@homeflare/alchemy 0.27.1 → 0.27.3

package/dist/forgejo/index.js.map

@@ -1,21 +1,20 @@
 {
   "version": 3,
-  "sources": ["../src/forgejo/branch-protection.ts", "../src/forgejo/branch-protection-form.ts", "../src/forgejo/resource.ts", "../src/forgejo/client.ts", "../src/forgejo/values.ts", "../src/forgejo/org-actions-secrets.ts", "../src/forgejo/org-label.ts", "../src/forgejo/org-team.ts", "../src/forgejo/repo-webhook.ts", "../src/forgejo/repo-webhook-form.ts", "../src/forgejo/repository.ts", "../src/forgejo/team-member.ts"],
+  "sources": ["../src/forgejo/branch-protection.ts", "../src/forgejo/branch-protection-form.ts", "../src/forgejo/resource.ts", "../src/forgejo/values.ts", "../src/forgejo/org-actions-secrets.ts", "../src/forgejo/org-label.ts", "../src/forgejo/org-team.ts", "../src/forgejo/repo-webhook.ts", "../src/forgejo/repo-webhook-form.ts", "../src/forgejo/repository.ts", "../src/forgejo/team-member.ts"],
   "sourcesContent": [
-    "/**\n * `Forgejo.BranchProtection` — one rule at `/repos/{owner}/{repo}/branch_protections/{name}`.\n *\n * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json`: create is POST collection;\n *   read/update/delete use the branch/rule name in the path segment `{name}`. Response carries\n *   `rule_name` (preferred) and deprecated `branch_name`.\n *\n * ⛔ `defaultRemovalPolicy: 'retain'` — dropping a protection rule from the stack must not silently\n *   unprotect a branch; opt into `.pipe(RemovalPolicy.destroy())` to DELETE.\n *\n * ⛔ TOKEN NEEDS `write:repository` TO CREATE OR PATCH — get needs `read:repository`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { branchProtectionForm } from './branch-protection-form.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, int, stringArray, text } from './values.ts';\n\nexport interface BranchProtectionProps {\n  owner: string;\n  repo: string;\n  /** Branch or rule name — path key and `rule_name` on the wire. */\n  branchName: string;\n  requiredApprovals?: number;\n  enablePush?: boolean;\n  enableStatusCheck?: boolean;\n  requireSignedCommits?: boolean;\n  dismissStaleApprovals?: boolean;\n  ignoreStaleApprovals?: boolean;\n  applyToAdmins?: boolean;\n  statusCheckContexts?: string[];\n}\n\nexport interface BranchProtectionAttributes {\n  owner: string;\n  repo: string;\n  branchName: string;\n  requiredApprovals: number;\n  enablePush: boolean;\n  enableStatusCheck: boolean;\n  requireSignedCommits: boolean;\n  dismissStaleApprovals: boolean;\n  ignoreStaleApprovals: boolean;\n  applyToAdmins: boolean;\n  statusCheckContexts: string[];\n}\n\nexport interface ForgejoBranchProtection extends Resource<\n  'Forgejo.BranchProtection',\n  BranchProtectionProps,\n  BranchProtectionAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoBranchProtection = Resource<ForgejoBranchProtection>(\n  'Forgejo.BranchProtection',\n  { defaultRemovalPolicy: 'retain' },\n);\n\nconst handlers = forgejoHandlers<BranchProtectionProps, BranchProtectionAttributes>({\n  attributes: (live, props) => {\n    const ruleName = text(live['rule_name'], text(live['branch_name']));\n    if (ruleName === '') return undefined;\n    return {\n      applyToAdmins: bool(live['apply_to_admins']),\n      branchName: props.branchName,\n      dismissStaleApprovals: bool(live['dismiss_stale_approvals']),\n      enablePush: bool(live['enable_push'], true),\n      enableStatusCheck: bool(live['enable_status_check']),\n      ignoreStaleApprovals: bool(live['ignore_stale_approvals']),\n      owner: props.owner,\n      repo: props.repo,\n      requireSignedCommits: bool(live['require_signed_commits']),\n      requiredApprovals: int(live['required_approvals']),\n      statusCheckContexts: stringArray(live['status_check_contexts']),\n    };\n  },\n  collection: (props) => `repos/${props.owner}/${props.repo}/branch_protections`,\n  createForm: branchProtectionForm,\n  matches: (attributes, props) =>\n    attributes.requiredApprovals === (props.requiredApprovals ?? 0) &&\n    attributes.enablePush === (props.enablePush ?? true) &&\n    attributes.enableStatusCheck === (props.enableStatusCheck ?? false) &&\n    attributes.requireSignedCommits === (props.requireSignedCommits ?? false) &&\n    attributes.dismissStaleApprovals === (props.dismissStaleApprovals ?? false) &&\n    attributes.ignoreStaleApprovals === (props.ignoreStaleApprovals ?? false) &&\n    attributes.applyToAdmins === (props.applyToAdmins ?? false) &&\n    (props.statusCheckContexts === undefined ||\n      stringArray(props.statusCheckContexts).join('\\0') ===\n        attributes.statusCheckContexts.join('\\0')),\n  path: (props) => `repos/${props.owner}/${props.repo}/branch_protections/${props.branchName}`,\n  updateForm: branchProtectionForm,\n});\n\nexport const ForgejoBranchProtectionProvider = () =>\n  Provider.effect(\n    ForgejoBranchProtection,\n    Effect.succeed(ForgejoBranchProtection.Provider.of(handlers)),\n  );\n",
-    "/**\n * Create/PATCH bodies for `Forgejo.BranchProtection` — extracted for the 250-line cap.\n *\n * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json` — create posts\n *   `CreateBranchProtectionOption`; update sends `EditBranchProtectionOption` fields only.\n */\nimport type { BranchProtectionProps } from './branch-protection.ts';\n\nexport const branchProtectionForm = (props: BranchProtectionProps) => ({\n  ...(props.applyToAdmins === undefined ? {} : { apply_to_admins: props.applyToAdmins }),\n  ...(props.dismissStaleApprovals === undefined\n    ? {}\n    : { dismiss_stale_approvals: props.dismissStaleApprovals }),\n  ...(props.enablePush === undefined ? {} : { enable_push: props.enablePush }),\n  ...(props.enableStatusCheck === undefined\n    ? {}\n    : { enable_status_check: props.enableStatusCheck }),\n  ...(props.ignoreStaleApprovals === undefined\n    ? {}\n    : { ignore_stale_approvals: props.ignoreStaleApprovals }),\n  ...(props.requireSignedCommits === undefined\n    ? {}\n    : { require_signed_commits: props.requireSignedCommits }),\n  ...(props.requiredApprovals === undefined ? {} : { required_approvals: props.requiredApprovals }),\n  ...(props.statusCheckContexts === undefined\n    ? {}\n    : { status_check_contexts: props.statusCheckContexts }),\n  rule_name: props.branchName,\n});\n",
-    "/**\n * One shape for every Forgejo object — the same four operations, different path and JSON body.\n *\n * ⛔ THE ALTERNATIVE IS COPYING THE SAME HANDLERS PER RESOURCE. Repositories, org labels, teams,\n *   runners, branch protection and package settings are all create / read / update / delete over\n *   `/api/v1` with JSON bodies. Hand-rolling the fourth copy is where someone drops the read-back\n *   or the isResolved guard and the plan lies.\n *\n * ★ SO THE FOUR OPERATIONS LIVE HERE, ONCE. A new Forgejo object should be a spec plus ~forty\n *   lines, not a hundred and thirty.\n *\n * ⚠️ GITEA ANSWERS WITH THE OBJECT DIRECTLY — NOT `{\"data\": ...}`. See client.ts. reconcile still\n *   READS BACK after every write rather than trusting the status code alone.\n *\n * ★ WHY `Forgejo.Repository` DECLARES `defaultRemovalPolicy: 'retain'`, WRITTEN ONCE HERE.\n *   Alchemy's own `GitHub.Repository` defaults to retain \"because their contents are\n *   irreplaceable\". A git repository is the most irreplaceable object on this estate. `retain`\n *   means the engine skips `provider.delete` when a resource is orphaned unless the caller opted\n *   into `.pipe(RemovalPolicy.destroy())`. The `delete` handler is FULLY IMPLEMENTED anyway — a\n *   stub that silently does nothing lies to whoever reads the plan.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\nimport { ForgejoError, forgejo } from './client.ts';\n\n/**\n * ★ WHAT EVERY OPERATION HERE NEEDS FROM THE RUNTIME — and it is NOT what the first draft said.\n *\n *   These resources declared `ChildProcessSpawner`, copied from <estate>/proxmox, where it is there\n *   because a PVE credential is minted by shelling out to `bao`. Nothing in this package shells\n *   out: the token comes from `FORGEJO_TOKEN` in the environment. Declaring a service you never\n *   use is not harmless — it makes a stack provide a layer for nothing, and it hides the one\n *   service you DO need.\n *\n *   What is actually required is `HttpClient`, for the reason in client.ts: Alchemy's own\n *   providers call through Effect's client rather than the global `fetch`.\n */\nexport type ForgejoRequirements = HttpClient.HttpClient;\n\nexport type ForgejoSpec<Props extends object, Attributes> = {\n  /** `repos/HomeFlare/homeflare`, `orgs/homeflare/labels/40` — one object. */\n  readonly path: (props: Props) => string;\n  /** `orgs/HomeFlare/repos`, `orgs/homeflare/labels` — where a new one is POSTed. */\n  readonly collection: (props: Props) => string;\n  readonly attributes: (live: Record<string, unknown>, props: Props) => Attributes | undefined;\n  /** JSON body on create. ⚠️ Gitea takes JSON, not form encoding. */\n  readonly createForm: (props: Props) => Record<string, unknown>;\n  readonly updateForm?: (props: Props) => Record<string, unknown>;\n  readonly matches: (attributes: Attributes, props: Props) => boolean;\n  /**\n   * When the stable key is not enough for the wire path — org labels are addressed by numeric id.\n   * `locate` lists or searches; `wirePath` builds update/delete paths from the live row.\n   */\n  readonly locate?: (\n    props: Props,\n  ) => Effect.Effect<Record<string, unknown> | undefined, ForgejoError, ForgejoRequirements>;\n  readonly wirePath?: (props: Props, live: Record<string, unknown>) => string;\n  /**\n   * When create is PUT upsert rather than POST — org actions secrets have no POST and no GET-by-name.\n   * `before === undefined` means absent; the callback decides whether to write. Existence-only families\n   * noop when `before` is set because the API never returns the value for comparison.\n   */\n  readonly upsert?: (\n    props: Props,\n    before: Record<string, unknown> | undefined,\n  ) => Effect.Effect<void, ForgejoError, ForgejoRequirements>;\n};\n\n/** ⚠️ Only 404 folds to \"absent\". A 403 is a real failure — folding it would plan a create over an existing object. */\nconst absentOn404 = <A>(io: Effect.Effect<A, ForgejoError, ForgejoRequirements>) =>\n  io.pipe(\n    Effect.catchIf(\n      (cause): cause is ForgejoError => cause instanceof ForgejoError && cause.status === 404,\n      () => Effect.succeed(undefined as A),\n    ),\n  );\n\nexport const forgejoOperations = <Props extends object, Attributes>(\n  spec: ForgejoSpec<Props, Attributes>,\n) => {\n  const fetchLive = (props: Props) =>\n    absentOn404(\n      spec.locate !== undefined\n        ? spec.locate(props)\n        : forgejo<Record<string, unknown>>('GET', spec.path(props)),\n    );\n\n  const objectPath = (props: Props, live: Record<string, unknown>) =>\n    spec.wirePath === undefined ? spec.path(props) : spec.wirePath(props, live);\n\n  const read = (props: Props) =>\n    fetchLive(props).pipe(\n      Effect.map((data) => (data === undefined ? undefined : spec.attributes(data, props))),\n    );\n\n  return {\n    read,\n\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        if (output === undefined || !isResolved(news)) return undefined;\n        const live = yield* read(news);\n        if (live === undefined) return { action: 'update' } as const;\n        if (spec.matches(live, news)) return { action: 'noop' } as const;\n        return spec.updateForm === undefined\n          ? ({ action: 'replace' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const before = yield* fetchLive(news);\n        if (spec.upsert !== undefined) {\n          yield* spec.upsert(news, before);\n        } else if (before === undefined) {\n          yield* forgejo('POST', spec.collection(news), spec.createForm(news));\n        } else if (spec.updateForm !== undefined) {\n          const mapped = spec.attributes(before, news);\n          if (mapped === undefined || spec.matches(mapped, news)) {\n            /* adoption or already converged — no PATCH */\n          } else {\n            const form = spec.updateForm(news);\n            if (Object.keys(form).length > 0) {\n              yield* forgejo('PATCH', objectPath(news, before), form);\n            }\n          }\n        }\n        const after = yield* read(news);\n        if (after === undefined) {\n          return yield* Effect.die(\n            new Error(\n              `${spec.path(news)}: the write returned no error but the object is still absent. ` +\n                'Gitea returns the object directly — read back rather than trusting the status code.',\n            ),\n          );\n        }\n        return after;\n      }),\n\n    destroy: (olds: Props) =>\n      Effect.gen(function* () {\n        const live = yield* fetchLive(olds);\n        if (live === undefined) return;\n        yield* forgejo('DELETE', objectPath(olds, live));\n      }),\n  };\n};\n\n/**\n * The five provider handlers for a spec'd Forgejo object, wired once.\n *\n * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER — same reasoning as pveHandlers in\n *   <estate>/proxmox: wrapping `Provider.effect` here needs casts against Alchemy's `Props<R>`.\n *\n * ⚠️ `list` answers empty — Forgejo index endpoints return the whole org; adoption stays explicit.\n */\nexport const forgejoHandlers = <Props extends object, Attributes extends object>(\n  spec: ForgejoSpec<Props, Attributes>,\n) => {\n  const ops = forgejoOperations(spec);\n  return {\n    list: () => Effect.succeed([]),\n    read: ({ olds }: { olds: Props }) => ops.read(olds),\n    diff: ({ news, output }: { news: Input<Props>; output: Attributes | undefined }) =>\n      ops.diff(news, output),\n    reconcile: ({ news }: { news: Props }) => ops.reconcile(news),\n    delete: ({ olds }: { olds: Props }) => ops.destroy(olds),\n  };\n};\n",
-    "/**\n * One authenticated call to the Forgejo (Gitea) API at `/api/v1`.\n *\n * ★ PLAIN `fetch`, NO TLS ESCAPE HATCH — your Forgejo host serves a real certificate on :443,\n *   and the local daemon on :3000 is loopback. There is no `rejectUnauthorized` switch to leave\n *   on by accident elsewhere.\n *\n * ⚠️ GITEA DOES NOT WRAP ANSWERS IN `{\"data\": ...}` THE WAY PVE DOES. MEASURED 2026-09-13 on\n *   the live daemon: `GET /api/v1/version` returns `{\"version\":\"16.0.3\"}`; `GET /api/v1/user`\n *   returns the user object; `GET /api/v1/orgs/HomeFlare/repos` returns a JSON array. A caller\n *   that unwraps a non-existent envelope sees `undefined` and calls a healthy object \"absent\".\n *\n * ⛔ THE TOKEN IS NEVER A PROP. Read `FORGEJO_TOKEN` from the environment at call time only.\n *   Alchemy persists attributes unencrypted and this estate's state store is Postgres dumped\n *   nightly — nothing stored may be a credential.\n */\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport * as HttpClientRequest from 'effect/unstable/http/HttpClientRequest';\n\nconst PATH_PREFIX = '/api/v1';\n\n/**\n * The Forgejo instance, from `FORGEJO_URL`. Trailing slash stripped.\n *\n * ⛔ NO DEFAULT HOSTNAME. This used to fall back to the author's own instance, which is\n *   fine inside one estate and wrong in a published package: a consumer who forgets the\n *   variable would silently point at someone else's server rather than being told.\n * ⚠️ Read at CALL time, never at module scope — a value captured at import is pinned to\n *   whatever the first isolate saw.\n */\nexport const apiBase = (): string => {\n  const raw = process.env['FORGEJO_URL'];\n  if (raw === undefined || raw.trim() === '') {\n    throw new Error(\n      'FORGEJO_URL is not set. Point it at your Forgejo instance, e.g. https://git.example.com',\n    );\n  }\n  return raw.trim().replace(/\\/$/, '');\n};\n\nconst token = (): Effect.Effect<string, ForgejoError> =>\n  Effect.gen(function* () {\n    const raw = process.env['FORGEJO_TOKEN'];\n    if (raw === undefined || raw.trim() === '') {\n      return yield* Effect.fail(\n        new ForgejoError(\n          0,\n          'GET',\n          '',\n          'FORGEJO_TOKEN is unset. Mint a scoped token and export it — never store it in Alchemy props.',\n        ),\n      );\n    }\n    return raw.trim();\n  });\n\nexport class ForgejoError extends Error {\n  constructor(\n    readonly status: number,\n    readonly method: string,\n    readonly path: string,\n    detail: string,\n  ) {\n    super(`Forgejo ${method} ${path} -> ${String(status)}: ${detail}`);\n    this.name = 'ForgejoError';\n  }\n}\n\n/**\n * ⚠️ `Authorization: token <value>`, NOT `Bearer`. Gitea docs and MEASURED behaviour on this\n *   estate: Bearer is treated as OAuth2 and rejected; `token` is the documented API-key form.\n */\nconst authorization = (value: string) => ({ Authorization: `token ${value}` });\n\n/** One JSON call. Returns the parsed body, or `undefined` when the response is empty (DELETE). */\nexport const forgejo = <T>(\n  method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE',\n  path: string,\n  body?: Record<string, unknown>,\n) =>\n  Effect.gen(function* () {\n    const credential = yield* token();\n    const url = `${apiBase()}${PATH_PREFIX}/${path.replace(/^\\//, '')}`;\n    /**\n     * ★ THROUGH `HttpClient`, NOT THE GLOBAL `fetch` — the idiom Alchemy's own providers follow\n     *   (src/Hetzner/Providers.ts builds on `FetchHttpClient.layer`; there is no bare fetch in its\n     *   Docker, Kubernetes or GitHub providers). It buys a typed error channel, interruption when\n     *   a plan is cancelled, the runtime's tracing, and a client a test can replace without\n     *   monkey-patching a global. <estate>/proxmox/src/resource.ts carries the same note.