Add Forgejo namespace workflow stack

2026-03-18 02:49:55 -07:00 · 2026-03-18 02:49:55 -07:00 · 865b676c99
commit 865b676c99
parent 482fd5d085
68 changed files with 9709 additions and 11 deletions
--- a/services/forgejo-nsc/README.md
+++ b/services/forgejo-nsc/README.md
@ -0,0 +1,183 @@
+## forgejo-nsc-dispatcher
+
+This service exposes a simple HTTP API that tells Namespace Cloud to start
+ephemeral Forgejo Actions runners on demand. It glues together three pieces:
+
+1. **Forgejo Actions** – the service requests a scoped registration token
+   for the repository/organization/instance where you want to run jobs.
+2. **Namespace (`nsc`)** – the dispatcher shells out to the `nsc` CLI to create
+   a short‑lived environment, runs the `forgejo-runner` container inside it,
+   and exits after a single job (`forgejo-runner one-job`). The Namespace TTL is
+   the hard cap, not the typical lifetime.
+3. **Your automation** – you call the service via HTTP (directly, through Caddy,
+   via Forgejo webhooks, etc.) whenever a new runner is needed.
+
+### Directory layout
+
+```
+.
+├── cmd/forgejo-nsc-dispatcher   # main entry point
+├── internal/                    # service packages (config, forgejo client, nsc dispatcher, HTTP server)
+├── config.example.yaml          # starter config referenced by README
+├── flake.nix / flake.lock       # reproducible builds (Go binary + container image)
+└── .forgejo/workflows           # CI that runs go test/build and publishes manifests
+```
+
+### Configuration
+
+Copy `config.example.yaml` and update it for your Forgejo instance and Namespace
+profile. The important knobs are:
+
+- `forgejo.base_url` – HTTPS endpoint of your Forgejo server. A PAT with
+  `actions:runner` scope is required in `forgejo.token`.
+- `forgejo.instance_url` – URL that spawned runners use to register back to Forgejo.
+  This must be reachable from the runner (typically the public URL like
+  `https://git.burrow.net`). On the forge host it commonly differs from `base_url`
+  (which may be `http://127.0.0.1:3000`).
+- `forgejo.default_scope` – where new runners register
+  (`instance`, `organization`, or `repository`).
+- `forgejo.default_labels` – labels applied to every spawned runner. GateForge
+  workflows via `runs-on: ["namespace-profile-linux-medium"]` (or other
+  `namespace-profile-linux-*` labels).
+- `namespace.nsc_binary` – path to the `nsc` binary (the Nix container ships one
+  compiled from `namespacelabs/foundation` so `/app/bin/nsc` works out of the box).
+- `namespace.image` – OCI image containing `forgejo-runner`.
+- `namespace.machine_type` / `namespace.duration` – shape + TTL for the ephemeral
+  Namespace environment. The dispatcher destroys the instance after a job so the
+  TTL acts as a hard cap, not an idle timeout.
+
+### Running locally
+
+```shell
+# Ensure nsc is available (e.g. `go build ./foundation/cmd/nsc`)
+cp config.example.yaml config.yaml
+nix develop   # optional dev shell with Go toolchain
+go run ./cmd/forgejo-nsc-dispatcher --config config.yaml
+```
+
+API example:
+
+```shell
+curl -X POST http://localhost:8080/api/v1/dispatch \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "count": 1,
+    "ttl": "20m",
+    "labels": ["namespace-profile-linux-medium"],
+    "scope": {"level": "repository", "owner": "example", "name": "app"}
+  }'
+```
+
+### Deploying with Nix + GHCR
+
+- `nix build .#packages.x86_64-linux.container-amd64` produces a deterministic
+  tarball containing the service, the `nsc` binary, BusyBox, and `forgejo-runner`.
+- The included `Build Container` workflow builds both `amd64` and `arm64` images
+  on Namespace runners and pushes them to `ghcr.io/<owner>/<repo>`.
+  No Fly.io manifests are emitted – the multi‑arch manifest points only at GHCR.
+
+### How this fits behind Caddy (last-mile networking)
+
+The dispatcher is just an HTTP server. You can:
+
+1. Run it anywhere that can reach Forgejo and Namespace: bare metal, Namespace
+   cluster, Kubernetes, Fly, etc.
+2. Put Caddy (or any reverse proxy) in front to terminate TLS, do auth, or
+   rewrite URLs. For example:
+
+   ```
+   forgejo-dispatcher.example.com {
+     reverse_proxy 127.0.0.1:8080
+     basicauth /api/* {
+       user JDJhJDE...
+     }
+   }
+   ```
+
+The service doesn’t assume Caddy, nor does it manipulate HTTP clients
+directly – it simply waits for POST requests. As long as the dispatcher can
+reach Forgejo’s REST API and run the `nsc` binary, you can drop it anywhere.
+
+### Autoscaling (webhook + poller)
+
+If you don’t want to call `/api/v1/dispatch` manually, there’s a companion
+autoscaler (`cmd/forgejo-nsc-autoscaler`) that watches Forgejo job queues and
+triggers the dispatcher for you. It operates in two modes simultaneously:
+
+1. **Polling** – every instance polls `GET /api/v1/.../actions/runners` to keep a
+   minimum number of idle Namespace runners per label. This continues until a
+   webhook is successfully processed, so the system is self-bootstrapping.
+2. **Webhooks** – once Forgejo reaches the autoscaler via the `/webhook/{name}`
+   endpoint, the autoscaler stops polling and reacts to `workflow_job` events in
+   real time. Each payload is mapped to a target label set and results in a
+   dispatch call.
+
+You can manage multiple Forgejo instances by listing them under `instances` in
+`autoscaler.example.yaml`:
+
+```
+listen: ":8090"
+dispatcher:
+  url: "http://dispatcher:8080"
+
+instances:
+- name: burrow
+  forgejo:
+    base_url: "https://git.burrow.net"
+    token: "PENDING-FORGEJO-PAT"
+  scope:
+    level: "repository"
+    owner: "hackclub"
+    name: "burrow"
+    disable_polling: true   # webhook-only mode
+    poll_interval: "30s"
+    webhook_secret: "supersecret"
+    webhook:
+      url: "https://nsc-autoscaler.burrow.net/webhook/burrow"
+      content_type: "json"
+      events: ["workflow_job"]
+      active: true
+    targets:
+      - labels: ["namespace-profile-linux-medium"]
+        min_idle: 0  # set to 0 to scale-to-zero between jobs
+        ttl: "20m"
+      - labels: ["namespace-profile-macos-large"]
+        min_idle: 0
+        ttl: "90m"
+        machine_type: "12x28"
+      - labels: ["namespace-profile-windows-large"]
+        min_idle: 0
+        ttl: "45m"
+        machine_type: "windows/amd64:8x16"
+```
+
+For Burrow, use `Scripts/provision-forgejo-nsc.sh` to mint the Forgejo PAT,
+generate a Namespace token from the logged-in namespace account, and render the
+dispatcher/autoscaler configs into `intake/forgejo_nsc_{dispatcher,autoscaler}.yaml`
+plus `intake/forgejo_nsc_token.txt`.
+
+For ongoing operations, use `Scripts/sync-forgejo-nsc-config.sh`:
+
+- `Scripts/sync-forgejo-nsc-config.sh` copies the intake-backed configs and
+  Namespace token onto `/var/lib/burrow/intake/` on the forge host, reapplies
+  file ownership for `forgejo-nsc`, and restarts the dispatcher/autoscaler.
+- `Scripts/sync-forgejo-nsc-config.sh --rotate-pat` additionally mints a new
+  Forgejo PAT on the Burrow forge host and refreshes the local intake files.
+
+Run it next to the dispatcher:
+
+```bash
+go run ./cmd/forgejo-nsc-autoscaler --config autoscaler.yaml
+# or build the binary/container via `nix build .#forgejo-nsc-autoscaler`
+```
+
+If your Forgejo build doesn’t expose the runner listing API, set
+`disable_polling: true` and rely on `webhook` entries. The autoscaler will
+auto-create/update the webhook (using the PAT) so that new `workflow_job` events
+immediately call the dispatcher even if the service isn’t publicly reachable yet.
+
+In Forgejo add a webhook pointing to `https://nsc-autoscaler.burrow.net/webhook/burrow`
+with the shared secret (or let the autoscaler create it by specifying `webhook.url`
+in config). The autoscaler continues polling until it receives the first valid
+webhook (unless disabled), so you get capacity immediately even if outbound
+webhooks from Forgejo aren’t yet configured.
--- a/services/forgejo-nsc/autoscaler.example.yaml
+++ b/services/forgejo-nsc/autoscaler.example.yaml
@ -0,0 +1,34 @@
+listen: ":8090"
+dispatcher:
+  url: "http://localhost:8080"
+
+instances:
+  - name: burrow
+    forgejo:
+      base_url: "https://git.burrow.net"
+      token: "PENDING-FORGEJO-PAT"
+    scope:
+      level: "repository"
+      owner: "hackclub"
+      name: "burrow"
+    disable_polling: true
+    poll_interval: "30s"
+    webhook_secret: "supersecret"
+    webhook:
+      url: "https://nsc-autoscaler.burrow.net/webhook/burrow"
+      content_type: "json"
+      events: ["workflow_job"]
+      active: true
+    targets:
+      - labels: ["namespace-profile-linux-medium"]
+        min_idle: 1
+        ttl: "20m"
+        machine_type: "4x8"
+      - labels: ["namespace-profile-macos-large"]
+        min_idle: 0
+        ttl: "90m"
+        machine_type: "12x28"
+      - labels: ["namespace-profile-windows-large"]
+        min_idle: 0
+        ttl: "45m"
+        machine_type: "windows/amd64:8x16"
--- a/services/forgejo-nsc/cmd/forgejo-nsc-autoscaler/main.go
+++ b/services/forgejo-nsc/cmd/forgejo-nsc-autoscaler/main.go
@ -0,0 +1,46 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log/slog"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"namespacelabs.dev/foundation/std/tasks"
+	"namespacelabs.dev/foundation/std/tasks/simplelog"
+
+	"github.com/burrow/forgejo-nsc/internal/autoscaler"
+)
+
+func main() {
+	var configPath string
+	flag.StringVar(&configPath, "config", "autoscaler.yaml", "Path to the autoscaler config file")
+	flag.Parse()
+
+	logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
+
+	cfg, err := autoscaler.LoadConfig(configPath)
+	if err != nil {
+		logger.Error("failed to load config", "error", err)
+		os.Exit(1)
+	}
+
+	service, err := autoscaler.NewService(cfg)
+	if err != nil {
+		logger.Error("failed to initialize autoscaler", "error", err)
+		os.Exit(1)
+	}
+
+	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer cancel()
+	ctx = tasks.WithSink(ctx, simplelog.NewSink(os.Stdout, 0))
+
+	if err := tasks.Action("autoscaler.run").Run(ctx, func(ctx context.Context) error {
+		return service.Start(ctx)
+	}); err != nil {
+		logger.Error("autoscaler exited", "error", err)
+		os.Exit(1)
+	}
+}
--- a/services/forgejo-nsc/cmd/forgejo-nsc-dispatcher/main.go
+++ b/services/forgejo-nsc/cmd/forgejo-nsc-dispatcher/main.go
@ -0,0 +1,90 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log/slog"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/burrow/forgejo-nsc/internal/app"
+	"github.com/burrow/forgejo-nsc/internal/config"
+	"github.com/burrow/forgejo-nsc/internal/forgejo"
+	"github.com/burrow/forgejo-nsc/internal/nsc"
+	"github.com/burrow/forgejo-nsc/internal/server"
+)
+
+func main() {
+	var configPath string
+	flag.StringVar(&configPath, "config", "config.yaml", "Path to the dispatcher config file.")
