL,CACF;AAAA,EACF;AAAA,EACA,OAAO,IAAI,KAAK;AAAA,CACjB;AAEH,IAAM,YAAW,gBAAqD;AAAA,EACpE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,WAAW,KAAK,KAAK,aAAa;AAAA,IAClC,MAAM,MAAM;AAAA,IACZ,KAAK,MAAM;AAAA,EACb;AAAA,EACA,YAAY,CAAC,UAAU,QAAQ,MAAM,uBAAuB,MAAM;AAAA,EAClE,YAAY,OAAO,CAAC;AAAA,EACpB,QAAQ,CAAC,UACP,QAAmC,OAAO,QAAQ,MAAM,+BAA+B,EAAE,KAChF,YAAI,CAAC,SACV,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,IAAI,IAAI,SACzE,CACF;AAAA,EACF,SAAS,MAAM;AAAA,EACf,MAAM,CAAC,UAAU,QAAQ,MAAM,uBAAuB,MAAM;AAAA,EAC5D,QAAQ,CAAC,OAAO,WACP,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,WAAW,MAAM,KAAK,MAAM,IAAI;AAAA,IACpD,OAAO,QAAQ,OAAO,QAAQ,MAAM,uBAAuB,MAAM,QAAQ,EAAE,KAAK,CAAC;AAAA,GAClF;AACL,CAAC;AAEM,IAAM,2BAA2B,MAC7B,iBAAO,kBAAyB,gBAAQ,iBAAiB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AC9E1F,qBAAS;AACT;AACA;AAiCO,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAED,IAAM,YAAW,gBAAmD;AAAA,EAClE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,KAAK,KAAK;AAAA,IAChB,IAAI,OAAO,OAAO;AAAA,MAAU;AAAA,IAC5B,OAAO;AAAA,MACL,OAAO,MAAM,KAAK,QAAQ;AAAA,MAC1B,aAAa,KAAK,KAAK,cAAc;AAAA,MACrC,WAAW,KAAK,KAAK,YAAY;AAAA,MACjC,SAAS;AAAA,MACT,MAAM,MAAM;AAAA,MACZ,KAAK,MAAM;AAAA,IACb;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,QAAQ,MAAM;AAAA,EACrC,YAAY,CAAC,WAAW;AAAA,IACtB,OAAO,MAAM,MAAM,KAAK;AAAA,IACxB,aAAa,MAAM,eAAe;AAAA,IAClC,WAAW,MAAM,aAAa;AAAA,IAC9B,MAAM,MAAM;AAAA,EACd;AAAA,EACA,QAAQ,CAAC,UACP,QAAmC,OAAO,QAAQ,MAAM,sBAAsB,EAAE,KACvE,YAAI,CAAC,SACV,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,IAAI,IAAI,SACzE,CACF;AAAA,EACF,SAAS,CAAC,YAAY,UACpB,WAAW,UAAU,MAAM,MAAM,KAAK,KACtC,WAAW,iBAAiB,MAAM,eAAe,OACjD,WAAW,eAAe,MAAM,aAAa;AAAA,EAC/C,MAAM,CAAC,UAAU,QAAQ,MAAM,cAAc,MAAM;AAAA,EACnD,YAAY,CAAC,WAAW;AAAA,IACtB,OAAO,MAAM,MAAM,KAAK;AAAA,IACxB,aAAa,MAAM,eAAe;AAAA,IAClC,WAAW,MAAM,aAAa;AAAA,EAChC;AAAA,EACA,UAAU,CAAC,OAAO,SAAS,QAAQ,MAAM,cAAc,OAAO,KAAK,KAAK;AAC1E,CAAC;AAEM,IAAM,0BAA0B,MAC5B,iBAAO,iBAAwB,gBAAQ,gBAAgB,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACxFxF,qBAAS;AACT;AACA;AAuCO,IAAM,iBAAiB,UAAyB,iBAAiB;AAExE,IAAM,WAAW,CAAC,WAAyB;AAAA,EACzC,qBAAqB,MAAM,oBAAoB;AAAA,EAC/C,aAAa,MAAM,eAAe;AAAA,EAClC,2BAA2B,MAAM,2BAA2B;AAAA,EAC5D,MAAM,MAAM;AAAA,KACR,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,KACrE,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,KACtD,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,SAAS;AACtE;AAEA,IAAM,YAAW,gBAAiD;AAAA,EAChE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,KAAK,KAAK;AAAA,IAChB,IAAI,OAAO,OAAO;AAAA,MAAU;AAAA,IAC5B,MAAM,aAAa,KAAK,KAAK,eAAe,MAAM;AAAA,IAClD,IAAI,eAAe,UAAU,eAAe,WAAW,eAAe;AAAA,MAAS;AAAA,IAC/E,OAAO;AAAA,MACL,kBAAkB,KAAK,KAAK,sBAAsB;AAAA,MAClD,aAAa,KAAK,KAAK,cAAc;AAAA,MACrC,yBAAyB,KAAK,KAAK,4BAA4B;AAAA,MAC/D,MAAM,MAAM;AAAA,MACZ,KAAK,MAAM;AAAA,MACX;AAAA,MACA,QAAQ;AAAA,MACR,OAAO,YAAY,KAAK,QAAQ;AAAA,MAChC,UAAU,aAAa,KAAK,YAAY;AAAA,IAC1C;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,QAAQ,MAAM;AAAA,EACrC,YAAY;AAAA,EACZ,QAAQ,CAAC,UACP,QAAmC,OAAO,QAAQ,MAAM,qBAAqB,EAAE,KACtE,YAAI,CAAC,SACV,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,IAAI,IAAI,SACzE,CACF;AAAA,EACF,SAAS,CAAC,YAAY,UACpB,WAAW,iBAAiB,MAAM,eAAe,OACjD,WAAW,gBAAgB,MAAM,cAAc,WAC/C,WAAW,6BAA6B,MAAM,2BAA2B,UACzE,WAAW,sBAAsB,MAAM,oBAAoB,WAC1D,MAAM,UAAU,aACf,YAAY,MAAM,KAAK,EAAE,KAAK,MAAI,MAAM,WAAW,MAAM,KAAK,MAAI,OACnE,MAAM,aAAa,aAAa,YAAY,WAAW,UAAU,MAAM,QAAQ;AAAA,EAClF,MAAM,CAAC,UAAU,QAAQ,MAAM,aAAa,MAAM;AAAA,EAClD,YAAY;AAAA,EACZ,UAAU,CAAC,QAAQ,SAAS,SAAS,OAAO,KAAK,KAAK;AACxD,CAAC;AAEM,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,gBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;AC7FtF,qBAAS;AACT;AACA;;;ACHO,IAAM,UAAU,CAAC,SACtB,KAAK,KAAK,MAAM,KAAK,KAAK,aAAa,KAAK,SAAS,EAAE,MAAM;AAExD,IAAM,iBAAiB,CAAC,OAAyB,kBAA2B;AAAA,EACjF,MAAM,SAAiC;AAAA,IACrC,cAAc,MAAM,eAAe;AAAA,IACnC,KAAK,MAAM;AAAA,EACb;AAAA,EACA,IAAI,eAAe;AAAA,IACjB,MAAM,MAAM,iBAAiB,MAAM,OAAO,MAAM,MAAM,MAAM,IAAI;AAAA,IAChE,MAAM,SAAS,QAAQ,IAAI,MAAM,KAAK;AAAA,IACtC,IAAI,WAAW,aAAa,WAAW;AAAA,MAAI,OAAO,YAAY;AAAA,EAChE;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,iBAAiB,CAAC,WAA6B;AAAA,EAC1D,QAAQ,MAAM,UAAU;AAAA,KACpB,MAAM,wBAAwB,YAC9B,CAAC,IACD,EAAE,sBAAsB,MAAM,oBAAoB;AAAA,KAClD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,eAAe,MAAM,aAAa;AAAA,EAChF,QAAQ,eAAe,OAAO,IAAI;AAAA,EAClC,QAAQ,MAAM;AAAA,EACd,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;AAEO,IAAM,iBAAiB,CAAC,WAA6B;AAAA,EAC1D,QAAQ,MAAM,UAAU;AAAA,KACpB,MAAM,wBAAwB,YAC9B,CAAC,IACD,EAAE,sBAAsB,MAAM,oBAAoB;AAAA,KAClD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,eAAe,MAAM,aAAa;AAAA,EAChF,QAAQ,eAAe,OAAO,KAAK;AAAA,EACnC,QAAQ,MAAM;AAChB;;;ADsBO,IAAM,qBAAqB,UAA6B,qBAAqB;AAEpF,IAAM,YAAW,gBAAyD;AAAA,EACxE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,KAAK,KAAK;AAAA,IAChB,IAAI,OAAO,OAAO;AAAA,MAAU;AAAA,IAC5B,MAAM,SAAS,iBAAiB,KAAK,SAAS;AAAA,IAC9C,MAAM,OAAO,KAAK,KAAK,OAAO;AAAA,IAC9B,OAAO;AAAA,MACL,QAAQ,KAAK,KAAK,WAAW,IAAI;AAAA,MACjC,qBAAqB,KAAK,KAAK,uBAAuB;AAAA,MACtD,cAAc,KAAK,KAAK,gBAAgB;AAAA,MACxC,aAAa,KAAK,OAAO,iBAAiB,KAAK,KAAK,iBAAiB,MAAM,CAAC;AAAA,MAC5E,QAAQ,YAAY,KAAK,SAAS;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,MAAM;AAAA,MACZ,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ;AAAA,MACA,KAAK,QAAQ,IAAI;AAAA,IACnB;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,SAAS,MAAM,SAAS,MAAM;AAAA,EACrD,YAAY;AAAA,EACZ,QAAQ,CAAC,UACP,QACE,OACA,SAAS,MAAM,SAAS,MAAM,sBAChC,EAAE,KACO,YAAI,CAAC,SACV,MAAM,QAAQ,IAAI,IACd,KAAK,KAAK,CAAC,QAAQ,KAAK,IAAI,OAAO,MAAM,MAAM,QAAQ,QAAQ,GAAG,MAAM,MAAM,GAAG,IACjF,SACN,CACF;AAAA,EACF,SAAS,CAAC,YAAY,UACpB,WAAW,SAAS,MAAM,QAC1B,WAAW,QAAQ,MAAM,OACzB,WAAW,YAAY,MAAM,UAAU,SACvC,WAAW,iBAAiB,MAAM,eAAe,WACjD,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,yBAAyB,MAAM,uBAAuB,OACjE,YAAY,MAAM,MAAM,EAAE,KAAK,MAAI,MAAM,WAAW,OAAO,KAAK,MAAI;AAAA,EACtE,MAAM,CAAC,UAAU,SAAS,MAAM,SAAS,MAAM,cAAc,MAAM;AAAA,EACnE,YAAY;AAAA,EACZ,UAAU,CAAC,OAAO,SAAS,SAAS,MAAM,SAAS,MAAM,cAAc,OAAO,KAAK,KAAK;AAC1F,CAAC;AAEM,IAAM,6BAA6B,MAC/B,iBAAO,oBAA2B,gBAAQ,mBAAmB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AE3G9F,qBAAS;AACT;AACA;AAyCO,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AAED,IAAM,YAAW,gBAAuD;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