@homeflare/alchemy 0.35.0 → 0.37.0

package/src/argocd/repo-creds.test.ts

@@ -0,0 +1,123 @@
+/**
+ * `Argocd.RepoCreds`'s `spec` against a fake Argo CD.
+ *
+ * ⚠️ THERE IS NO GET-BY-URL OPERATION (see `repo-creds.ts`'s header) — `fetchLive` lists and
+ *   finds, so the tests here cover "found in the list", "absent from a non-empty list" AND
+ *   "empty list", not just a single not-found case.
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { FAKE_BASE, fakeArgocd, fakeArgocdLayer, fakeFailure } from './fake-argocd.ts';
+import { argocdOperations } from './resource.ts';
+import { spec } from './repo-creds.ts';
+
+const URL_PREFIX = `${FAKE_BASE}/homeflare/`;
+const ENV_VAR = 'ARGOCD_REPOCREDS_HOMEFLARE_SSH_KEY';
+
+const listWith = (...items: Record<string, unknown>[]) => Response.json({ items });
+
+describe('Argocd.RepoCreds spec.fetchLive (list + find, no single Get)', () => {
+  test('finds a matching entry in a non-empty list', async () => {
+    const fake = fakeArgocd(() =>
+      listWith(
+        { type: 'git', url: URL_PREFIX, username: 'ci' },
+        { type: 'git', url: `${FAKE_BASE}/other/` },
+      ),
+    );
+    const live = await Effect.runPromise(
+      spec.fetchLive({ url: URL_PREFIX }).pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    expect(live?.username).toBe('ci');
+  });
+
+  test('an empty list is undefined', async () => {
+    const fake = fakeArgocd(() => listWith());
+    const result = await Effect.runPromise(
+      spec.fetchLive({ url: URL_PREFIX }).pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    expect(result).toBeUndefined();
+  });
+
+  test('a non-empty list with no matching url is undefined', async () => {
+    const fake = fakeArgocd(() => listWith({ type: 'git', url: `${FAKE_BASE}/other/` }));
+    const result = await Effect.runPromise(
+      spec.fetchLive({ url: URL_PREFIX }).pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    expect(result).toBeUndefined();
+  });
+
+  test('a 401 propagates — not folded to absent', async () => {
+    const fake = fakeArgocd(() => fakeFailure(401, 'bad token'));
+    const failure = await Effect.runPromise(
+      Effect.flip(
+        spec.fetchLive({ url: URL_PREFIX }).pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+      ),
+    );
+    expect(failure._tag).toBe('Unauthorized');
+  });
+});
+
+describe('Argocd.RepoCreds destroy — idempotent (S11)', () => {
+  test('deleting an absent template makes no DELETE call', async () => {
+    const fake = fakeArgocd(() => listWith());
+    await Effect.runPromise(
+      argocdOperations(spec)
+        .destroy({ url: URL_PREFIX })
+        .pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    expect(fake.seen.every((call) => call.method !== 'DELETE')).toBe(true);
+  });
+
+  test('the DELETE call itself returning 404 (a race with an external removal) still succeeds', async () => {
+    // ⚠️ fetchLive's pre-check list finds the template, but something else removes it before
+    //   this call's own DELETE lands — matching upstream's Hetzner/Certificate.ts `deleteById`.