\n     */\n    const client = yield* HttpClient.HttpClient;\n    /**\n     * ⛔ THE CONTENT TYPE GOES ON `bodyText`, NOT IN THE HEADER MAP, AND PUTTING IT IN BOTH IS HOW\n     *   THIS PACKAGE SHIPPED UNABLE TO WRITE AT ALL.\n     *\n     * 🔴 THE BUG, MEASURED THE FIRST TIME A WRITE WAS EVER ATTEMPTED. The header map DID carry\n     *   `Content-Type: application/json` — and `bodyText(s)` with no second argument sets\n     *   `text/plain` and OVERWRITES it, because it is piped AFTER `setHeaders`. Forgejo answered\n     *       422 {\"message\":\"[]: Unsupported Content-Type\"}\n     *   on `PATCH orgs/homeflare/labels/1`. Every create and every update in every family here was\n     *   broken, identically, from the day the client was written.\n     *\n     * ⛔ NOTHING CAUGHT IT BECAUSE NOTHING HAD EVER WRITTEN. The only credential on the shelf was\n     *   `mcp-read`, which answers 403 before a request body is ever parsed — so read, adopt, diff\n     *   and plan all worked perfectly and the write path had literally never executed. A provider\n     *   that has never performed its own writes is not a tested provider, whatever the plan says.\n     *\n     * ⚠️ `bodyJsonUnsafe` WOULD ALSO WORK. `bodyText` with an explicit type is used instead\n     *   because it makes the content type visible at the call site, which is the thing that was\n     *   invisible before.\n     */\n    const request = HttpClientRequest.make(method)(url).pipe(\n      HttpClientRequest.setHeaders({ ...authorization(credential), Accept: 'application/json' }),\n      body === undefined\n        ? (self) => self\n        : HttpClientRequest.bodyText(JSON.stringify(body), 'application/json'),\n    );\n    const response = yield* client\n      .execute(request)\n      .pipe(Effect.mapError((cause) => new ForgejoError(0, method, path, String(cause))));\n    // ⛔ Status first, body once — a Gitea error body is JSON but a proxy's 502 is not.\n    if (response.status < 200 || response.status >= 300) {\n      const detail = yield* response.text.pipe(Effect.orElseSucceed(() => ''));\n      return yield* Effect.fail(\n        new ForgejoError(response.status, method, path, detail.slice(0, 300)),\n      );\n    }\n    // ⚠️ 204 AND AN EMPTY BODY ARE REAL: a label DELETE answers no content, and `json` on an empty\n    //   body fails. Read text once and parse only when there is something to parse.\n    const text = yield* response.text.pipe(\n      Effect.mapError((cause) => new ForgejoError(0, method, path, String(cause))),\n    );\n    // ⚠️ PUT/DELETE on actions secrets and hooks often answer 201/204 with no body — same trap as DELETE.\n    return (text === '' ? undefined : JSON.parse(text)) as T;\n  });\n",
-    "/**\n * Wire coercions shared across Forgejo resources.\n *\n * ★ GITEA/ FORGEJO JSON USES snake_case ON THE WIRE and camelCase in props — each resource\n *   translates at the form boundary; these helpers only normalise values for comparison.\n */\n\nexport const text = (value: unknown, fallback = '') =>\n  typeof value === 'string' ? value : fallback;\n\n/** Forgejo returns label colours without `#`; declarations may include it. */\nexport const color = (value: unknown) => text(value).replace(/^#/, '').toLowerCase();\n\nexport const bool = (value: unknown, fallback = false) =>\n  value === undefined || value === null ? fallback : value === true || value === 1 || value === '1';\n\nexport const int = (value: unknown, fallback = 0) => {\n  if (typeof value === 'number' && Number.isFinite(value)) return Math.trunc(value);\n  if (typeof value === 'string' && value.trim() !== '') {\n    const parsed = Number.parseInt(value, 10);\n    if (Number.isFinite(parsed)) return parsed;\n  }\n  return fallback;\n};\n\n/** Wire arrays compared in sorted order — Gitea reshuffles nothing but callers should not depend on order. */\nexport const stringArray = (value: unknown) =>\n  Array.isArray(value)\n    ? value.filter((entry): entry is string => typeof entry === 'string').toSorted()\n    : [];\n\nexport const stringRecord = (value: unknown): Record<string, string> => {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return {};\n  const out: Record<string, string> = {};\n  for (const [key, entry] of Object.entries(value)) {\n    if (typeof entry === 'string') out[key] = entry;\n  }\n  return out;\n};\n\nexport const recordEqual = (left: Record<string, string>, right: Record<string, string>) => {\n  const leftKeys = Object.keys(left).toSorted();\n  const rightKeys = Object.keys(right).toSorted();\n  if (leftKeys.length !== rightKeys.length) return false;\n  return leftKeys.every((key, index) => rightKeys[index] === key && left[key] === right[key]);\n};\n\n/** Hook `config` without `secret` — the value must never land in Alchemy attributes. */\nexport const hookConfigPublic = (value: unknown) => {\n  const config = stringRecord(value);\n  const { secret: _secret, ...rest } = config;\n  return rest;\n};\n\n/** Env key for a write-only org actions secret — value read at PUT time only, never stored. */\nexport const orgSecretEnvKey = (org: string, name: string) =>\n  `FORGEJO_ORG_SECRET_${org}_${name}`.replace(/[^A-Za-z0-9_]/g, '_').toUpperCase();\n\n/** Env key for a write-only repo webhook HMAC secret — omitted from attributes and props. */\nexport const hookSecretEnvKey = (owner: string, repo: string, name: string) =>\n  `FORGEJO_HOOK_SECRET_${owner}_${repo}_${name}`.replace(/[^A-Za-z0-9_]/g, '_').toUpperCase();\n",
-    "/**\n * `Forgejo.OrgSecret` — org-level Actions secret metadata at `/orgs/{org}/actions/secrets/{name}`.\n *\n * ★ CHOICE: AUTHORED WITH WRITE-ONLY VALUE VIA ENV, NOT REFUSED. The OpenAPI in\n *   `<estate>/mcp-servers/docs/api/upstream/forgejo.json` shows `Secret` returns only `name` and\n *   `created_at` — never the `data` field — so attributes stay metadata-only. Create/update is PUT\n *   with body `{ data }`, which does not fit POST/PATCH; this family uses the `upsert` seam on\n *   `ForgejoSpec` instead of hand-rolling provider handlers.\n *\n * ⛔ THE SECRET VALUE IS NEVER A PROP OR AN ATTRIBUTE. It is read from `FORGEJO_ORG_SECRET_{org}_{name}`\n *   (see orgSecretEnvKey) at PUT time when the name is absent from the list. Once present, reconcile\n *   noops — the API cannot confirm the value matches, and re-PUT on every deploy would rotate\n *   unintentionally. Rotate by destroy-then-create or a manual PUT outside Alchemy.\n *\n * ⚠️ PUT ANSWERS 201/204 WITH NO BODY — client.ts treats empty responses as `undefined`; read-back\n *   uses the list endpoint, not the PUT response.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO PUT — list needs `read:organization`.\n *\n * ⛔ THE FILE NAME IS PLURAL ON PURPOSE AND MUST STAY THAT WAY. `.gitignore:198` carries\n *   `*-secret.*` — the rule that stops `client-secret.json` and friends being committed — and it\n *   matches a SOURCE file called `org-secret.ts` just as happily. This family was first authored\n *   under that name: it existed on disk, typechecked, passed oxlint, was imported by alchemy.run.ts\n *   and appeared in NO `git status`. It would have been committed as a broken import for everyone\n *   else, with the local tree green the whole time. `scripts/husky/ignored-imports.ts` is the gate\n *   that now catches the class; this comment is for whoever is tempted to rename it back.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { ForgejoError, forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { orgSecretEnvKey, text } from './values.ts';\n\nexport interface OrgSecretProps {\n  org: string;\n  /** Secret name — path key; value lives in env, not here. */\n  name: string;\n}\n\nexport interface OrgSecretAttributes {\n  org: string;\n  name: string;\n  createdAt: string;\n}\n\nexport interface ForgejoOrgSecret extends Resource<\n  'Forgejo.OrgSecret',\n  OrgSecretProps,\n  OrgSecretAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgSecret = Resource<ForgejoOrgSecret>('Forgejo.OrgSecret');\n\nconst secretData = (org: string, name: string) =>\n  Effect.gen(function* () {\n    const key = orgSecretEnvKey(org, name);\n    const raw = process.env[key];\n    if (raw === undefined || raw.trim() === '') {\n      return yield* Effect.fail(\n        new ForgejoError(\n          0,\n          'PUT',\n          `orgs/${org}/actions/secrets/${name}`,\n          `${key} is unset. Export the secret value there — never as an Alchemy prop.`,\n        ),\n      );\n    }\n    return raw.trim();\n  });\n\nconst handlers = forgejoHandlers<OrgSecretProps, OrgSecretAttributes>({\n  attributes: (live, props) => ({\n    createdAt: text(live['created_at']),\n    name: props.name,\n    org: props.org,\n  }),\n  collection: (props) => `orgs/${props.org}/actions/secrets/${props.name}`,\n  createForm: () => ({}),\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>('GET', `orgs/${props.org}/actions/secrets?limit=200`).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows) ? rows.find((row) => row['name'] === props.name) : undefined,\n      ),\n    ),\n  matches: () => true,\n  path: (props) => `orgs/${props.org}/actions/secrets/${props.name}`,\n  upsert: (props, before) =>\n    Effect.gen(function* () {\n      if (before !== undefined) return;\n      const data = yield* secretData(props.org, props.name);\n      yield* forgejo('PUT', `orgs/${props.org}/actions/secrets/${props.name}`, { data });\n    }),\n});\n\nexport const ForgejoOrgSecretProvider = () =>\n  Provider.effect(ForgejoOrgSecret, Effect.succeed(ForgejoOrgSecret.Provider.of(handlers)));\n",
-    "/**\n * `Forgejo.OrgLabel` — one org-level issue label shared across every repository in the org.\n *\n * ★ RETIRES the estate's hand-run `labels-reconcile.sh`, which\n *   converged the whole `labels.yaml` file in one shot. That script CREATED and PATCHED labels\n *   from the spec and REPORTED `EXTRA` labels present live but absent from the file — it never\n *   deleted them, because removing a label strips it from every issue that carries it.\n *\n * ★ THIS RESOURCE DOES NOT REMOVE EXTRA LABELS EITHER. Alchemy manages only labels you declare;\n *   labels on the org that nobody declared stay untouched — the same boundary as the script's\n *   `EXTRA … NOT deleted` lines. Removing a declaration defaults to `retain`, so dropping a label\n *   from the stack does not DELETE it unless the caller opts into `.pipe(RemovalPolicy.destroy())`.\n *   That matches the script's never-delete posture while still allowing a deliberate destroy.\n *\n * ⚠️ THE WIRE PATH USES NUMERIC ID, NOT NAME — measured on live org labels: PATCH and DELETE are\n *   `/orgs/{org}/labels/{id}`. `locate` lists by name; `wirePath` uses the id from that row.\n *\n * ⛔ TOKEN NEEDS `write:organization` FOR RECONCILE — the mcp-read token lacks it (POST 403\n *   measured 2026-09-13). Plan/deploy needs a provision-scoped credential in `FORGEJO_TOKEN`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, color, text } from './values.ts';\n\nexport interface OrgLabelProps {\n  /** Organization login — `homeflare` / `HomeFlare` must match the live org. */\n  org: string;\n  /** Label name — primary key for locate; immutable on update. */\n  name: string;\n  /** Six-digit hex, with or without `#`. */\n  color: string;\n  description?: string;\n  exclusive?: boolean;\n}\n\nexport interface OrgLabelAttributes {\n  org: string;\n  name: string;\n  labelId: number;\n  color: string;\n  description: string;\n  exclusive: boolean;\n}\n\nexport interface ForgejoOrgLabel extends Resource<\n  'Forgejo.OrgLabel',\n  OrgLabelProps,\n  OrgLabelAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgLabel = Resource<ForgejoOrgLabel>('Forgejo.OrgLabel', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst handlers = forgejoHandlers<OrgLabelProps, OrgLabelAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    return {\n      color: color(live['color']),\n      description: text(live['description']),\n      exclusive: bool(live['exclusive']),\n      labelId: id,\n      name: props.name,\n      org: props.org,\n    };\n  },\n  collection: (props) => `orgs/${props.org}/labels`,\n  createForm: (props) => ({\n    color: color(props.color),\n    description: props.description ?? '',\n    exclusive: props.exclusive ?? false,\n    name: props.name,\n  }),\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>('GET', `orgs/${props.org}/labels?limit=200`).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows) ? rows.find((row) => row['name'] === props.name) : undefined,\n      ),\n    ),\n  matches: (attributes, props) =>\n    attributes.color === color(props.color) &&\n    attributes.description === (props.description ?? '') &&\n    attributes.exclusive === (props.exclusive ?? false),\n  path: (props) => `orgs/${props.org}/labels/${props.name}`,\n  updateForm: (props) => ({\n    color: color(props.color),\n    description: props.description ?? '',\n    exclusive: props.exclusive ?? false,\n  }),\n  wirePath: (props, live) => `orgs/${props.org}/labels/${String(live['id'])}`,\n});\n\nexport const ForgejoOrgLabelProvider = () =>\n  Provider.effect(ForgejoOrgLabel, Effect.succeed(ForgejoOrgLabel.Provider.of(handlers)));\n",
-    "/**\n * `Forgejo.OrgTeam` — one organization team under `/orgs/{org}/teams`.\n *\n * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json` (Forgejo 16.x OpenAPI): create is\n *   `POST /orgs/{org}/teams`; read/update/delete use numeric id at `/teams/{id}` — not the name.\n *\n * ⚠️ PATCH AND DELETE USE `/teams/{id}` — same seam as org labels. `locate` lists by name;\n *   `wirePath` carries the id from that row.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO CREATE OR PATCH — read list/get needs `read:organization`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, recordEqual, stringArray, stringRecord, text } from './values.ts';\n\nexport type TeamPermission = 'read' | 'write' | 'admin';\n\nexport interface OrgTeamProps {\n  org: string;\n  /** Team name — primary locate key; sent on every PATCH body. */\n  name: string;\n  description?: string;\n  permission?: TeamPermission;\n  units?: string[];\n  unitsMap?: Record<string, string>;\n  includesAllRepositories?: boolean;\n  canCreateOrgRepo?: boolean;\n}\n\nexport interface OrgTeamAttributes {\n  org: string;\n  name: string;\n  teamId: number;\n  description: string;\n  permission: TeamPermission;\n  units: string[];\n  unitsMap: Record<string, string>;\n  includesAllRepositories: boolean;\n  canCreateOrgRepo: boolean;\n}\n\nexport interface ForgejoOrgTeam extends Resource<\n  'Forgejo.OrgTeam',\n  OrgTeamProps,\n  OrgTeamAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgTeam = Resource<ForgejoOrgTeam>('Forgejo.OrgTeam');\n\nconst teamForm = (props: OrgTeamProps) => ({\n  can_create_org_repo: props.canCreateOrgRepo ?? false,\n  description: props.description ?? '',\n  includes_all_repositories: props.includesAllRepositories ?? false,\n  name: props.name,\n  ...(props.permission === undefined ? {} : { permission: props.permission }),\n  ...(props.units === undefined ? {} : { units: props.units }),\n  ...(props.unitsMap === undefined ? {} : { units_map: props.unitsMap }),\n});\n\nconst handlers = forgejoHandlers<OrgTeamProps, OrgTeamAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    const permission = text(live['permission'], 'read');\n    if (permission !== 'read' && permission !== 'write' && permission !== 'admin') return undefined;\n    return {\n      canCreateOrgRepo: bool(live['can_create_org_repo']),\n      description: text(live['description']),\n      includesAllRepositories: bool(live['includes_all_repositories']),\n      name: props.name,\n      org: props.org,\n      permission,\n      teamId: id,\n      units: stringArray(live['units']),\n      unitsMap: stringRecord(live['units_map']),\n    };\n  },\n  collection: (props) => `orgs/${props.org}/teams`,\n  createForm: teamForm,\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>('GET', `orgs/${props.org}/teams?limit=200`).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows) ? rows.find((row) => row['name'] === props.name) : undefined,\n      ),\n    ),\n  matches: (attributes, props) =>\n    attributes.description === (props.description ?? '') &&\n    attributes.permission === (props.permission ?? 'read') &&\n    attributes.includesAllRepositories === (props.includesAllRepositories ?? false) &&\n    attributes.canCreateOrgRepo === (props.canCreateOrgRepo ?? false) &&\n    (props.units === undefined ||\n      stringArray(props.units).join('\\0') === attributes.units.join('\\0')) &&\n    (props.unitsMap === undefined || recordEqual(attributes.unitsMap, props.unitsMap)),\n  path: (props) => `orgs/${props.org}/teams/${props.name}`,\n  updateForm: teamForm,\n  wirePath: (_props, live) => `teams/${String(live['id'])}`,\n});\n\nexport const ForgejoOrgTeamProvider = () =>\n  Provider.effect(ForgejoOrgTeam, Effect.succeed(ForgejoOrgTeam.Provider.of(handlers)));\n",