,KAAK,KAAK;AAAA,IAChB,IAAI,OAAO,OAAO;AAAA,MAAU;AAAA,IAC5B,OAAO;AAAA,MACL,eAAe,KAAK,KAAK,mBAAmB,MAAM;AAAA,MAClD,aAAa,KAAK,KAAK,cAAc;AAAA,MACrC,OAAO,KAAK,KAAK,QAAQ;AAAA,MACzB,WAAW,KAAK,KAAK,eAAe,IAAI;AAAA,MACxC,aAAa,KAAK,KAAK,iBAAiB,IAAI;AAAA,MAC5C,SAAS,KAAK,KAAK,aAAa,IAAI;AAAA,MACpC,MAAM,MAAM;AAAA,MACZ,KAAK,MAAM;AAAA,MACX,SAAS,KAAK,KAAK,YAAY,IAAI;AAAA,MACnC,QAAQ;AAAA,IACV;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,QAAQ,MAAM;AAAA,EACrC,YAAY,CAAC,WAAW;AAAA,IACtB,WAAW,MAAM,YAAY;AAAA,IAC7B,aAAa,MAAM,eAAe;AAAA,IAClC,YAAY,MAAM,aAAa;AAAA,IAC/B,cAAc,MAAM,eAAe;AAAA,IACnC,UAAU,MAAM,WAAW;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM,WAAW;AAAA,EAC5B;AAAA,EAuBA,SAAS,CAAC,YAAY,WACnB,MAAM,gBAAgB,aAAa,WAAW,gBAAgB,MAAM,iBACpE,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,cAAc,aAAa,WAAW,cAAc,MAAM,eAChE,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,gBAAgB,aAAa,WAAW,gBAAgB,MAAM,iBACpE,MAAM,kBAAkB,aAAa,WAAW,kBAAkB,MAAM;AAAA,EAC3E,MAAM,CAAC,UAAU,SAAS,MAAM,OAAO,MAAM;AAAA,EAC7C,YAAY,CAAC,WAAW;AAAA,OAClB,MAAM,kBAAkB,YAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,cAAc;AAAA,OAC/E,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,OACxE,MAAM,cAAc,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,UAAU;AAAA,OACnE,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,MAAM,YAAY;AAAA,OACzE,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,QAAQ;AAAA,OAC7D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,EAClE;AACF,CAAC;AAEM,IAAM,4BAA4B,MAC9B,iBAAO,mBAA0B,gBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AC1G5F,qBAAS;AACT;AACA;AA0BO,IAAM,oBAAoB,UAA4B,oBAAoB;AAGjF,IAAM,UAAU;AAEhB,IAAM,WAAW,CAAC,UACT,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,QAAQ,MAAM;AAAA,EAC3B,MAAM,OAAO,OAAO,QAAmC,OAAO,IAAI;AAAA,EAClE,MAAM,MAAM,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,IAAI,IAAI;AAAA,EACzF,IAAI,OAAO,OAAO,UAAU;AAAA,IAC1B,OAAO,OAAc,aACnB,IAAI,aAAa,GAAG,OAAO,MAAM,iBAAiB,MAAM,eAAe,MAAM,KAAK,CACpF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAEH,IAAM,aAAa,CAAC,IAAY,UAC9B,SAAS,OAAO,EAAE,aAAa,MAAM;AAEvC,IAAM,YAAW,gBAAuD;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,KAAK,KAAK;AAAA,IAChB,MAAM,QAAQ,KAAK;AAAA,IACnB,IAAI,OAAO,OAAO,YAAY,OAAO,UAAU;AAAA,MAAU;AAAA,IACzD,IAAI,MAAM,YAAY,MAAM,MAAM,SAAS,YAAY;AAAA,MAAG;AAAA,IAC1D,OAAO,EAAE,KAAK,MAAM,KAAK,MAAM,MAAM,MAAM,QAAQ,IAAI,UAAU,MAAM,SAAS;AAAA;AAAA,EAElF,YAAY,CAAC,UAAU,QAAQ,MAAM;AAAA,EACrC,YAAY,OAAO,CAAC;AAAA,EACpB,QAAQ,CAAC,UACA,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,KAAK,OAAO,SAAS,KAAK;AAAA,IAChC,MAAM,OAAO,OAAO,QAAiC,OAAO,WAAW,IAAI,KAAK,CAAC;AAAA,IACjF,OAAO,SAAS,YAAY,YAAY,KAAK,OAAO,UAAU,GAAG;AAAA,GAClE;AAAA,EACH,SAAS,MAAM;AAAA,EACf,MAAM,CAAC,UAAU,QAAQ,MAAM,aAAa,MAAM,gBAAgB,MAAM;AAAA,EACxE,QAAQ,CAAC,OAAO,WACd,WAAW,YACA,eACA,gBAAQ,SAAS,KAAK,GAAG,CAAC,OACxB,eAAO,QAAQ,OAAO,WAAW,IAAI,KAAK,CAAC,CAAC,CACrD;AAAA,EACN,UAAU,CAAC,OAAO,SAAS,WAAW,OAAO,KAAK,QAAQ,GAAG,KAAK;AACpE,CAAC;AAEM,IAAM,4BAA4B,MAC9B,iBAAO,mBAA0B,gBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;",
   "debugId": "09F62B41760BE1CD64756E2164756E21",