+    const fake = fakeArgocd((method) =>
+      method === 'GET' ? listWith({ type: 'git', url: URL_PREFIX }) : fakeFailure(404, 'not found'),
+    );
+    await Effect.runPromise(
+      argocdOperations(spec)
+        .destroy({ url: URL_PREFIX })
+        .pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    expect(fake.seen.filter((call) => call.method === 'DELETE')).toHaveLength(1);
+  });
+});
+
+describe('Argocd.RepoCreds spec.upsert — write-only credentials', () => {
+  beforeEach(() => {
+    delete process.env[ENV_VAR];
+  });
+  afterEach(() => {
+    delete process.env[ENV_VAR];
+  });
+
+  test('refuses with a typed domain error when the declared env var is unset', async () => {
+    const fake = fakeArgocd(() => listWith());
+    const failure = await Effect.runPromise(
+      Effect.flip(
+        spec
+          .upsert({ credentials: { sshPrivateKey: { fromEnv: ENV_VAR } }, url: URL_PREFIX })
+          .pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+      ),
+    );
+    expect(failure._tag).toBe('ArgocdSecretEnvUnsetError');
+    expect(fake.seen).toEqual([]);
+  });
+
+  test('resolves the env var and sends it in the body, with upsert=true on the query string', async () => {
+    process.env[ENV_VAR] = '-----BEGIN KEY-----fake-----END KEY-----';
+    const fake = fakeArgocd((method) =>
+      method === 'POST' ? Response.json({ url: URL_PREFIX }) : fakeFailure(404, 'x'),
+    );
+    await Effect.runPromise(
+      spec
+        .upsert({ credentials: { sshPrivateKey: { fromEnv: ENV_VAR } }, url: URL_PREFIX })
+        .pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    const [create] = fake.seen.filter((call) => call.method === 'POST');
+    expect(create?.path).toContain('upsert=true');
+    const body = create?.body as Record<string, unknown>;
+    expect(body.sshPrivateKey).toBe('-----BEGIN KEY-----fake-----END KEY-----');
+    expect(JSON.stringify(body)).not.toContain('fromEnv');
+  });
+});

package/src/argocd/repo-creds.ts

@@ -0,0 +1,115 @@
+/**
+ * `Argocd.RepoCreds` — a credential TEMPLATE that Argo CD applies to any repository whose URL
+ * starts with `url` (`/api/v1/repocreds`) — distinct from `Argocd.Repository`, which registers one
+ * specific repository. REST-managed, not a CRD; see `docs/argocd.md`.
+ *
+ * ⚠️ NO `GetRepoCredsService` OPERATION EXISTS — measured against the operation list in
+ *   `services/argocd.ts` (distilled homeflare/base): Create/Update/Delete/List only, no single-item
+ *   Get. `fetchLive` below lists and finds by `url`, the same shape
+ *   `discord/guild-application-command.ts#fetchByName` and
+ *   `forgejo/org-actions-secrets.ts#fetchLive` use for the same reason.
+ *
+ * ⚠️ NO LIVE ARGO CD INSTANCE EXISTS ON THE ESTATE (2026-09-24) — see `docs/argocd.md`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as argocd from '@distilled.cloud/argocd/argocd';
+import * as Effect from 'effect/Effect';
+import {
+  type ArgocdSecretEnvUnsetError,
+  type GitCredentialRefs,
+  resolveGitCredentials,
+} from './git-credentials.ts';
+import { type ArgocdRequirements, type ArgocdSpec, argocdHandlers, present } from './resource.ts';
+
+export interface RepoCredsProps {
+  /** The URL prefix this template matches — identity key; changing it is a replace. */
+  url: string;
+  /** "git" (default), "helm" or "oci". */
+  type?: string;
+  username?: string;
+  /** The client certificate itself — public, unlike its key. */
+  tlsClientCertData?: string;
+  /** Write-only — see `git-credentials.ts`. Never a value here, only env var names. */
+  credentials?: GitCredentialRefs;
+}
+
+export interface RepoCredsAttributes {
+  url: string;
+  type: string | undefined;
+  username: string | undefined;
+  tlsClientCertData: string | undefined;
+}
+
+export interface ArgocdRepoCreds extends Resource<
+  'Argocd.RepoCreds',
+  RepoCredsProps,
+  RepoCredsAttributes,
+  never,
+  ArgocdRequirements
+> {}
+
+export const ArgocdRepoCreds = Resource<ArgocdRepoCreds>('Argocd.RepoCreds');
+
+const attributesOf = (live: argocd.V1alpha1RepoCreds): RepoCredsAttributes => ({
+  tlsClientCertData: live.tlsClientCertData,
+  type: live.type,
+  url: live.url ?? '',
+  username: live.username,
+});
+
+/** Only the plain fields — see `git-credentials.ts` for why the secret fields are excluded. */
+const plainMatches = (attrs: RepoCredsAttributes, props: RepoCredsProps): boolean =>
+  (props.type ?? 'git') === (attrs.type ?? 'git') &&
+  (props.username ?? undefined) === (attrs.username ?? undefined) &&
+  (props.tlsClientCertData ?? undefined) === (attrs.tlsClientCertData ?? undefined);
+
+type RepoCredsError =
+  | argocd.ListRepoCredsServiceRepositoryCredentialsError
+  | argocd.CreateRepoCredsServiceRepositoryCredentialsError
+  | argocd.DeleteRepoCredsServiceRepositoryCredentialsError
+  | ArgocdSecretEnvUnsetError;
+
+/** ★ EXPORTED for direct testing against `fake-argocd.ts` — see `repo-creds.test.ts`. */
+export const spec: ArgocdSpec<
+  RepoCredsProps,
+  argocd.V1alpha1RepoCreds,
+  RepoCredsAttributes,
+  RepoCredsError
+> = {
+  attributes: (live) => attributesOf(live),
+  // ★ Catches the DELETE call's own NotFound too — closes the TOCTOU race between the pre-check
+  //   `fetchLive` above and this call. Matches upstream's Hetzner/Certificate.ts `deleteById`.