-    "/**\n * `Forgejo.RepoWebhook` — one repository webhook under `/repos/{owner}/{repo}/hooks`.\n *\n * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json`: create is POST collection; read/update/delete\n *   use numeric hook id at `/repos/{owner}/{repo}/hooks/{id}`. `locate` lists and matches on `name`.\n *\n * ⛔ NO WEBHOOK `secret` IN PROPS OR ATTRIBUTES. Optional HMAC material is env-only at write time\n *   (`FORGEJO_HOOK_SECRET_*` — see repo-webhook-form.ts). `hookConfigPublic` strips `secret` on read.\n *\n * ⛔ TOKEN NEEDS `write:repository` TO CREATE OR PATCH — list/get needs `read:repository`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { forgejo } from './client.ts';\nimport { createHookForm, hookUrl, updateHookForm } from './repo-webhook-form.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, hookConfigPublic, stringArray, text } from './values.ts';\n\nexport type RepoWebhookType =\n  | 'dingtalk'\n  | 'discord'\n  | 'feishu'\n  | 'forgejo'\n  | 'gitea'\n  | 'gogs'\n  | 'msteams'\n  | 'packagist'\n  | 'slack'\n  | 'telegram'\n  | 'wechatwork';\n\nexport interface RepoWebhookProps {\n  owner: string;\n  repo: string;\n  /** Stable locate key — also sent as Hook.name on create. */\n  name: string;\n  type: RepoWebhookType;\n  url: string;\n  events: string[];\n  contentType?: 'json' | 'form';\n  active?: boolean;\n  branchFilter?: string;\n  authorizationHeader?: string;\n}\n\nexport interface RepoWebhookAttributes {\n  owner: string;\n  repo: string;\n  name: string;\n  hookId: number;\n  type: RepoWebhookType;\n  url: string;\n  contentType: string;\n  events: string[];\n  active: boolean;\n  branchFilter: string;\n  authorizationHeader: string;\n}\n\nexport interface ForgejoRepoWebhook extends Resource<\n  'Forgejo.RepoWebhook',\n  RepoWebhookProps,\n  RepoWebhookAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoRepoWebhook = Resource<ForgejoRepoWebhook>('Forgejo.RepoWebhook');\n\nconst handlers = forgejoHandlers<RepoWebhookProps, RepoWebhookAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    const config = hookConfigPublic(live['config']);\n    const type = text(live['type']);\n    return {\n      active: bool(live['active'], true),\n      authorizationHeader: text(live['authorization_header']),\n      branchFilter: text(live['branch_filter']),\n      contentType: text(config['content_type'], text(live['content_type'], 'json')),\n      events: stringArray(live['events']),\n      hookId: id,\n      name: props.name,\n      owner: props.owner,\n      repo: props.repo,\n      type: type as RepoWebhookType,\n      url: hookUrl(live),\n    };\n  },\n  collection: (props) => `repos/${props.owner}/${props.repo}/hooks`,\n  createForm: createHookForm,\n  locate: (props) =>\n    forgejo<Record<string, unknown>[]>(\n      'GET',\n      `repos/${props.owner}/${props.repo}/hooks?limit=200`,\n    ).pipe(\n      Effect.map((rows) =>\n        Array.isArray(rows)\n          ? rows.find((row) => text(row['name']) === props.name || hookUrl(row) === props.url)\n          : undefined,\n      ),\n    ),\n  matches: (attributes, props) =>\n    attributes.type === props.type &&\n    attributes.url === props.url &&\n    attributes.active === (props.active ?? true) &&\n    attributes.contentType === (props.contentType ?? 'json') &&\n    attributes.branchFilter === (props.branchFilter ?? '') &&\n    attributes.authorizationHeader === (props.authorizationHeader ?? '') &&\n    stringArray(props.events).join('\\0') === attributes.events.join('\\0'),\n  path: (props) => `repos/${props.owner}/${props.repo}/hooks/${props.name}`,\n  updateForm: updateHookForm,\n  wirePath: (props, live) => `repos/${props.owner}/${props.repo}/hooks/${String(live['id'])}`,\n});\n\nexport const ForgejoRepoWebhookProvider = () =>\n  Provider.effect(ForgejoRepoWebhook, Effect.succeed(ForgejoRepoWebhook.Provider.of(handlers)));\n",
-    "/**\n * JSON bodies for `Forgejo.RepoWebhook` — split to keep repo-webhook.ts under the line cap.\n *\n * ⛔ `config.secret` IS NEVER A PROP. When present it is read from `FORGEJO_HOOK_SECRET_*` at\n *   create/update time only (see hookSecretEnvKey in values.ts). Alchemy attributes are Postgres\n *   plaintext — a webhook HMAC secret must not be stored there.\n */\nimport type { RepoWebhookProps } from './repo-webhook.ts';\nimport { hookSecretEnvKey, stringRecord, text } from './values.ts';\n\nexport const hookUrl = (live: Record<string, unknown>) =>\n  text(live['url']) || text(stringRecord(live['config'])['url']);\n\nexport const hookConfigForm = (props: RepoWebhookProps, includeSecret: boolean) => {\n  const config: Record<string, string> = {\n    content_type: props.contentType ?? 'json',\n    url: props.url,\n  };\n  if (includeSecret) {\n    const key = hookSecretEnvKey(props.owner, props.repo, props.name);\n    const secret = process.env[key]?.trim();\n    if (secret !== undefined && secret !== '') config['secret'] = secret;\n  }\n  return config;\n};\n\nexport const createHookForm = (props: RepoWebhookProps) => ({\n  active: props.active ?? true,\n  ...(props.authorizationHeader === undefined\n    ? {}\n    : { authorization_header: props.authorizationHeader }),\n  ...(props.branchFilter === undefined ? {} : { branch_filter: props.branchFilter }),\n  config: hookConfigForm(props, true),\n  events: props.events,\n  name: props.name,\n  type: props.type,\n});\n\nexport const updateHookForm = (props: RepoWebhookProps) => ({\n  active: props.active ?? true,\n  ...(props.authorizationHeader === undefined\n    ? {}\n    : { authorization_header: props.authorizationHeader }),\n  ...(props.branchFilter === undefined ? {} : { branch_filter: props.branchFilter }),\n  config: hookConfigForm(props, false),\n  events: props.events,\n});\n",
-    "/**\n * `Forgejo.Repository` — an organization-owned git repository.\n *\n * ★ MEASURED 2026-09-13 against the live daemon (`GET /api/v1/repos/<org>/<repo>`):\n *   responses are flat JSON with `private`, `has_issues`, `default_branch`, etc. Create is\n *   `POST /orgs/{org}/repos`; read/update/delete use `/repos/{owner}/{repo}`.\n *\n * ⛔ `defaultRemovalPolicy: 'retain'` — history, issues and packages in a repo are irreplaceable.\n *   Opt into deletion with `.pipe(RemovalPolicy.destroy())`; `delete` below is fully implemented.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\nimport { bool, text } from './values.ts';\n\nexport interface RepositoryProps {\n  /** Organization login — the owner segment in `<org>/<repo>`. */\n  org: string;\n  /** Repository name. Changing it is a replace, not an update. */\n  name: string;\n  description?: string;\n  private?: boolean;\n  hasIssues?: boolean;\n  hasWiki?: boolean;\n  hasProjects?: boolean;\n  /** Only applied when the repository already has at least one branch. */\n  defaultBranch?: string;\n  /** Create an initial commit with a README when the repository is new. */\n  autoInit?: boolean;\n}\n\nexport interface RepositoryAttributes {\n  org: string;\n  name: string;\n  repoId: number;\n  description: string;\n  private: boolean;\n  hasIssues: boolean;\n  hasWiki: boolean;\n  hasProjects: boolean;\n  defaultBranch: string;\n  empty: boolean;\n}\n\nexport interface ForgejoRepository extends Resource<\n  'Forgejo.Repository',\n  RepositoryProps,\n  RepositoryAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoRepository = Resource<ForgejoRepository>('Forgejo.Repository', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst handlers = forgejoHandlers<RepositoryProps, RepositoryAttributes>({\n  attributes: (live, props) => {\n    const id = live['id'];\n    if (typeof id !== 'number') return undefined;\n    return {\n      defaultBranch: text(live['default_branch'], 'main'),\n      description: text(live['description']),\n      empty: bool(live['empty']),\n      hasIssues: bool(live['has_issues'], true),\n      hasProjects: bool(live['has_projects'], true),\n      hasWiki: bool(live['has_wiki'], true),\n      name: props.name,\n      org: props.org,\n      private: bool(live['private'], true),\n      repoId: id,\n    };\n  },\n  collection: (props) => `orgs/${props.org}/repos`,\n  createForm: (props) => ({\n    auto_init: props.autoInit ?? false,\n    description: props.description ?? '',\n    has_issues: props.hasIssues ?? true,\n    has_projects: props.hasProjects ?? true,\n    has_wiki: props.hasWiki ?? true,\n    name: props.name,\n    private: props.private ?? true,\n  }),\n  /**\n   * ⛔ AN UNDECLARED FIELD IS NEITHER COMPARED NOR SENT — the rule every other family in this\n   *   estate follows (storage.ts, backup-job.ts, and all four Pbs.* families say it in those\n   *   words), and this file was the exception.\n   *\n   * 🔴 WHAT THE EXCEPTION DID. Five fields were compared against a DEFAULT rather than skipped:\n   *   `description ?? ''`, and `?? true` for private, hasIssues, hasWiki and hasProjects. So a\n   *   declaration that simply did not mention `hasWiki` asserted \"the wiki is ON\", and one that\n   *   did not mention `description` asserted \"the description is EMPTY\" — and `updateForm` sent\n   *   both. Declaring a repo you only wanted to rename would have wiped its description and\n   *   switched features on, reported as a plain `update`. Only `defaultBranch` was written\n   *   correctly, on the line below, which is what the other five now copy.\n   *\n   * ⚠️ THE PRICE, STATED: dropping a line no longer resets a field. Clear one out of band in the\n   *   Forgejo UI or with a direct PATCH. It costs no forever-diff, because an undeclared field is\n   *   not compared either.\n   *\n   * ⚠️ `private` IS THE ONE WORTH DECLARING ANYWAY ON EVERY REPO. Leaving it undeclared now means\n   *   Alchemy will not notice a repository being made public. That is the correct trade for a\n   *   generic family — undeclared is unmanaged, not assumed — but it is a real gap, so say it\n   *   explicitly in each declaration rather than relying on a default that no longer exists.\n   */\n  matches: (attributes, props) =>\n    (props.description === undefined || attributes.description === props.description) &&\n    (props.private === undefined || attributes.private === props.private) &&\n    (props.hasIssues === undefined || attributes.hasIssues === props.hasIssues) &&\n    (props.hasWiki === undefined || attributes.hasWiki === props.hasWiki) &&\n    (props.hasProjects === undefined || attributes.hasProjects === props.hasProjects) &&\n    (props.defaultBranch === undefined || attributes.defaultBranch === props.defaultBranch),\n  path: (props) => `repos/${props.org}/${props.name}`,\n  updateForm: (props) => ({\n    ...(props.defaultBranch === undefined ? {} : { default_branch: props.defaultBranch }),\n    ...(props.description === undefined ? {} : { description: props.description }),\n    ...(props.hasIssues === undefined ? {} : { has_issues: props.hasIssues }),\n    ...(props.hasProjects === undefined ? {} : { has_projects: props.hasProjects }),\n    ...(props.hasWiki === undefined ? {} : { has_wiki: props.hasWiki }),\n    ...(props.private === undefined ? {} : { private: props.private }),\n  }),\n});\n\nexport const ForgejoRepositoryProvider = () =>\n  Provider.effect(ForgejoRepository, Effect.succeed(ForgejoRepository.Provider.of(handlers)));\n",
-    "/**\n * `Forgejo.TeamMember` — one user in one organization team.\n *\n * ★ WHY IT EXISTS: forgejo-provision, the service account the Forgejo engine mints as, belongs to the\n *   HomeFlare Owners team — Tim, 2026-09-14. Membership is what its tokens can reach; the role's\n *   scopes only cap it (<estate>/openbao/src/forgejo-bootstrap.ts).\n *\n * ★ READ OFF THE LIVE 16.0.3 SWAGGER (127.0.0.1:3000/swagger.v1.json, 2026-09-14): GET, PUT and\n *   DELETE `/teams/{id}/members/{username}` answer 200, 204 and 204, and 404 when absent. The team\n *   is addressed by numeric id, so it is found by name first — the same seam as org-team.ts.\n *\n * ⚠️ EXISTENCE IS THE WHOLE OBJECT. Nothing about a membership can be updated, so `matches` is\n *   always true; a different team or user is a different resource id in alchemy.run.ts.\n *\n * ⚠️ THE TEAM ITSELF IS ONLY LOCATED HERE, NEVER MANAGED. A missing team fails the plan by name\n *   instead of folding into \"absent\", because a PUT can add a member but cannot create a team.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO ADD OR REMOVE, and an identity allowed to manage the team.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as Effect from 'effect/Effect';\nimport { ForgejoError, forgejo } from './client.ts';\nimport { type ForgejoRequirements, forgejoHandlers } from './resource.ts';\n\nexport interface TeamMemberProps {\n  org: string;\n  /** Team name as Forgejo shows it, e.g. `Owners`. */\n  team: string;\n  username: string;\n}\n\nexport interface TeamMemberAttributes {\n  org: string;\n  team: string;\n  teamId: number;\n  username: string;\n}\n\nexport interface ForgejoTeamMember extends Resource<\n  'Forgejo.TeamMember',\n  TeamMemberProps,\n  TeamMemberAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoTeamMember = Resource<ForgejoTeamMember>('Forgejo.TeamMember');\n\n/** Where `locate` leaves the team id on the live row, for `attributes` and `wirePath`. */\nconst TEAM_ID = '__team_id';\n\nconst teamIdOf = (props: TeamMemberProps) =>\n  Effect.gen(function* () {\n    const path = `orgs/${props.org}/teams?limit=200`;\n    const rows = yield* forgejo<Record<string, unknown>[]>('GET', path);\n    const id = (Array.isArray(rows) ? rows : []).find((row) => row['name'] === props.team)?.['id'];\n    if (typeof id !== 'number') {\n      return yield* Effect.fail(\n        new ForgejoError(0, 'GET', path, `no team named ${props.team} in org ${props.org}`),\n      );\n    }\n    return id;\n  });\n\nconst memberPath = (id: number, props: TeamMemberProps) =>\n  `teams/${String(id)}/members/${props.username}`;\n\nconst handlers = forgejoHandlers<TeamMemberProps, TeamMemberAttributes>({\n  attributes: (live, props) => {\n    const id = live[TEAM_ID];\n    const login = live['login'];\n    if (typeof id !== 'number' || typeof login !== 'string') return undefined;\n    if (login.toLowerCase() !== props.username.toLowerCase()) return undefined;\n    return { org: props.org, team: props.team, teamId: id, username: props.username };\n  },\n  collection: (props) => `orgs/${props.org}/teams`,\n  createForm: () => ({}),\n  locate: (props) =>\n    Effect.gen(function* () {\n      const id = yield* teamIdOf(props);\n      const user = yield* forgejo<Record<string, unknown>>('GET', memberPath(id, props));\n      return user === undefined ? undefined : { ...user, [TEAM_ID]: id };\n    }),\n  matches: () => true,\n  path: (props) => `orgs/${props.org}/teams/${props.team}/members/${props.username}`,\n  upsert: (props, before) =>\n    before !== undefined\n      ? Effect.void\n      : Effect.flatMap(teamIdOf(props), (id) =>\n          Effect.asVoid(forgejo('PUT', memberPath(id, props))),\n        ),\n  wirePath: (props, live) => memberPath(Number(live[TEAM_ID]), props),\n});\n\nexport const ForgejoTeamMemberProvider = () =>\n  Provider.effect(ForgejoTeamMember, Effect.succeed(ForgejoTeamMember.Provider.of(handlers)));\n"