+	flag.Parse()
+
+	logger := slog.New(slog.NewTextHandler(os.Stdout, &slog.HandlerOptions{Level: slog.LevelInfo}))
+
+	cfg, err := config.Load(configPath)
+	if err != nil {
+		logger.Error("failed to load config", "error", err)
+		os.Exit(1)
+	}
+
+	scope, err := cfg.Forgejo.DefaultScope.ToScope()
+	if err != nil {
+		logger.Error("invalid default scope", "error", err)
+		os.Exit(1)
+	}
+
+	forgejoClient, err := forgejo.NewClient(cfg.Forgejo.BaseURL, cfg.Forgejo.Token)
+	if err != nil {
+		logger.Error("failed to create forgejo client", "error", err)
+		os.Exit(1)
+	}
+
+	dispatcher, err := nsc.NewDispatcher(nsc.Options{
+		BinaryPath:       cfg.Namespace.NSCBinary,
+		ComputeBaseURL:   cfg.Namespace.ComputeBaseURL,
+		DefaultImage:     cfg.Namespace.Image,
+		DefaultMachine:   cfg.Namespace.MachineType,
+		MacosBaseImageID: cfg.Namespace.MacosBaseImageID,
+		MacosMachineArch: cfg.Namespace.MacosMachineArch,
+		DefaultDuration:  cfg.Namespace.Duration.Duration,
+		WorkDir:          cfg.Namespace.WorkDir,
+		MaxParallel:      cfg.Namespace.MaxParallel,
+		RunnerNamePrefix: cfg.Runner.NamePrefix,
+		Executor:         cfg.Runner.Executor,
+		Network:          cfg.Namespace.Network,
+		Logger:           logger,
+	})
+	if err != nil {
+		logger.Error("failed to create dispatcher", "error", err)
+		os.Exit(1)
+	}
+
+	service := app.NewService(app.Config{
+		DefaultScope:  scope,
+		DefaultLabels: cfg.Forgejo.DefaultLabels,
+		InstanceURL:   cfg.Forgejo.InstanceURL,
+		DefaultTTL:    cfg.Namespace.Duration.Duration,
+		AllowLabels:   cfg.Namespace.AllowLabels,
+		AllowScopes:   cfg.Namespace.AllowScopes,
+	}, forgejoClient, dispatcher, logger)
+
+	srv := server.New(cfg.Listen, service, logger)
+
+	go func() {
+		logger.Info("dispatcher listening", "addr", cfg.Listen)
+		if err := srv.ListenAndServe(); err != nil && err != context.Canceled && err != http.ErrServerClosed {
+			logger.Error("server terminated", "error", err)
+		}
+	}()
+
+	interrupt := make(chan os.Signal, 1)
+	signal.Notify(interrupt, syscall.SIGTERM, syscall.SIGINT)
+	<-interrupt
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	_ = srv.Shutdown(ctx)
+}
--- a/services/forgejo-nsc/config.example.yaml
+++ b/services/forgejo-nsc/config.example.yaml
@ -0,0 +1,27 @@
+listen: ":8080"
+
+forgejo:
+  base_url: "https://forgejo.example.com"
+  token: "${FORGEJO_PERSONAL_ACCESS_TOKEN}"
+  default_scope:
+    level: "organization"
+    owner: "example"
+  default_labels:
+    - namespace-profile-linux-medium
+  timeout: "30s"
+
+namespace:
+  nsc_binary: "/app/bin/nsc"
+  compute_base_url: "https://ord4.compute.namespaceapis.com"
+  image: "ghcr.io/forgejo/runner:3"
+  machine_type: "8x16"
+  macos_base_image_id: "tahoe"
+  macos_machine_arch: "arm64"
+  duration: "30m"
+  workdir: "/var/lib/forgejo-runner"
+  max_parallel: 4
+  network: ""
+
+runner:
+  name_prefix: "nscloud-"
+  executor: "shell"
--- a/services/forgejo-nsc/deploy/autoscaler.yaml
+++ b/services/forgejo-nsc/deploy/autoscaler.yaml
@ -0,0 +1,35 @@
+listen: "127.0.0.1:8090"
+
+dispatcher:
+  url: "http://127.0.0.1:8080"
+
+instances:
+  - name: burrow
+    forgejo:
+      base_url: "http://127.0.0.1:3000"
+      token: "PENDING-FORGEJO-PAT"
+    scope:
+      level: "repository"
+      owner: "hackclub"
+      name: "burrow"
+    disable_polling: false
+    poll_interval: "30s"
+    webhook_secret: "PENDING-WEBHOOK-SECRET"
+    webhook:
+      url: "https://nsc-autoscaler.burrow.net/webhook/burrow"
+      content_type: "json"
+      events: ["workflow_job"]
+      active: true
+    targets:
+      - labels: ["namespace-profile-linux-medium"]
+        min_idle: 0
+        ttl: "20m"
+        machine_type: "4x8"
+      - labels: ["namespace-profile-macos-large"]
+        min_idle: 0
+        ttl: "90m"
+        machine_type: "12x28"
+      - labels: ["namespace-profile-windows-large"]
+        min_idle: 0
+        ttl: "45m"
+        machine_type: "windows/amd64:8x16"
--- a/services/forgejo-nsc/deploy/dispatcher.yaml
+++ b/services/forgejo-nsc/deploy/dispatcher.yaml
@ -0,0 +1,37 @@
+listen: "127.0.0.1:8080"
+
+forgejo:
+  base_url: "http://127.0.0.1:3000"
+  instance_url: "https://git.burrow.net"
+  token: "PENDING-FORGEJO-PAT"
+  default_scope:
+    level: "repository"
+    owner: "hackclub"
+    name: "burrow"
+  default_labels:
+    - namespace-profile-linux-medium
+  timeout: "30s"
+
+namespace:
+  nsc_binary: "/run/current-system/sw/bin/nsc"
+  compute_base_url: "https://ord4.compute.namespaceapis.com"
+  image: "code.forgejo.org/forgejo/runner:11"
+  machine_type: "4x8"
+  macos_base_image_id: "tahoe"
+  macos_machine_arch: "arm64"
+  duration: "30m"
+  workdir: "/var/lib/forgejo-runner"
+  max_parallel: 4
+  allow_labels:
+    - namespace-profile-linux-medium
+    - namespace-profile-macos-large
+    - namespace-profile-windows-large
+  allow_scopes:
+    - "repository:hackclub/burrow"
+  instance_tags:
+    - "burrow"
+  network: ""
+
+runner:
+  name_prefix: "nscloud-"
+  executor: "shell"
--- a/services/forgejo-nsc/go.mod
+++ b/services/forgejo-nsc/go.mod
@ -0,0 +1,65 @@
+module github.com/burrow/forgejo-nsc
+
+go 1.24.4
+
+require (
+	buf.build/gen/go/namespace/cloud/connectrpc/go v1.19.1-20260212004106-290ae81f8d6d.2
+	buf.build/gen/go/namespace/cloud/protocolbuffers/go v1.36.11-20260212004106-290ae81f8d6d.1
+	connectrpc.com/connect v1.19.1
+	github.com/go-chi/chi/v5 v5.2.1
+	github.com/google/uuid v1.6.0
+	golang.org/x/crypto v0.48.0
+	golang.org/x/sync v0.19.0
+	google.golang.org/protobuf v1.36.11
+	gopkg.in/yaml.v3 v3.0.1
+	namespacelabs.dev/foundation v0.0.478
+)
+
+require (
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/jxskiss/base62 v1.1.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/magiconair/properties v1.8.6 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mattn/go-zglob v0.0.3 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
+	github.com/muesli/reflow v0.3.0 // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/rivo/uniseg v0.4.2 // indirect
+	github.com/segmentio/ksuid v1.0.4 // indirect
+	github.com/spf13/afero v1.9.2 // indirect
+	github.com/spf13/cast v1.7.0 // indirect
+	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+	github.com/spf13/pflag v1.0.7 // indirect
+	github.com/spf13/viper v1.14.0 // indirect
+	github.com/subosito/gotenv v1.4.1 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/otel v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/jaeger v1.17.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 // indirect
+	go.opentelemetry.io/otel/metric v1.38.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.38.0 // indirect
+	go.opentelemetry.io/otel/trace v1.38.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.7.1 // indirect
+	golang.org/x/exp v0.0.0-20250911091902-df9299821621 // indirect
+	golang.org/x/net v0.49.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/term v0.40.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 // indirect
+	google.golang.org/grpc v1.76.0 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	helm.sh/helm/v3 v3.18.4 // indirect
+	namespacelabs.dev/go-ids v0.0.0-20221124082625-9fc72ee06af7 // indirect
+)
--- a/services/forgejo-nsc/go.sum
+++ b/services/forgejo-nsc/go.sum
@ -0,0 +1,575 @@
+buf.build/gen/go/namespace/cloud/connectrpc/go v1.19.1-20260212004106-290ae81f8d6d.2 h1:XaeFtt6yN8G5q2uYoiTjyshOyai1Q+GzwfEKlxrTzVw=
+buf.build/gen/go/namespace/cloud/connectrpc/go v1.19.1-20260212004106-290ae81f8d6d.2/go.mod h1:QvCL7PUDMFotMXVUoWMeRClEEnCbh7S51xHy39mO+H4=
+buf.build/gen/go/namespace/cloud/protocolbuffers/go v1.36.11-20260212004106-290ae81f8d6d.1 h1:xTgPJaOj5QNRPAA3nxW3fTz01aAOLr/6SG7C4Iqxm54=
+buf.build/gen/go/namespace/cloud/protocolbuffers/go v1.36.11-20260212004106-290ae81f8d6d.1/go.mod h1:Il2wpJNQB40Yj3Rmuhg5xKJPSXaZVwij+Q30d1PNuNY=
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
+cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
+cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
+cloud.google.com/go v0.44.3/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
+cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
+cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
+cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
+cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
+cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
+cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
+cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
+cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
+cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
+cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
+cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
+cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
+cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
+cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
+cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
+cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
+cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
+cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
+cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
+cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
+cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
+cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
+cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
+cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
+cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
+cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
+cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
+cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
+cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
+cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
+connectrpc.com/connect v1.19.1 h1:R5M57z05+90EfEvCY1b7hBxDVOUl45PrtXtAV2fOC14=
+connectrpc.com/connect v1.19.1/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w=
+dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
+github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=
+github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
+github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
+github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
+github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
+github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
+github.com/jxskiss/base62 v1.1.0 h1:A5zbF8v8WXx2xixnAKD2w+abC+sIzYJX+nxmhA6HWFw=
+github.com/jxskiss/base62 v1.1.0/go.mod h1:HhWAlUXvxKThfOlZbcuFzsqwtF5TcqS9ru3y5GfjWAc=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/magiconair/properties v1.8.6 h1:5ibWZ6iY0NctNGWo87LalDlEZ6R41TqbbDamhfG/Qzo=
+github.com/magiconair/properties v1.8.6/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
+github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
+github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
+github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-zglob v0.0.3 h1:6Ry4EYsScDyt5di4OI6xw1bYhOqfE5S33Z1OPy+d+To=
+github.com/mattn/go-zglob v0.0.3/go.mod h1:9fxibJccNxU2cnpIKLRRFA7zX7qhkJIQWBb449FYHOo=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
+github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8=
+github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
+github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.2 h1:YwD0ulJSJytLpiaWua0sBDusfsCZohxjxzVTYjwxfV8=
+github.com/rivo/uniseg v0.4.2/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/segmentio/ksuid v1.0.4 h1:sBo2BdShXjmcugAMwjugoGUdUV0pcxY5mW4xKRn3v4c=
+github.com/segmentio/ksuid v1.0.4/go.mod h1:/XUiZBD3kVx5SmUOl55voK5yeAbBNNIed+2O73XgrPE=
+github.com/spf13/afero v1.9.2 h1:j49Hj62F0n+DaZ1dDCvhABaPNSGNkt32oRFxI33IEMw=
+github.com/spf13/afero v1.9.2/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
+github.com/spf13/cast v1.7.0 h1:ntdiHjuueXFgm5nzDRdOS4yfT43P5Fnud6DH50rz/7w=
+github.com/spf13/cast v1.7.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/jwalterweatherman v1.1.0 h1:ue6voC5bR5F8YxI5S67j9i582FU4Qvo2bmqnqMYADFk=
+github.com/spf13/jwalterweatherman v1.1.0/go.mod h1:aNWZUN0dPAAO/Ljvb5BEdw96iTZ0EXowPYD95IqWIGo=
+github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
+github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.14.0 h1:Rg7d3Lo706X9tHsJMUjdiwMpHB7W8WnSVOssIY+JElU=
+github.com/spf13/viper v1.14.0/go.mod h1:WT//axPky3FdvXHzGw33dNdXXXfFQqmEalje+egj8As=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.5.0 h1:1zr/of2m5FGMsad5YfcqgdqdWrIhu+EBEJRhR1U7z/c=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/subosito/gotenv v1.4.1 h1:jyEFiXpy21Wm81FBN71l9VoMMV8H8jG+qIK3GCpY6Qs=
+github.com/subosito/gotenv v1.4.1/go.mod h1:ayKnFf/c6rvx/2iiLrJUk1e6plDbT3edrFNGqEflhK0=
+github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