package/dist/forgejo/org-actions-secrets.d.ts

@@ -2,7 +2,7 @@
  * `Forgejo.OrgSecret` — org-level Actions secret metadata at `/orgs/{org}/actions/secrets/{name}`.
  *
  * ★ CHOICE: AUTHORED WITH WRITE-ONLY VALUE VIA ENV, NOT REFUSED. The OpenAPI in
- *   `house/mcp-servers/docs/api/upstream/forgejo.json` shows `Secret` returns only `name` and
+ *   `<estate>/mcp-servers/docs/api/upstream/forgejo.json` shows `Secret` returns only `name` and
  *   `created_at` — never the `data` field — so attributes stay metadata-only. Create/update is PUT
  *   with body `{ data }`, which does not fit POST/PATCH; this family uses the `upsert` seam on
  *   `ForgejoSpec` instead of hand-rolling provider handlers.

package/dist/forgejo/org-label.d.ts

@@ -1,7 +1,7 @@
 /**
  * `Forgejo.OrgLabel` — one org-level issue label shared across every repository in the org.
  *
- * ★ RETIRES `house/nix/homeflare-config/hosts/macmini/forgejo/labels-reconcile.sh`, which
+ * ★ RETIRES the estate's hand-run `labels-reconcile.sh`, which
  *   converged the whole `labels.yaml` file in one shot. That script CREATED and PATCHED labels
  *   from the spec and REPORTED `EXTRA` labels present live but absent from the file — it never
  *   deleted them, because removing a label strips it from every issue that carries it.