+  destroy: (props) =>
+    argocd
+      .deleteRepoCredsServiceRepositoryCredentials({ url: props.url })
+      .pipe(Effect.catchTag('NotFound', () => Effect.void)),
+  identityOfAttributes: (attrs) => attrs.url,
+  identityOfProps: (props) => props.url,
+  fetchLive: (props) =>
+    argocd.listRepoCredsServiceRepositoryCredentials({ url: props.url }).pipe(
+      Effect.map((page) => (page.items ?? []).find((row) => row.url === props.url)),
+      Effect.catchTag('NotFound', () => Effect.succeed(undefined)),
+    ),
+  matches: plainMatches,
+  upsert: (props) =>
+    resolveGitCredentials(props.credentials ?? {}).pipe(
+      Effect.flatMap((creds) =>
+        argocd.createRepoCredsServiceRepositoryCredentials(
+          present({
+            upsert: true,
+            tlsClientCertData: props.tlsClientCertData,
+            type: props.type,
+            url: props.url,
+            username: props.username,
+            ...creds,
+          }),
+        ),
+      ),
+    ),
+};
+
+export const handlers = argocdHandlers(spec);
+
+export const ArgocdRepoCredsProvider = () =>
+  Provider.effect(ArgocdRepoCreds, Effect.succeed(ArgocdRepoCreds.Provider.of(handlers)));

package/src/argocd/repository.test.ts

@@ -0,0 +1,167 @@
+/**
+ * `Argocd.Repository`'s `spec` against a fake Argo CD — proves the doctrine-required shapes:
+ *
+ * - `fetchLive` folds a real distilled `NotFound` (404) to `undefined`, and does NOT fold a
+ *   401 — the same `catchTag('NotFound', ...)` idiom `forgejo/repository.test.ts` proves.
+ * - `spec.destroy`-via-`argocdOperations#destroy` is idempotent: a delete of an already-absent
+ *   repository makes no request at all (S11).
+ * - `spec.upsert` sends `upsert: true` and resolves write-only credentials from the environment,
+ *   never a literal value on a stack file — and refuses (a typed domain error, not a distilled
+ *   one) when the declared env var is unset.
+ *
+ * No live Argo CD instance exists on the estate (2026-09-24) — every assertion here runs against
+ * `fake-argocd.ts`, never a real server.
+ */
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { FAKE_BASE, fakeArgocd, fakeArgocdLayer, fakeFailure } from './fake-argocd.ts';
+import { argocdOperations } from './resource.ts';
+import { spec } from './repository.ts';
+
+const REPO = `${FAKE_BASE}/homeflare/kit.git`;
+const ENV_VAR = 'ARGOCD_REPO_KIT_PASSWORD';
+
+const liveRepo = (overrides: Record<string, unknown> = {}) =>
+  Response.json({ enableLfs: true, repo: REPO, type: 'git', ...overrides });
+
+describe('Argocd.Repository spec.fetchLive', () => {
+  test('a live repository decodes into attributes', async () => {
+    const fake = fakeArgocd((method) =>
+      method === 'GET' ? liveRepo() : fakeFailure(404, 'not found'),
+    );
+    const live = await Effect.runPromise(
+      spec.fetchLive({ repo: REPO }).pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    expect(live?.repo).toBe(REPO);
+    expect(live?.enableLfs).toBe(true);
+  });
+
+  test('a 404 folds to undefined', async () => {
+    const fake = fakeArgocd(() => fakeFailure(404, 'repository not found'));
+    const result = await Effect.runPromise(
+      spec.fetchLive({ repo: REPO }).pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    expect(result).toBeUndefined();
+  });
+
+  test('a 401 propagates — not folded to absent', async () => {
+    const fake = fakeArgocd(() => fakeFailure(401, 'bad token'));
+    const failure = await Effect.runPromise(
+      Effect.flip(spec.fetchLive({ repo: REPO }).pipe(Effect.provide(fakeArgocdLayer(fake.fetch)))),
+    );
+    expect(failure._tag).toBe('Unauthorized');
+  });
+});
+
+describe('Argocd.Repository destroy — idempotent (S11)', () => {
+  test('deleting an already-absent repository makes no delete call', async () => {
+    const fake = fakeArgocd(() => fakeFailure(404, 'repository not found'));
+    await Effect.runPromise(
+      argocdOperations(spec)
+        .destroy({ repo: REPO })
+        .pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    // Only the read (fetchLive) happened — never a DELETE against an object that was never there.