+go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
+go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
+go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
+go.opentelemetry.io/otel/exporters/jaeger v1.17.0 h1:D7UpUy2Xc2wsi1Ras6V40q806WM07rqoCWzXu7Sqy+4=
+go.opentelemetry.io/otel/exporters/jaeger v1.17.0/go.mod h1:nPCqOnEH9rNLKqH/+rrUjiMzHJdV1BlpKcTwRTyKkKI=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0 h1:GqRJVj7UmLjCVyVJ3ZFLdPRmhDUp2zFmQe3RHIOsw24=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.38.0/go.mod h1:ri3aaHSmCTVYu2AWv44YMauwAQc0aqI9gHKIcSbI1pU=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0 h1:lwI4Dc5leUqENgGuQImwLo4WnuXFPetmPpkLi2IrX54=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.38.0/go.mod h1:Kz/oCE7z5wuyhPxsXDuaPteSWqjSBD5YaSdbxZYGbGk=
+go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
+go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
+go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
+go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
+go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
+go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
+go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
+go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
+go.opentelemetry.io/proto/otlp v1.7.1 h1:gTOMpGDb0WTBOP8JaO72iL3auEZhVmAQg4ipjOVAtj4=
+go.opentelemetry.io/proto/otlp v1.7.1/go.mod h1:b2rVh6rfI/s2pHWNlB7ILJcRALpcNDzKhACevjI+ZnE=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
+golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
+golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
+golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
+golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
+golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
+golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU=
+golang.org/x/exp v0.0.0-20250911091902-df9299821621/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk=
+golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
+golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
+golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
+golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
+golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
+golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
+golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
+golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
+golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
+golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
+golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
+golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
+golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
+golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
+golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
+golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=
+gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E=
+google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
+google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
+google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
+google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
+google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
+google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
+google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
+google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
+google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
+google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
+google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
+google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
+google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
+google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
+google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
+google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5 h1:BIRfGDEjiHRrk0QKZe3Xv2ieMhtgRGeLcZQ0mIVn4EY=
+google.golang.org/genproto/googleapis/api v0.0.0-20250825161204-c5933d9347a5/go.mod h1:j3QtIyytwqGr1JUDtYXwtMXWPKsEa5LtzIFN1Wn5WvE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5 h1:eaY8u2EuxbRv7c3NiGK0/NedzVsCcV6hDuU5qPX5EGE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250825161204-c5933d9347a5/go.mod h1:M4/wBTSeyLxupu3W3tJtOgB14jILAS/XWPSSa3TAlJc=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
+google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
+google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
+google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
+google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+helm.sh/helm/v3 v3.18.4 h1:pNhnHM3nAmDrxz6/UC+hfjDY4yeDATQCka2/87hkZXQ=
+helm.sh/helm/v3 v3.18.4/go.mod h1:WVnwKARAw01iEdjpEkP7Ii1tT1pTPYfM1HsakFKM3LI=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
+honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+namespacelabs.dev/foundation v0.0.478 h1:3xFLZcrjih7Jjey2N7faSfr6EoBCg2LMTHipq/3Hlrg=
+namespacelabs.dev/foundation v0.0.478/go.mod h1:svBrTIfZK773sytmjudGkCzQWNisxcQtcWNCs+uLznI=
+namespacelabs.dev/go-ids v0.0.0-20221124082625-9fc72ee06af7 h1:8NlnfPlzDSJr8TYV/qarIWwhjLd1gOXf3Jme0M/oGBM=
+namespacelabs.dev/go-ids v0.0.0-20221124082625-9fc72ee06af7/go.mod h1:J+Sd+ngeffnCsaO/M7zgs2bR8Klq/ZBhS0+bbnDEH2M=
+rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
+rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
+rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
--- a/services/forgejo-nsc/internal/app/service.go
+++ b/services/forgejo-nsc/internal/app/service.go
@ -0,0 +1,253 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+	"time"
+
+	"golang.org/x/sync/errgroup"
+
+	"github.com/burrow/forgejo-nsc/internal/forgejo"
+	"github.com/burrow/forgejo-nsc/internal/nsc"
+)
+
+type Dispatcher interface {
+	LaunchRunner(ctx context.Context, req nsc.LaunchRequest) (string, error)
+}
+
+type ForgejoClient interface {
+	RegistrationToken(ctx context.Context, scope forgejo.Scope) (string, error)
+}
+
+type Service struct {
+	forgejo    ForgejoClient
+	dispatcher Dispatcher
+	logger     *slog.Logger
+
+	defaultScope  forgejo.Scope
+	defaultLabels []string
+	instanceURL   string
+	defaultTTL    time.Duration
+
+	allowLabels map[string]struct{}
+	allowScopes map[string]struct{}
+}
+
+type Config struct {
+	DefaultScope  forgejo.Scope
+	DefaultLabels []string
+	InstanceURL   string
+	DefaultTTL    time.Duration
+	AllowLabels   []string
+	AllowScopes   []string
+}
+
+func NewService(cfg Config, forgejo ForgejoClient, dispatcher Dispatcher, logger *slog.Logger) *Service {
+	if logger == nil {
+		logger = slog.Default()
+	}
+	allowLabels := make(map[string]struct{}, len(cfg.AllowLabels))
+	for _, label := range cfg.AllowLabels {
+		allowLabels[normalizeLabel(label)] = struct{}{}
+	}
+	allowScopes := make(map[string]struct{}, len(cfg.AllowScopes))
+	for _, scope := range cfg.AllowScopes {
+		allowScopes[scope] = struct{}{}
+	}
+	return &Service{
+		defaultScope:  cfg.DefaultScope,
+		defaultLabels: cfg.DefaultLabels,
+		instanceURL:   cfg.InstanceURL,
+		defaultTTL:    cfg.DefaultTTL,
+		forgejo:       forgejo,
+		dispatcher:    dispatcher,
+		logger:        logger,
+		allowLabels:   allowLabels,
+		allowScopes:   allowScopes,
+	}
+}
+
+type DispatchRequest struct {
+	Count    int
+	Labels   []string
+	Scope    *Scope
+	TTL      time.Duration
+	Machine  string
+	Image    string
+	ExtraEnv map[string]string
+}
+
+type Scope struct {
+	Level string
+	Owner string
+	Name  string
+}
+
+type DispatchResponse struct {
+	Runners []RunnerHandle `json:"runners"`
+}
+
+type RunnerHandle struct {
+	Name string `json:"name"`
+}
+
+func (s *Service) Dispatch(ctx context.Context, req DispatchRequest) (DispatchResponse, error) {
+	count := req.Count
+	if count <= 0 {
+		count = 1
+	}
+
+	scope, err := s.mergeScope(req.Scope)
+	if err != nil {
+		return DispatchResponse{}, err
+	}
+
+	labels, err := s.mergeLabels(req.Labels)
+	if err != nil {
+		return DispatchResponse{}, err
+	}
+	if len(labels) == 0 {
+		return DispatchResponse{}, errors.New("no runner labels resolved")
+	}
+
+	ttl := req.TTL
+	if ttl == 0 {
+		ttl = s.defaultTTL
+	}
+
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	res := DispatchResponse{
+		Runners: make([]RunnerHandle, count),
+	}
+	eg, egCtx := errgroup.WithContext(ctx)
+
+	for i := 0; i < count; i++ {
+		index := i
+		eg.Go(func() error {
+			token, err := s.forgejo.RegistrationToken(egCtx, scope)
+			if err != nil {
+				return fmt.Errorf("fetching registration token: %w", err)
+			}
+
+			name, err := s.dispatcher.LaunchRunner(egCtx, nsc.LaunchRequest{
+				Token:       token,
+				InstanceURL: s.instanceURL,
+				Labels:      labels,
+				Duration:    ttl,
+				MachineType: req.Machine,
+				Image:       req.Image,
+				ExtraEnv:    req.ExtraEnv,
+			})
+			if err != nil {
+				return err
+			}
+
+			res.Runners[index] = RunnerHandle{Name: name}
+			return nil
+		})
+	}
+
+	if err := eg.Wait(); err != nil {
+		return DispatchResponse{}, err
+	}
+
+	return res, nil
+}
+
+func (s *Service) mergeScope(value *Scope) (forgejo.Scope, error) {
+	if value == nil {
+		return s.defaultScope, nil
+	}
+
+	scope := forgejo.Scope{
+		Level: forgejo.ScopeLevel(value.Level),
+		Owner: value.Owner,
+		Name:  value.Name,
+	}
+	if scope.Level == "" {
+		return forgejo.Scope{}, errors.New("scope level is required")
+	}
+	switch scope.Level {
+	case forgejo.ScopeInstance:
+		if !s.scopeAllowed(scope) {
+			return forgejo.Scope{}, fmt.Errorf("scope %q not allowed", scopeKey(scope))
+		}
+		return scope, nil
+	case forgejo.ScopeOrganization:
+		if scope.Owner == "" {
+			return forgejo.Scope{}, errors.New("organization scope requires owner")
+		}
+		if !s.scopeAllowed(scope) {
+			return forgejo.Scope{}, fmt.Errorf("scope %q not allowed", scopeKey(scope))
+		}
+		return scope, nil
+	case forgejo.ScopeRepository:
+		if scope.Owner == "" || scope.Name == "" {
+			return forgejo.Scope{}, errors.New("repository scope requires owner and name")
+		}
+		if !s.scopeAllowed(scope) {
+			return forgejo.Scope{}, fmt.Errorf("scope %q not allowed", scopeKey(scope))
+		}
+		return scope, nil
+	default:
+		return forgejo.Scope{}, fmt.Errorf("unsupported scope %q", scope.Level)
+	}
+}
+
+func (s *Service) mergeLabels(labels []string) ([]string, error) {
+	var resolved []string
+	if len(labels) == 0 {
+		resolved = append([]string{}, s.defaultLabels...)
+	} else {
+		resolved = labels
+	}
+	if len(s.allowLabels) == 0 {
+		return resolved, nil
+	}
+	for _, label := range resolved {
+		norm := normalizeLabel(label)
+		if _, ok := s.allowLabels[norm]; !ok {
+			return nil, fmt.Errorf("label %q not allowed", label)
+		}
+	}
+	return resolved, nil
+}
+
+func normalizeLabel(label string) string {
+	trimmed := strings.TrimSpace(label)
+	if trimmed == "" {
+		return ""
+	}
+	// Ignore any explicit executor suffix ("label:host"), since workflows
+	// and config allowlists typically deal in base label names.
+	if before, _, ok := strings.Cut(trimmed, ":"); ok {
+		return before
+	}
+	return trimmed
+}
+
+func scopeKey(scope forgejo.Scope) string {
+	switch scope.Level {
+	case forgejo.ScopeInstance:
+		return "instance"
+	case forgejo.ScopeOrganization:
+		return fmt.Sprintf("organization:%s", scope.Owner)
+	case forgejo.ScopeRepository:
+		return fmt.Sprintf("repository:%s/%s", scope.Owner, scope.Name)
+	default:
+		return string(scope.Level)
+	}
+}
+
+func (s *Service) scopeAllowed(scope forgejo.Scope) bool {
+	if len(s.allowScopes) == 0 {
+		return true
+	}
+	_, ok := s.allowScopes[scopeKey(scope)]
+	return ok
+}
--- a/services/forgejo-nsc/internal/app/service_test.go
+++ b/services/forgejo-nsc/internal/app/service_test.go
@ -0,0 +1,160 @@
+package app
+
+import (
+	"context"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/burrow/forgejo-nsc/internal/forgejo"
+	"github.com/burrow/forgejo-nsc/internal/nsc"
+)
+
+type mockForgejo struct {
+	mu      sync.Mutex
+	tokens  []string
+	scopes  []forgejo.Scope
+	err     error
+	counter int
+}
+
+func (m *mockForgejo) RegistrationToken(ctx context.Context, scope forgejo.Scope) (string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.scopes = append(m.scopes, scope)
+	if m.err != nil {
+		return "", m.err
+	}
+	if m.counter >= len(m.tokens) {
+		return "", context.Canceled
+	}
+	tok := m.tokens[m.counter]
+	m.counter++
+	return tok, nil
+}
+
+type mockDispatcher struct {
+	mu        sync.Mutex
+	requests  []nsc.LaunchRequest
+	responses []string
+	err       error
+}
+
+func (m *mockDispatcher) LaunchRunner(ctx context.Context, req nsc.LaunchRequest) (string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.err != nil {
+		return "", m.err
+	}