package/dist/forgejo/org-team.d.ts

@@ -1,7 +1,7 @@
 /**
  * `Forgejo.OrgTeam` — one organization team under `/orgs/{org}/teams`.
  *
- * ★ READ OFF `house/mcp-servers/docs/api/upstream/forgejo.json` (Forgejo 16.x OpenAPI): create is
+ * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json` (Forgejo 16.x OpenAPI): create is
  *   `POST /orgs/{org}/teams`; read/update/delete use numeric id at `/teams/{id}` — not the name.
  *
  * ⚠️ PATCH AND DELETE USE `/teams/{id}` — same seam as org labels. `locate` lists by name;

package/dist/forgejo/repo-webhook.d.ts

@@ -1,7 +1,7 @@
 /**
  * `Forgejo.RepoWebhook` — one repository webhook under `/repos/{owner}/{repo}/hooks`.
  *
- * ★ READ OFF `house/mcp-servers/docs/api/upstream/forgejo.json`: create is POST collection; read/update/delete
+ * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json`: create is POST collection; read/update/delete
  *   use numeric hook id at `/repos/{owner}/{repo}/hooks/{id}`. `locate` lists and matches on `name`.
  *
  * ⛔ NO WEBHOOK `secret` IN PROPS OR ATTRIBUTES. Optional HMAC material is env-only at write time

package/dist/forgejo/repository.d.ts

@@ -1,7 +1,7 @@
 /**
  * `Forgejo.Repository` — an organization-owned git repository.
  *
- * ★ MEASURED 2026-09-13 against the live daemon (`GET /api/v1/repos/HomeFlare/homeflare-config`):
+ * ★ MEASURED 2026-09-13 against the live daemon (`GET /api/v1/repos/<org>/<repo>`):
  *   responses are flat JSON with `private`, `has_issues`, `default_branch`, etc. Create is
  *   `POST /orgs/{org}/repos`; read/update/delete use `/repos/{owner}/{repo}`.
  *
@@ -12,7 +12,7 @@ import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import { type ForgejoRequirements } from './resource.ts';
 export interface RepositoryProps {
-    /** Organization login — the owner segment in `HomeFlare/homeflare-config`. */
+    /** Organization login — the owner segment in `<org>/<repo>`. */
     org: string;
     /** Repository name. Changing it is a replace, not an update. */
     name: string;

package/dist/forgejo/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/forgejo/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,mBAAmB,EAAmB,MAAM,eAAe,CAAC;AAG1E,MAAM,WAAW,eAAe;IAC9B,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,mBAAmB,CACpB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAqEH,eAAO,MAAM,yBAAyB,uIACuD,CAAC"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/forgejo/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,KAAK,mBAAmB,EAAmB,MAAM,eAAe,CAAC;AAG1E,MAAM,WAAW,eAAe;IAC9B,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,eAAe,EACf,oBAAoB,EACpB,KAAK,EACL,mBAAmB,CACpB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAqEH,eAAO,MAAM,yBAAyB,uIACuD,CAAC"}

package/dist/forgejo/resource.d.ts

@@ -5,7 +5,7 @@ import { ForgejoError } from './client.ts';
 /**
  * ★ WHAT EVERY OPERATION HERE NEEDS FROM THE RUNTIME — and it is NOT what the first draft said.
  *
- *   These resources declared `ChildProcessSpawner`, copied from house/proxmox, where it is there
+ *   These resources declared `ChildProcessSpawner`, copied from <estate>/proxmox, where it is there
  *   because a PVE credential is minted by shelling out to `bao`. Nothing in this package shells
  *   out: the token comes from `FORGEJO_TOKEN` in the environment. Declaring a service you never
  *   use is not harmless — it makes a stack provide a layer for nothing, and it hides the one
@@ -54,7 +54,7 @@ export declare const forgejoOperations: <Props extends object, Attributes>(spec:
  * The five provider handlers for a spec'd Forgejo object, wired once.
  *
  * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER — same reasoning as pveHandlers in
- *   house/proxmox: wrapping `Provider.effect` here needs casts against Alchemy's `Props<R>`.
+ *   <estate>/proxmox: wrapping `Provider.effect` here needs casts against Alchemy's `Props<R>`.
  *
  * ⚠️ `list` answers empty — Forgejo index endpoints return the whole org; adoption stays explicit.
  */