+    expect(fake.seen.every((call) => call.method !== 'DELETE')).toBe(true);
+  });
+
+  test('deleting a live repository calls DELETE once', async () => {
+    const fake = fakeArgocd((method) => (method === 'GET' ? liveRepo() : Response.json({})));
+    await Effect.runPromise(
+      argocdOperations(spec)
+        .destroy({ repo: REPO })
+        .pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    expect(fake.seen.filter((call) => call.method === 'DELETE')).toHaveLength(1);
+  });
+
+  test('the DELETE call itself returning 404 (a race with an external removal) still succeeds', async () => {
+    // ⚠️ Different from the "already-absent" case above: fetchLive's pre-check finds the object
+    //   live, but something else deletes it before this call's own DELETE lands — matching
+    //   upstream's Hetzner/Certificate.ts `deleteById` pattern (catchTag on the delete itself).
+    const fake = fakeArgocd((method) =>
+      method === 'GET' ? liveRepo() : fakeFailure(404, 'repository not found'),
+    );
+    await Effect.runPromise(
+      argocdOperations(spec)
+        .destroy({ repo: REPO })
+        .pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    expect(fake.seen.filter((call) => call.method === 'DELETE')).toHaveLength(1);
+  });
+});
+
+describe('Argocd.Repository spec.upsert — write-only credentials', () => {
+  beforeEach(() => {
+    delete process.env[ENV_VAR];
+  });
+  afterEach(() => {
+    delete process.env[ENV_VAR];
+  });
+
+  test('refuses with a typed domain error when the declared env var is unset', async () => {
+    const fake = fakeArgocd(() => fakeFailure(404, 'unused'));
+    const failure = await Effect.runPromise(
+      Effect.flip(
+        spec
+          .upsert({ credentials: { password: { fromEnv: ENV_VAR } }, repo: REPO, username: 'ci' })
+          .pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+      ),
+    );
+    expect(failure._tag).toBe('ArgocdSecretEnvUnsetError');
+    expect(fake.seen).toEqual([]);
+  });
+
+  test('resolves the env var and sends it — never the FromEnv reference itself', async () => {
+    process.env[ENV_VAR] = 'hunter2';
+    const fake = fakeArgocd((method) =>
+      method === 'POST' ? Response.json({ repo: REPO }) : fakeFailure(404, 'x'),
+    );
+    await Effect.runPromise(
+      spec
+        .upsert({ credentials: { password: { fromEnv: ENV_VAR } }, repo: REPO, username: 'ci' })
+        .pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    const [create] = fake.seen.filter((call) => call.method === 'POST');
+    // `upsert` is a query-string trait on this operation (`T.Query()`), not a body field —
+    // measured against `CreateRepositoryServiceRepositoryRequest` in services/argocd.ts.
+    expect(create?.path).toContain('upsert=true');
+    const body = create?.body as Record<string, unknown>;
+    expect(body.password).toBe('hunter2');
+    expect(body.username).toBe('ci');
+    expect(JSON.stringify(body)).not.toContain('fromEnv');
+  });
+});
+
+describe('Argocd.Repository diff — a changed identity key is a replace, never an update', () => {
+  // ⛔ REGRESSION: adversarial review 2026-09-24 found `diff` could only ever return
+  //   noop/update, so a changed `repo` (Argo CD indexes by it) silently created a new
+  //   registration at the new URL and left the old, still-credentialed one orphaned — no state
+  //   pointed at it, nothing would ever delete it. Fixed via `identityOfProps`/
+  //   `identityOfAttributes` in resource.ts.