+	m.requests = append(m.requests, req)
+	idx := len(m.requests) - 1
+	if idx < len(m.responses) {
+		return m.responses[idx], nil
+	}
+	return "runner", nil
+}
+
+func TestServiceDispatchUsesDefaults(t *testing.T) {
+	forgejoMock := &mockForgejo{tokens: []string{"token"}}
+	dispatcherMock := &mockDispatcher{responses: []string{"runner-default"}}
+
+	cfg := Config{
+		DefaultScope:  forgejo.Scope{Level: forgejo.ScopeInstance},
+		DefaultLabels: []string{"nscloud"},
+		InstanceURL:   "https://forgejo.example.com",
+		DefaultTTL:    15 * time.Minute,
+	}
+
+	service := NewService(cfg, forgejoMock, dispatcherMock, nil)
+
+	resp, err := service.Dispatch(context.Background(), DispatchRequest{})
+	if err != nil {
+		t.Fatalf("Dispatch returned error: %v", err)
+	}
+	if len(resp.Runners) != 1 || resp.Runners[0].Name != "runner-default" {
+		t.Fatalf("unexpected dispatch response: %+v", resp)
+	}
+
+	if len(forgejoMock.scopes) != 1 || forgejoMock.scopes[0].Level != forgejo.ScopeInstance {
+		t.Fatalf("expected default scope, got %+v", forgejoMock.scopes)
+	}
+
+	if len(dispatcherMock.requests) != 1 {
+		t.Fatalf("expected one dispatcher call, got %d", len(dispatcherMock.requests))
+	}
+	req := dispatcherMock.requests[0]
+	if req.InstanceURL != cfg.InstanceURL {
+		t.Fatalf("expected instance URL %s, got %s", cfg.InstanceURL, req.InstanceURL)
+	}
+	if got := req.Labels; len(got) != 1 || got[0] != "nscloud" {
+		t.Fatalf("expected default labels, got %v", got)
+	}
+	if req.Duration != cfg.DefaultTTL {
+		t.Fatalf("expected duration %v, got %v", cfg.DefaultTTL, req.Duration)
+	}
+}
+
+func TestServiceDispatchCustomScopeAndCount(t *testing.T) {
+	forgejoMock := &mockForgejo{tokens: []string{"token-1", "token-2"}}
+	dispatcherMock := &mockDispatcher{responses: []string{"runner-1", "runner-2"}}
+
+	cfg := Config{
+		DefaultScope:  forgejo.Scope{Level: forgejo.ScopeInstance},
+		DefaultLabels: []string{"default"},
+		InstanceURL:   "https://forgejo.example.com",
+		DefaultTTL:    10 * time.Minute,
+	}
+
+	service := NewService(cfg, forgejoMock, dispatcherMock, nil)
+
+	reqScope := &Scope{Level: string(forgejo.ScopeRepository), Owner: "acme", Name: "repo"}
+	res, err := service.Dispatch(context.Background(), DispatchRequest{
+		Count:    2,
+		Labels:   []string{"custom"},
+		Scope:    reqScope,
+		TTL:      5 * time.Minute,
+		Machine:  "4x8",
+		Image:    "runner:latest",
+		ExtraEnv: map[string]string{"FOO": "bar"},
+	})
+	if err != nil {
+		t.Fatalf("Dispatch returned error: %v", err)
+	}
+	if len(res.Runners) != 2 {
+		t.Fatalf("expected two runners, got %+v", res)
+	}
+
+	if len(forgejoMock.scopes) != 2 {
+		t.Fatalf("expected two scope calls, got %d", len(forgejoMock.scopes))
+	}
+	for _, scope := range forgejoMock.scopes {
+		if scope.Level != forgejo.ScopeRepository || scope.Owner != "acme" || scope.Name != "repo" {
+			t.Fatalf("unexpected scope: %+v", scope)
+		}
+	}
+
+	if len(dispatcherMock.requests) != 2 {
+		t.Fatalf("expected two dispatcher calls, got %d", len(dispatcherMock.requests))
+	}
+	for _, call := range dispatcherMock.requests {
+		if call.MachineType != "4x8" || call.Image != "runner:latest" {
+			t.Fatalf("unexpected machine/image in %+v", call)
+		}
+		if call.Duration != 5*time.Minute {
+			t.Fatalf("expected TTL to override default, got %v", call.Duration)
+		}
+		if call.Labels[0] != "custom" {
+			t.Fatalf("expected custom labels, got %v", call.Labels)
+		}
+		if call.ExtraEnv["FOO"] != "bar" {
+			t.Fatalf("expected env passthrough, got %v", call.ExtraEnv)
+		}
+	}
+}
+
+func TestServiceDispatchErrorsWithoutLabels(t *testing.T) {
+	service := NewService(Config{DefaultScope: forgejo.Scope{Level: forgejo.ScopeInstance}}, &mockForgejo{}, &mockDispatcher{}, nil)
+	if _, err := service.Dispatch(context.Background(), DispatchRequest{}); err == nil {
+		t.Fatalf("expected error when no labels are available")
+	}
+}
--- a/services/forgejo-nsc/internal/autoscaler/config.go
+++ b/services/forgejo-nsc/internal/autoscaler/config.go
@ -0,0 +1,108 @@
+package autoscaler
+
+import (
+	"fmt"
+	"os"
+	"time"
+
+	"gopkg.in/yaml.v3"
+
+	"github.com/burrow/forgejo-nsc/internal/config"
+)
+
+type Config struct {
+	Listen     string           `yaml:"listen"`
+	Dispatcher DispatcherConfig `yaml:"dispatcher"`
+	Instances  []InstanceConfig `yaml:"instances"`
+}
+
+type DispatcherConfig struct {
+	URL     string          `yaml:"url"`
+	Timeout config.Duration `yaml:"timeout"`
+}
+
+type InstanceConfig struct {
+	Name           string             `yaml:"name"`
+	Forgejo        ForgejoInstance    `yaml:"forgejo"`
+	Scope          config.ScopeConfig `yaml:"scope"`
+	PollInterval   config.Duration    `yaml:"poll_interval"`
+	DisablePolling bool               `yaml:"disable_polling"`
+	WebhookSecret  string             `yaml:"webhook_secret"`
+	Webhook        WebhookConfig      `yaml:"webhook"`
+	Dispatcher     *DispatcherConfig  `yaml:"dispatcher"`
+	Targets        []TargetConfig     `yaml:"targets"`
+}
+
+type ForgejoInstance struct {
+	BaseURL string `yaml:"base_url"`
+	Token   string `yaml:"token"`
+}
+
+type WebhookConfig struct {
+	URL         string   `yaml:"url"`
+	ContentType string   `yaml:"content_type"`
+	Events      []string `yaml:"events"`
+	Active      *bool    `yaml:"active"`
+}
+
+type TargetConfig struct {
+	Labels      []string          `yaml:"labels"`
+	MinIdle     int               `yaml:"min_idle"`
+	TTL         config.Duration   `yaml:"ttl"`
+	MachineType string            `yaml:"machine_type"`
+	Image       string            `yaml:"image"`
+	Env         map[string]string `yaml:"env"`
+}
+
+func LoadConfig(path string) (Config, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return Config{}, err
+	}
+	var cfg Config
+	if err := yaml.Unmarshal(data, &cfg); err != nil {
+		return Config{}, err
+	}
+	if cfg.Listen == "" {
+		cfg.Listen = ":8090"
+	}
+	if cfg.Dispatcher.URL == "" {
+		return Config{}, fmt.Errorf("dispatcher.url is required")
+	}
+	if cfg.Dispatcher.Timeout.Duration == 0 {
+		cfg.Dispatcher.Timeout = config.Duration{Duration: 15 * time.Second}
+	}
+	if len(cfg.Instances) == 0 {
+		return Config{}, fmt.Errorf("at least one instance must be configured")
+	}
+	for i := range cfg.Instances {
+		inst := &cfg.Instances[i]
+		if inst.Name == "" {
+			return Config{}, fmt.Errorf("instance[%d] missing name", i)
+		}
+		if inst.Forgejo.BaseURL == "" || inst.Forgejo.Token == "" {
+			return Config{}, fmt.Errorf("instance %s missing forgejo.base_url or token", inst.Name)
+		}
+		if inst.PollInterval.Duration == 0 {
+			inst.PollInterval = config.Duration{Duration: 30 * time.Second}
+		}
+		if len(inst.Webhook.Events) == 0 {
+			inst.Webhook.Events = []string{"workflow_job"}
+		}
+		if inst.Webhook.ContentType == "" {
+			inst.Webhook.ContentType = "json"
+		}
+		if len(inst.Targets) == 0 {
+			return Config{}, fmt.Errorf("instance %s requires at least one target", inst.Name)
+		}
+		for ti, tgt := range inst.Targets {
+			if len(tgt.Labels) == 0 {
+				return Config{}, fmt.Errorf("instance %s target[%d] missing labels", inst.Name, ti)
+			}
+			if tgt.MinIdle < 0 {
+				return Config{}, fmt.Errorf("instance %s target[%d] min_idle must be >= 0", inst.Name, ti)
+			}
+		}
+	}
+	return cfg, nil
+}
--- a/services/forgejo-nsc/internal/autoscaler/service.go
+++ b/services/forgejo-nsc/internal/autoscaler/service.go
@ -0,0 +1,385 @@
+package autoscaler
+
+import (
+	"bytes"
+	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+
+	"namespacelabs.dev/foundation/std/tasks"
+
+	"github.com/burrow/forgejo-nsc/internal/forgejo"
+)
+
+type Service struct {
+	listen      string
+	controllers map[string]*InstanceController
+	router      chi.Router
+}
+
+func NewService(cfg Config) (*Service, error) {
+	controllers := make(map[string]*InstanceController)
+	for _, inst := range cfg.Instances {
+		scope, err := inst.Scope.ToScope()
+		if err != nil {
+			return nil, err
+		}
+		forgejoClient, err := forgejo.NewClient(inst.Forgejo.BaseURL, inst.Forgejo.Token)
+		if err != nil {
+			return nil, err
+		}
+		dispCfg := cfg.Dispatcher
+		if inst.Dispatcher != nil && inst.Dispatcher.URL != "" {
+			dispCfg = *inst.Dispatcher
+			if dispCfg.Timeout.Duration == 0 {
+				dispCfg.Timeout = cfg.Dispatcher.Timeout
+			}
+		}
+		dClient := newDispatcherClient(dispCfg.URL, dispCfg.Timeout.Duration)
+		webhookActive := true
+		if inst.Webhook.Active != nil {
+			webhookActive = *inst.Webhook.Active
+		}
+		controller := &InstanceController{
+			name:       inst.Name,
+			cfg:        inst,
+			scope:      scope,
+			forgejo:    forgejoClient,
+			dispatcher: dClient,
+			webhook: forgejo.WebhookConfig{
+				URL:         inst.Webhook.URL,
+				ContentType: inst.Webhook.ContentType,
+				Events:      inst.Webhook.Events,
+				Active:      webhookActive,
+			},
+			secret: inst.WebhookSecret,
+		}
+		controllers[inst.Name] = controller
+	}
+
+	router := chi.NewRouter()
+	service := &Service{
+		listen:      cfg.Listen,
+		controllers: controllers,
+		router:      router,
+	}
+
+	router.Get("/healthz", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("ok"))
+	})
+	router.Post("/webhook/{instance}", service.handleWebhook)
+
+	return service, nil
+}
+
+func (s *Service) Start(ctx context.Context) error {
+	for _, controller := range s.controllers {
+		if err := controller.EnsureWebhook(ctx); err != nil {
+			return err
+		}
+	}
+
+	var wg sync.WaitGroup
+	for _, controller := range s.controllers {
+		wg.Add(1)
+		go func(c *InstanceController) {
+			defer wg.Done()
+			c.Run(ctx)
+		}(controller)
+	}
+
+	srv := &http.Server{
+		Addr:    s.listen,
+		Handler: s.router,
+	}
+
+	go func() {
+		<-ctx.Done()
+		_ = srv.Shutdown(context.Background())
+	}()
+
+	if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
+		return err
+	}
+	wg.Wait()
+	return nil
+}
+
+func (s *Service) handleWebhook(w http.ResponseWriter, r *http.Request) {
+	name := chi.URLParam(r, "instance")
+	controller, ok := s.controllers[name]
+	if !ok {
+		http.Error(w, "unknown instance", http.StatusNotFound)
+		return
+	}
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		http.Error(w, "invalid body", http.StatusBadRequest)
+		return
+	}
+	if controller.cfg.WebhookSecret != "" {
+		signature := r.Header.Get("X-Gitea-Signature")
+		if signature == "" {
+			http.Error(w, "missing signature", http.StatusUnauthorized)
+			return
+		}
+		if !verifySignature(controller.cfg.WebhookSecret, signature, body) {
+			http.Error(w, "invalid signature", http.StatusUnauthorized)
+			return
+		}
+	}
+
+	var payload workflowJobPayload
+	if err := json.Unmarshal(body, &payload); err != nil {
+		http.Error(w, "bad payload", http.StatusBadRequest)
+		return
+	}
+
+	controller.MarkWebhookSeen()
+	if payload.Action == "queued" {
+		controller.DispatchForJob(r.Context(), payload)
+	}
+
+	w.WriteHeader(http.StatusAccepted)
+}
+
+type workflowJobPayload struct {
+	Action      string `json:"action"`
+	WorkflowJob struct {
+		Labels []string `json:"labels"`
+	} `json:"workflow_job"`
+}
+
+type InstanceController struct {
+	name       string
+	cfg        InstanceConfig
+	scope      forgejo.Scope
+	forgejo    *forgejo.Client
+	dispatcher *dispatcherClient
+	ready      atomic.Bool
+	webhook    forgejo.WebhookConfig
+	secret     string
+}
+
+func (c *InstanceController) EnsureWebhook(ctx context.Context) error {
+	if c.webhook.URL == "" {
+		return nil
+	}
+	return tasks.Action("autoscaler.ensure-webhook").Arg("instance", c.name).Run(ctx, func(ctx context.Context) error {
+		return c.forgejo.EnsureWebhook(ctx, c.scope, c.webhook, c.secret)
+	})
+}
+
+func (c *InstanceController) Run(ctx context.Context) {
+	if c.cfg.DisablePolling {
+		<-ctx.Done()
+		return
+	}
+	ticker := time.NewTicker(c.cfg.PollInterval.Duration)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			_ = tasks.Action("autoscaler.poll").Arg("instance", c.name).Run(ctx, func(ctx context.Context) error {
+				return c.reconcile(ctx)
+			})
+		}
+	}
+}
+
+func (c *InstanceController) reconcile(ctx context.Context) error {
+	runners, err := c.forgejo.ListRunners(ctx, c.scope)
+	if err != nil {
+		// Keep polling even if runner listing fails; we can still dispatch based on queued jobs.
+		runners = nil
+	}
+
+	for _, target := range c.cfg.Targets {
+		idle := countIdle(runners, target.Labels)
+
+		need := 0
+		if idle < target.MinIdle {
+			need = target.MinIdle - idle
+		}
+
+		jobs, jobErr := c.forgejo.ListRunJobs(ctx, c.scope, target.Labels)
+		if jobErr != nil {
+			return jobErr
+		}
+		waiting := countWaitingJobs(jobs, target.Labels)
+		// Scale-to-zero friendly: if anything is waiting and there are no idle runners
+		// for that label set, dispatch exactly one runner to unblock the queue.