package/dist/forgejo/team-member.d.ts

@@ -3,7 +3,7 @@
  *
  * ★ WHY IT EXISTS: forgejo-provision, the service account the Forgejo engine mints as, belongs to the
  *   HomeFlare Owners team — Tim, 2026-09-14. Membership is what its tokens can reach; the role's
- *   scopes only cap it (house/openbao/src/forgejo-bootstrap.ts).
+ *   scopes only cap it (<estate>/openbao/src/forgejo-bootstrap.ts).
  *
  * ★ READ OFF THE LIVE 16.0.3 SWAGGER (127.0.0.1:3000/swagger.v1.json, 2026-09-14): GET, PUT and
  *   DELETE `/teams/{id}/members/{username}` answer 200, 204 and 204, and 404 when absent. The team

package/dist/openbao/auth-role.d.ts

@@ -7,7 +7,7 @@
  *
  * ★ `defaultRemovalPolicy: 'retain'` — deleting a role locks out every host that logs in with it:
  *   its secret_ids go with it (the ⚠️ on `delete` below). Opt in with
- *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in house/proxmox.
+ *   `.pipe(RemovalPolicy.destroy())`; see resource.ts in <estate>/proxmox.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';

package/dist/openbao/bao-http.d.ts

@@ -2,14 +2,14 @@
  * One call to OpenBao's HTTP API through Effect's `HttpClient` — the transport every Bao.* family
  * uses since it stopped shelling out to `bao`.
  *
- * ★ `HttpClient`, THE SAME PATTERN house/proxmox and house/forgejo USE AGAINST THEIR APIs, decided
+ * ★ `HttpClient`, THE SAME PATTERN <estate>/proxmox and <estate>/forgejo USE AGAINST THEIR APIs, decided
  *   2026-09-14. It buys a typed error channel, interruption when a plan is cancelled, the runtime's
  *   tracing, and a client a test can point at a fake server — and it needs no Alchemy session, so
  *   every call here works from all four operations. (`CommandExecutor.run` was tried on Bao.Policy
  *   first and blocked read/diff: Alchemy passes a session to reconcile/delete but NOT to read/diff,
  *   Provider.ts:258-289. The ChildProcessSpawner that fixed that is gone with the CLI.)
  * ⚠️ THE STACK MUST PROVIDE `FetchHttpClient.layer`. alchemy.run.ts does, the way
- *   house/proxmox/alchemy.run.ts does.
+ *   <estate>/proxmox/alchemy.run.ts does.
  */
 import * as Context from 'effect/Context';
 import * as Effect from 'effect/Effect';
@@ -24,7 +24,7 @@ export declare const BaoEnv: Context.Reference<Readonly<Record<string, string |
 /**
  * ⛔ AT MOST EIGHT EXCHANGES WITH OPENBAO AT ONCE — ACROSS EVERY Bao.* FAMILY, IN ONE PROCESS.
  *
- * 🔴 MEASURED 2026-09-14 10:41: A DEPLOY OF THIS STACK TOOK OPENBAO's API OFF THE MINI. Alchemy fans
+ * 🔴 MEASURED 2026-09-14 10:41: A DEPLOY OF THIS STACK TOOK OPENBAO's API OFF ITS HOST. Alchemy fans
  *   resources out with a hard-coded `concurrency: "unbounded"` (alchemy Plan.ts:476, Apply.ts:259,
  *   :263, :303 — no option reaches it), and 555 Bao.CloudflareRole resources each read, diff,
  *   reconcile and read back: well over a thousand requests at one loopback listener within seconds.
@@ -32,7 +32,7 @@ export declare const BaoEnv: Context.Reference<Readonly<Record<string, string |
  *     HTTP server (listening on 127.0.0.1:8200) exited with error: set tcp
  *     127.0.0.1:8200->127.0.0.1:57974: setsockopt: invalid argument
  *   and KEPT RUNNING with 8200 closed. launchd saw a live process and restarted nothing. Everything
- *   on the mini that talks to 127.0.0.1:8200 was cut off, starting with the agent's templates, until
+ *   on the vault host that talks to 127.0.0.1:8200 was cut off, starting with the agent's templates, until
  *   a manual restart.
  * ★ THE LISTENER DYING IS A GO-ON-DARWIN FAILURE, NOT OURS TO FIX. Traefik lost its entrypoints the
  *   same way on darwin/arm64 (traefik issue 8841). The BURST is ours. The adoption deploy an hour