+    "/**\n * `Forgejo.BranchProtection` — one rule at `/repos/{owner}/{repo}/branch_protections/{name}`.\n *\n * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json`: create is POST collection;\n *   read/update/delete use the branch/rule name in the path segment `{name}`. Now through\n *   `@distilled.cloud/forgejo`'s `repository.repoCreateBranchProtection` /\n *   `repoGetBranchProtection` / `repoEditBranchProtection` / `repoDeleteBranchProtection`.\n *\n * ⚠️ `BranchProtection.rule_name` IS A REQUIRED STRING IN THE PACKAGE'S SCHEMA — the deprecated\n *   `branch_name` fallback the hand-rolled client carried is gone; a response missing `rule_name`\n *   now fails the operation's own decode instead of this family silently treating it as absent.\n *\n * ⛔ `defaultRemovalPolicy: 'retain'` — dropping a protection rule from the stack must not silently\n *   unprotect a branch; opt into `.pipe(RemovalPolicy.destroy())` to DELETE.\n *\n * ⛔ TOKEN NEEDS `write:repository` TO CREATE OR PATCH — get needs `read:repository`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as repository from '@distilled.cloud/forgejo/repository';\nimport * as Effect from 'effect/Effect';\nimport { createBranchProtectionForm, editBranchProtectionForm } from './branch-protection-form.ts';\nimport { type ForgejoRequirements, type ForgejoSpec, forgejoHandlers } from './resource.ts';\nimport { stringArray } from './values.ts';\n\nexport interface BranchProtectionProps {\n  owner: string;\n  repo: string;\n  /** Branch or rule name — path key and `rule_name` on the wire. */\n  branchName: string;\n  requiredApprovals?: number;\n  enablePush?: boolean;\n  enableStatusCheck?: boolean;\n  requireSignedCommits?: boolean;\n  dismissStaleApprovals?: boolean;\n  ignoreStaleApprovals?: boolean;\n  applyToAdmins?: boolean;\n  statusCheckContexts?: string[];\n}\n\nexport interface BranchProtectionAttributes {\n  owner: string;\n  repo: string;\n  branchName: string;\n  requiredApprovals: number;\n  enablePush: boolean;\n  enableStatusCheck: boolean;\n  requireSignedCommits: boolean;\n  dismissStaleApprovals: boolean;\n  ignoreStaleApprovals: boolean;\n  applyToAdmins: boolean;\n  statusCheckContexts: string[];\n}\n\nexport interface ForgejoBranchProtection extends Resource<\n  'Forgejo.BranchProtection',\n  BranchProtectionProps,\n  BranchProtectionAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoBranchProtection = Resource<ForgejoBranchProtection>(\n  'Forgejo.BranchProtection',\n  { defaultRemovalPolicy: 'retain' },\n);\n\n/** ★ EXPORTED for direct testing with an explicit fake `Credentials` layer — see repository.ts. */\nexport const spec: ForgejoSpec<\n  BranchProtectionProps,\n  repository.BranchProtection,\n  BranchProtectionAttributes,\n  | repository.RepoCreateBranchProtectionError\n  | repository.RepoGetBranchProtectionError\n  | repository.RepoEditBranchProtectionError\n  | repository.RepoDeleteBranchProtectionError\n> = {\n  attributes: (live, props) => ({\n    applyToAdmins: live.apply_to_admins ?? false,\n    branchName: props.branchName,\n    dismissStaleApprovals: live.dismiss_stale_approvals ?? false,\n    enablePush: live.enable_push ?? true,\n    enableStatusCheck: live.enable_status_check ?? false,\n    ignoreStaleApprovals: live.ignore_stale_approvals ?? false,\n    owner: props.owner,\n    repo: props.repo,\n    requireSignedCommits: live.require_signed_commits ?? false,\n    requiredApprovals: live.required_approvals ?? 0,\n    statusCheckContexts: stringArray(live.status_check_contexts ?? []),\n  }),\n  create: (props) =>\n    repository.repoCreateBranchProtection({\n      owner: props.owner,\n      repo: props.repo,\n      ...createBranchProtectionForm(props),\n    }),\n  destroy: (props) =>\n    repository.repoDeleteBranchProtection({\n      owner: props.owner,\n      repo: props.repo,\n      name: props.branchName,\n    }),\n  fetchLive: (props) =>\n    repository\n      .repoGetBranchProtection({ owner: props.owner, repo: props.repo, name: props.branchName })\n      .pipe(Effect.catchTag('NotFound', () => Effect.succeed(undefined))),\n  matches: (attributes, props) =>\n    attributes.requiredApprovals === (props.requiredApprovals ?? 0) &&\n    attributes.enablePush === (props.enablePush ?? true) &&\n    attributes.enableStatusCheck === (props.enableStatusCheck ?? false) &&\n    attributes.requireSignedCommits === (props.requireSignedCommits ?? false) &&\n    attributes.dismissStaleApprovals === (props.dismissStaleApprovals ?? false) &&\n    attributes.ignoreStaleApprovals === (props.ignoreStaleApprovals ?? false) &&\n    attributes.applyToAdmins === (props.applyToAdmins ?? false) &&\n    (props.statusCheckContexts === undefined ||\n      stringArray(props.statusCheckContexts).join('\\0') ===\n        attributes.statusCheckContexts.join('\\0')),\n  update: (props) =>\n    repository.repoEditBranchProtection({\n      owner: props.owner,\n      repo: props.repo,\n      name: props.branchName,\n      ...editBranchProtectionForm(props),\n    }),\n};\n\nexport const handlers = forgejoHandlers(spec);\n\nexport const ForgejoBranchProtectionProvider = () =>\n  Provider.effect(\n    ForgejoBranchProtection,\n    Effect.succeed(ForgejoBranchProtection.Provider.of(handlers)),\n  );\n",
+    "/**\n * Create/edit request bodies for `Forgejo.BranchProtection` — extracted for the 250-line cap.\n *\n * ★ `repoCreateBranchProtection`'s request carries `branch_name`; `repoEditBranchProtection`'s\n *   carries `name` (the rule-name path segment) instead — both are covered by the two exports\n *   below, so branch-protection.ts never builds the field list twice.\n */\nimport type { BranchProtectionProps } from './branch-protection.ts';\n\nconst shared = (props: BranchProtectionProps) => ({\n  ...(props.applyToAdmins === undefined ? {} : { apply_to_admins: props.applyToAdmins }),\n  ...(props.dismissStaleApprovals === undefined\n    ? {}\n    : { dismiss_stale_approvals: props.dismissStaleApprovals }),\n  ...(props.enablePush === undefined ? {} : { enable_push: props.enablePush }),\n  ...(props.enableStatusCheck === undefined\n    ? {}\n    : { enable_status_check: props.enableStatusCheck }),\n  ...(props.ignoreStaleApprovals === undefined\n    ? {}\n    : { ignore_stale_approvals: props.ignoreStaleApprovals }),\n  ...(props.requireSignedCommits === undefined\n    ? {}\n    : { require_signed_commits: props.requireSignedCommits }),\n  ...(props.requiredApprovals === undefined ? {} : { required_approvals: props.requiredApprovals }),\n  ...(props.statusCheckContexts === undefined\n    ? {}\n    : { status_check_contexts: props.statusCheckContexts }),\n});\n\nexport const createBranchProtectionForm = (props: BranchProtectionProps) => ({\n  ...shared(props),\n  branch_name: props.branchName,\n});\n\nexport const editBranchProtectionForm = (props: BranchProtectionProps) => shared(props);\n",
+    "/**\n * One shape for every Forgejo object — the same four operations, different distilled call.\n *\n * ⛔ THE ALTERNATIVE IS COPYING THE SAME HANDLERS PER RESOURCE. Repositories, org labels, teams,\n *   webhooks, branch protection and org secrets are all create / read / update / delete against\n *   `@distilled.cloud/forgejo`'s typed operations. Hand-rolling the fourth copy is where someone\n *   drops the read-back or the isResolved guard and the plan lies.\n *\n * ★ SO THE FOUR OPERATIONS LIVE HERE, ONCE. A new Forgejo object is a spec (which distilled\n *   operations to call) plus attribute mapping, not a hundred and thirty lines of its own.\n *\n * 🔴 WHY THIS REPLACED `client.ts`'s HAND-ROLLED `HttpClient` CALLS. Measured against Tim's\n *   distilled research page 2026-09-23: upstream Alchemy only accepts providers that call\n *   `@distilled.cloud/<vendor>` operations and `catchTag` their typed errors — not a raw\n *   `fetch`/`HttpClient` client over a hand-maintained path table. `@distilled.cloud/forgejo`\n *   published at 1.0.0-rc.12 covers every operation this family calls (verified operation by\n *   operation while porting each resource file).\n *\n * ⚠️ `NotFound` IS FOLDED TO \"ABSENT\" INSIDE EACH RESOURCE FILE'S OWN `fetchLive`, NOT HERE — the\n *   direct successor to the old, centralized `absentOn404`. `Effect.catchTag`'s tag-literal\n *   inference needs a concrete error union to resolve `\"NotFound\"` against; a spec's `E` is only\n *   concrete at each resource file's own call site (`RepoGetBranchProtectionError`, `GetRepoError`,\n *   …), not inside this shared engine's generic functions. So every `fetchLive` below ends\n *   `.pipe(Effect.catchTag('NotFound', () => Effect.succeed(undefined)))` itself — one line,\n *   `catchTag`, never a status comparison — and this engine trusts the result is already folded.\n *\n * ⚠️ GITEA ANSWERS WITH THE OBJECT DIRECTLY — NOT `{\"data\": ...}`, and the distilled SDK decodes\n *   that shape already. `reconcile` still READS BACK after every write rather than trusting a\n *   write response alone — a create/update can 200 with a body this family does not fully trust\n *   until the follow-up `read`.\n *\n * ★ WHY `Forgejo.Repository` DECLARES `defaultRemovalPolicy: 'retain'`, WRITTEN ONCE HERE.\n *   Alchemy's own `GitHub.Repository` defaults to retain \"because their contents are\n *   irreplaceable\". A git repository is the most irreplaceable object on this estate. `retain`\n *   means the engine skips `provider.delete` when a resource is orphaned unless the caller opted\n *   into `.pipe(RemovalPolicy.destroy())`. The `delete` handler is FULLY IMPLEMENTED anyway — a\n *   stub that silently does nothing lies to whoever reads the plan.\n */\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport { CredentialsFromEnv } from '@distilled.cloud/forgejo/Credentials';\nimport type { ForgejoOpContext } from '@distilled.cloud/forgejo/Protocol';\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/unstable/http/HttpClient';\n\n/**\n * ★ WHAT EVERY HANDLER NEEDS FROM THE CALLER'S RUNTIME, after Credentials are provided below.\n *   `Forgejo.ForgejoOpContext` is `Credentials | HttpClient.HttpClient`; `forgejoHandlers` closes\n *   over `CredentialsFromEnv` itself (same `FORGEJO_URL` / `FORGEJO_TOKEN` names client.ts read,\n *   still resolved at call time — see credentials.ts's own note on that), so a consuming stack\n *   only has to provide `HttpClient.HttpClient`, exactly as it did before this migration.\n */\nexport type ForgejoRequirements = HttpClient.HttpClient;\n\n/**\n * One Forgejo object's distilled calls. `Live` is whatever the SDK decodes (a `Repository`, a\n * `Label`, a composite for team membership, …) — no more untyped `Record<string, unknown>`.\n *\n * `E` is left to each resource file to declare (the union of the distilled operations' error\n * types it actually calls, e.g. `RepoCreateHookError | RepoEditHookError | ...`), so a call site's\n * precise per-operation error union flows straight through instead of being widened by hand here.\n */\nexport type ForgejoSpec<Props extends object, Live, Attributes, E> = {\n  /** Already folds the SDK's `NotFound` to `undefined` via its own `catchTag` — see the note above. */\n  readonly fetchLive: (props: Props) => Effect.Effect<Live | undefined, E, ForgejoOpContext>;\n  readonly attributes: (live: Live, props: Props) => Attributes | undefined;\n  readonly matches: (attributes: Attributes, props: Props) => boolean;\n  /** Absent for the two existence-only families (`OrgSecret`, `TeamMember`), which use `upsert` instead. */\n  readonly create?: (props: Props) => Effect.Effect<unknown, E, ForgejoOpContext>;\n  readonly update?: (props: Props, live: Live) => Effect.Effect<unknown, E, ForgejoOpContext>;\n  /**\n   * When create is PUT upsert rather than POST — org actions secrets have no POST and no GET-by-name.\n   * `before === undefined` means absent; the callback decides whether to write. Existence-only families\n   * noop when `before` is set because the API never returns the value for comparison.\n   */\n  readonly upsert?: (\n    props: Props,\n    before: Live | undefined,\n  ) => Effect.Effect<void, E, ForgejoOpContext>;\n  readonly destroy: (props: Props, live: Live) => Effect.Effect<unknown, E, ForgejoOpContext>;\n};\n\nexport const forgejoOperations = <Props extends object, Live, Attributes, E>(\n  spec: ForgejoSpec<Props, Live, Attributes, E>,\n) => {\n  const read = (props: Props) =>\n    spec\n      .fetchLive(props)\n      .pipe(Effect.map((live) => (live === undefined ? undefined : spec.attributes(live, props))));\n\n  return {\n    read,\n\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        if (output === undefined || !isResolved(news)) return undefined;\n        const live = yield* read(news);\n        if (live === undefined) return { action: 'update' } as const;\n        if (spec.matches(live, news)) return { action: 'noop' } as const;\n        return spec.update === undefined\n          ? ({ action: 'replace' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const before = yield* spec.fetchLive(news);\n        if (spec.upsert !== undefined) {\n          yield* spec.upsert(news, before);\n        } else if (before === undefined) {\n          if (spec.create === undefined) {\n            return yield* Effect.die(\n              new Error('forgejoOperations: spec declares neither create nor upsert'),\n            );\n          }\n          yield* spec.create(news);\n        } else if (spec.update !== undefined) {\n          const mapped = spec.attributes(before, news);\n          if (mapped === undefined || spec.matches(mapped, news)) {\n            /* adoption or already converged — no PATCH */\n          } else {\n            yield* spec.update(news, before);\n          }\n        }\n        const after = yield* read(news);\n        if (after === undefined) {\n          return yield* Effect.die(\n            new Error(\n              'the write returned no error but the object is still absent. ' +\n                'Gitea returns the object directly — read back rather than trusting the status code.',\n            ),\n          );\n        }\n        return after;\n      }),\n\n    destroy: (olds: Props) =>\n      Effect.gen(function* () {\n        const live = yield* spec.fetchLive(olds);\n        if (live === undefined) return;\n        yield* spec.destroy(olds, live);\n      }),\n  };\n};\n\n/**\n * The five provider handlers for a spec'd Forgejo object, wired once.\n *\n * ★ CREDENTIALS ARE PROVIDED HERE, ONCE, NOT BY EVERY CALLER. `CredentialsFromEnv` resolves\n *   `FORGEJO_URL` / `FORGEJO_TOKEN` on the calling fiber per request (credentials.ts's own note),\n *   so this closure keeps that laziness — nothing is captured at module load.\n *\n * ⛔ IT STOPS AT THE HANDLERS AND DOES NOT RETURN THE LAYER — same reasoning as pveHandlers in\n *   <estate>/proxmox: wrapping `Provider.effect` here needs casts against Alchemy's `Props<R>`.\n *\n * ⚠️ `list` answers empty — Forgejo index endpoints return the whole org; adoption stays explicit.\n */\nexport const forgejoHandlers = <Props extends object, Live, Attributes extends object, E>(\n  spec: ForgejoSpec<Props, Live, Attributes, E>,\n) => {\n  const ops = forgejoOperations(spec);\n  const withCredentials = <A>(effect: Effect.Effect<A, E, ForgejoOpContext>) =>\n    Effect.provide(effect, CredentialsFromEnv);\n  return {\n    list: () => Effect.succeed([]),\n    read: ({ olds }: { olds: Props }) => withCredentials(ops.read(olds)),\n    diff: ({ news, output }: { news: Input<Props>; output: Attributes | undefined }) =>\n      withCredentials(ops.diff(news, output)),\n    reconcile: ({ news }: { news: Props }) => withCredentials(ops.reconcile(news)),\n    delete: ({ olds }: { olds: Props }) => withCredentials(ops.destroy(olds)),\n  };\n};\n",
+    "/**\n * Wire coercions shared across Forgejo resources.\n *\n * ★ GITEA/FORGEJO JSON USES snake_case ON THE WIRE and camelCase in props — each resource\n *   translates at the form boundary; these helpers only normalise values for comparison.\n *\n * ⛔ `text`/`bool`/`int` FROM THE HAND-ROLLED CLIENT ERA ARE GONE. They coerced values out of an\n *   untyped `Record<string, unknown>` response. `@distilled.cloud/forgejo`'s operations decode\n *   into typed structs (`Repository`, `Label`, `BranchProtection`, …), so an optional field is\n *   already `string | undefined` / `boolean | undefined` — a plain `live.field ?? fallback` at\n *   the call site replaces every one of their call sites, and a malformed response now fails the\n *   operation's decode instead of silently coercing to a fallback.\n */\n\n/** Forgejo returns label colours without `#`; declarations may include it. */\nexport const color = (value: string) => value.replace(/^#/, '').toLowerCase();\n\n/** Wire arrays compared in sorted order — Gitea reshuffles nothing but callers should not depend on order. */\nexport const stringArray = (value: unknown) =>\n  Array.isArray(value)\n    ? value.filter((entry): entry is string => typeof entry === 'string').toSorted()\n    : [];\n\nexport const stringRecord = (value: unknown): Record<string, string> => {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return {};\n  const out: Record<string, string> = {};\n  for (const [key, entry] of Object.entries(value)) {\n    if (typeof entry === 'string') out[key] = entry;\n  }\n  return out;\n};\n\nexport const recordEqual = (left: Record<string, string>, right: Record<string, string>) => {\n  const leftKeys = Object.keys(left).toSorted();\n  const rightKeys = Object.keys(right).toSorted();\n  if (leftKeys.length !== rightKeys.length) return false;\n  return leftKeys.every((key, index) => rightKeys[index] === key && left[key] === right[key]);\n};\n\n/** Hook `config` without `secret` — the value must never land in Alchemy attributes. */\nexport const hookConfigPublic = (value: unknown) => {\n  const config = stringRecord(value);\n  const { secret: _secret, ...rest } = config;\n  return rest;\n};\n\n/** Env key for a write-only org actions secret — value read at PUT time only, never stored. */\nexport const orgSecretEnvKey = (org: string, name: string) =>\n  `FORGEJO_ORG_SECRET_${org}_${name}`.replace(/[^A-Za-z0-9_]/g, '_').toUpperCase();\n\n/** Env key for a write-only repo webhook HMAC secret — omitted from attributes and props. */\nexport const hookSecretEnvKey = (owner: string, repo: string, name: string) =>\n  `FORGEJO_HOOK_SECRET_${owner}_${repo}_${name}`.replace(/[^A-Za-z0-9_]/g, '_').toUpperCase();\n",