+		if waiting > 0 && idle == 0 && need < 1 {
+			need = 1
+		}
+
+		if need <= 0 {
+			continue
+		}
+		if err := c.dispatch(ctx, target, need, "poll"); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (c *InstanceController) dispatch(ctx context.Context, target TargetConfig, count int, reason string) error {
+	if count <= 0 {
+		return nil
+	}
+	req := dispatcherRequest{
+		Count:  count,
+		Labels: target.Labels,
+	}
+	if target.TTL.Duration > 0 {
+		req.TTL = target.TTL.Duration.String()
+	}
+	if target.MachineType != "" {
+		req.MachineType = target.MachineType
+	}
+	if target.Image != "" {
+		req.Image = target.Image
+	}
+	if len(target.Env) > 0 {
+		req.Env = target.Env
+	}
+	return tasks.Action("autoscaler.dispatch").Arg("instance", c.name).Arg("reason", reason).Arg("labels", strings.Join(target.Labels, ",")).Run(ctx, func(ctx context.Context) error {
+		return c.dispatcher.Dispatch(ctx, req)
+	})
+}
+
+func (c *InstanceController) DispatchForJob(ctx context.Context, payload workflowJobPayload) {
+	action := strings.ToLower(payload.Action)
+	if action != "queued" && action != "waiting" {
+		return
+	}
+	jobLabels := payload.WorkflowJob.Labels
+	for _, target := range c.cfg.Targets {
+		if labelsMatch(jobLabels, target.Labels) {
+			_ = c.dispatch(ctx, target, 1, "webhook")
+			return
+		}
+	}
+}
+
+func (c *InstanceController) MarkWebhookSeen() {
+	c.ready.Store(true)
+}
+
+func countIdle(runners []forgejo.Runner, labels []string) int {
+	count := 0
+	for _, runner := range runners {
+		if strings.ToLower(runner.Status) != "online" || runner.Busy {
+			continue
+		}
+		if labelsMatch(extractLabels(runner.Labels), labels) {
+			count++
+		}
+	}
+	return count
+}
+
+func countWaitingJobs(jobs []forgejo.RunJob, labels []string) int {
+	count := 0
+	for _, job := range jobs {
+		if status := strings.ToLower(job.Status); status != "waiting" && status != "queued" {
+			continue
+		}
+		if labelsMatch(job.RunsOn, labels) {
+			count++
+		}
+	}
+	return count
+}
+
+func extractLabels(src []forgejo.RunnerLabel) []string {
+	result := make([]string, 0, len(src))
+	for _, lbl := range src {
+		result = append(result, lbl.Name)
+	}
+	return result
+}
+
+func labelsMatch(have, want []string) bool {
+	set := make(map[string]struct{}, len(have))
+	for _, label := range have {
+		set[label] = struct{}{}
+	}
+	for _, label := range want {
+		if _, ok := set[label]; !ok {
+			return false
+		}
+	}
+	return true
+}
+
+func verifySignature(secret, signature string, body []byte) bool {
+	parts := strings.SplitN(signature, "=", 2)
+	if len(parts) == 2 {
+		signature = parts[1]
+	}
+	mac := hmac.New(sha256.New, []byte(secret))
+	mac.Write(body)
+	expected := hex.EncodeToString(mac.Sum(nil))
+	return hmac.Equal([]byte(expected), []byte(signature))
+}
+
+type dispatcherClient struct {
+	url    string
+	client *http.Client
+}
+
+type dispatcherRequest struct {
+	Count       int               `json:"count"`
+	Labels      []string          `json:"labels"`
+	TTL         string            `json:"ttl,omitempty"`
+	MachineType string            `json:"machine_type,omitempty"`
+	Image       string            `json:"image,omitempty"`
+	Env         map[string]string `json:"env,omitempty"`
+}
+
+func newDispatcherClient(url string, timeout time.Duration) *dispatcherClient {
+	if timeout == 0 {
+		timeout = 30 * time.Second
+	}
+	return &dispatcherClient{
+		url: url,
+		client: &http.Client{
+			Timeout: timeout,
+		},
+	}
+}
+
+func (d *dispatcherClient) Dispatch(ctx context.Context, req dispatcherRequest) error {
+	body, _ := json.Marshal(req)
+	endpoint := strings.TrimSuffix(d.url, "/") + "/api/v1/dispatch"
+	httpReq, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	httpReq.Header.Set("Content-Type", "application/json")
+	resp, err := d.client.Do(httpReq)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("dispatcher returned %s", resp.Status)
+	}
+	return nil
+}
--- a/services/forgejo-nsc/internal/config/config.go
+++ b/services/forgejo-nsc/internal/config/config.go
@ -0,0 +1,185 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"gopkg.in/yaml.v3"
+
+	"github.com/burrow/forgejo-nsc/internal/forgejo"
+)
+
+// Duration wraps time.Duration to support YAML unmarshalling from strings.
+type Duration struct {
+	time.Duration
+}
+
+// UnmarshalYAML implements yaml.v3 unmarshalling for Duration.
+func (d *Duration) UnmarshalYAML(value *yaml.Node) error {
+	switch value.Tag {
+	case "!!int":
+		var seconds int64
+		if err := value.Decode(&seconds); err != nil {
+			return err
+		}
+		d.Duration = time.Duration(seconds) * time.Second
+		return nil
+	default:
+		parsed, err := time.ParseDuration(value.Value)
+		if err != nil {
+			return err
+		}
+		d.Duration = parsed
+		return nil
+	}
+}
+
+// MarshalYAML implements yaml.v3 marshalling.
+func (d Duration) MarshalYAML() (any, error) {
+	return d.Duration.String(), nil
+}
+
+type Config struct {
+	Listen    string          `yaml:"listen"`
+	Forgejo   ForgejoConfig   `yaml:"forgejo"`
+	Namespace NamespaceConfig `yaml:"namespace"`
+	Runner    RunnerConfig    `yaml:"runner"`
+}
+
+type ForgejoConfig struct {
+	BaseURL       string      `yaml:"base_url"`
+	// InstanceURL is the URL runners should use when registering with Forgejo.
+	// This must be reachable from the spawned runner (e.g. the public URL like
+	// https://git.burrow.net), and may differ from BaseURL (which can be a local
+	// loopback URL on the forge host).
+	InstanceURL   string      `yaml:"instance_url"`
+	Token         string      `yaml:"token"`
+	DefaultScope  ScopeConfig `yaml:"default_scope"`
+	DefaultLabels []string    `yaml:"default_labels"`
+	Timeout       Duration    `yaml:"timeout"`
+	ExtraHeaders  yaml.Node   `yaml:"extra_headers"`
+}
+
+type ScopeConfig struct {
+	Level string `yaml:"level"`
+	Owner string `yaml:"owner,omitempty"`
+	Name  string `yaml:"name,omitempty"`
+}
+
+type NamespaceConfig struct {
+	NSCBinary string `yaml:"nsc_binary"`
+	// ComputeBaseURL is the Namespace Cloud Compute API endpoint (Connect RPC base URL).
+	// This is used for macOS runners, since NSC "run" is container-based (Linux-only).
+	// Example: "https://ord4.compute.namespaceapis.com"
+	ComputeBaseURL string `yaml:"compute_base_url"`
+	Image          string `yaml:"image"`
+	MachineType    string `yaml:"machine_type"`
+	// MacosBaseImageID selects which macOS base image to use (e.g. "tahoe").
+	MacosBaseImageID string `yaml:"macos_base_image_id"`
+	// MacosMachineArch is the architecture used for macOS instances (typically "arm64").
+	MacosMachineArch string   `yaml:"macos_machine_arch"`
+	Duration         Duration `yaml:"duration"`
+	WorkDir          string   `yaml:"workdir"`
+	MaxParallel      int64    `yaml:"max_parallel"`
+	Environment      []string `yaml:"environment"`
+	AllowLabels      []string `yaml:"allow_labels"`
+	AllowScopes      []string `yaml:"allow_scopes"`
+	Network          string   `yaml:"network"`
+	InstanceTags     []string `yaml:"instance_tags"`
+}
+
+type RunnerConfig struct {
+	NamePrefix string `yaml:"name_prefix"`
+	Executor   string `yaml:"executor"`
+}
+
+func Load(path string) (*Config, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+
+	var cfg Config
+	if err := yaml.Unmarshal(data, &cfg); err != nil {
+		return nil, err
+	}
+
+	if err := cfg.Validate(); err != nil {
+		return nil, err
+	}
+
+	return &cfg, nil
+}
+
+func (c *Config) Validate() error {
+	if c.Listen == "" {
+		c.Listen = ":8080"
+	}
+	if c.Runner.NamePrefix == "" {
+		c.Runner.NamePrefix = "nscloud-"
+	}
+	if c.Runner.Executor == "" {
+		c.Runner.Executor = "shell"
+	}
+
+	if c.Forgejo.BaseURL == "" {
+		return errors.New("forgejo.base_url is required")
+	}
+	if c.Forgejo.InstanceURL == "" {
+		// Backwards-compatible default: assume runners can reach the same URL.
+		c.Forgejo.InstanceURL = c.Forgejo.BaseURL
+	}
+	if c.Forgejo.Token == "" {
+		return errors.New("forgejo.token is required")
+	}
+	if c.Forgejo.Timeout.Duration == 0 {
+		c.Forgejo.Timeout.Duration = 30 * time.Second
+	}
+	if _, err := c.Forgejo.DefaultScope.ToScope(); err != nil {
+		return err
+	}
+
+	if c.Namespace.NSCBinary == "" {
+		c.Namespace.NSCBinary = "nsc"
+	}
+	if c.Namespace.Image == "" {
+		c.Namespace.Image = "code.forgejo.org/forgejo/runner:11"
+	}
+	if c.Namespace.MacosBaseImageID == "" {
+		c.Namespace.MacosBaseImageID = "tahoe"
+	}
+	if c.Namespace.MacosMachineArch == "" {
+		c.Namespace.MacosMachineArch = "arm64"
+	}
+	if c.Namespace.Duration.Duration == 0 {
+		c.Namespace.Duration.Duration = 30 * time.Minute
+	}
+	if c.Namespace.MaxParallel <= 0 {
+		c.Namespace.MaxParallel = 4
+	}
+
+	return nil
+}
+
+func (s ScopeConfig) ToScope() (forgejo.Scope, error) {
+	level := forgejo.ScopeLevel(strings.ToLower(s.Level))
+	switch level {
+	case forgejo.ScopeInstance:
+		return forgejo.Scope{Level: level}, nil
+	case forgejo.ScopeOrganization:
+		if s.Owner == "" {
+			return forgejo.Scope{}, errors.New("forgejo default scope requires owner for organization level")
+		}
+		return forgejo.Scope{Level: level, Owner: s.Owner}, nil
+	case forgejo.ScopeRepository:
+		if s.Owner == "" || s.Name == "" {
+			return forgejo.Scope{}, errors.New("forgejo default scope requires owner and name for repository level")
+		}
+		return forgejo.Scope{Level: level, Owner: s.Owner, Name: s.Name}, nil
+	default:
+		return forgejo.Scope{}, fmt.Errorf("unknown scope level %q", s.Level)
+	}
+}
--- a/services/forgejo-nsc/internal/config/config_test.go
+++ b/services/forgejo-nsc/internal/config/config_test.go
@ -0,0 +1,41 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+func TestLoadConfig(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.yaml")
+	content := `
+listen: ":9090"
+forgejo:
+  base_url: https://forgejo.test
+  token: abc
+  default_scope:
+    level: instance
+namespace:
+  nsc_binary: /usr/bin/nsc
+  image: ghcr.io/forgejo/runner:3
+  duration: 15m
+runner:
+  name_prefix: custom-
+`
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+	if cfg.Listen != ":9090" {
+		t.Fatalf("unexpected listen addr: %s", cfg.Listen)
+	}
+	if cfg.Namespace.Duration.Duration != 15*time.Minute {
+		t.Fatalf("duration parsing failed: %s", cfg.Namespace.Duration.Duration)
+	}
+}
--- a/services/forgejo-nsc/internal/forgejo/client.go
+++ b/services/forgejo-nsc/internal/forgejo/client.go
@ -0,0 +1,454 @@
+package forgejo
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"path"
+	"strings"
+	"time"
+)
+
+type ScopeLevel string
+
+const (
+	ScopeInstance     ScopeLevel = "instance"
+	ScopeOrganization ScopeLevel = "organization"
+	ScopeRepository   ScopeLevel = "repository"
+)
+
+type Scope struct {
+	Level ScopeLevel
+	Owner string
+	Name  string
+}
+
+type Client struct {
+	baseURL *url.URL
+	token   string
+	client  *http.Client
+}
+
+type Runner struct {
+	ID     int64         `json:"id"`
+	Name   string        `json:"name"`
+	Status string        `json:"status"`
+	Busy   bool          `json:"busy"`
+	Labels []RunnerLabel `json:"labels"`
+}
+
+type RunnerLabel struct {
+	Name string `json:"name"`
+}
+
+type RunJob struct {
+	ID     int64    `json:"id"`
+	Name   string   `json:"name"`
+	RunsOn []string `json:"runs_on"`
+	Status string   `json:"status"`
+	TaskID int64    `json:"task_id"`
+}
+
+type WebhookConfig struct {
+	URL         string
+	ContentType string
+	Events      []string
+	Active      bool
+}
+
+type Option func(*Client)
+
+func WithHTTPClient(httpClient *http.Client) Option {
+	return func(c *Client) {
+		if httpClient != nil {
+			c.client = httpClient
+		}
+	}
+}
+
+func NewClient(rawURL, token string, opts ...Option) (*Client, error) {
+	if rawURL == "" {
+		return nil, errors.New("forgejo base URL is required")
+	}
+
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return nil, err
+	}
+
+	client := &Client{
+		baseURL: u,
+		token:   strings.TrimSpace(token),
+		client: &http.Client{
+			Timeout: 30 * time.Second,
+		},
+	}
+
+	for _, opt := range opts {
+		opt(client)
+	}
+
+	if client.token == "" {
+		return nil, errors.New("forgejo token is required")
+	}
+
+	return client, nil
+}
+
+type registrationTokenResponse struct {
+	Token string    `json:"token"`
+	TTL   time.Time `json:"expires_at"`
+}
+
+func (c *Client) RegistrationToken(ctx context.Context, scope Scope) (string, error) {
+	endpoint, err := c.registrationEndpoint(scope)
+	if err != nil {
+		return "", err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return "", err
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return "", fmt.Errorf("forgejo returned %s", resp.Status)
+	}
+
+	var decoded registrationTokenResponse
+	if err := json.NewDecoder(resp.Body).Decode(&decoded); err != nil {
+		return "", err
+	}
+	if decoded.Token == "" {
+		return "", errors.New("forgejo response missing token")
+	}
+
+	return decoded.Token, nil
+}
+
+func (c *Client) ListRunners(ctx context.Context, scope Scope) ([]Runner, error) {
+	endpoint, err := c.runnersEndpoint(scope)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return nil, fmt.Errorf("forgejo returned %s", resp.Status)
+	}
+
+	var decoded []Runner
+	if err := json.NewDecoder(resp.Body).Decode(&decoded); err != nil {
+		return nil, err
+	}
+
+	return decoded, nil
+}
+
+func (c *Client) ListRunJobs(ctx context.Context, scope Scope, labels []string) ([]RunJob, error) {
+	endpoint, err := c.runJobsEndpoint(scope)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, err
+	}
+	if len(labels) > 0 {
+		query := req.URL.Query()
+		query.Set("labels", strings.Join(labels, ","))
+		req.URL.RawQuery = query.Encode()
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return nil, fmt.Errorf("forgejo returned %s", resp.Status)
+	}
+
+	var decoded []RunJob
+	if err := json.NewDecoder(resp.Body).Decode(&decoded); err != nil {
+		return nil, err
+	}
+
+	if decoded == nil {
+		decoded = []RunJob{}
+	}
+	return decoded, nil
+}
+
+func (c *Client) EnsureWebhook(ctx context.Context, scope Scope, cfg WebhookConfig, secret string) error {
+	if cfg.URL == "" {
+		return nil
+	}
+
+	hooks, err := c.listWebhooks(ctx, scope)
+	if err != nil {
+		return err
+	}
+
+	for _, hook := range hooks {
+		if strings.EqualFold(hook.Config.URL, cfg.URL) {
+			return c.updateWebhook(ctx, scope, hook.ID, cfg, secret)
+		}
+	}
+
+	return c.createWebhook(ctx, scope, cfg, secret)
+}
+
+func (c *Client) registrationEndpoint(scope Scope) (string, error) {
+	var segments []string
+	switch scope.Level {
+	case ScopeRepository:
+		if scope.Owner == "" || scope.Name == "" {
+			return "", errors.New("repository scope requires owner and name")
+		}
+		segments = []string{"api", "v1", "repos", scope.Owner, scope.Name, "actions", "runners", "registration-token"}
+	case ScopeOrganization:
+		if scope.Owner == "" {
+			return "", errors.New("organization scope requires owner")
+		}
+		segments = []string{"api", "v1", "orgs", scope.Owner, "actions", "runners", "registration-token"}
+	case ScopeInstance:
+		segments = []string{"api", "v1", "admin", "actions", "runners", "registration-token"}
+	default:
+		return "", fmt.Errorf("unsupported scope level %q", scope.Level)
+	}
+
+	clone := *c.baseURL
+	clone.Path = path.Join(append([]string{clone.Path}, segments...)...)