package/dist/openbao/cloudflare-permission-groups.d.ts

@@ -69,7 +69,7 @@ export declare const permissionGroupsFromEngine: () => Effect.Effect<{
  *   undeclared live role carries IDs with no names to pair them with — and solves the account at
  *   once.
  * 🔴 WHAT RETIRED IT, 2026-09-15 10:13: `alchemy deploy` could not create
- *   `cloudflare-{<account>,testing}-platform/roles/r2-backup-mini` — `unknown group "Workers R2
+ *   `cloudflare-{<account>,testing}-platform/roles/r2-backup-host` — `unknown group "Workers R2
  *   Storage Bucket Item Write" — no live role on account <account> carries it; a NEW group needs
  *   the engine endpoint`. That is this source's documented blind spot arriving, not a bug in it.
  *

package/dist/openbao/cloudflare-role-form.d.ts

@@ -2,7 +2,7 @@
  * Props, attributes and field comparison for Bao.CloudflareRole — the resource is
  * cloudflare-role.ts, the policy document rules are cloudflare-policy.ts.
  *
- * MEASURED from the engine (house/platform/secrets/vault/plugin/cloudflare/path_roles.go) and the
+ * MEASURED from the engine (<estate>/platform/secrets/vault/plugin/cloudflare/path_roles.go) and the
  * 2026-09-14 snapshot of all 586 live roles:
  *   • A role is name, description, policies, ttl and max_ttl AND NOTHING ELSE (path_roles.go:14-20
  *     stores those; :204-210 returns them). Every snapshot read carries exactly those five keys, so
@@ -66,7 +66,7 @@ export interface RoleDifference {
     readonly want: string;
     readonly have: string;
 }
-/** `cloudflare-<account>-dns/roles/homeflare-dev-dns-read` — read, write and delete use it. */
+/** `cloudflare-<account>-dns/roles/example-dns-read` — read, write and delete use it. */
 export declare const rolePath: (mount: string, name: string) => string;
 /** A read's `data`, shaped. Lenient on purpose: a malformed field compares unequal, loudly. */
 export declare const liveRoleOf: (data: Readonly<Record<string, unknown>>) => LiveCloudflareRole;

package/dist/openbao/cloudflare-role-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,UAAU,EAIhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAInE,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,+FAA+F;AAC/F,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAK7F,+FAA+F;AAC/F,eAAO,MAAM,UAAU,SAAU,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAG,kBAOnE,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY,UAChB,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,MAAM,CAAC,QAC/C,kBAAkB,KACvB,2BAUF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,UAAW,sBAAsB,KAAG,MAAM,GAAG,SASlE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,UAAW,sBAAsB,YAAY,SAAS,UAAU,EAAE;IACtF,WAAW;IACX,OAAO;IACP,QAAQ;IACR,GAAG;CACH,CAAC;AAOH;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,UACf,IAAI,CAAC,sBAAsB,EAAE,aAAa,GAAG,QAAQ,GAAG,KAAK,CAAC,YAC3D,SAAS,cAAc,EAAE,QAC7B,kBAAkB,KACvB,cAAc,EAehB,CAAC"}
+{"version":3,"file":"cloudflare-role-form.d.ts","sourceRoot":"","sources":["../../src/openbao/cloudflare-role-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,UAAU,EAIhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAInE,MAAM,WAAW,sBAAsB;IACrC,+EAA+E;IAC/E,KAAK,EAAE,MAAM,CAAC;IACd,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,2CAA2C;AAC3C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,CAAC;CACtD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,yFAAyF;AACzF,eAAO,MAAM,QAAQ,UAAW,MAAM,QAAQ,MAAM,WAAwC,CAAC;AAK7F,+FAA+F;AAC/F,eAAO,MAAM,UAAU,SAAU,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAG,kBAOnE,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,YAAY,UAChB,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,MAAM,CAAC,QAC/C,kBAAkB,KACvB,2BAUF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,UAAW,sBAAsB,KAAG,MAAM,GAAG,SASlE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,UAAW,sBAAsB,YAAY,SAAS,UAAU,EAAE;IACtF,WAAW;IACX,OAAO;IACP,QAAQ;IACR,GAAG;CACH,CAAC;AAOH;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,UACf,IAAI,CAAC,sBAAsB,EAAE,aAAa,GAAG,QAAQ,GAAG,KAAK,CAAC,YAC3D,SAAS,cAAc,EAAE,QAC7B,kBAAkB,KACvB,cAAc,EAehB,CAAC"}