+    "/**\n * `Forgejo.OrgSecret` — org-level Actions secret metadata at `/orgs/{org}/actions/secrets/{name}`.\n *\n * ★ CHOICE: AUTHORED WITH WRITE-ONLY VALUE VIA ENV, NOT REFUSED. `organization.Secret` (the\n *   package's typed output) has only `name` and `created_at` — never `data` — so attributes stay\n *   metadata-only. Create/update is `updateOrgSecret`, a PUT with `{ data }`, which does not fit\n *   POST/PATCH; this family uses the `upsert` seam on `ForgejoSpec` instead of a plain create.\n *\n * ⛔ THE SECRET VALUE IS NEVER A PROP OR AN ATTRIBUTE. It is read from `FORGEJO_ORG_SECRET_{org}_{name}`\n *   (see orgSecretEnvKey) at PUT time when the name is absent from the list. Once present, reconcile\n *   noops — the API cannot confirm the value matches, and re-PUT on every deploy would rotate\n *   unintentionally. Rotate by destroy-then-create or a manual PUT outside Alchemy.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO PUT — list needs `read:organization`.\n *\n * ⛔ THE FILE NAME IS PLURAL ON PURPOSE AND MUST STAY THAT WAY. `.gitignore:198` carries\n *   `*-secret.*` — the rule that stops `client-secret.json` and friends being committed — and it\n *   matches a SOURCE file called `org-secret.ts` just as happily. This family was first authored\n *   under that name: it existed on disk, typechecked, passed oxlint, was imported by alchemy.run.ts\n *   and appeared in NO `git status`. `scripts/husky/ignored-imports.ts` is the gate that now\n *   catches the class; this comment is for whoever is tempted to rename it back.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as organization from '@distilled.cloud/forgejo/organization';\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\nimport { type ForgejoRequirements, type ForgejoSpec, forgejoHandlers } from './resource.ts';\nimport { orgSecretEnvKey } from './values.ts';\n\nexport interface OrgSecretProps {\n  org: string;\n  /** Secret name — path key; value lives in env, not here. */\n  name: string;\n}\n\nexport interface OrgSecretAttributes {\n  org: string;\n  name: string;\n  createdAt: string;\n}\n\nexport interface ForgejoOrgSecret extends Resource<\n  'Forgejo.OrgSecret',\n  OrgSecretProps,\n  OrgSecretAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgSecret = Resource<ForgejoOrgSecret>('Forgejo.OrgSecret');\n\n/** Domain refusal, not a distilled error — the env var this family reads the secret value from is unset. */\nexport class ForgejoSecretEnvUnsetError extends Data.TaggedError('ForgejoSecretEnvUnsetError')<{\n  readonly message: string;\n}> {}\n\nconst secretData = (org: string, name: string) =>\n  Effect.gen(function* () {\n    const key = orgSecretEnvKey(org, name);\n    const raw = process.env[key];\n    if (raw === undefined || raw.trim() === '') {\n      return yield* Effect.fail(\n        new ForgejoSecretEnvUnsetError({\n          message: `${key} is unset. Export the secret value there — never as an Alchemy prop.`,\n        }),\n      );\n    }\n    return raw.trim();\n  });\n\n/** ★ EXPORTED for direct testing with an explicit fake `Credentials` layer — see repository.ts. */\nexport const spec: ForgejoSpec<\n  OrgSecretProps,\n  organization.Secret,\n  OrgSecretAttributes,\n  | organization.OrgListActionsSecretsError\n  | organization.UpdateOrgSecretError\n  | organization.DeleteOrgSecretError\n  | ForgejoSecretEnvUnsetError\n> = {\n  attributes: (live, props) => ({\n    createdAt: live.created_at,\n    name: props.name,\n    org: props.org,\n  }),\n  destroy: (props) => organization.deleteOrgSecret({ org: props.org, secretname: props.name }),\n  fetchLive: (props) =>\n    organization.orgListActionsSecrets({ org: props.org, limit: 200 }).pipe(\n      Effect.map((rows) => rows.find((row) => row.name === props.name)),\n      Effect.catchTag('NotFound', () => Effect.succeed(undefined)),\n    ),\n  matches: () => true,\n  upsert: (props, before) =>\n    before !== undefined\n      ? Effect.void\n      : Effect.flatMap(secretData(props.org, props.name), (data) =>\n          Effect.asVoid(\n            organization.updateOrgSecret({ data, org: props.org, secretname: props.name }),\n          ),\n        ),\n};\n\nexport const handlers = forgejoHandlers(spec);\n\nexport const ForgejoOrgSecretProvider = () =>\n  Provider.effect(ForgejoOrgSecret, Effect.succeed(ForgejoOrgSecret.Provider.of(handlers)));\n",
+    "/**\n * `Forgejo.OrgLabel` — one org-level issue label shared across every repository in the org.\n *\n * ★ RETIRES the estate's hand-run `labels-reconcile.sh`, which\n *   converged the whole `labels.yaml` file in one shot. That script CREATED and PATCHED labels\n *   from the spec and REPORTED `EXTRA` labels present live but absent from the file — it never\n *   deleted them, because removing a label strips it from every issue that carries it.\n *\n * ★ THIS RESOURCE DOES NOT REMOVE EXTRA LABELS EITHER. Alchemy manages only labels you declare;\n *   labels on the org that nobody declared stay untouched — the same boundary as the script's\n *   `EXTRA … NOT deleted` lines. Removing a declaration defaults to `retain`, so dropping a label\n *   from the stack does not DELETE it unless the caller opts into `.pipe(RemovalPolicy.destroy())`.\n *   That matches the script's never-delete posture while still allowing a deliberate destroy.\n *\n * ⚠️ THE WIRE PATH USES NUMERIC ID, NOT NAME — measured on live org labels: edit and delete are\n *   `orgEditLabel`/`orgDeleteLabel({ org, id })`. `fetchLive` lists by name; the id comes off that\n *   row for `update`/`destroy`, the same seam the hand-rolled `wirePath` used.\n *\n * ⛔ TOKEN NEEDS `write:organization` FOR RECONCILE — the mcp-read token lacks it (POST 403\n *   measured 2026-09-13). Plan/deploy needs a provision-scoped credential in `FORGEJO_TOKEN`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as organization from '@distilled.cloud/forgejo/organization';\nimport * as Effect from 'effect/Effect';\nimport { type ForgejoRequirements, type ForgejoSpec, forgejoHandlers } from './resource.ts';\nimport { color } from './values.ts';\n\nexport interface OrgLabelProps {\n  /** Organization login — `homeflare` / `HomeFlare` must match the live org. */\n  org: string;\n  /** Label name — primary key for locate; immutable on update. */\n  name: string;\n  /** Six-digit hex, with or without `#`. */\n  color: string;\n  description?: string;\n  exclusive?: boolean;\n}\n\nexport interface OrgLabelAttributes {\n  org: string;\n  name: string;\n  labelId: number;\n  color: string;\n  description: string;\n  exclusive: boolean;\n}\n\nexport interface ForgejoOrgLabel extends Resource<\n  'Forgejo.OrgLabel',\n  OrgLabelProps,\n  OrgLabelAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgLabel = Resource<ForgejoOrgLabel>('Forgejo.OrgLabel', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** ★ EXPORTED for direct testing with an explicit fake `Credentials` layer — see repository.ts. */\nexport const spec: ForgejoSpec<\n  OrgLabelProps,\n  organization.Label,\n  OrgLabelAttributes,\n  | organization.OrgCreateLabelError\n  | organization.OrgEditLabelError\n  | organization.OrgDeleteLabelError\n  | organization.OrgListLabelsError\n> = {\n  attributes: (live, props) => ({\n    color: color(live.color),\n    description: live.description ?? '',\n    exclusive: live.exclusive ?? false,\n    labelId: live.id,\n    name: props.name,\n    org: props.org,\n  }),\n  create: (props) =>\n    organization.orgCreateLabel({\n      color: color(props.color),\n      description: props.description ?? '',\n      exclusive: props.exclusive ?? false,\n      name: props.name,\n      org: props.org,\n    }),\n  destroy: (props, live) => organization.orgDeleteLabel({ org: props.org, id: live.id }),\n  fetchLive: (props) =>\n    organization.orgListLabels({ org: props.org, limit: 200 }).pipe(\n      Effect.map((rows) => rows.find((row) => row.name === props.name)),\n      Effect.catchTag('NotFound', () => Effect.succeed(undefined)),\n    ),\n  matches: (attributes, props) =>\n    attributes.color === color(props.color) &&\n    attributes.description === (props.description ?? '') &&\n    attributes.exclusive === (props.exclusive ?? false),\n  update: (props, live) =>\n    organization.orgEditLabel({\n      color: color(props.color),\n      description: props.description ?? '',\n      exclusive: props.exclusive ?? false,\n      id: live.id,\n      org: props.org,\n    }),\n};\n\nexport const handlers = forgejoHandlers(spec);\n\nexport const ForgejoOrgLabelProvider = () =>\n  Provider.effect(ForgejoOrgLabel, Effect.succeed(ForgejoOrgLabel.Provider.of(handlers)));\n",
+    "/**\n * `Forgejo.OrgTeam` — one organization team under `/orgs/{org}/teams`.\n *\n * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json` (Forgejo 16.x OpenAPI): create is\n *   `POST /orgs/{org}/teams`; read/update/delete use numeric id at `/teams/{id}` — not the name.\n *   Now `organization.orgCreateTeam` / `orgListTeams` / `orgEditTeam` / `orgDeleteTeam`.\n *\n * ⚠️ `orgEditTeam`/`orgDeleteTeam` TAKE ONLY `{ id, ... }` — NO `org` FIELD. The package's schema\n *   confirms Forgejo's edit/delete routes are `/teams/{id}` with no org segment; `fetchLive` lists\n *   by name and `update`/`destroy` carry the id off that row, same seam as org labels.\n *\n * ⚠️ `live.permission` IS TYPED `\"none\" | \"read\" | \"write\" | \"admin\" | \"owner\"` IN THE PACKAGE —\n *   wider than this family's own `TeamPermission`. The guard below keeps the original behaviour:\n *   an out-of-range value (`none`/`owner`) folds `attributes` to `undefined` rather than lying\n *   about which of the three this family manages the team is at.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO CREATE OR PATCH — read list/get needs `read:organization`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as organization from '@distilled.cloud/forgejo/organization';\nimport * as Effect from 'effect/Effect';\nimport { type ForgejoRequirements, type ForgejoSpec, forgejoHandlers } from './resource.ts';\nimport { recordEqual, stringArray, stringRecord } from './values.ts';\n\nexport type TeamPermission = 'read' | 'write' | 'admin';\n\nexport interface OrgTeamProps {\n  org: string;\n  /** Team name — primary locate key; sent on every edit body. */\n  name: string;\n  description?: string;\n  permission?: TeamPermission;\n  units?: string[];\n  unitsMap?: Record<string, string>;\n  includesAllRepositories?: boolean;\n  canCreateOrgRepo?: boolean;\n}\n\nexport interface OrgTeamAttributes {\n  org: string;\n  name: string;\n  teamId: number;\n  description: string;\n  permission: TeamPermission;\n  units: string[];\n  unitsMap: Record<string, string>;\n  includesAllRepositories: boolean;\n  canCreateOrgRepo: boolean;\n}\n\nexport interface ForgejoOrgTeam extends Resource<\n  'Forgejo.OrgTeam',\n  OrgTeamProps,\n  OrgTeamAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoOrgTeam = Resource<ForgejoOrgTeam>('Forgejo.OrgTeam');\n\nconst teamForm = (props: OrgTeamProps) => ({\n  can_create_org_repo: props.canCreateOrgRepo ?? false,\n  description: props.description ?? '',\n  includes_all_repositories: props.includesAllRepositories ?? false,\n  name: props.name,\n  ...(props.permission === undefined ? {} : { permission: props.permission }),\n  ...(props.units === undefined ? {} : { units: props.units }),\n  ...(props.unitsMap === undefined ? {} : { units_map: props.unitsMap }),\n});\n\n/** ★ EXPORTED for direct testing with an explicit fake `Credentials` layer — see repository.ts. */\nexport const spec: ForgejoSpec<\n  OrgTeamProps,\n  organization.Team,\n  OrgTeamAttributes,\n  | organization.OrgCreateTeamError\n  | organization.OrgEditTeamError\n  | organization.OrgDeleteTeamError\n  | organization.OrgListTeamsError\n> = {\n  attributes: (live, props) => {\n    const permission = live.permission ?? 'read';\n    if (permission !== 'read' && permission !== 'write' && permission !== 'admin') return undefined;\n    return {\n      canCreateOrgRepo: live.can_create_org_repo ?? false,\n      description: live.description ?? '',\n      includesAllRepositories: live.includes_all_repositories ?? false,\n      name: props.name,\n      org: props.org,\n      permission,\n      teamId: live.id,\n      units: stringArray(live.units ?? []),\n      unitsMap: stringRecord(live.units_map ?? {}),\n    };\n  },\n  create: (props) => organization.orgCreateTeam({ org: props.org, ...teamForm(props) }),\n  destroy: (_props, live) => organization.orgDeleteTeam({ id: live.id }),\n  fetchLive: (props) =>\n    organization.orgListTeams({ org: props.org, limit: 200 }).pipe(\n      Effect.map((rows) => rows.find((row) => row.name === props.name)),\n      Effect.catchTag('NotFound', () => Effect.succeed(undefined)),\n    ),\n  matches: (attributes, props) =>\n    attributes.description === (props.description ?? '') &&\n    attributes.permission === (props.permission ?? 'read') &&\n    attributes.includesAllRepositories === (props.includesAllRepositories ?? false) &&\n    attributes.canCreateOrgRepo === (props.canCreateOrgRepo ?? false) &&\n    (props.units === undefined ||\n      stringArray(props.units).join('\\0') === attributes.units.join('\\0')) &&\n    (props.unitsMap === undefined || recordEqual(attributes.unitsMap, props.unitsMap)),\n  update: (props, live) => organization.orgEditTeam({ id: live.id, ...teamForm(props) }),\n};\n\nexport const handlers = forgejoHandlers(spec);\n\nexport const ForgejoOrgTeamProvider = () =>\n  Provider.effect(ForgejoOrgTeam, Effect.succeed(ForgejoOrgTeam.Provider.of(handlers)));\n",
+    "/**\n * `Forgejo.RepoWebhook` — one repository webhook under `/repos/{owner}/{repo}/hooks`.\n *\n * ★ READ OFF `<estate>/mcp-servers/docs/api/upstream/forgejo.json`: create is POST collection; read/update/delete\n *   use numeric hook id at `/repos/{owner}/{repo}/hooks/{id}`. Now `repository.repoCreateHook` /\n *   `repoListHooks` / `repoEditHook` / `repoDeleteHook`. `fetchLive` lists and matches on `url` —\n *   see repo-webhook-form.ts for why name was never the real match key.\n *\n * ⚠️ `Hook.url` IS A REQUIRED STRING IN THE PACKAGE'S SCHEMA — the `config.url` fallback the\n *   hand-rolled client carried (`stringRecord(live['config'])['url']`) is gone; a response\n *   without `url` now fails the operation's decode.\n *\n * ⛔ NO WEBHOOK `secret` IN PROPS OR ATTRIBUTES. Optional HMAC material is env-only at write time\n *   (`FORGEJO_HOOK_SECRET_*` — see repo-webhook-form.ts). `hookConfigPublic` strips `secret` on read.\n *\n * ⛔ TOKEN NEEDS `write:repository` TO CREATE OR PATCH — list/get needs `read:repository`.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as repository from '@distilled.cloud/forgejo/repository';\nimport * as Effect from 'effect/Effect';\nimport { hookConfigForm } from './repo-webhook-form.ts';\nimport { type ForgejoRequirements, type ForgejoSpec, forgejoHandlers } from './resource.ts';\nimport { hookConfigPublic, stringArray } from './values.ts';\n\nexport type RepoWebhookType =\n  | 'dingtalk'\n  | 'discord'\n  | 'feishu'\n  | 'forgejo'\n  | 'gitea'\n  | 'gogs'\n  | 'msteams'\n  | 'packagist'\n  | 'slack'\n  | 'telegram'\n  | 'wechatwork';\n\nexport interface RepoWebhookProps {\n  owner: string;\n  repo: string;\n  /** Stable locate key on this side only — Forgejo hooks have no `name` field (see the form file). */\n  name: string;\n  type: RepoWebhookType;\n  url: string;\n  events: string[];\n  contentType?: 'json' | 'form';\n  active?: boolean;\n  branchFilter?: string;\n  authorizationHeader?: string;\n}\n\nexport interface RepoWebhookAttributes {\n  owner: string;\n  repo: string;\n  name: string;\n  hookId: number;\n  type: RepoWebhookType;\n  url: string;\n  contentType: string;\n  events: string[];\n  active: boolean;\n  branchFilter: string;\n  authorizationHeader: string;\n}\n\nexport interface ForgejoRepoWebhook extends Resource<\n  'Forgejo.RepoWebhook',\n  RepoWebhookProps,\n  RepoWebhookAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoRepoWebhook = Resource<ForgejoRepoWebhook>('Forgejo.RepoWebhook');\n\n/** ★ EXPORTED for direct testing with an explicit fake `Credentials` layer — see repository.ts. */\nexport const spec: ForgejoSpec<\n  RepoWebhookProps,\n  repository.Hook,\n  RepoWebhookAttributes,\n  | repository.RepoCreateHookError\n  | repository.RepoEditHookError\n  | repository.RepoDeleteHookError\n  | repository.RepoListHooksError\n> = {\n  attributes: (live, props) => {\n    const config = hookConfigPublic(live.config);\n    return {\n      active: live.active ?? true,\n      authorizationHeader: live.authorization_header ?? '',\n      branchFilter: live.branch_filter ?? '',\n      contentType: config['content_type'] ?? live.content_type ?? 'json',\n      events: stringArray(live.events ?? []),\n      hookId: live.id,\n      name: props.name,\n      owner: props.owner,\n      repo: props.repo,\n      type: live.type as RepoWebhookType,\n      url: live.url,\n    };\n  },\n  create: (props) =>\n    repository.repoCreateHook({\n      active: props.active ?? true,\n      ...(props.authorizationHeader === undefined\n        ? {}\n        : { authorization_header: props.authorizationHeader }),\n      ...(props.branchFilter === undefined ? {} : { branch_filter: props.branchFilter }),\n      config: hookConfigForm(props, true),\n      events: props.events,\n      owner: props.owner,\n      repo: props.repo,\n      type: props.type,\n    }),\n  destroy: (props, live) =>\n    repository.repoDeleteHook({ owner: props.owner, repo: props.repo, id: live.id }),\n  fetchLive: (props) =>\n    repository.repoListHooks({ owner: props.owner, repo: props.repo, limit: 200 }).pipe(\n      Effect.map((rows) => rows.find((row) => row.url === props.url)),\n      Effect.catchTag('NotFound', () => Effect.succeed(undefined)),\n    ),\n  matches: (attributes, props) =>\n    attributes.type === props.type &&\n    attributes.url === props.url &&\n    attributes.active === (props.active ?? true) &&\n    attributes.contentType === (props.contentType ?? 'json') &&\n    attributes.branchFilter === (props.branchFilter ?? '') &&\n    attributes.authorizationHeader === (props.authorizationHeader ?? '') &&\n    stringArray(props.events).join('\\0') === attributes.events.join('\\0'),\n  update: (props, live) =>\n    repository.repoEditHook({\n      active: props.active ?? true,\n      ...(props.authorizationHeader === undefined\n        ? {}\n        : { authorization_header: props.authorizationHeader }),\n      ...(props.branchFilter === undefined ? {} : { branch_filter: props.branchFilter }),\n      config: hookConfigForm(props, false),\n      events: props.events,\n      id: live.id,\n      owner: props.owner,\n      repo: props.repo,\n    }),\n};\n\nexport const handlers = forgejoHandlers(spec);\n\nexport const ForgejoRepoWebhookProvider = () =>\n  Provider.effect(ForgejoRepoWebhook, Effect.succeed(ForgejoRepoWebhook.Provider.of(handlers)));\n",