+	return clone.String(), nil
+}
+
+type webhook struct {
+	ID     int64                `json:"id"`
+	Config webhookConfigPayload `json:"config"`
+}
+
+type webhookConfigPayload struct {
+	URL         string `json:"url"`
+	ContentType string `json:"content_type"`
+}
+
+func (c *Client) listWebhooks(ctx context.Context, scope Scope) ([]webhook, error) {
+	endpoint, err := c.webhooksEndpoint(scope)
+	if err != nil {
+		return nil, err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, err
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return nil, fmt.Errorf("forgejo returned %s", resp.Status)
+	}
+
+	var hooks []webhook
+	if err := json.NewDecoder(resp.Body).Decode(&hooks); err != nil {
+		return nil, err
+	}
+
+	return hooks, nil
+}
+
+func (c *Client) createWebhook(ctx context.Context, scope Scope, cfg WebhookConfig, secret string) error {
+	payload := webhookRequestPayload{
+		Type: "gitea",
+		Config: map[string]string{
+			"url":          cfg.URL,
+			"content_type": cfg.ContentType,
+			"secret":       secret,
+			"insecure_ssl": "0",
+		},
+		Events: cfg.Events,
+		Active: cfg.Active,
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+
+	endpoint, err := c.webhooksEndpoint(scope)
+	if err != nil {
+		return err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, endpoint, bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return fmt.Errorf("forgejo returned %s", resp.Status)
+	}
+
+	return nil
+}
+
+func (c *Client) updateWebhook(ctx context.Context, scope Scope, id int64, cfg WebhookConfig, secret string) error {
+	payload := webhookRequestPayload{
+		Type: "gitea",
+		Config: map[string]string{
+			"url":          cfg.URL,
+			"content_type": cfg.ContentType,
+			"secret":       secret,
+			"insecure_ssl": "0",
+		},
+		Events: cfg.Events,
+		Active: cfg.Active,
+	}
+
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return err
+	}
+
+	endpoint, err := c.webhooksEndpoint(scope)
+	if err != nil {
+		return err
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPatch, fmt.Sprintf("%s/%d", endpoint, id), bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", fmt.Sprintf("token %s", c.token))
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := c.client.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return fmt.Errorf("forgejo returned %s", resp.Status)
+	}
+
+	return nil
+}
+
+func (c *Client) webhooksEndpoint(scope Scope) (string, error) {
+	var segments []string
+	switch scope.Level {
+	case ScopeRepository:
+		if scope.Owner == "" || scope.Name == "" {
+			return "", errors.New("repository scope requires owner and name")
+		}
+		segments = []string{"api", "v1", "repos", scope.Owner, scope.Name, "hooks"}
+	case ScopeOrganization:
+		if scope.Owner == "" {
+			return "", errors.New("organization scope requires owner")
+		}
+		segments = []string{"api", "v1", "orgs", scope.Owner, "hooks"}
+	default:
+		return "", fmt.Errorf("webhook management not supported for scope level %q", scope.Level)
+	}
+
+	clone := *c.baseURL
+	clone.Path = path.Join(append([]string{clone.Path}, segments...)...)
+	return clone.String(), nil
+}
+
+type webhookRequestPayload struct {
+	Type   string            `json:"type"`
+	Config map[string]string `json:"config"`
+	Events []string          `json:"events"`
+	Active bool              `json:"active"`
+}
+
+func (c *Client) runnersEndpoint(scope Scope) (string, error) {
+	var segments []string
+	switch scope.Level {
+	case ScopeRepository:
+		if scope.Owner == "" || scope.Name == "" {
+			return "", errors.New("repository scope requires owner and name")
+		}
+		segments = []string{"api", "v1", "repos", scope.Owner, scope.Name, "actions", "runners"}
+	case ScopeOrganization:
+		if scope.Owner == "" {
+			return "", errors.New("organization scope requires owner")
+		}
+		segments = []string{"api", "v1", "orgs", scope.Owner, "actions", "runners"}
+	case ScopeInstance:
+		segments = []string{"api", "v1", "actions", "runners"}
+	default:
+		return "", fmt.Errorf("unsupported scope level %q", scope.Level)
+	}
+
+	clone := *c.baseURL
+	clone.Path = path.Join(append([]string{clone.Path}, segments...)...)
+	return clone.String(), nil
+}
+
+func (c *Client) runJobsEndpoint(scope Scope) (string, error) {
+	var segments []string
+	switch scope.Level {
+	case ScopeRepository:
+		if scope.Owner == "" || scope.Name == "" {
+			return "", errors.New("repository scope requires owner and name")
+		}
+		segments = []string{"api", "v1", "repos", scope.Owner, scope.Name, "actions", "runners", "jobs"}
+	case ScopeOrganization:
+		if scope.Owner == "" {
+			return "", errors.New("organization scope requires owner")
+		}
+		segments = []string{"api", "v1", "orgs", scope.Owner, "actions", "runners", "jobs"}
+	default:
+		return "", fmt.Errorf("run jobs not supported for scope level %q", scope.Level)
+	}
+
+	clone := *c.baseURL
+	clone.Path = path.Join(append([]string{clone.Path}, segments...)...)
+	return clone.String(), nil
+}
--- a/services/forgejo-nsc/internal/nsc/dispatcher.go
+++ b/services/forgejo-nsc/internal/nsc/dispatcher.go
@ -0,0 +1,460 @@
+package nsc
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"os/exec"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/sync/semaphore"
+)
+
+type Options struct {
+	BinaryPath       string
+	DefaultImage     string
+	DefaultMachine   string
+	DefaultDuration  time.Duration
+	WorkDir          string
+	MaxParallel      int64
+	RunnerNamePrefix string
+	Executor         string
+	Network          string
+	ComputeBaseURL   string
+	MacosBaseImageID string
+	MacosMachineArch string
+	Logger           *slog.Logger
+}
+
+type LaunchRequest struct {
+	Token       string
+	InstanceURL string
+	Labels      []string
+	Duration    time.Duration
+	MachineType string
+	Image       string
+	ExtraEnv    map[string]string
+}
+
+type Dispatcher struct {
+	opts Options
+	sem  *semaphore.Weighted
+	log  *slog.Logger
+}
+
+func NewDispatcher(opts Options) (*Dispatcher, error) {
+	if opts.BinaryPath == "" {
+		return nil, errors.New("nsc binary path is required")
+	}
+	if opts.DefaultImage == "" {
+		return nil, errors.New("default Namespace runner image is required")
+	}
+	if opts.RunnerNamePrefix == "" {
+		opts.RunnerNamePrefix = "nscloud-"
+	}
+	if opts.Executor == "" {
+		opts.Executor = "shell"
+	}
+	if opts.MacosBaseImageID == "" {
+		opts.MacosBaseImageID = "tahoe"
+	}
+	if opts.MacosMachineArch == "" {
+		opts.MacosMachineArch = "arm64"
+	}
+	if opts.MaxParallel <= 0 {
+		opts.MaxParallel = 4
+	}
+	if opts.DefaultDuration == 0 {
+		opts.DefaultDuration = 30 * time.Minute
+	}
+	logger := opts.Logger
+	if logger == nil {
+		logger = slog.New(slog.NewTextHandler(io.Discard, nil))
+	}
+
+	return &Dispatcher{
+		opts: opts,
+		sem:  semaphore.NewWeighted(opts.MaxParallel),
+		log:  logger,
+	}, nil
+}
+
+func (d *Dispatcher) LaunchRunner(ctx context.Context, req LaunchRequest) (string, error) {
+	if req.Token == "" {
+		return "", errors.New("registration token is required")
+	}
+	if req.InstanceURL == "" {
+		return "", errors.New("forgejo instance url is required")
+	}
+	if err := d.sem.Acquire(ctx, 1); err != nil {
+		return "", err
+	}
+	defer d.sem.Release(1)
+
+	runnerName := d.generateName()
+	duration := req.Duration
+	if duration == 0 {
+		duration = d.opts.DefaultDuration
+	}
+	machineType := choose(req.MachineType, d.opts.DefaultMachine)
+	image := choose(req.Image, d.opts.DefaultImage)
+
+	if hasWindowsLabel(req.Labels) {
+		if err := d.launchWindowsRunnerViaWinRM(ctx, runnerName, req, duration, machineType); err != nil {
+			return "", err
+		}
+		return runnerName, nil
+	}
+
+	if hasMacOSLabel(req.Labels) {
+		// Compute macOS shapes differ from the Linux "run" defaults. If the request
+		// didn't specify a machine type, ensure we pick a macOS-valid default.
+		if machineType == "" || machineType == d.opts.DefaultMachine {
+			machineType = "12x28"
+		}
+
+		// Prefer the Compute API path because it uses the service token (NSC_TOKEN_FILE)
+		// and does not require an interactive `nsc login` session.
+		if err := d.launchMacOSRunner(ctx, runnerName, req, duration, machineType); err != nil {
+			d.log.Warn("macos compute launch failed; falling back to nsc create+ssh", "runner", runnerName, "err", err)
+			if err := d.launchMacOSRunnerViaNSC(ctx, runnerName, req, duration, machineType); err != nil {
+				return "", err
+			}
+		}
+		return runnerName, nil
+	}
+
+	env := map[string]string{
+		"FORGEJO_INSTANCE_URL":  req.InstanceURL,
+		"FORGEJO_RUNNER_TOKEN":  req.Token,
+		"FORGEJO_RUNNER_NAME":   runnerName,
+		"FORGEJO_RUNNER_LABELS": strings.Join(req.Labels, ","),
+		"FORGEJO_RUNNER_EXEC":   d.opts.Executor,
+	}
+	for k, v := range req.ExtraEnv {
+		env[k] = v
+	}
+	if _, ok := env["NSC_CACHE_PATH"]; !ok {
+		env["NSC_CACHE_PATH"] = "/nix/store"
+	}
+
+	script := d.bootstrapScript()
+	args := []string{
+		"run",
+		"--wait",
+		"--output",
+		"json",
+		"--duration", duration.String(),
+		"--image", image,
+		"--name", runnerName,
+		"--user", "root",
+	}
+	if machineType != "" {
+		args = append(args, "--machine_type", machineType)
+	}
+	if d.opts.Network != "" {
+		args = append(args, "--network", d.opts.Network)
+	}
+	for key, value := range env {
+		if value == "" {
+			continue
+		}
+		args = append(args, "-e", fmt.Sprintf("%s=%s", key, value))
+	}
+	if d.opts.WorkDir != "" {
+		args = append(args, "-e", fmt.Sprintf("FORGEJO_RUNNER_WORKDIR=%s", d.opts.WorkDir))
+	}
+
+	args = append(args, "--", "/bin/sh", "-c", script)
+
+	cmd := exec.CommandContext(ctx, d.opts.BinaryPath, args...)