package/dist/openbao/cloudflare-roles-expand.d.ts

@@ -26,7 +26,7 @@ export interface DeclaredPolicy {
      * ⛔ IT MOVES THE LOOKUP, NEVER THE RESOURCE. The entry still binds the groups to the resource
      *   above; only the id chosen for each name changes. That is the shape Cloudflare calls "all
      *   zones from an account" — the ACCOUNT resource carrying ZONE-scoped groups
-     *   (house/nix/homeflare-config/scripts/cf-mint-analytics-tokens.py:155-158, beside a working
+     *   (<estate>/nix/scripts/cf-mint-analytics-tokens.py:155-158, beside a working
      *   token). Without this field the resource is the only witness, and it says `account`.
      */
     readonly scope?: string;

package/dist/openbao/digest.d.ts

@@ -7,7 +7,7 @@
  * The only form a policy body may be hashed or compared in.
  *
  * ⛔ OPENBAO STRIPS THE TRAILING NEWLINE AND THAT ALONE WAS A FOREVER-DIFF. MEASURED on the live
- *   server: the assembler emits each fragment followed by a newline, so `homeflare-llm` goes in as
+ *   server: the assembler emits each fragment followed by a newline, so `app-llm` goes in as
  *   41 lines and `bao policy read` hands back 40 — identical text, one `\n` apart, two different
  *   digests. Every plan therefore reported `update`, every deploy rewrote the same policy, and the
  *   stack could never settle. It was invisible until the stack planned for the first time today.

package/dist/openbao/forgejo-bootstrap-parse.d.ts

@@ -4,9 +4,9 @@
  * ★ PURE, SO THE ONE PART THAT TOUCHES THE PASSWORD IS TESTED WITHOUT ONE. Every format below was
  *   read off the running 16.0.3 daemon or its source on 2026-09-14, not assumed.
  */
-/** Where the mini's Forgejo keeps its state (hosts/macmini/modules/forgejo.nix:235, app.ini:14). */
+/** Where the host's Forgejo keeps its state (its NixOS module and `app.ini`). */
 export declare const FORGEJO_WORK_PATH = "/opt/homeflare/forgejo";
-/** The file the launchd runner renders at every start (forgejo.nix:78). Readable by tim, who runs Forgejo. */
+/** The file the launchd runner renders at every start. Readable by the account that runs Forgejo. */
 export declare const FORGEJO_CONFIG = "/opt/homeflare/forgejo/custom/conf/app.ini";
 /**
  * The binary of the RUNNING server, so the CLI writes the same schema as the daemon serving it.

package/dist/openbao/forgejo-bootstrap-parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forgejo-bootstrap-parse.d.ts","sourceRoot":"","sources":["../../src/openbao/forgejo-bootstrap-parse.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,oGAAoG;AACpG,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,8GAA8G;AAC9G,eAAO,MAAM,cAAc,+CAA6C,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,eAAgB,MAAM,KAAG,MAAM,GAAG,SAYlE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,UAAW,MAAM,KAAG,MAAM,EAYnD,CAAC;AAEF,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,WAAY,MAAM,YAAY,MAAM,KAAG,YAcnE,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,MAAM,SAAU,MAAM,qBAAc,MACmB,CAAC"}
+{"version":3,"file":"forgejo-bootstrap-parse.d.ts","sourceRoot":"","sources":["../../src/openbao/forgejo-bootstrap-parse.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,2BAA2B,CAAC;AAC1D,qGAAqG;AACrG,eAAO,MAAM,cAAc,+CAA6C,CAAC;AAEzE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,eAAgB,MAAM,KAAG,MAAM,GAAG,SAYlE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,UAAW,MAAM,KAAG,MAAM,EAYnD,CAAC;AAEF,oEAAoE;AACpE,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,iEAAiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,uDAAuD;IACvD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,WAAY,MAAM,YAAY,MAAM,KAAG,YAcnE,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,MAAM,SAAU,MAAM,qBAAc,MACmB,CAAC"}

package/dist/openbao/forgejo-bootstrap.d.ts

@@ -3,7 +3,7 @@
  * straight to the Forgejo engine's role and nowhere else.
  *
  * ★ TIM'S CALL, 2026-09-14: "Random password, piped", and membership of the HomeFlare Owners team
- *   (house/forgejo, Forgejo.TeamMember). Forgejo has no service-account type and no app.ini setting
+ *   (<estate>/forgejo, Forgejo.TeamMember). Forgejo has no service-account type and no app.ini setting
  *   that creates users — the bot type is database-only (codeberg issue 8136) — so this is an
  *   ordinary user made by `forgejo admin user create`.
  *