+  const RENAMED_REPO = `${FAKE_BASE}/homeflare/kit-renamed.git`;
+  const oldOutput = spec.attributes({ enableLfs: true, repo: REPO, type: 'git' }, { repo: REPO });
+
+  test('a changed repo URL is a replace, and no read of the new URL happens first', async () => {
+    const fake = fakeArgocd(() => fakeFailure(500, 'must not be called — identity differs'));
+    const result = await Effect.runPromise(
+      argocdOperations(spec)
+        .diff({ repo: RENAMED_REPO }, oldOutput)
+        .pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    expect(result).toEqual({ action: 'replace' });
+    expect(fake.seen).toEqual([]);
+  });
+
+  test('the SAME repo URL with a plain-field change is an update, not a replace', async () => {
+    const fake = fakeArgocd((method) =>
+      method === 'GET' ? liveRepo({ enableLfs: false }) : fakeFailure(404, 'x'),
+    );
+    const result = await Effect.runPromise(
+      argocdOperations(spec)
+        .diff({ enableLfs: true, repo: REPO }, oldOutput)
+        .pipe(Effect.provide(fakeArgocdLayer(fake.fetch))),
+    );
+    expect(result).toEqual({ action: 'update' });
+  });
+});

package/src/argocd/repository.ts

@@ -0,0 +1,165 @@
+/**
+ * `Argocd.Repository` — a git/helm/OCI source registered with an Argo CD instance
+ * (`/api/v1/repositories`). REST-managed, NOT a Kubernetes CRD — see `docs/argocd.md` for the
+ * measured split between this family and `Kubernetes.Manifest` (upstream Alchemy's family, for
+ * `Application`/`AppProject`, which genuinely are CRDs).
+ *
+ * ⚠️ NO LIVE ARGO CD INSTANCE EXISTS ON THE ESTATE (2026-09-24). Built ahead of the Talos-on-PVE
+ *   cluster this targets; every test runs against `fake-argocd.ts`. See `docs/argocd.md`.
+ *
+ * ⛔ `defaultRemovalPolicy: 'retain'` — deregistering a repository Argo CD applications still
+ *   reference breaks their sync, the same reasoning `forgejo/repository.ts` gives for git repos.
+ *   `delete` below is fully implemented; opt in with `.pipe(RemovalPolicy.destroy())`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as argocd from '@distilled.cloud/argocd/argocd';
+import * as Effect from 'effect/Effect';
+import {
+  type ArgocdSecretEnvUnsetError,
+  type GitCredentialRefs,
+  resolveGitCredentials,
+} from './git-credentials.ts';
+import { type ArgocdRequirements, type ArgocdSpec, argocdHandlers, present } from './resource.ts';
+
+export interface RepositoryProps {
+  /** The repository URL — identity key; changing it is a replace, not an update. */
+  repo: string;
+  /** "git" (default), "helm" or "oci". */
+  type?: string;
+  /** Required for "helm" repositories (Argo CD indexes helm repos by name, not URL). */
+  name?: string;
+  /** Restricts this repository to one Argo CD project; omit for every project. */
+  project?: string;
+  username?: string;
+  insecure?: boolean;
+  insecureIgnoreHostKey?: boolean;
+  enableLfs?: boolean;
+  enableOCI?: boolean;
+  forceHttpBasicAuth?: boolean;
+  proxy?: string;
+  noProxy?: string;
+  /** The client certificate itself — public, unlike its key. */
+  tlsClientCertData?: string;
+  /** Write-only — see `git-credentials.ts`. Never a value here, only env var names. */
+  credentials?: GitCredentialRefs;
+}
+
+export interface RepositoryAttributes {
+  repo: string;
+  type: string | undefined;
+  name: string | undefined;
+  project: string | undefined;
+  username: string | undefined;
+  insecure: boolean | undefined;
+  insecureIgnoreHostKey: boolean | undefined;
+  enableLfs: boolean | undefined;
+  enableOCI: boolean | undefined;
+  forceHttpBasicAuth: boolean | undefined;
+  proxy: string | undefined;
+  noProxy: string | undefined;
+  tlsClientCertData: string | undefined;
+}
+
+export interface ArgocdRepository extends Resource<
+  'Argocd.Repository',
+  RepositoryProps,
+  RepositoryAttributes,
+  never,
+  ArgocdRequirements
+> {}
+