+	var buf bytes.Buffer
+	cmd.Stdout = &buf
+	cmd.Stderr = &buf
+
+	start := time.Now()
+	d.log.Info("launching Namespace runner",
+		"runner", runnerName,
+		"machine_type", machineType,
+		"image", image,
+	)
+	err := cmd.Run()
+	if err != nil {
+		return "", fmt.Errorf("nsc run failed: %w\n%s", err, buf.String())
+	}
+
+	if output := strings.TrimSpace(buf.String()); output != "" {
+		d.log.Info("runner output", "runner", runnerName, "output", output)
+	}
+
+	d.log.Info("runner completed",
+		"runner", runnerName,
+		"duration", time.Since(start),
+	)
+
+	if instanceID := parseInstanceID(buf.String()); instanceID != "" {
+		waitCtx, cancel := context.WithTimeout(context.Background(), duration)
+		defer cancel()
+		stopped := d.waitForInstanceStop(waitCtx, runnerName, instanceID, duration)
+		if !stopped {
+			d.log.Warn("runner did not stop before timeout", "runner", runnerName, "instance", instanceID)
+		}
+		d.destroyInstance(waitCtx, runnerName, instanceID)
+	}
+
+	return runnerName, nil
+}
+
+func (d *Dispatcher) generateName() string {
+	id := strings.ReplaceAll(uuid.NewString(), "-", "")
+	return d.opts.RunnerNamePrefix + id[:12]
+}
+
+func parseInstanceID(output string) string {
+	if jsonBlob := extractJSON(output); jsonBlob != "" {
+		var payload struct {
+			ClusterID string `json:"cluster_id"`
+		}
+		if err := json.Unmarshal([]byte(jsonBlob), &payload); err == nil && payload.ClusterID != "" {
+			return payload.ClusterID
+		}
+	}
+	const marker = "ID:"
+	idx := strings.Index(output, marker)
+	if idx == -1 {
+		return ""
+	}
+	rest := strings.TrimSpace(output[idx+len(marker):])
+	if rest == "" {
+		return ""
+	}
+	fields := strings.Fields(rest)
+	if len(fields) == 0 {
+		return ""
+	}
+	return fields[0]
+}
+
+func extractJSON(output string) string {
+	trimmed := strings.TrimSpace(output)
+	if trimmed == "" {
+		return ""
+	}
+	start := strings.IndexAny(trimmed, "[{")
+	if start == -1 {
+		return ""
+	}
+	end := strings.LastIndexAny(trimmed, "]}")
+	if end == -1 || end < start {
+		return ""
+	}
+	return trimmed[start : end+1]
+}
+
+type describeResponse struct {
+	Resource    string                    `json:"resource"`
+	PerResource map[string]describeTarget `json:"per_resource"`
+}
+
+type describeTarget struct {
+	Tombstone string              `json:"tombstone"`
+	Container []describeContainer `json:"container"`
+}
+
+type describeContainer struct {
+	Status       string `json:"status"`
+	TerminatedAt string `json:"terminated_at"`
+}
+
+func instanceStopped(output string) bool {
+	jsonBlob := extractJSON(output)
+	if jsonBlob == "" {
+		return false
+	}
+	var payload []describeResponse
+	if err := json.Unmarshal([]byte(jsonBlob), &payload); err != nil {
+		return false
+	}
+	if len(payload) == 0 {
+		return false
+	}
+	for _, entry := range payload {
+		for _, target := range entry.PerResource {
+			if target.Tombstone != "" {
+				return true
+			}
+			if len(target.Container) == 0 {
+				continue
+			}
+			for _, container := range target.Container {
+				if container.Status != "stopped" && container.TerminatedAt == "" {
+					return false
+				}
+			}
+		}
+	}
+	return true
+}
+
+func (d *Dispatcher) waitForInstanceStop(ctx context.Context, runnerName, instanceID string, timeout time.Duration) bool {
+	if timeout <= 0 {
+		timeout = d.opts.DefaultDuration
+	}
+	deadline := time.Now().Add(timeout)
+	ticker := time.NewTicker(10 * time.Second)
+	defer ticker.Stop()
+
+	for {
+		stopped, err := d.checkInstanceStopped(ctx, instanceID)
+		if err != nil {
+			d.log.Warn("runner stop check failed", "runner", runnerName, "instance", instanceID, "err", err)
+			return false
+		}
+		if stopped {
+			return true
+		}
+		if time.Now().After(deadline) {
+			return false
+		}
+		select {
+		case <-ctx.Done():
+			return false
+		case <-ticker.C:
+		}
+	}
+}
+
+func (d *Dispatcher) checkInstanceStopped(ctx context.Context, instanceID string) (bool, error) {
+	cmd := exec.CommandContext(ctx, d.opts.BinaryPath, "describe", "--output", "json", instanceID)
+	var buf bytes.Buffer
+	cmd.Stdout = &buf
+	cmd.Stderr = &buf
+	if err := cmd.Run(); err != nil {
+		output := strings.ToLower(buf.String())
+		if strings.Contains(output, "destroyed") || strings.Contains(output, "not found") {
+			return true, nil
+		}
+		return false, fmt.Errorf("nsc describe failed: %w\n%s", err, strings.TrimSpace(buf.String()))
+	}
+	return instanceStopped(buf.String()), nil
+}
+
+func (d *Dispatcher) destroyInstance(ctx context.Context, runnerName, instanceID string) {
+	cmd := exec.CommandContext(ctx, d.opts.BinaryPath, "destroy", "--force", instanceID)
+	var buf bytes.Buffer
+	cmd.Stdout = &buf
+	cmd.Stderr = &buf
+	if err := cmd.Run(); err != nil {
+		d.log.Warn("runner destroy failed", "runner", runnerName, "instance", instanceID, "err", err, "output", strings.TrimSpace(buf.String()))
+		return
+	}
+	if output := strings.TrimSpace(buf.String()); output != "" {
+		d.log.Info("runner destroyed", "runner", runnerName, "instance", instanceID, "output", output)
+	} else {
+		d.log.Info("runner destroyed", "runner", runnerName, "instance", instanceID)
+	}
+}
+
+func choose(values ...string) string {
+	for _, v := range values {
+		if strings.TrimSpace(v) != "" {
+			return v
+		}
+	}
+	return ""
+}
+
+func (d *Dispatcher) bootstrapScript() string {
+	var builder strings.Builder
+	builder.WriteString(`set -euo pipefail
+mkdir -p "${FORGEJO_RUNNER_WORKDIR:-/tmp/forgejo-runner}"
+cd "${FORGEJO_RUNNER_WORKDIR:-/tmp/forgejo-runner}"
+
+if ! command -v node >/dev/null 2>&1; then
+  apk add --no-cache nodejs npm >/dev/null
+fi
+if ! command -v sudo >/dev/null 2>&1; then
+  apk add --no-cache sudo bash >/dev/null
+fi
+if ! command -v curl >/dev/null 2>&1; then
+  apk add --no-cache curl >/dev/null
+fi
+if ! command -v xz >/dev/null 2>&1; then
+  apk add --no-cache xz >/dev/null
+fi
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+node --version >/dev/null
+
+cat > runner.yaml <<'EOF'
+log:
+  level: info
+runner:
+  file: .runner
+  capacity: 1
+  name: ${FORGEJO_RUNNER_NAME}
+  labels:
+EOF
+`)
+	builder.WriteString(`runner_exec="${FORGEJO_RUNNER_EXEC:-host}"
+if [ "$runner_exec" = "shell" ]; then
+  runner_exec="host"
+fi
+
+resolved_labels=""
+for label in ${FORGEJO_RUNNER_LABELS//,/ } ; do
+  if [ -z "${label}" ]; then
+    continue
+  fi
+  case "${label}" in
+    *:*) resolved="${label}" ;;
+    *)
+      if [ "$runner_exec" = "host" ]; then
+        resolved="${label}:host"
+      else
+        resolved="${label}:${runner_exec}"
+      fi
+      ;;
+  esac
+  echo "  - ${resolved}" >> runner.yaml
+  if [ -z "${resolved_labels}" ]; then
+    resolved_labels="${resolved}"
+  else
+    resolved_labels="${resolved_labels},${resolved}"
+  fi
+done
+`)
+	builder.WriteString(`cat >> runner.yaml <<'EOF'
+cache:
+  enabled: false
+EOF
+
+forgejo-runner register \
+  --no-interactive \
+  --instance "${FORGEJO_INSTANCE_URL}" \
+  --token "${FORGEJO_RUNNER_TOKEN}" \
+  --name "${FORGEJO_RUNNER_NAME}" \
+  --labels "${resolved_labels}" \
+  --config runner.yaml
+
+runner_mode="${FORGEJO_RUNNER_MODE:-one-job}"
+case "$runner_mode" in
+  one-job)
+    forgejo-runner one-job --config runner.yaml
+    ;;
+  daemon)
+    forgejo-runner daemon --config runner.yaml
+    ;;
+  *)
+    echo "Unknown FORGEJO_RUNNER_MODE: ${runner_mode}" >&2
+    exit 1
+    ;;
+esac
+`)
+	return builder.String()
+}
--- a/services/forgejo-nsc/internal/nsc/macos.go
+++ b/services/forgejo-nsc/internal/nsc/macos.go
@ -0,0 +1,708 @@
+package nsc
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	computev1betaconnect "buf.build/gen/go/namespace/cloud/connectrpc/go/proto/namespace/cloud/compute/v1beta/computev1betaconnect"
+	computev1beta "buf.build/gen/go/namespace/cloud/protocolbuffers/go/proto/namespace/cloud/compute/v1beta"
+	stdlib "buf.build/gen/go/namespace/cloud/protocolbuffers/go/proto/namespace/stdlib"
+	"connectrpc.com/connect"
+	"golang.org/x/crypto/ssh"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+func hasMacOSLabel(labels []string) bool {
+	for _, label := range labels {
+		l := strings.TrimSpace(label)
+		if l == "" {
+			continue
+		}
+		if strings.HasPrefix(l, "namespace-profile-macos-") {
+			return true
+		}
+	}
+	return false
+}
+
+type lockedBuffer struct {
+	mu sync.Mutex
+	b  bytes.Buffer
+}
+
+func (lb *lockedBuffer) Write(p []byte) (int, error) {
+	lb.mu.Lock()
+	defer lb.mu.Unlock()
+	return lb.b.Write(p)
+}
+
+func (lb *lockedBuffer) Len() int {
+	lb.mu.Lock()
+	defer lb.mu.Unlock()
+	return lb.b.Len()
+}
+
+func (lb *lockedBuffer) String() string {
+	lb.mu.Lock()
+	defer lb.mu.Unlock()
+	return lb.b.String()
+}
+
+func macosSupportDiskSelectors(baseImageID string) []*stdlib.Label {
+	id := strings.TrimSpace(baseImageID)
+	if id == "" {
+		id = "tahoe"
+	}
+
+	// Allow specifying selectors directly, e.g. "macos.version=26.x,image.with=xcode-26".
+	if strings.Contains(id, "=") {
+		var out []*stdlib.Label
+		for _, part := range strings.Split(id, ",") {
+			part = strings.TrimSpace(part)
+			if part == "" {
+				continue
+			}
+			name, value, ok := strings.Cut(part, "=")
+			name = strings.TrimSpace(name)
+			value = strings.TrimSpace(value)
+			if !ok || name == "" || value == "" {
+				continue
+			}
+			out = append(out, &stdlib.Label{Name: name, Value: value})
+		}
+		if len(out) > 0 {
+			return out
+		}
+	}
+
+	// Human-friendly presets used by burrow config.
+	switch strings.ToLower(id) {
+	case "sonoma", "macos-14", "macos14", "14":
+		return []*stdlib.Label{{Name: "macos.version", Value: "14.x"}}
+	case "sequoia", "macos-15", "macos15", "15":
+		return []*stdlib.Label{{Name: "macos.version", Value: "15.x"}}
+	case "tahoe", "macos-26", "macos26", "26":
+		// Constrain to the Xcode 26 support disk explicitly, since Apple builds
+		// depend on Xcode being present and Compute currently errors if it can't
+		// resolve a support disk selection.
+		return []*stdlib.Label{{Name: "macos.version", Value: "26.x"}, {Name: "image.with", Value: "xcode-26"}}
+	default:
+		return []*stdlib.Label{{Name: "macos.version", Value: "26.x"}}
+	}
+}
+
+func macosComputeBaseImageID(baseImageID string) string {
+	id := strings.TrimSpace(baseImageID)
+	if id == "" {
+		return "tahoe"
+	}
+	// If selectors were provided directly, we cannot safely infer a canonical
+	// base image ID from them.
+	if strings.Contains(id, "=") {
+		return ""
+	}
+	switch strings.ToLower(id) {
+	case "sonoma", "macos-14", "macos14", "14":
+		return "sonoma"
+	case "sequoia", "macos-15", "macos15", "15":
+		return "sequoia"
+	case "tahoe", "macos-26", "macos26", "26":
+		return "tahoe"
+	default:
+		return id
+	}
+}
+
+type nscBearerTokenFile struct {
+	BearerToken string `json:"bearer_token"`
+}
+
+func readNSCBearerToken() (string, error) {
+	path := os.Getenv("NSC_TOKEN_FILE")
+	if path == "" {
+		return "", errors.New("NSC_TOKEN_FILE is required for macos runners")
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read NSC_TOKEN_FILE: %w", err)
+	}
+	trimmed := strings.TrimSpace(string(raw))
+	if trimmed == "" {
+		return "", errors.New("NSC_TOKEN_FILE is empty")
+	}
+	// Support the on-host format used by burrow: {"bearer_token":"..."}.
+	var parsed nscBearerTokenFile
+	if err := json.Unmarshal([]byte(trimmed), &parsed); err == nil && parsed.BearerToken != "" {
+		return parsed.BearerToken, nil
+	}
+	// Fallback: allow a raw bearer token.