+    "/**\n * `config` bodies for `Forgejo.RepoWebhook` — split to keep repo-webhook.ts under the line cap.\n *\n * ⛔ `config.secret` IS NEVER A PROP. When present it is read from `FORGEJO_HOOK_SECRET_*` at\n *   create/update time only (see hookSecretEnvKey in values.ts). Alchemy attributes are Postgres\n *   plaintext — a webhook HMAC secret must not be stored there.\n *\n * ⛔ NO `name` FIELD ON EITHER SIDE. `@distilled.cloud/forgejo`'s `RepoCreateHookRequest` and\n *   `Hook` (the create input and the read/list output) have no `name` property — verified against\n *   the package's schema. The hand-rolled client sent `name: props.name` on create anyway; Gitea's\n *   JSON decoder silently dropped it, so `locate` never actually matched by name either (its\n *   `row['name']` read was always `undefined` on an untyped response) — matching was always by\n *   URL in practice. `props.name`/`RepoWebhookAttributes.name` stay as this family's own stable\n *   key; nothing on the wire carries it.\n */\nimport type { RepoWebhookProps } from './repo-webhook.ts';\nimport { hookSecretEnvKey } from './values.ts';\n\nexport const hookConfigForm = (props: RepoWebhookProps, includeSecret: boolean) => {\n  const config: Record<string, string> = {\n    content_type: props.contentType ?? 'json',\n    url: props.url,\n  };\n  if (includeSecret) {\n    const key = hookSecretEnvKey(props.owner, props.repo, props.name);\n    const secret = process.env[key]?.trim();\n    if (secret !== undefined && secret !== '') config['secret'] = secret;\n  }\n  return config;\n};\n",
+    "/**\n * `Forgejo.Repository` — an organization-owned git repository.\n *\n * ★ MEASURED 2026-09-13 against the live daemon (`GET /api/v1/repos/<org>/<repo>`):\n *   responses are flat JSON with `private`, `has_issues`, `default_branch`, etc. Create is\n *   `POST /orgs/{org}/repos`; read/update/delete use `/repos/{owner}/{repo}`. Now called through\n *   `@distilled.cloud/forgejo`'s `organization.createOrgRepo` / `repository.{getRepo,editRepo,\n *   deleteRepo}` instead of the retired hand-rolled client (resource.ts).\n *\n * ⛔ `CreateOrgRepoRequest` HAS NO `has_issues` / `has_wiki` / `has_projects`. Verified against\n *   the package's typed schema: Forgejo's own `POST /orgs/{org}/repos` never accepted them either\n *   (the hand-rolled client sent them anyway; Gitea's JSON decoder silently drops unknown keys,\n *   so they were always ignored on create). `editRepo`'s schema does carry them, and\n *   `updateForm`/`matches` below still converge them on the first non-create reconcile — the same\n *   two-step behaviour the old client had, now provable at the type level instead of by reading\n *   Gitea's source.\n *\n * ⛔ `defaultRemovalPolicy: 'retain'` — history, issues and packages in a repo are irreplaceable.\n *   Opt into deletion with `.pipe(RemovalPolicy.destroy())`; `delete` below is fully implemented.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as organization from '@distilled.cloud/forgejo/organization';\nimport * as repository from '@distilled.cloud/forgejo/repository';\nimport * as Effect from 'effect/Effect';\nimport { type ForgejoRequirements, type ForgejoSpec, forgejoHandlers } from './resource.ts';\n\nexport interface RepositoryProps {\n  /** Organization login — the owner segment in `<org>/<repo>`. */\n  org: string;\n  /** Repository name. Changing it is a replace, not an update. */\n  name: string;\n  description?: string;\n  private?: boolean;\n  hasIssues?: boolean;\n  hasWiki?: boolean;\n  hasProjects?: boolean;\n  /** Only applied when the repository already has at least one branch. */\n  defaultBranch?: string;\n  /** Create an initial commit with a README when the repository is new. */\n  autoInit?: boolean;\n}\n\nexport interface RepositoryAttributes {\n  org: string;\n  name: string;\n  repoId: number;\n  description: string;\n  private: boolean;\n  hasIssues: boolean;\n  hasWiki: boolean;\n  hasProjects: boolean;\n  defaultBranch: string;\n  empty: boolean;\n}\n\nexport interface ForgejoRepository extends Resource<\n  'Forgejo.Repository',\n  RepositoryProps,\n  RepositoryAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoRepository = Resource<ForgejoRepository>('Forgejo.Repository', {\n  defaultRemovalPolicy: 'retain',\n});\n\nconst editForm = (props: RepositoryProps) => ({\n  ...(props.defaultBranch === undefined ? {} : { default_branch: props.defaultBranch }),\n  ...(props.description === undefined ? {} : { description: props.description }),\n  ...(props.hasIssues === undefined ? {} : { has_issues: props.hasIssues }),\n  ...(props.hasProjects === undefined ? {} : { has_projects: props.hasProjects }),\n  ...(props.hasWiki === undefined ? {} : { has_wiki: props.hasWiki }),\n  ...(props.private === undefined ? {} : { private: props.private }),\n});\n\n/**\n * ★ EXPORTED, NOT JUST PASSED INLINE TO `forgejoHandlers` BELOW — so a test can call\n *   `spec.fetchLive` / `spec.attributes` directly (repository.test.ts does), against an explicit\n *   fake `Credentials` layer, without touching `forgejoHandlers`'s baked-in `CredentialsFromEnv`.\n *   That layer resolves `FORGEJO_URL` / `FORGEJO_TOKEN` through Effect's `Config`, whose default\n *   provider snapshots `process.env` once — a test-time `process.env` mutation is invisible to it,\n *   so the only way to run this exact production code against a fake server is to call it with an\n *   explicit `Credentials` layer, bypassing the env read entirely.\n */\nexport const spec: ForgejoSpec<\n  RepositoryProps,\n  repository.Repository,\n  RepositoryAttributes,\n  | organization.CreateOrgRepoError\n  | repository.GetRepoError\n  | repository.EditRepoError\n  | repository.DeleteRepoError\n> = {\n  attributes: (live, props) => ({\n    defaultBranch: live.default_branch,\n    description: live.description ?? '',\n    empty: live.empty ?? false,\n    hasIssues: live.has_issues ?? true,\n    hasProjects: live.has_projects ?? true,\n    hasWiki: live.has_wiki ?? true,\n    name: props.name,\n    org: props.org,\n    private: live.private ?? true,\n    repoId: live.id,\n  }),\n  create: (props) =>\n    organization.createOrgRepo({\n      auto_init: props.autoInit ?? false,\n      description: props.description ?? '',\n      name: props.name,\n      org: props.org,\n      private: props.private ?? true,\n    }),\n  destroy: (props) => repository.deleteRepo({ owner: props.org, repo: props.name }),\n  fetchLive: (props) =>\n    repository\n      .getRepo({ owner: props.org, repo: props.name })\n      .pipe(Effect.catchTag('NotFound', () => Effect.succeed(undefined))),\n  /**\n   * ⛔ AN UNDECLARED FIELD IS NEITHER COMPARED NOR SENT — the rule every other family in this\n   *   estate follows (storage.ts, backup-job.ts, and all four Pbs.* families say it in those\n   *   words). Declaring a repo you only wanted to rename leaves its description and feature\n   *   toggles alone; dropping a line no longer resets a field.\n   *\n   * ⚠️ `private` IS THE ONE WORTH DECLARING ANYWAY ON EVERY REPO. Leaving it undeclared means\n   *   Alchemy will not notice a repository being made public. That is the correct trade for a\n   *   generic family — undeclared is unmanaged, not assumed — but it is a real gap, so say it\n   *   explicitly in each declaration rather than relying on a default that no longer exists.\n   */\n  matches: (attributes, props) =>\n    (props.description === undefined || attributes.description === props.description) &&\n    (props.private === undefined || attributes.private === props.private) &&\n    (props.hasIssues === undefined || attributes.hasIssues === props.hasIssues) &&\n    (props.hasWiki === undefined || attributes.hasWiki === props.hasWiki) &&\n    (props.hasProjects === undefined || attributes.hasProjects === props.hasProjects) &&\n    (props.defaultBranch === undefined || attributes.defaultBranch === props.defaultBranch),\n  update: (props) =>\n    repository.editRepo({ owner: props.org, repo: props.name, ...editForm(props) }),\n};\n\nexport const handlers = forgejoHandlers(spec);\n\nexport const ForgejoRepositoryProvider = () =>\n  Provider.effect(ForgejoRepository, Effect.succeed(ForgejoRepository.Provider.of(handlers)));\n",
+    "/**\n * `Forgejo.TeamMember` — one user in one organization team.\n *\n * ★ WHY IT EXISTS: forgejo-provision, the service account the Forgejo engine mints as, belongs to the\n *   HomeFlare Owners team — Tim, 2026-09-14. Membership is what its tokens can reach; the role's\n *   scopes only cap it (<estate>/openbao/src/forgejo-bootstrap.ts).\n *\n * ★ READ OFF THE LIVE 16.0.3 SWAGGER (127.0.0.1:3000/swagger.v1.json, 2026-09-14): GET, PUT and\n *   DELETE `/teams/{id}/members/{username}` answer 200, 204 and 204, and 404 when absent. Now\n *   `organization.orgListTeamMember` / `orgAddTeamMember` / `orgRemoveTeamMember`; the team is\n *   still addressed by numeric id, found by name first via `orgListTeams` — the same seam as\n *   org-team.ts.\n *\n * ⚠️ EXISTENCE IS THE WHOLE OBJECT. Nothing about a membership can be updated, so `matches` is\n *   always true; a different team or user is a different resource id in alchemy.run.ts.\n *\n * ⚠️ THE TEAM ITSELF IS ONLY LOCATED HERE, NEVER MANAGED. A missing team fails the plan by name\n *   instead of folding into \"absent\" — `ForgejoTeamNotFoundError` is this family's own domain\n *   error, not one of the distilled SDK's typed HTTP errors, so the `catchTag('NotFound', ...)`\n *   at the end of `fetchLive` below (see resource.ts's header for why every `fetchLive` folds its\n *   own `NotFound` rather than one shared helper) never touches it. A PUT can add a member but\n *   cannot create a team.\n *\n * ⛔ TOKEN NEEDS `write:organization` TO ADD OR REMOVE, and an identity allowed to manage the team.\n */\nimport { Resource } from 'alchemy';\nimport * as Provider from 'alchemy/Provider';\nimport * as organization from '@distilled.cloud/forgejo/organization';\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\nimport { type ForgejoRequirements, type ForgejoSpec, forgejoHandlers } from './resource.ts';\n\nexport interface TeamMemberProps {\n  org: string;\n  /** Team name as Forgejo shows it, e.g. `Owners`. */\n  team: string;\n  username: string;\n}\n\nexport interface TeamMemberAttributes {\n  org: string;\n  team: string;\n  teamId: number;\n  username: string;\n}\n\nexport interface ForgejoTeamMember extends Resource<\n  'Forgejo.TeamMember',\n  TeamMemberProps,\n  TeamMemberAttributes,\n  never,\n  ForgejoRequirements\n> {}\n\nexport const ForgejoTeamMember = Resource<ForgejoTeamMember>('Forgejo.TeamMember');\n\nexport class ForgejoTeamNotFoundError extends Data.TaggedError('ForgejoTeamNotFoundError')<{\n  readonly message: string;\n}> {}\n\ninterface TeamMemberLive {\n  readonly teamId: number;\n  readonly login: string;\n}\n\nconst teamIdOf = (props: TeamMemberProps) =>\n  organization.orgListTeams({ org: props.org, limit: 200 }).pipe(\n    Effect.flatMap((rows) => {\n      const id = rows.find((row) => row.name === props.team)?.id;\n      return id === undefined\n        ? Effect.fail(\n            new ForgejoTeamNotFoundError({\n              message: `no team named ${props.team} in org ${props.org}`,\n            }),\n          )\n        : Effect.succeed(id);\n    }),\n  );\n\n/** ★ EXPORTED for direct testing with an explicit fake `Credentials` layer — see repository.ts. */\nexport const spec: ForgejoSpec<\n  TeamMemberProps,\n  TeamMemberLive,\n  TeamMemberAttributes,\n  | organization.OrgAddTeamMemberError\n  | organization.OrgRemoveTeamMemberError\n  | organization.OrgListTeamMemberError\n  | organization.OrgListTeamsError\n  | ForgejoTeamNotFoundError\n> = {\n  attributes: (live, props) => {\n    if (live.login.toLowerCase() !== props.username.toLowerCase()) return undefined;\n    return { org: props.org, team: props.team, teamId: live.teamId, username: props.username };\n  },\n  destroy: (props, live) =>\n    organization.orgRemoveTeamMember({ id: live.teamId, username: props.username }),\n  fetchLive: (props) =>\n    Effect.gen(function* () {\n      const teamId = yield* teamIdOf(props);\n      const user = yield* organization.orgListTeamMember({ id: teamId, username: props.username });\n      return { login: user.login, teamId };\n    }).pipe(Effect.catchTag('NotFound', () => Effect.succeed(undefined))),\n  matches: () => true,\n  upsert: (props, before) =>\n    before !== undefined\n      ? Effect.void\n      : Effect.flatMap(teamIdOf(props), (id) =>\n          Effect.asVoid(organization.orgAddTeamMember({ id, username: props.username })),\n        ),\n};\n\nexport const handlers = forgejoHandlers(spec);\n\nexport const ForgejoTeamMemberProvider = () =>\n  Provider.effect(ForgejoTeamMember, Effect.succeed(ForgejoTeamMember.Provider.of(handlers)));\n"
   ],
-  "mappings": ";AAYA;AACA;AACA;;;ACNO,IAAM,uBAAuB,CAAC,WAAkC;AAAA,KACjE,MAAM,kBAAkB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,cAAc;AAAA,KAChF,MAAM,0BAA0B,YAChC,CAAC,IACD,EAAE,yBAAyB,MAAM,sBAAsB;AAAA,KACvD,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,WAAW;AAAA,KACtE,MAAM,sBAAsB,YAC5B,CAAC,IACD,EAAE,qBAAqB,MAAM,kBAAkB;AAAA,KAC/C,MAAM,yBAAyB,YAC/B,CAAC,IACD,EAAE,wBAAwB,MAAM,qBAAqB;AAAA,KACrD,MAAM,yBAAyB,YAC/B,CAAC,IACD,EAAE,wBAAwB,MAAM,qBAAqB;AAAA,KACrD,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,oBAAoB,MAAM,kBAAkB;AAAA,KAC3F,MAAM,wBAAwB,YAC9B,CAAC,IACD,EAAE,uBAAuB,MAAM,oBAAoB;AAAA,EACvD,WAAW,MAAM;AACnB;;;ACPA;AAEA;;;ACPA;AACA;AACA;AAEA,IAAM,cAAc;AAWb,IAAM,UAAU,MAAc;AAAA,EACnC,MAAM,MAAM,QAAQ,IAAI;AAAA,EACxB,IAAI,QAAQ,aAAa,IAAI,KAAK,MAAM,IAAI;AAAA,IAC1C,MAAM,IAAI,MACR,yFACF;AAAA,EACF;AAAA,EACA,OAAO,IAAI,KAAK,EAAE,QAAQ,OAAO,EAAE;AAAA;AAGrC,IAAM,QAAQ,MACL,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,QAAQ,IAAI;AAAA,EACxB,IAAI,QAAQ,aAAa,IAAI,KAAK,MAAM,IAAI;AAAA,IAC1C,OAAO,OAAc,YACnB,IAAI,aACF,GACA,OACA,IACA,8FACF,CACF;AAAA,EACF;AAAA,EACA,OAAO,IAAI,KAAK;AAAA,CACjB;AAAA;AAEI,MAAM,qBAAqB,MAAM;AAAA,EAE3B;AAAA,EACA;AAAA,EACA;AAAA,EAHX,WAAW,CACA,QACA,QACA,MACT,QACA;AAAA,IACA,MAAM,WAAW,UAAU,WAAW,OAAO,MAAM,MAAM,QAAQ;AAAA,IALxD;AAAA,IACA;AAAA,IACA;AAAA,IAIT,KAAK,OAAO;AAAA;AAEhB;AAMA,IAAM,gBAAgB,CAAC,WAAmB,EAAE,eAAe,SAAS,QAAQ;AAGrE,IAAM,UAAU,CACrB,QACA,MACA,SAEO,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,aAAa,OAAO,MAAM;AAAA,EAChC,MAAM,MAAM,GAAG,QAAQ,IAAI,eAAe,KAAK,QAAQ,OAAO,EAAE;AAAA,EAQhE,MAAM,SAAS,OAAkB;AAAA,EAqBjC,MAAM,UAA4B,uBAAK,MAAM,EAAE,GAAG,EAAE,KAChC,6BAAW,KAAK,cAAc,UAAU,GAAG,QAAQ,mBAAmB,CAAC,GACzF,SAAS,YACL,CAAC,SAAS,OACQ,2BAAS,KAAK,UAAU,IAAI,GAAG,kBAAkB,CACzE;AAAA,EACA,MAAM,WAAW,OAAO,OACrB,QAAQ,OAAO,EACf,KAAY,gBAAS,CAAC,UAAU,IAAI,aAAa,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CAAC;AAAA,EAEpF,IAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AAAA,IACnD,MAAM,SAAS,OAAO,SAAS,KAAK,KAAY,qBAAc,MAAM,EAAE,CAAC;AAAA,IACvE,OAAO,OAAc,YACnB,IAAI,aAAa,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,GAAG,GAAG,CAAC,CACtE;AAAA,EACF;AAAA,EAGA,MAAM,OAAO,OAAO,SAAS,KAAK,KACzB,gBAAS,CAAC,UAAU,IAAI,aAAa,GAAG,QAAQ,MAAM,OAAO,KAAK,CAAC,CAAC,CAC7E;AAAA,EAEA,OAAQ,SAAS,KAAK,YAAY,KAAK,MAAM,IAAI;AAAA,CAClD;;;ADhEH,IAAM,cAAc,CAAI,OACtB,GAAG,KACM,gBACL,CAAC,UAAiC,iBAAiB,gBAAgB,MAAM,WAAW,KACpF,MAAa,gBAAQ,SAAc,CACrC,CACF;AAEK,IAAM,oBAAoB,CAC/B,SACG;AAAA,EACH,MAAM,YAAY,CAAC,UACjB,YACE,KAAK,WAAW,YACZ,KAAK,OAAO,KAAK,IACjB,QAAiC,OAAO,KAAK,KAAK,KAAK,CAAC,CAC9D;AAAA,EAEF,MAAM,aAAa,CAAC,OAAc,SAChC,KAAK,aAAa,YAAY,KAAK,KAAK,KAAK,IAAI,KAAK,SAAS,OAAO,IAAI;AAAA,EAE5E,MAAM,OAAO,CAAC,UACZ,UAAU,KAAK,EAAE,KACR,YAAI,CAAC,SAAU,SAAS,YAAY,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,CACtF;AAAA,EAEF,OAAO;AAAA,IACL;AAAA,IAEA,MAAM,CAAC,MAAoB,WAClB,YAAI,UAAU,GAAG;AAAA,MACtB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,QAAG;AAAA,MAC/C,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAC7B,IAAI,SAAS;AAAA,QAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,MAClD,IAAI,KAAK,QAAQ,MAAM,IAAI;AAAA,QAAG,OAAO,EAAE,QAAQ,OAAO;AAAA,MACtD,OAAO,KAAK,eAAe,YACtB,EAAE,QAAQ,UAAU,IACpB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAEH,WAAW,CAAC,SACH,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,SAAS,OAAO,UAAU,IAAI;AAAA,MACpC,IAAI,KAAK,WAAW,WAAW;AAAA,QAC7B,OAAO,KAAK,OAAO,MAAM,MAAM;AAAA,MACjC,EAAO,SAAI,WAAW,WAAW;AAAA,QAC/B,OAAO,QAAQ,QAAQ,KAAK,WAAW,IAAI,GAAG,KAAK,WAAW,IAAI,CAAC;AAAA,MACrE,EAAO,SAAI,KAAK,eAAe,WAAW;AAAA,QACxC,MAAM,SAAS,KAAK,WAAW,QAAQ,IAAI;AAAA,QAC3C,IAAI,WAAW,aAAa,KAAK,QAAQ,QAAQ,IAAI,GAAG,CAExD,EAAO;AAAA,UACL,MAAM,OAAO,KAAK,WAAW,IAAI;AAAA,UACjC,IAAI,OAAO,KAAK,IAAI,EAAE,SAAS,GAAG;AAAA,YAChC,OAAO,QAAQ,SAAS,WAAW,MAAM,MAAM,GAAG,IAAI;AAAA,UACxD;AAAA;AAAA,MAEJ;AAAA,MACA,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU,WAAW;AAAA,QACvB,OAAO,OAAc,YACnB,IAAI,MACF,GAAG,KAAK,KAAK,IAAI,oEACf,qFACJ,CACF;AAAA,MACF;AAAA,MACA,OAAO;AAAA,KACR;AAAA,IAEH,SAAS,CAAC,SACD,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,OAAO,OAAO,UAAU,IAAI;AAAA,MAClC,IAAI,SAAS;AAAA,QAAW;AAAA,MACxB,OAAO,QAAQ,UAAU,WAAW,MAAM,IAAI,CAAC;AAAA,KAChD;AAAA,EACL;AAAA;AAWK,IAAM,kBAAkB,CAC7B,SACG;AAAA,EACH,MAAM,MAAM,kBAAkB,IAAI;AAAA,EAClC,OAAO;AAAA,IACL,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,WAA4B,IAAI,KAAK,IAAI;AAAA,IAClD,MAAM,GAAG,MAAM,aACb,IAAI,KAAK,MAAM,MAAM;AAAA,IACvB,WAAW,GAAG,WAA4B,IAAI,UAAU,IAAI;AAAA,IAC5D,QAAQ,GAAG,WAA4B,IAAI,QAAQ,IAAI;AAAA,EACzD;AAAA;;;AElKK,IAAM,OAAO,CAAC,OAAgB,WAAW,OAC9C,OAAO,UAAU,WAAW,QAAQ;AAG/B,IAAM,QAAQ,CAAC,UAAmB,KAAK,KAAK,EAAE,QAAQ,MAAM,EAAE,EAAE,YAAY;AAE5E,IAAM,OAAO,CAAC,OAAgB,WAAW,UAC9C,UAAU,aAAa,UAAU,OAAO,WAAW,UAAU,QAAQ,UAAU,KAAK,UAAU;AAEzF,IAAM,MAAM,CAAC,OAAgB,WAAW,MAAM;AAAA,EACnD,IAAI,