+export const ArgocdRepository = Resource<ArgocdRepository>('Argocd.Repository', {
+  defaultRemovalPolicy: 'retain',
+});
+
+const attributesOf = (live: argocd.V1alpha1Repository): RepositoryAttributes => ({
+  enableLfs: live.enableLfs,
+  enableOCI: live.enableOCI,
+  forceHttpBasicAuth: live.forceHttpBasicAuth,
+  insecure: live.insecure,
+  insecureIgnoreHostKey: live.insecureIgnoreHostKey,
+  name: live.name,
+  noProxy: live.noProxy,
+  project: live.project,
+  proxy: live.proxy,
+  repo: live.repo ?? '',
+  tlsClientCertData: live.tlsClientCertData,
+  type: live.type,
+  username: live.username,
+});
+
+/** Only the plain fields — see `git-credentials.ts` for why the secret fields are excluded. */
+const plainMatches = (attrs: RepositoryAttributes, props: RepositoryProps): boolean =>
+  (props.type ?? 'git') === (attrs.type ?? 'git') &&
+  (props.name ?? undefined) === (attrs.name ?? undefined) &&
+  (props.project ?? undefined) === (attrs.project ?? undefined) &&
+  (props.username ?? undefined) === (attrs.username ?? undefined) &&
+  Boolean(props.insecure) === Boolean(attrs.insecure) &&
+  Boolean(props.insecureIgnoreHostKey) === Boolean(attrs.insecureIgnoreHostKey) &&
+  Boolean(props.enableLfs) === Boolean(attrs.enableLfs) &&
+  Boolean(props.enableOCI) === Boolean(attrs.enableOCI) &&
+  Boolean(props.forceHttpBasicAuth) === Boolean(attrs.forceHttpBasicAuth) &&
+  (props.proxy ?? undefined) === (attrs.proxy ?? undefined) &&
+  (props.noProxy ?? undefined) === (attrs.noProxy ?? undefined) &&
+  (props.tlsClientCertData ?? undefined) === (attrs.tlsClientCertData ?? undefined);
+
+type RepositoryError =
+  | argocd.GetRepositoryServiceError
+  | argocd.CreateRepositoryServiceRepositoryError
+  | argocd.DeleteRepositoryServiceRepositoryError
+  | ArgocdSecretEnvUnsetError;
+
+/** ★ EXPORTED for direct testing against `fake-argocd.ts` — see `repository.test.ts`. */
+export const spec: ArgocdSpec<
+  RepositoryProps,
+  argocd.V1alpha1Repository,
+  RepositoryAttributes,
+  RepositoryError
+> = {
+  attributes: (live) => attributesOf(live),
+  // ★ Catches the DELETE call's own NotFound too, not just the pre-check `fetchLive` fold above
+  //   — closes the TOCTOU race between that read and this call (the object could be removed by
+  //   something else in between). Matches upstream's own pattern: Hetzner/Certificate.ts's
+  //   `deleteById` (`.pipe(Effect.catchTag('NotFound', () => Effect.void))`).
+  destroy: (props) =>
+    argocd
+      .deleteRepositoryServiceRepository({ repo: props.repo })
+      .pipe(Effect.catchTag('NotFound', () => Effect.void)),
+  identityOfAttributes: (attrs) => attrs.repo,
+  identityOfProps: (props) => props.repo,
+  fetchLive: (props) =>
+    argocd
+      .getRepositoryService({ repo: props.repo })
+      .pipe(Effect.catchTag('NotFound', () => Effect.succeed(undefined))),
+  matches: plainMatches,
+  upsert: (props) =>
+    resolveGitCredentials(props.credentials ?? {}).pipe(
+      Effect.flatMap((creds) =>
+        argocd.createRepositoryServiceRepository(
+          present({
+            upsert: true,
+            enableLfs: props.enableLfs,
+            enableOCI: props.enableOCI,
+            forceHttpBasicAuth: props.forceHttpBasicAuth,
+            insecure: props.insecure,
+            insecureIgnoreHostKey: props.insecureIgnoreHostKey,
+            name: props.name,
+            noProxy: props.noProxy,
+            project: props.project,
+            proxy: props.proxy,
+            repo: props.repo,
+            tlsClientCertData: props.tlsClientCertData,
+            type: props.type,
+            username: props.username,
+            ...creds,
+          }),
+        ),
+      ),
+    ),
+};
+
+export const handlers = argocdHandlers(spec);
+
+export const ArgocdRepositoryProvider = () =>
+  Provider.effect(ArgocdRepository, Effect.succeed(ArgocdRepository.Provider.of(handlers)));