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK;AAAA,IAAG,OAAO,KAAK,MAAM,KAAK;AAAA,EAChF,IAAI,OAAO,UAAU,YAAY,MAAM,KAAK,MAAM,IAAI;AAAA,IACpD,MAAM,SAAS,OAAO,SAAS,OAAO,EAAE;AAAA,IACxC,IAAI,OAAO,SAAS,MAAM;AAAA,MAAG,OAAO;AAAA,EACtC;AAAA,EACA,OAAO;AAAA;AAIF,IAAM,cAAc,CAAC,UAC1B,MAAM,QAAQ,KAAK,IACf,MAAM,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,EAAE,SAAS,IAC7E,CAAC;AAEA,IAAM,eAAe,CAAC,UAA2C;AAAA,EACtE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,CAAC;AAAA,EACjF,MAAM,MAA8B,CAAC;AAAA,EACrC,YAAY,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;AAAA,IAChD,IAAI,OAAO,UAAU;AAAA,MAAU,IAAI,OAAO;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,cAAc,CAAC,MAA8B,UAAkC;AAAA,EAC1F,MAAM,WAAW,OAAO,KAAK,IAAI,EAAE,SAAS;AAAA,EAC5C,MAAM,YAAY,OAAO,KAAK,KAAK,EAAE,SAAS;AAAA,EAC9C,IAAI,SAAS,WAAW,UAAU;AAAA,IAAQ,OAAO;AAAA,EACjD,OAAO,SAAS,MAAM,CAAC,KAAK,UAAU,UAAU,WAAW,OAAO,KAAK,SAAS,MAAM,IAAI;AAAA;AAIrF,IAAM,mBAAmB,CAAC,UAAmB;AAAA,EAClD,MAAM,SAAS,aAAa,KAAK;AAAA,EACjC,QAAQ,QAAQ,YAAY,SAAS;AAAA,EACrC,OAAO;AAAA;AAIF,IAAM,kBAAkB,CAAC,KAAa,SAC3C,sBAAsB,OAAO,OAAO,QAAQ,kBAAkB,GAAG,EAAE,YAAY;AAG1E,IAAM,mBAAmB,CAAC,OAAe,MAAc,SAC5D,uBAAuB,SAAS,QAAQ,OAAO,QAAQ,kBAAkB,GAAG,EAAE,YAAY;;;AJJrF,IAAM,0BAA0B,SACrC,4BACA,EAAE,sBAAsB,SAAS,CACnC;AAEA,IAAM,WAAW,gBAAmE;AAAA,EAClF,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,WAAW,KAAK,KAAK,cAAc,KAAK,KAAK,cAAc,CAAC;AAAA,IAClE,IAAI,aAAa;AAAA,MAAI;AAAA,IACrB,OAAO;AAAA,MACL,eAAe,KAAK,KAAK,kBAAkB;AAAA,MAC3C,YAAY,MAAM;AAAA,MAClB,uBAAuB,KAAK,KAAK,0BAA0B;AAAA,MAC3D,YAAY,KAAK,KAAK,gBAAgB,IAAI;AAAA,MAC1C,mBAAmB,KAAK,KAAK,sBAAsB;AAAA,MACnD,sBAAsB,KAAK,KAAK,yBAAyB;AAAA,MACzD,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,sBAAsB,KAAK,KAAK,yBAAyB;AAAA,MACzD,mBAAmB,IAAI,KAAK,qBAAqB;AAAA,MACjD,qBAAqB,YAAY,KAAK,wBAAwB;AAAA,IAChE;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,SAAS,MAAM,SAAS,MAAM;AAAA,EACrD,YAAY;AAAA,EACZ,SAAS,CAAC,YAAY,UACpB,WAAW,uBAAuB,MAAM,qBAAqB,MAC7D,WAAW,gBAAgB,MAAM,cAAc,SAC/C,WAAW,uBAAuB,MAAM,qBAAqB,UAC7D,WAAW,0BAA0B,MAAM,wBAAwB,UACnE,WAAW,2BAA2B,MAAM,yBAAyB,UACrE,WAAW,0BAA0B,MAAM,wBAAwB,UACnE,WAAW,mBAAmB,MAAM,iBAAiB,WACpD,MAAM,wBAAwB,aAC7B,YAAY,MAAM,mBAAmB,EAAE,KAAK,MAAI,MAC9C,WAAW,oBAAoB,KAAK,MAAI;AAAA,EAC9C,MAAM,CAAC,UAAU,SAAS,MAAM,SAAS,MAAM,2BAA2B,MAAM;AAAA,EAChF,YAAY;AACd,CAAC;AAEM,IAAM,kCAAkC,MACpC,gBACP,yBACO,gBAAQ,wBAAwB,SAAS,GAAG,QAAQ,CAAC,CAC9D;;AKzEF,qBAAS;AACT;AACA;AAyBO,IAAM,mBAAmB,UAA2B,mBAAmB;AAE9E,IAAM,aAAa,CAAC,KAAa,SACxB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,gBAAgB,KAAK,IAAI;AAAA,EACrC,MAAM,MAAM,QAAQ,IAAI;AAAA,EACxB,IAAI,QAAQ,aAAa,IAAI,KAAK,MAAM,IAAI;AAAA,IAC1C,OAAO,OAAc,aACnB,IAAI,aACF,GACA,OACA,QAAQ,uBAAuB,QAC/B,GAAG,yEACL,CACF;AAAA,EACF;AAAA,EACA,OAAO,IAAI,KAAK;AAAA,CACjB;AAEH,IAAM,YAAW,gBAAqD;AAAA,EACpE,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,WAAW,KAAK,KAAK,aAAa;AAAA,IAClC,MAAM,MAAM;AAAA,IACZ,KAAK,MAAM;AAAA,EACb;AAAA,EACA,YAAY,CAAC,UAAU,QAAQ,MAAM,uBAAuB,MAAM;AAAA,EAClE,YAAY,OAAO,CAAC;AAAA,EACpB,QAAQ,CAAC,UACP,QAAmC,OAAO,QAAQ,MAAM,+BAA+B,EAAE,KAChF,YAAI,CAAC,SACV,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,IAAI,IAAI,SACzE,CACF;AAAA,EACF,SAAS,MAAM;AAAA,EACf,MAAM,CAAC,UAAU,QAAQ,MAAM,uBAAuB,MAAM;AAAA,EAC5D,QAAQ,CAAC,OAAO,WACP,YAAI,UAAU,GAAG;AAAA,IACtB,IAAI,WAAW;AAAA,MAAW;AAAA,IAC1B,MAAM,OAAO,OAAO,WAAW,MAAM,KAAK,MAAM,IAAI;AAAA,IACpD,OAAO,QAAQ,OAAO,QAAQ,MAAM,uBAAuB,MAAM,QAAQ,EAAE,KAAK,CAAC;AAAA,GAClF;AACL,CAAC;AAEM,IAAM,2BAA2B,MAC7B,iBAAO,kBAAyB,gBAAQ,iBAAiB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AC9E1F,qBAAS;AACT;AACA;AAiCO,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAED,IAAM,YAAW,gBAAmD;AAAA,EAClE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,KAAK,KAAK;AAAA,IAChB,IAAI,OAAO,OAAO;AAAA,MAAU;AAAA,IAC5B,OAAO;AAAA,MACL,OAAO,MAAM,KAAK,QAAQ;AAAA,MAC1B,aAAa,KAAK,KAAK,cAAc;AAAA,MACrC,WAAW,KAAK,KAAK,YAAY;AAAA,MACjC,SAAS;AAAA,MACT,MAAM,MAAM;AAAA,MACZ,KAAK,MAAM;AAAA,IACb;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,QAAQ,MAAM;AAAA,EACrC,YAAY,CAAC,WAAW;AAAA,IACtB,OAAO,MAAM,MAAM,KAAK;AAAA,IACxB,aAAa,MAAM,eAAe;AAAA,IAClC,WAAW,MAAM,aAAa;AAAA,IAC9B,MAAM,MAAM;AAAA,EACd;AAAA,EACA,QAAQ,CAAC,UACP,QAAmC,OAAO,QAAQ,MAAM,sBAAsB,EAAE,KACvE,YAAI,CAAC,SACV,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,IAAI,IAAI,SACzE,CACF;AAAA,EACF,SAAS,CAAC,YAAY,UACpB,WAAW,UAAU,MAAM,MAAM,KAAK,KACtC,WAAW,iBAAiB,MAAM,eAAe,OACjD,WAAW,eAAe,MAAM,aAAa;AAAA,EAC/C,MAAM,CAAC,UAAU,QAAQ,MAAM,cAAc,MAAM;AAAA,EACnD,YAAY,CAAC,WAAW;AAAA,IACtB,OAAO,MAAM,MAAM,KAAK;AAAA,IACxB,aAAa,MAAM,eAAe;AAAA,IAClC,WAAW,MAAM,aAAa;AAAA,EAChC;AAAA,EACA,UAAU,CAAC,OAAO,SAAS,QAAQ,MAAM,cAAc,OAAO,KAAK,KAAK;AAC1E,CAAC;AAEM,IAAM,0BAA0B,MAC5B,iBAAO,iBAAwB,gBAAQ,gBAAgB,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACxFxF,qBAAS;AACT;AACA;AAuCO,IAAM,iBAAiB,UAAyB,iBAAiB;AAExE,IAAM,WAAW,CAAC,WAAyB;AAAA,EACzC,qBAAqB,MAAM,oBAAoB;AAAA,EAC/C,aAAa,MAAM,eAAe;AAAA,EAClC,2BAA2B,MAAM,2BAA2B;AAAA,EAC5D,MAAM,MAAM;AAAA,KACR,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,KACrE,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,KACtD,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,SAAS;AACtE;AAEA,IAAM,YAAW,gBAAiD;AAAA,EAChE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,KAAK,KAAK;AAAA,IAChB,IAAI,OAAO,OAAO;AAAA,MAAU;AAAA,IAC5B,MAAM,aAAa,KAAK,KAAK,eAAe,MAAM;AAAA,IAClD,IAAI,eAAe,UAAU,eAAe,WAAW,eAAe;AAAA,MAAS;AAAA,IAC/E,OAAO;AAAA,MACL,kBAAkB,KAAK,KAAK,sBAAsB;AAAA,MAClD,aAAa,KAAK,KAAK,cAAc;AAAA,MACrC,yBAAyB,KAAK,KAAK,4BAA4B;AAAA,MAC/D,MAAM,MAAM;AAAA,MACZ,KAAK,MAAM;AAAA,MACX;AAAA,MACA,QAAQ;AAAA,MACR,OAAO,YAAY,KAAK,QAAQ;AAAA,MAChC,UAAU,aAAa,KAAK,YAAY;AAAA,IAC1C;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,QAAQ,MAAM;AAAA,EACrC,YAAY;AAAA,EACZ,QAAQ,CAAC,UACP,QAAmC,OAAO,QAAQ,MAAM,qBAAqB,EAAE,KACtE,YAAI,CAAC,SACV,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,IAAI,IAAI,SACzE,CACF;AAAA,EACF,SAAS,CAAC,YAAY,UACpB,WAAW,iBAAiB,MAAM,eAAe,OACjD,WAAW,gBAAgB,MAAM,cAAc,WAC/C,WAAW,6BAA6B,MAAM,2BAA2B,UACzE,WAAW,sBAAsB,MAAM,oBAAoB,WAC1D,MAAM,UAAU,aACf,YAAY,MAAM,KAAK,EAAE,KAAK,MAAI,MAAM,WAAW,MAAM,KAAK,MAAI,OACnE,MAAM,aAAa,aAAa,YAAY,WAAW,UAAU,MAAM,QAAQ;AAAA,EAClF,MAAM,CAAC,UAAU,QAAQ,MAAM,aAAa,MAAM;AAAA,EAClD,YAAY;AAAA,EACZ,UAAU,CAAC,QAAQ,SAAS,SAAS,OAAO,KAAK,KAAK;AACxD,CAAC;AAEM,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,gBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;AC7FtF,qBAAS;AACT;AACA;;;ACHO,IAAM,UAAU,CAAC,SACtB,KAAK,KAAK,MAAM,KAAK,KAAK,aAAa,KAAK,SAAS,EAAE,MAAM;AAExD,IAAM,iBAAiB,CAAC,OAAyB,kBAA2B;AAAA,EACjF,MAAM,SAAiC;AAAA,IACrC,cAAc,MAAM,eAAe;AAAA,IACnC,KAAK,MAAM;AAAA,EACb;AAAA,EACA,IAAI,eAAe;AAAA,IACjB,MAAM,MAAM,iBAAiB,MAAM,OAAO,MAAM,MAAM,MAAM,IAAI;AAAA,IAChE,MAAM,SAAS,QAAQ,IAAI,MAAM,KAAK;AAAA,IACtC,IAAI,WAAW,aAAa,WAAW;AAAA,MAAI,OAAO,YAAY;AAAA,EAChE;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,iBAAiB,CAAC,WAA6B;AAAA,EAC1D,QAAQ,MAAM,UAAU;AAAA,KACpB,MAAM,wBAAwB,YAC9B,CAAC,IACD,EAAE,sBAAsB,MAAM,oBAAoB;AAAA,KAClD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,eAAe,MAAM,aAAa;AAAA,EAChF,QAAQ,eAAe,OAAO,IAAI;AAAA,EAClC,QAAQ,MAAM;AAAA,EACd,MAAM,MAAM;AAAA,EACZ,MAAM,MAAM;AACd;AAEO,IAAM,iBAAiB,CAAC,WAA6B;AAAA,EAC1D,QAAQ,MAAM,UAAU;AAAA,KACpB,MAAM,wBAAwB,YAC9B,CAAC,IACD,EAAE,sBAAsB,MAAM,oBAAoB;AAAA,KAClD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,eAAe,MAAM,aAAa;AAAA,EAChF,QAAQ,eAAe,OAAO,KAAK;AAAA,EACnC,QAAQ,MAAM;AAChB;;;ADsBO,IAAM,qBAAqB,UAA6B,qBAAqB;AAEpF,IAAM,YAAW,gBAAyD;AAAA,EACxE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,KAAK,KAAK;AAAA,IAChB,IAAI,OAAO,OAAO;AAAA,MAAU;AAAA,IAC5B,MAAM,SAAS,iBAAiB,KAAK,SAAS;AAAA,IAC9C,MAAM,OAAO,KAAK,KAAK,OAAO;AAAA,IAC9B,OAAO;AAAA,MACL,QAAQ,KAAK,KAAK,WAAW,IAAI;AAAA,MACjC,qBAAqB,KAAK,KAAK,uBAAuB;AAAA,MACtD,cAAc,KAAK,KAAK,gBAAgB;AAAA,MACxC,aAAa,KAAK,OAAO,iBAAiB,KAAK,KAAK,iBAAiB,MAAM,CAAC;AAAA,MAC5E,QAAQ,YAAY,KAAK,SAAS;AAAA,MAClC,QAAQ;AAAA,MACR,MAAM,MAAM;AAAA,MACZ,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ;AAAA,MACA,KAAK,QAAQ,IAAI;AAAA,IACnB;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,SAAS,MAAM,SAAS,MAAM;AAAA,EACrD,YAAY;AAAA,EACZ,QAAQ,CAAC,UACP,QACE,OACA,SAAS,MAAM,SAAS,MAAM,sBAChC,EAAE,KACO,YAAI,CAAC,SACV,MAAM,QAAQ,IAAI,IACd,KAAK,KAAK,CAAC,QAAQ,KAAK,IAAI,OAAO,MAAM,MAAM,QAAQ,QAAQ,GAAG,MAAM,MAAM,GAAG,IACjF,SACN,CACF;AAAA,EACF,SAAS,CAAC,YAAY,UACpB,WAAW,SAAS,MAAM,QAC1B,WAAW,QAAQ,MAAM,OACzB,WAAW,YAAY,MAAM,UAAU,SACvC,WAAW,iBAAiB,MAAM,eAAe,WACjD,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,yBAAyB,MAAM,uBAAuB,OACjE,YAAY,MAAM,MAAM,EAAE,KAAK,MAAI,MAAM,WAAW,OAAO,KAAK,MAAI;AAAA,EACtE,MAAM,CAAC,UAAU,SAAS,MAAM,SAAS,MAAM,cAAc,MAAM;AAAA,EACnE,YAAY;AAAA,EACZ,UAAU,CAAC,OAAO,SAAS,SAAS,MAAM,SAAS,MAAM,cAAc,OAAO,KAAK,KAAK;AAC1F,CAAC;AAEM,IAAM,6BAA6B,MAC/B,iBAAO,oBAA2B,gBAAQ,mBAAmB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AE3G9F,qBAAS;AACT;AACA;AAyCO,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AAED,IAAM,YAAW,gBAAuD;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,KAAK,KAAK;AAAA,IAChB,IAAI,OAAO,OAAO;AAAA,MAAU;AAAA,IAC5B,OAAO;AAAA,MACL,eAAe,KAAK,KAAK,mBAAmB,MAAM;AAAA,MAClD,aAAa,KAAK,KAAK,cAAc;AAAA,MACrC,OAAO,KAAK,KAAK,QAAQ;AAAA,MACzB,WAAW,KAAK,KAAK,eAAe,IAAI;AAAA,MACxC,aAAa,KAAK,KAAK,iBAAiB,IAAI;AAAA,MAC5C,SAAS,KAAK,KAAK,aAAa,IAAI;AAAA,MACpC,MAAM,MAAM;AAAA,MACZ,KAAK,MAAM;AAAA,MACX,SAAS,KAAK,KAAK,YAAY,IAAI;AAAA,MACnC,QAAQ;AAAA,IACV;AAAA;AAAA,EAEF,YAAY,CAAC,UAAU,QAAQ,MAAM;AAAA,EACrC,YAAY,CAAC,WAAW;AAAA,IACtB,WAAW,MAAM,YAAY;AAAA,IAC7B,aAAa,MAAM,eAAe;AAAA,IAClC,YAAY,MAAM,aAAa;AAAA,IAC/B,cAAc,MAAM,eAAe;AAAA,IACnC,UAAU,MAAM,WAAW;AAAA,IAC3B,MAAM,MAAM;AAAA,IACZ,SAAS,MAAM,WAAW;AAAA,EAC5B;AAAA,EAuBA,SAAS,CAAC,YAAY,WACnB,MAAM,gBAAgB,aAAa,WAAW,gBAAgB,MAAM,iBACpE,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,cAAc,aAAa,WAAW,cAAc,MAAM,eAChE,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,gBAAgB,aAAa,WAAW,gBAAgB,MAAM,iBACpE,MAAM,kBAAkB,aAAa,WAAW,kBAAkB,MAAM;AAAA,EAC3E,MAAM,CAAC,UAAU,SAAS,MAAM,OAAO,MAAM;AAAA,EAC7C,YAAY,CAAC,WAAW;AAAA,OAClB,MAAM,kBAAkB,YAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,cAAc;AAAA,OAC/E,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,OACxE,MAAM,cAAc,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,UAAU;AAAA,OACnE,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,MAAM,YAAY;AAAA,OACzE,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,QAAQ;AAAA,OAC7D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,EAClE;AACF,CAAC;AAEM,IAAM,4BAA4B,MAC9B,iBAAO,mBAA0B,gBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AC1G5F,qBAAS;AACT;AACA;AA0BO,IAAM,oBAAoB,UAA4B,oBAAoB;AAGjF,IAAM,UAAU;AAEhB,IAAM,WAAW,CAAC,UACT,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAO,QAAQ,MAAM;AAAA,EAC3B,MAAM,OAAO,OAAO,QAAmC,OAAO,IAAI;AAAA,EAClE,MAAM,MAAM,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,YAAY,MAAM,IAAI,IAAI;AAAA,EACzF,IAAI,OAAO,OAAO,UAAU;AAAA,IAC1B,OAAO,OAAc,aACnB,IAAI,aAAa,GAAG,OAAO,MAAM,iBAAiB,MAAM,eAAe,MAAM,KAAK,CACpF;AAAA,EACF;AAAA,EACA,OAAO;AAAA,CACR;AAEH,IAAM,aAAa,CAAC,IAAY,UAC9B,SAAS,OAAO,EAAE,aAAa,MAAM;AAEvC,IAAM,YAAW,gBAAuD;AAAA,EACtE,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,KAAK,KAAK;AAAA,IAChB,MAAM,QAAQ,KAAK;AAAA,IACnB,IAAI,OAAO,OAAO,YAAY,OAAO,UAAU;AAAA,MAAU;AAAA,IACzD,IAAI,MAAM,YAAY,MAAM,MAAM,SAAS,YAAY;AAAA,MAAG;AAAA,IAC1D,OAAO,EAAE,KAAK,MAAM,KAAK,MAAM,MAAM,MAAM,QAAQ,IAAI,UAAU,MAAM,SAAS;AAAA;AAAA,EAElF,YAAY,CAAC,UAAU,QAAQ,MAAM;AAAA,EACrC,YAAY,OAAO,CAAC;AAAA,EACpB,QAAQ,CAAC,UACA,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,KAAK,OAAO,SAAS,KAAK;AAAA,IAChC,MAAM,OAAO,OAAO,QAAiC,OAAO,WAAW,IAAI,KAAK,CAAC;AAAA,IACjF,OAAO,SAAS,YAAY,YAAY,KAAK,OAAO,UAAU,GAAG;AAAA,GAClE;AAAA,EACH,SAAS,MAAM;AAAA,EACf,MAAM,CAAC,UAAU,QAAQ,MAAM,aAAa,MAAM,gBAAgB,MAAM;AAAA,EACxE,QAAQ,CAAC,OAAO,WACd,WAAW,YACA,eACA,gBAAQ,SAAS,KAAK,GAAG,CAAC,OACxB,eAAO,QAAQ,OAAO,WAAW,IAAI,KAAK,CAAC,CAAC,CACrD;AAAA,EACN,UAAU,CAAC,OAAO,SAAS,WAAW,OAAO,KAAK,QAAQ,GAAG,KAAK;AACpE,CAAC;AAEM,IAAM,4BAA4B,MAC9B,iBAAO,mBAA0B,gBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;",
-  "debugId": "09F62B41760BE1CD64756E2164756E21",
+  "mappings": ";AAiBA;AACA;AACA;AACA;;;ACXA,IAAM,SAAS,CAAC,WAAkC;AAAA,KAC5C,MAAM,kBAAkB,YAAY,CAAC,IAAI,EAAE,iBAAiB,MAAM,cAAc;AAAA,KAChF,MAAM,0BAA0B,YAChC,CAAC,IACD,EAAE,yBAAyB,MAAM,sBAAsB;AAAA,KACvD,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,WAAW;AAAA,KACtE,MAAM,sBAAsB,YAC5B,CAAC,IACD,EAAE,qBAAqB,MAAM,kBAAkB;AAAA,KAC/C,MAAM,yBAAyB,YAC/B,CAAC,IACD,EAAE,wBAAwB,MAAM,qBAAqB;AAAA,KACrD,MAAM,yBAAyB,YAC/B,CAAC,IACD,EAAE,wBAAwB,MAAM,qBAAqB;AAAA,KACrD,MAAM,sBAAsB,YAAY,CAAC,IAAI,EAAE,oBAAoB,MAAM,kBAAkB;AAAA,KAC3F,MAAM,wBAAwB,YAC9B,CAAC,IACD,EAAE,uBAAuB,MAAM,oBAAoB;AACzD;AAEO,IAAM,6BAA6B,CAAC,WAAkC;AAAA,KACxE,OAAO,KAAK;AAAA,EACf,aAAa,MAAM;AACrB;AAEO,IAAM,2BAA2B,CAAC,UAAiC,OAAO,KAAK;;;ACGtF;AAEA;AAEA;AAwCO,IAAM,oBAAoB,CAC/B,SACG;AAAA,EACH,MAAM,OAAO,CAAC,UACZ,KACG,UAAU,KAAK,EACf,KAAY,WAAI,CAAC,SAAU,SAAS,YAAY,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,CAAC;AAAA,EAE/F,OAAO;AAAA,IACL;AAAA,IAEA,MAAM,CAAC,MAAoB,WAClB,WAAI,UAAU,GAAG;AAAA,MACtB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,QAAG;AAAA,MAC/C,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAC7B,IAAI,SAAS;AAAA,QAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,MAClD,IAAI,KAAK,QAAQ,MAAM,IAAI;AAAA,QAAG,OAAO,EAAE,QAAQ,OAAO;AAAA,MACtD,OAAO,KAAK,WAAW,YAClB,EAAE,QAAQ,UAAU,IACpB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAEH,WAAW,CAAC,SACH,WAAI,UAAU,GAAG;AAAA,MACtB,MAAM,SAAS,OAAO,KAAK,UAAU,IAAI;AAAA,MACzC,IAAI,KAAK,WAAW,WAAW;AAAA,QAC7B,OAAO,KAAK,OAAO,MAAM,MAAM;AAAA,MACjC,EAAO,SAAI,WAAW,WAAW;AAAA,QAC/B,IAAI,KAAK,WAAW,WAAW;AAAA,UAC7B,OAAO,OAAc,WACnB,IAAI,MAAM,4DAA4D,CACxE;AAAA,QACF;AAAA,QACA,OAAO,KAAK,OAAO,IAAI;AAAA,MACzB,EAAO,SAAI,KAAK,WAAW,WAAW;AAAA,QACpC,MAAM,SAAS,KAAK,WAAW,QAAQ,IAAI;AAAA,QAC3C,IAAI,WAAW,aAAa,KAAK,QAAQ,QAAQ,IAAI,GAAG,CAExD,EAAO;AAAA,UACL,OAAO,KAAK,OAAO,MAAM,MAAM;AAAA;AAAA,MAEnC;AAAA,MACA,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU,WAAW;AAAA,QACvB,OAAO,OAAc,WACnB,IAAI,MACF,iEACE,qFACJ,CACF;AAAA,MACF;AAAA,MACA,OAAO;AAAA,KACR;AAAA,IAEH,SAAS,CAAC,SACD,WAAI,UAAU,GAAG;AAAA,MACtB,MAAM,OAAO,OAAO,KAAK,UAAU,IAAI;AAAA,MACvC,IAAI,SAAS;AAAA,QAAW;AAAA,MACxB,OAAO,KAAK,QAAQ,MAAM,IAAI;AAAA,KAC/B;AAAA,EACL;AAAA;AAeK,IAAM,kBAAkB,CAC7B,SACG;AAAA,EACH,MAAM,MAAM,kBAAkB,IAAI;AAAA,EAClC,MAAM,kBAAkB,CAAI,WACnB,eAAQ,QAAQ,kBAAkB;AAAA,EAC3C,OAAO;AAAA,IACL,MAAM,MAAa,eAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,GAAG,WAA4B,gBAAgB,IAAI,KAAK,IAAI,CAAC;AAAA,IACnE,MAAM,GAAG,MAAM,aACb,gBAAgB,IAAI,KAAK,MAAM,MAAM,CAAC;AAAA,IACxC,WAAW,GAAG,WAA4B,gBAAgB,IAAI,UAAU,IAAI,CAAC;AAAA,IAC7E,QAAQ,GAAG,WAA4B,gBAAgB,IAAI,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAAA;;;AC3JK,IAAM,QAAQ,CAAC,UAAkB,MAAM,QAAQ,MAAM,EAAE,EAAE,YAAY;AAGrE,IAAM,cAAc,CAAC,UAC1B,MAAM,QAAQ,KAAK,IACf,MAAM,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,EAAE,SAAS,IAC7E,CAAC;AAEA,IAAM,eAAe,CAAC,UAA2C;AAAA,EACtE,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AAAA,IAAG,OAAO,CAAC;AAAA,EACjF,MAAM,MAA8B,CAAC;AAAA,EACrC,YAAY,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;AAAA,IAChD,IAAI,OAAO,UAAU;AAAA,MAAU,IAAI,OAAO;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,cAAc,CAAC,MAA8B,UAAkC;AAAA,EAC1F,MAAM,WAAW,OAAO,KAAK,IAAI,EAAE,SAAS;AAAA,EAC5C,MAAM,YAAY,OAAO,KAAK,KAAK,EAAE,SAAS;AAAA,EAC9C,IAAI,SAAS,WAAW,UAAU;AAAA,IAAQ,OAAO;AAAA,EACjD,OAAO,SAAS,MAAM,CAAC,KAAK,UAAU,UAAU,WAAW,OAAO,KAAK,SAAS,MAAM,IAAI;AAAA;AAIrF,IAAM,mBAAmB,CAAC,UAAmB;AAAA,EAClD,MAAM,SAAS,aAAa,KAAK;AAAA,EACjC,QAAQ,QAAQ,YAAY,SAAS;AAAA,EACrC,OAAO;AAAA;AAIF,IAAM,kBAAkB,CAAC,KAAa,SAC3C,sBAAsB,OAAO,OAAO,QAAQ,kBAAkB,GAAG,EAAE,YAAY;AAG1E,IAAM,mBAAmB,CAAC,OAAe,MAAc,SAC5D,uBAAuB,SAAS,QAAQ,OAAO,QAAQ,kBAAkB,GAAG,EAAE,YAAY;;;AHUrF,IAAM,0BAA0B,SACrC,4BACA,EAAE,sBAAsB,SAAS,CACnC;AAGO,IAAM,OAQT;AAAA,EACF,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,eAAe,KAAK,mBAAmB;AAAA,IACvC,YAAY,MAAM;AAAA,IAClB,uBAAuB,KAAK,2BAA2B;AAAA,IACvD,YAAY,KAAK,eAAe;AAAA,IAChC,mBAAmB,KAAK,uBAAuB;AAAA,IAC/C,sBAAsB,KAAK,0BAA0B;AAAA,IACrD,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,IACZ,sBAAsB,KAAK,0BAA0B;AAAA,IACrD,mBAAmB,KAAK,sBAAsB;AAAA,IAC9C,qBAAqB,YAAY,KAAK,yBAAyB,CAAC,CAAC;AAAA,EACnE;AAAA,EACA,QAAQ,CAAC,UACI,sCAA2B;AAAA,IACpC,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,OACT,2BAA2B,KAAK;AAAA,EACrC,CAAC;AAAA,EACH,SAAS,CAAC,UACG,sCAA2B;AAAA,IACpC,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,EACd,CAAC;AAAA,EACH,WAAW,CAAC,UAEP,mCAAwB,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,MAAM,MAAM,WAAW,CAAC,EACxF,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,SAAS,CAAC,YAAY,UACpB,WAAW,uBAAuB,MAAM,qBAAqB,MAC7D,WAAW,gBAAgB,MAAM,cAAc,SAC/C,WAAW,uBAAuB,MAAM,qBAAqB,UAC7D,WAAW,0BAA0B,MAAM,wBAAwB,UACnE,WAAW,2BAA2B,MAAM,yBAAyB,UACrE,WAAW,0BAA0B,MAAM,wBAAwB,UACnE,WAAW,mBAAmB,MAAM,iBAAiB,WACpD,MAAM,wBAAwB,aAC7B,YAAY,MAAM,mBAAmB,EAAE,KAAK,MAAI,MAC9C,WAAW,oBAAoB,KAAK,MAAI;AAAA,EAC9C,QAAQ,CAAC,UACI,oCAAyB;AAAA,IAClC,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,OACT,yBAAyB,KAAK;AAAA,EACnC,CAAC;AACL;AAEO,IAAM,WAAW,gBAAgB,IAAI;AAErC,IAAM,kCAAkC,MACpC,gBACP,yBACO,gBAAQ,wBAAwB,SAAS,GAAG,QAAQ,CAAC,CAC9D;;AI9GF,qBAAS;AACT;AACA;AACA;AACA;AAwBO,IAAM,mBAAmB,UAA2B,mBAAmB;AAAA;AAGvE,MAAM,mCAAwC,iBAAY,4BAA4B,EAE1F;AAAC;AAEJ,IAAM,aAAa,CAAC,KAAa,SACxB,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,MAAM,gBAAgB,KAAK,IAAI;AAAA,EACrC,MAAM,MAAM,QAAQ,IAAI;AAAA,EACxB,IAAI,QAAQ,aAAa,IAAI,KAAK,MAAM,IAAI;AAAA,IAC1C,OAAO,OAAc,aACnB,IAAI,2BAA2B;AAAA,MAC7B,SAAS,GAAG;AAAA,IACd,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAO,IAAI,KAAK;AAAA,CACjB;AAGI,IAAM,QAQT;AAAA,EACF,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,WAAW,KAAK;AAAA,IAChB,MAAM,MAAM;AAAA,IACZ,KAAK,MAAM;AAAA,EACb;AAAA,EACA,SAAS,CAAC,UAAuB,6BAAgB,EAAE,KAAK,MAAM,KAAK,YAAY,MAAM,KAAK,CAAC;AAAA,EAC3F,WAAW,CAAC,UACG,mCAAsB,EAAE,KAAK,MAAM,KAAK,OAAO,IAAI,CAAC,EAAE,KAC1D,YAAI,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,IAAI,SAAS,MAAM,IAAI,CAAC,GACzD,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAC7D;AAAA,EACF,SAAS,MAAM;AAAA,EACf,QAAQ,CAAC,OAAO,WACd,WAAW,YACA,eACA,gBAAQ,WAAW,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,SAC1C,eACQ,6BAAgB,EAAE,MAAM,KAAK,MAAM,KAAK,YAAY,MAAM,KAAK,CAAC,CAC/E,CACF;AACR;AAEO,IAAM,YAAW,gBAAgB,KAAI;AAErC,IAAM,2BAA2B,MAC7B,iBAAO,kBAAyB,gBAAQ,iBAAiB,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACrF1F,qBAAS;AACT;AACA;AACA;AAgCO,IAAM,kBAAkB,UAA0B,oBAAoB;AAAA,EAC3E,sBAAsB;AACxB,CAAC;AAGM,IAAM,QAQT;AAAA,EACF,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,OAAO,MAAM,KAAK,KAAK;AAAA,IACvB,aAAa,KAAK,eAAe;AAAA,IACjC,WAAW,KAAK,aAAa;AAAA,IAC7B,SAAS,KAAK;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,KAAK,MAAM;AAAA,EACb;AAAA,EACA,QAAQ,CAAC,UACM,6BAAe;AAAA,IAC1B,OAAO,MAAM,MAAM,KAAK;AAAA,IACxB,aAAa,MAAM,eAAe;AAAA,IAClC,WAAW,MAAM,aAAa;AAAA,IAC9B,MAAM,MAAM;AAAA,IACZ,KAAK,MAAM;AAAA,EACb,CAAC;AAAA,EACH,SAAS,CAAC,OAAO,SAAsB,6BAAe,EAAE,KAAK,MAAM,KAAK,IAAI,KAAK,GAAG,CAAC;AAAA,EACrF,WAAW,CAAC,UACG,4BAAc,EAAE,KAAK,MAAM,KAAK,OAAO,IAAI,CAAC,EAAE,KAClD,YAAI,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,IAAI,SAAS,MAAM,IAAI,CAAC,GACzD,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAC7D;AAAA,EACF,SAAS,CAAC,YAAY,UACpB,WAAW,UAAU,MAAM,MAAM,KAAK,KACtC,WAAW,iBAAiB,MAAM,eAAe,OACjD,WAAW,eAAe,MAAM,aAAa;AAAA,EAC/C,QAAQ,CAAC,OAAO,SACD,2BAAa;AAAA,IACxB,OAAO,MAAM,MAAM,KAAK;AAAA,IACxB,aAAa,MAAM,eAAe;AAAA,IAClC,WAAW,MAAM,aAAa;AAAA,IAC9B,IAAI,KAAK;AAAA,IACT,KAAK,MAAM;AAAA,EACb,CAAC;AACL;AAEO,IAAM,YAAW,gBAAgB,KAAI;AAErC,IAAM,0BAA0B,MAC5B,iBAAO,iBAAwB,gBAAQ,gBAAgB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AC3FxF,qBAAS;AACT;AACA;AACA;AAsCO,IAAM,iBAAiB,UAAyB,iBAAiB;AAExE,IAAM,WAAW,CAAC,WAAyB;AAAA,EACzC,qBAAqB,MAAM,oBAAoB;AAAA,EAC/C,aAAa,MAAM,eAAe;AAAA,EAClC,2BAA2B,MAAM,2BAA2B;AAAA,EAC5D,MAAM,MAAM;AAAA,KACR,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,KACrE,MAAM,UAAU,YAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,KACtD,MAAM,aAAa,YAAY,CAAC,IAAI,EAAE,WAAW,MAAM,SAAS;AACtE;AAGO,IAAM,QAQT;AAAA,EACF,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,aAAa,KAAK,cAAc;AAAA,IACtC,IAAI,eAAe,UAAU,eAAe,WAAW,eAAe;AAAA,MAAS;AAAA,IAC/E,OAAO;AAAA,MACL,kBAAkB,KAAK,uBAAuB;AAAA,MAC9C,aAAa,KAAK,eAAe;AAAA,MACjC,yBAAyB,KAAK,6BAA6B;AAAA,MAC3D,MAAM,MAAM;AAAA,MACZ,KAAK,MAAM;AAAA,MACX;AAAA,MACA,QAAQ,KAAK;AAAA,MACb,OAAO,YAAY,KAAK,SAAS,CAAC,CAAC;AAAA,MACnC,UAAU,aAAa,KAAK,aAAa,CAAC,CAAC;AAAA,IAC7C;AAAA;AAAA,EAEF,QAAQ,CAAC,UAAuB,4BAAc,EAAE,KAAK,MAAM,QAAQ,SAAS,KAAK,EAAE,CAAC;AAAA,EACpF,SAAS,CAAC,QAAQ,SAAsB,4BAAc,EAAE,IAAI,KAAK,GAAG,CAAC;AAAA,EACrE,WAAW,CAAC,UACG,2BAAa,EAAE,KAAK,MAAM,KAAK,OAAO,IAAI,CAAC,EAAE,KACjD,YAAI,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,IAAI,SAAS,MAAM,IAAI,CAAC,GACzD,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAC7D;AAAA,EACF,SAAS,CAAC,YAAY,UACpB,WAAW,iBAAiB,MAAM,eAAe,OACjD,WAAW,gBAAgB,MAAM,cAAc,WAC/C,WAAW,6BAA6B,MAAM,2BAA2B,UACzE,WAAW,sBAAsB,MAAM,oBAAoB,WAC1D,MAAM,UAAU,aACf,YAAY,MAAM,KAAK,EAAE,KAAK,MAAI,MAAM,WAAW,MAAM,KAAK,MAAI,OACnE,MAAM,aAAa,aAAa,YAAY,WAAW,UAAU,MAAM,QAAQ;AAAA,EAClF,QAAQ,CAAC,OAAO,SAAsB,0BAAY,EAAE,IAAI,KAAK,OAAO,SAAS,KAAK,EAAE,CAAC;AACvF;AAEO,IAAM,YAAW,gBAAgB,KAAI;AAErC,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,gBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACpGtF,qBAAS;AACT;AACA;AACA;;;ACFO,IAAM,iBAAiB,CAAC,OAAyB,kBAA2B;AAAA,EACjF,MAAM,SAAiC;AAAA,IACrC,cAAc,MAAM,eAAe;AAAA,IACnC,KAAK,MAAM;AAAA,EACb;AAAA,EACA,IAAI,eAAe;AAAA,IACjB,MAAM,MAAM,iBAAiB,MAAM,OAAO,MAAM,MAAM,MAAM,IAAI;AAAA,IAChE,MAAM,SAAS,QAAQ,IAAI,MAAM,KAAK;AAAA,IACtC,IAAI,WAAW,aAAa,WAAW;AAAA,MAAI,OAAO,YAAY;AAAA,EAChE;AAAA,EACA,OAAO;AAAA;;;AD8CF,IAAM,qBAAqB,UAA6B,qBAAqB;AAG7E,IAAM,QAQT;AAAA,EACF,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,MAAM,SAAS,iBAAiB,KAAK,MAAM;AAAA,IAC3C,OAAO;AAAA,MACL,QAAQ,KAAK,UAAU;AAAA,MACvB,qBAAqB,KAAK,wBAAwB;AAAA,MAClD,cAAc,KAAK,iBAAiB;AAAA,MACpC,aAAa,OAAO,mBAAmB,KAAK,gBAAgB;AAAA,MAC5D,QAAQ,YAAY,KAAK,UAAU,CAAC,CAAC;AAAA,MACrC,QAAQ,KAAK;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,KAAK,KAAK;AAAA,IACZ;AAAA;AAAA,EAEF,QAAQ,CAAC,UACI,2BAAe;AAAA,IACxB,QAAQ,MAAM,UAAU;AAAA,OACpB,MAAM,wBAAwB,YAC9B,CAAC,IACD,EAAE,sBAAsB,MAAM,oBAAoB;AAAA,OAClD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,eAAe,MAAM,aAAa;AAAA,IAChF,QAAQ,eAAe,OAAO,IAAI;AAAA,IAClC,QAAQ,MAAM;AAAA,IACd,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,IACZ,MAAM,MAAM;AAAA,EACd,CAAC;AAAA,EACH,SAAS,CAAC,OAAO,SACJ,2BAAe,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,IAAI,KAAK,GAAG,CAAC;AAAA,EACjF,WAAW,CAAC,UACC,0BAAc,EAAE,OAAO,MAAM,OAAO,MAAM,MAAM,MAAM,OAAO,IAAI,CAAC,EAAE,KACtE,YAAI,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,IAAI,QAAQ,MAAM,GAAG,CAAC,GACvD,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAC7D;AAAA,EACF,SAAS,CAAC,YAAY,UACpB,WAAW,SAAS,MAAM,QAC1B,WAAW,QAAQ,MAAM,OACzB,WAAW,YAAY,MAAM,UAAU,SACvC,WAAW,iBAAiB,MAAM,eAAe,WACjD,WAAW,kBAAkB,MAAM,gBAAgB,OACnD,WAAW,yBAAyB,MAAM,uBAAuB,OACjE,YAAY,MAAM,MAAM,EAAE,KAAK,MAAI,MAAM,WAAW,OAAO,KAAK,MAAI;AAAA,EACtE,QAAQ,CAAC,OAAO,SACH,yBAAa;AAAA,IACtB,QAAQ,MAAM,UAAU;AAAA,OACpB,MAAM,wBAAwB,YAC9B,CAAC,IACD,EAAE,sBAAsB,MAAM,oBAAoB;AAAA,OAClD,MAAM,iBAAiB,YAAY,CAAC,IAAI,EAAE,eAAe,MAAM,aAAa;AAAA,IAChF,QAAQ,eAAe,OAAO,KAAK;AAAA,IACnC,QAAQ,MAAM;AAAA,IACd,IAAI,KAAK;AAAA,IACT,OAAO,MAAM;AAAA,IACb,MAAM,MAAM;AAAA,EACd,CAAC;AACL;AAEO,IAAM,YAAW,gBAAgB,KAAI;AAErC,IAAM,6BAA6B,MAC/B,iBAAO,oBAA2B,gBAAQ,mBAAmB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AEhI9F,qBAAS;AACT;AACA;AACA;AACA;AAwCO,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AAED,IAAM,WAAW,CAAC,WAA4B;AAAA,KACxC,MAAM,kBAAkB,YAAY,CAAC,IAAI,EAAE,gBAAgB,MAAM,cAAc;AAAA,KAC/E,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,KACxE,MAAM,cAAc,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,UAAU;AAAA,KACnE,MAAM,gBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,MAAM,YAAY;AAAA,KACzE,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,UAAU,MAAM,QAAQ;AAAA,KAC7D,MAAM,YAAY,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAClE;AAWO,IAAM,QAQT;AAAA,EACF,YAAY,CAAC,MAAM,WAAW;AAAA,IAC5B,eAAe,KAAK;AAAA,IACpB,aAAa,KAAK,eAAe;AAAA,IACjC,OAAO,KAAK,SAAS;AAAA,IACrB,WAAW,KAAK,cAAc;AAAA,IAC9B,aAAa,KAAK,gBAAgB;AAAA,IAClC,SAAS,KAAK,YAAY;AAAA,IAC1B,MAAM,MAAM;AAAA,IACZ,KAAK,MAAM;AAAA,IACX,SAAS,KAAK,WAAW;AAAA,IACzB,QAAQ,KAAK;AAAA,EACf;AAAA,EACA,QAAQ,CAAC,UACM,4BAAc;AAAA,IACzB,WAAW,MAAM,YAAY;AAAA,IAC7B,aAAa,MAAM,eAAe;AAAA,IAClC,MAAM,MAAM;AAAA,IACZ,KAAK,MAAM;AAAA,IACX,SAAS,MAAM,WAAW;AAAA,EAC5B,CAAC;AAAA,EACH,SAAS,CAAC,UAAqB,uBAAW,EAAE,OAAO,MAAM,KAAK,MAAM,MAAM,KAAK,CAAC;AAAA,EAChF,WAAW,CAAC,UAEP,oBAAQ,EAAE,OAAO,MAAM,KAAK,MAAM,MAAM,KAAK,CAAC,EAC9C,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EAYtE,SAAS,CAAC,YAAY,WACnB,MAAM,gBAAgB,aAAa,WAAW,gBAAgB,MAAM,iBACpE,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,cAAc,aAAa,WAAW,cAAc,MAAM,eAChE,MAAM,YAAY,aAAa,WAAW,YAAY,MAAM,aAC5D,MAAM,gBAAgB,aAAa,WAAW,gBAAgB,MAAM,iBACpE,MAAM,kBAAkB,aAAa,WAAW,kBAAkB,MAAM;AAAA,EAC3E,QAAQ,CAAC,UACI,qBAAS,EAAE,OAAO,MAAM,KAAK,MAAM,MAAM,SAAS,SAAS,KAAK,EAAE,CAAC;AAClF;AAEO,IAAM,YAAW,gBAAgB,KAAI;AAErC,IAAM,4BAA4B,MAC9B,iBAAO,mBAA0B,gBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;ACxH5F,qBAAS;AACT;AACA;AACA;AACA;AAyBO,IAAM,oBAAoB,UAA4B,oBAAoB;AAAA;AAE1E,MAAM,iCAAsC,kBAAY,0BAA0B,EAEtF;AAAC;AAOJ,IAAM,WAAW,CAAC,UACH,2BAAa,EAAE,KAAK,MAAM,KAAK,OAAO,IAAI,CAAC,EAAE,KACjD,gBAAQ,CAAC,SAAS;AAAA,EACvB,MAAM,KAAK,KAAK,KAAK,CAAC,QAAQ,IAAI,SAAS,MAAM,IAAI,GAAG;AAAA,EACxD,OAAO,OAAO,YACH,aACL,IAAI,yBAAyB;AAAA,IAC3B,SAAS,iBAAiB,MAAM,eAAe,MAAM;AAAA,EACvD,CAAC,CACH,IACO,gBAAQ,EAAE;AAAA,CACtB,CACH;AAGK,IAAM,QAST;AAAA,EACF,YAAY,CAAC,MAAM,UAAU;AAAA,IAC3B,IAAI,KAAK,MAAM,YAAY,MAAM,MAAM,SAAS,YAAY;AAAA,MAAG;AAAA,IAC/D,OAAO,EAAE,KAAK,MAAM,KAAK,MAAM,MAAM,MAAM,QAAQ,KAAK,QAAQ,UAAU,MAAM,SAAS;AAAA;AAAA,EAE3F,SAAS,CAAC,OAAO,SACF,kCAAoB,EAAE,IAAI,KAAK,QAAQ,UAAU,MAAM,SAAS,CAAC;AAAA,EAChF,WAAW,CAAC,UACH,YAAI,UAAU,GAAG;AAAA,IACtB,MAAM,SAAS,OAAO,SAAS,KAAK;AAAA,IACpC,MAAM,OAAO,OAAoB,gCAAkB,EAAE,IAAI,QAAQ,UAAU,MAAM,SAAS,CAAC;AAAA,IAC3F,OAAO,EAAE,OAAO,KAAK,OAAO,OAAO;AAAA,GACpC,EAAE,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,SAAS,MAAM;AAAA,EACf,QAAQ,CAAC,OAAO,WACd,WAAW,YACA,eACA,gBAAQ,SAAS,KAAK,GAAG,CAAC,OACxB,eAAoB,+BAAiB,EAAE,IAAI,UAAU,MAAM,SAAS,CAAC,CAAC,CAC/E;AACR;AAEO,IAAM,YAAW,gBAAgB,KAAI;AAErC,IAAM,4BAA4B,MAC9B,iBAAO,mBAA0B,gBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;",
+  "debugId": "D0F244891AADE98C64756E2164756E21",
   "names": []
 }

package/dist/forgejo/org-actions-secrets.d.ts

@@ -1,33 +1,30 @@
 /**
  * `Forgejo.OrgSecret` — org-level Actions secret metadata at `/orgs/{org}/actions/secrets/{name}`.
  *
- * ★ CHOICE: AUTHORED WITH WRITE-ONLY VALUE VIA ENV, NOT REFUSED. The OpenAPI in
- *   `<estate>/mcp-servers/docs/api/upstream/forgejo.json` shows `Secret` returns only `name` and
- *   `created_at` — never the `data` field — so attributes stay metadata-only. Create/update is PUT
- *   with body `{ data }`, which does not fit POST/PATCH; this family uses the `upsert` seam on
- *   `ForgejoSpec` instead of hand-rolling provider handlers.
+ * ★ CHOICE: AUTHORED WITH WRITE-ONLY VALUE VIA ENV, NOT REFUSED. `organization.Secret` (the
+ *   package's typed output) has only `name` and `created_at` — never `data` — so attributes stay
+ *   metadata-only. Create/update is `updateOrgSecret`, a PUT with `{ data }`, which does not fit
+ *   POST/PATCH; this family uses the `upsert` seam on `ForgejoSpec` instead of a plain create.
  *
  * ⛔ THE SECRET VALUE IS NEVER A PROP OR AN ATTRIBUTE. It is read from `FORGEJO_ORG_SECRET_{org}_{name}`
  *   (see orgSecretEnvKey) at PUT time when the name is absent from the list. Once present, reconcile
  *   noops — the API cannot confirm the value matches, and re-PUT on every deploy would rotate
  *   unintentionally. Rotate by destroy-then-create or a manual PUT outside Alchemy.
  *
- * ⚠️ PUT ANSWERS 201/204 WITH NO BODY — client.ts treats empty responses as `undefined`; read-back
- *   uses the list endpoint, not the PUT response.
- *
  * ⛔ TOKEN NEEDS `write:organization` TO PUT — list needs `read:organization`.
  *
  * ⛔ THE FILE NAME IS PLURAL ON PURPOSE AND MUST STAY THAT WAY. `.gitignore:198` carries
  *   `*-secret.*` — the rule that stops `client-secret.json` and friends being committed — and it
  *   matches a SOURCE file called `org-secret.ts` just as happily. This family was first authored
  *   under that name: it existed on disk, typechecked, passed oxlint, was imported by alchemy.run.ts
- *   and appeared in NO `git status`. It would have been committed as a broken import for everyone
- *   else, with the local tree green the whole time. `scripts/husky/ignored-imports.ts` is the gate
- *   that now catches the class; this comment is for whoever is tempted to rename it back.
+ *   and appeared in NO `git status`. `scripts/husky/ignored-imports.ts` is the gate that now
+ *   catches the class; this comment is for whoever is tempted to rename it back.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
-import { type ForgejoRequirements } from './resource.ts';
+import * as organization from '@distilled.cloud/forgejo/organization';
+import * as Effect from 'effect/Effect';
+import { type ForgejoRequirements, type ForgejoSpec } from './resource.ts';
 export interface OrgSecretProps {
     org: string;
     /** Secret name — path key; value lives in env, not here. */
@@ -41,5 +38,38 @@ export interface OrgSecretAttributes {
 export interface ForgejoOrgSecret extends Resource<'Forgejo.OrgSecret', OrgSecretProps, OrgSecretAttributes, never, ForgejoRequirements> {
 }
 export declare const ForgejoOrgSecret: import("alchemy").ResourceClass<ForgejoOrgSecret>;
+declare const ForgejoSecretEnvUnsetError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ForgejoSecretEnvUnsetError";
+} & Readonly<A>;
+/** Domain refusal, not a distilled error — the env var this family reads the secret value from is unset. */
+export declare class ForgejoSecretEnvUnsetError extends ForgejoSecretEnvUnsetError_base<{
+    readonly message: string;
+}> {
+}
+/** ★ EXPORTED for direct testing with an explicit fake `Credentials` layer — see repository.ts. */
+export declare const spec: ForgejoSpec<OrgSecretProps, organization.Secret, OrgSecretAttributes, organization.OrgListActionsSecretsError | organization.UpdateOrgSecretError | organization.DeleteOrgSecretError | ForgejoSecretEnvUnsetError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: ({ olds }: {
+        olds: OrgSecretProps;
+    }) => Effect.Effect<OrgSecretAttributes | undefined, import("@distilled.cloud/cloudflare/Errors").BadGateway | organization.BadRequest | import("@distilled.cloud/cloudflare/Errors").ConfigError | organization.Forbidden | import("@distilled.cloud/forgejo/Errors").ForgejoParseError | ForgejoSecretEnvUnsetError | import("@distilled.cloud/cloudflare/Errors").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/cloudflare/Errors").InternalServerError | organization.NotFound | import("@distilled.cloud/cloudflare/Errors").ServiceUnavailable | import("@distilled.cloud/cloudflare/Errors").TooManyRequests | import("@distilled.cloud/cloudflare/Errors").Unauthorized | import("@distilled.cloud/forgejo/Errors").UnknownForgejoError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: ({ news, output }: {
+        news: import("alchemy").Input<OrgSecretProps>;
+        output: OrgSecretAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | {
+        readonly action: 'replace';
+    } | undefined, import("@distilled.cloud/cloudflare/Errors").BadGateway | organization.BadRequest | import("@distilled.cloud/cloudflare/Errors").ConfigError | organization.Forbidden | import("@distilled.cloud/forgejo/Errors").ForgejoParseError | ForgejoSecretEnvUnsetError | import("@distilled.cloud/cloudflare/Errors").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/cloudflare/Errors").InternalServerError | organization.NotFound | import("@distilled.cloud/cloudflare/Errors").ServiceUnavailable | import("@distilled.cloud/cloudflare/Errors").TooManyRequests | import("@distilled.cloud/cloudflare/Errors").Unauthorized | import("@distilled.cloud/forgejo/Errors").UnknownForgejoError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: ({ news }: {
+        news: OrgSecretProps;
+    }) => Effect.Effect<OrgSecretAttributes, import("@distilled.cloud/cloudflare/Errors").BadGateway | organization.BadRequest | import("@distilled.cloud/cloudflare/Errors").ConfigError | organization.Forbidden | import("@distilled.cloud/forgejo/Errors").ForgejoParseError | ForgejoSecretEnvUnsetError | import("@distilled.cloud/cloudflare/Errors").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/cloudflare/Errors").InternalServerError | organization.NotFound | import("@distilled.cloud/cloudflare/Errors").ServiceUnavailable | import("@distilled.cloud/cloudflare/Errors").TooManyRequests | import("@distilled.cloud/cloudflare/Errors").Unauthorized | import("@distilled.cloud/forgejo/Errors").UnknownForgejoError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: ({ olds }: {
+        olds: OrgSecretProps;
+    }) => Effect.Effect<void, import("@distilled.cloud/cloudflare/Errors").BadGateway | organization.BadRequest | import("@distilled.cloud/cloudflare/Errors").ConfigError | organization.Forbidden | import("@distilled.cloud/forgejo/Errors").ForgejoParseError | ForgejoSecretEnvUnsetError | import("@distilled.cloud/cloudflare/Errors").GatewayTimeout | import("effect/unstable/http/HttpClientError").HttpClientError | import("@distilled.cloud/cloudflare/Errors").InternalServerError | organization.NotFound | import("@distilled.cloud/cloudflare/Errors").ServiceUnavailable | import("@distilled.cloud/cloudflare/Errors").TooManyRequests | import("@distilled.cloud/cloudflare/Errors").Unauthorized | import("@distilled.cloud/forgejo/Errors").UnknownForgejoError, import("effect/unstable/http/HttpClient").HttpClient>;
+};
 export declare const ForgejoOrgSecretProvider: () => import("effect/Layer").Layer<Provider.Provider<ForgejoOrgSecret>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export {};
 //# sourceMappingURL=org-actions-secrets.d.ts.map

package/dist/forgejo/org-actions-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"org-actions-secrets.d.ts","sourceRoot":"","sources":["../../src/forgejo/org-actions-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAG7C,OAAO,EAAE,KAAK,mBAAmB,EAAmB,MAAM,eAAe,CAAC;AAG1E,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,mBAAmB,CACpB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAAkD,CAAC;AA2ChF,eAAO,MAAM,wBAAwB,sIACsD,CAAC"}
+{"version":3,"file":"org-actions-secrets.d.ts","sourceRoot":"","sources":["../../src/forgejo/org-actions-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,YAAY,MAAM,uCAAuC,CAAC;AAEtE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,WAAW,EAAmB,MAAM,eAAe,CAAC;AAG5F,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAiB,SAAQ,QAAQ,CAChD,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,mBAAmB,CACpB;CAAG;AAEJ,eAAO,MAAM,gBAAgB,mDAAkD,CAAC;;;;AAEhF,4GAA4G;AAC5G,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;CAAG;AAgBL,mGAAmG;AACnG,eAAO,MAAM,IAAI,EAAE,WAAW,CAC5B,cAAc,EACd,YAAY,CAAC,MAAM,EACnB,mBAAmB,EACjB,YAAY,CAAC,0BAA0B,GACvC,YAAY,CAAC,oBAAoB,GACjC,YAAY,CAAC,oBAAoB,GACjC,0BAA0B,CAsB7B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;CAAwB,CAAC;AAE9C,eAAO,MAAM,wBAAwB,sIACsD,CAAC"}