+	return trimmed, nil
+}
+
+func parseMachineTypeCPUxMemGB(machineType string) (vcpu int32, memoryMB int32, err error) {
+	parts := strings.Split(machineType, "x")
+	if len(parts) != 2 {
+		return 0, 0, fmt.Errorf("invalid machine_type %q: expected CPUxMemoryGB (e.g. 12x28)", machineType)
+	}
+	cpu64, err := strconv.ParseInt(parts[0], 10, 32)
+	if err != nil {
+		return 0, 0, fmt.Errorf("invalid machine_type %q: cpu: %w", machineType, err)
+	}
+	memGB64, err := strconv.ParseInt(parts[1], 10, 32)
+	if err != nil {
+		return 0, 0, fmt.Errorf("invalid machine_type %q: memory: %w", machineType, err)
+	}
+	return int32(cpu64), int32(memGB64 * 1024), nil
+}
+
+func (d *Dispatcher) launchMacOSRunner(ctx context.Context, runnerName string, req LaunchRequest, ttl time.Duration, machineType string) error {
+	if machineType == "" {
+		return errors.New("machine_type is required for macos runners")
+	}
+	vcpu, memoryMB, err := parseMachineTypeCPUxMemGB(machineType)
+	if err != nil {
+		return err
+	}
+	bearer, err := readNSCBearerToken()
+	if err != nil {
+		return err
+	}
+
+	httpClient := &http.Client{Timeout: 60 * time.Second}
+	client := computev1betaconnect.NewComputeServiceClient(httpClient, d.opts.ComputeBaseURL)
+
+	workdir := d.opts.WorkDir
+	if strings.TrimSpace(workdir) == "" {
+		workdir = "/tmp/forgejo-runner"
+	}
+
+	env := map[string]string{
+		"FORGEJO_INSTANCE_URL":   req.InstanceURL,
+		"FORGEJO_RUNNER_TOKEN":   req.Token,
+		"FORGEJO_RUNNER_NAME":    runnerName,
+		"FORGEJO_RUNNER_LABELS":  strings.Join(req.Labels, ","),
+		"FORGEJO_RUNNER_EXEC":    d.opts.Executor,
+		"FORGEJO_RUNNER_WORKDIR": workdir,
+	}
+	for k, v := range req.ExtraEnv {
+		env[k] = v
+	}
+	// Best-effort caching: workflows call Scripts/nscloud-cache.sh, which is a
+	// no-op unless NSC_CACHE_PATH is set. This may still be skipped if spacectl
+	// lacks credentials, but setting the path is harmless and keeps behavior
+	// consistent across macOS / Linux runners.
+	if _, ok := env["NSC_CACHE_PATH"]; !ok {
+		env["NSC_CACHE_PATH"] = "/Users/runner/.cache/nscloud"
+	}
+
+	deadline := timestamppb.New(time.Now().Add(ttl))
+
+	createReq := &computev1beta.CreateInstanceRequest{
+		Shape: &computev1beta.InstanceShape{
+			VirtualCpu:      vcpu,
+			MemoryMegabytes: memoryMB,
+			MachineArch:     d.opts.MacosMachineArch,
+			Os:              "macos",
+			// Namespace macOS compute requires selectors to pick the base image
+			// ("support disk"), otherwise instance creation fails.
+			Selectors: macosSupportDiskSelectors(d.opts.MacosBaseImageID),
+		},
+		DocumentedPurpose: fmt.Sprintf("burrow forgejo runner %s", runnerName),
+		Deadline:          deadline,
+		Labels: []*stdlib.Label{
+			{Name: "nsc.source", Value: "forgejo-nsc"},
+			{Name: "burrow.service", Value: "forgejo-runner"},
+			{Name: "burrow.runner", Value: runnerName},
+		},
+		Applications: []*computev1beta.ApplicationRequest{
+			{
+				Name:         "forgejo-runner",
+				Command:      "/bin/bash",
+				Args:         []string{"-lc", macosBootstrapScript()},
+				Environment:  env,
+				WorkloadType: computev1beta.ApplicationRequest_JOB,
+			},
+		},
+	}
+	if imageID := macosComputeBaseImageID(d.opts.MacosBaseImageID); imageID != "" {
+		createReq.Experimental = &computev1beta.CreateInstanceRequest_ExperimentalFeatures{
+			MacosBaseImageId: imageID,
+		}
+	}
+
+	d.log.Info("launching Namespace macos runner",
+		"runner", runnerName,
+		"compute_base_url", d.opts.ComputeBaseURL,
+		"macos_base_image_id", d.opts.MacosBaseImageID,
+		"shape", fmt.Sprintf("%dx%d", vcpu, memoryMB/1024),
+		"arch", d.opts.MacosMachineArch,
+	)
+
+	reqCreate := connect.NewRequest(createReq)
+	reqCreate.Header().Set("Authorization", "Bearer "+bearer)
+	resp, err := client.CreateInstance(ctx, reqCreate)
+	if err != nil {
+		return fmt.Errorf("compute create instance failed: %w", err)
+	}
+	if resp.Msg == nil || resp.Msg.Metadata == nil {
+		return errors.New("compute create instance returned no metadata")
+	}
+	instanceID := resp.Msg.Metadata.InstanceId
+
+	waitErr := d.waitForMacOSRunnerStop(ctx, client, bearer, runnerName, instanceID, ttl)
+	d.destroyComputeInstance(context.Background(), client, bearer, runnerName, instanceID)
+	return waitErr
+}
+
+func (d *Dispatcher) runMacOSComputeSSHScript(ctx context.Context, runnerName, instanceID, script string) error {
+	bearer, err := readNSCBearerToken()
+	if err != nil {
+		return err
+	}
+
+	httpClient := &http.Client{Timeout: 60 * time.Second}
+	client := computev1betaconnect.NewComputeServiceClient(httpClient, d.opts.ComputeBaseURL)
+
+	getReq := connect.NewRequest(&computev1beta.GetSSHConfigRequest{
+		InstanceId: instanceID,
+		// TargetContainer is optional. Keep it empty to run commands in the default instance environment.
+	})
+	getReq.Header().Set("Authorization", "Bearer "+bearer)
+
+	resp, err := client.GetSSHConfig(ctx, getReq)
+	if err != nil {
+		return fmt.Errorf("compute get ssh config failed: %w", err)
+	}
+	if resp.Msg == nil {
+		return errors.New("compute get ssh config returned empty response")
+	}
+	if resp.Msg.Endpoint == "" {
+		return errors.New("compute get ssh config returned empty endpoint")
+	}
+	if len(resp.Msg.SshPrivateKey) == 0 {
+		return errors.New("compute get ssh config returned empty ssh private key")
+	}
+	if strings.TrimSpace(resp.Msg.Username) == "" {
+		return errors.New("compute get ssh config returned empty username")
+	}
+
+	signer, err := ssh.ParsePrivateKey(resp.Msg.SshPrivateKey)
+	if err != nil {
+		return fmt.Errorf("parse ssh private key: %w", err)
+	}
+
+	addr := fmt.Sprintf("%s:22", resp.Msg.Endpoint)
+	conn, err := net.Dial("tcp", addr)
+	if err != nil {
+		return fmt.Errorf("dial ssh endpoint: %w", err)
+	}
+	defer conn.Close()
+
+	sshCfg := &ssh.ClientConfig{
+		User:            resp.Msg.Username,
+		Auth:            []ssh.AuthMethod{ssh.PublicKeys(signer)},
+		HostKeyCallback: ssh.InsecureIgnoreHostKey(), // Endpoint is short-lived and key is delivered out-of-band.
+		Timeout:         30 * time.Second,
+	}
+
+	c, chans, reqs, err := ssh.NewClientConn(conn, addr, sshCfg)
+	if err != nil {
+		return fmt.Errorf("ssh client conn: %w", err)
+	}
+	clientSSH := ssh.NewClient(c, chans, reqs)
+	defer clientSSH.Close()
+
+	session, err := clientSSH.NewSession()
+	if err != nil {
+		return fmt.Errorf("ssh new session: %w", err)
+	}
+	defer session.Close()
+
+	var buf bytes.Buffer
+	session.Stdout = &buf
+	session.Stderr = &buf
+	session.Stdin = strings.NewReader(script)
+
+	// Feed the bootstrap script via stdin so we don't need to quote/escape it.
+	//
+	// Note: Some SSH servers do not reliably parse exec strings with arguments.
+	// Running bare `/bin/bash` still reads from stdin and avoids argument parsing.
+	if err := session.Run("/bin/bash"); err != nil {
+		outRaw := buf.String()
+		out := strings.TrimSpace(outRaw)
+
+		// Some SSH servers reject exec requests and only allow interactive shells,
+		// and others will "succeed" but still interpret stdin under the default
+		// login shell (showing the zsh banner / prompts).
+		//
+		// In those cases, retry via Shell() with a PTY.
+		exitStatus := 0
+		exitErr, isExitErr := err.(*ssh.ExitError)
+		if isExitErr {
+			exitStatus = exitErr.ExitStatus()
+		}
+
+		looksInteractive := strings.Contains(outRaw, "The default interactive shell is now zsh") ||
+			strings.Contains(outRaw, " runner$ ") ||
+			strings.Contains(outRaw, "bash-3.2$")
+		shouldFallback := !isExitErr || looksInteractive
+
+		if shouldFallback {
+			d.log.Warn("compute ssh exec bootstrap failed; retrying via interactive shell",
+				"runner", runnerName,
+				"instance", instanceID,
+				"exit_status", exitStatus,
+			)
+
+			session2, err2 := clientSSH.NewSession()
+			if err2 != nil {
+				return fmt.Errorf("ssh new session (fallback): %w", err2)
+			}
+			defer session2.Close()
+
+			// bytes.Buffer isn't safe for concurrent writes + reads; the SSH session
+			// writes from background goroutines. Wrap it so we can poll for a prompt
+			// before sending commands.
+			lb := &lockedBuffer{}
+			session2.Stdout = lb
+			session2.Stderr = lb
+
+			in, err2 := session2.StdinPipe()
+			if err2 != nil {
+				return fmt.Errorf("ssh stdin pipe (fallback): %w", err2)
+			}
+
+			// Request a PTY to match interactive semantics even when the caller
+			// doesn't have a local terminal.
+			_ = session2.RequestPty("xterm", 24, 80, nil)
+
+			if err2 := session2.Shell(); err2 != nil {
+				return fmt.Errorf("ssh shell (fallback): %w", err2)
+			}
+
+			// Wait briefly for the prompt/banner so the first command isn't dropped.
+			// We also emit a sentinel `echo` to verify the TTY is live.
+			deadline := time.Now().Add(3 * time.Second)
+			for time.Now().Before(deadline) {
+				n := lb.Len()
+				if n > 0 {
+					break
+				}
+				time.Sleep(50 * time.Millisecond)
+			}
+
+			// Stream the script then exit. Prefer LF line endings; macOS shells and
+			// PTYs can treat CRLF as literal CR characters (breaking heredoc
+			// delimiters and quoting).
+			writeTTY := func(s string) {
+				if s == "" {
+					return
+				}
+				s = strings.ReplaceAll(s, "\r\n", "\n")
+				_, _ = io.WriteString(in, s)
+			}
+
+			scriptTTY := strings.ReplaceAll(script, "\r\n", "\n")
+
+			// Cut down noise in logs and reduce the chance of ZSH line-editing
+			// behavior corrupting long inputs.
+			writeTTY("stty -echo 2>/dev/null || true\n")
+			writeTTY("echo BURROW_BOOTSTRAP_TTY_OK\n")
+
+			// Avoid heredocs for the script itself (PTY newline handling is fragile).
+			// Instead, stream base64 in short chunks to a file, then decode and run it.
+			enc := base64.StdEncoding.EncodeToString([]byte(scriptTTY))
+			idSafe := strings.ReplaceAll(instanceID, "-", "_")
+			b64Path := "/tmp/burrow-bootstrap-" + idSafe + ".b64"
+			shPath := "/tmp/burrow-bootstrap-" + idSafe + ".sh"
+
+			writeTTY("rm -f " + b64Path + " " + shPath + "\n")
+			writeTTY(": > " + b64Path + "\n")
+
+			const chunkSize = 80
+			for i := 0; i < len(enc); i += chunkSize {
+				j := i + chunkSize
+				if j > len(enc) {
+					j = len(enc)
+				}
+				chunk := enc[i:j]
+				// Base64 chunks contain only [A-Za-z0-9+/=], which are safe to pass
+				// unquoted. Avoid quotes entirely so a truncated line can't leave
+				// the remote shell in a multi-line continuation state.
+				writeTTY("printf %s " + chunk + " >> " + b64Path + "\n")
+				time.Sleep(5 * time.Millisecond)
+			}
+
+			// macOS uses `base64 -D` (BSD), some environments use `-d` (GNU).
+			writeTTY("base64 -D " + b64Path + " > " + shPath + " 2>/dev/null || base64 -d " + b64Path + " > " + shPath + "\n")
+			writeTTY("/bin/bash " + shPath + "\n")
+			writeTTY("exit\n")
+			_ = in.Close()
+
+			if err2 := session2.Wait(); err2 != nil {
+				out2 := strings.TrimSpace(lb.String())
+				if len(out2) > 16*1024 {
+					out2 = out2[len(out2)-16*1024:]
+				}
+				return fmt.Errorf("compute ssh runner bootstrap failed (shell fallback): %w\n%s", err2, out2)
+			}
+
+			d.log.Info("macos runner bootstrap completed via compute ssh shell", "runner", runnerName, "instance", instanceID)
+			return nil
+		}
+
+		if len(out) > 16*1024 {
+			out = out[len(out)-16*1024:]
+		}
+		return fmt.Errorf("compute ssh runner bootstrap failed: %w\n%s", err, out)
+	}
+
+	d.log.Info("macos runner bootstrap completed via compute ssh", "runner", runnerName, "instance", instanceID)
+	return nil
+}
+
+func (d *Dispatcher) waitForMacOSRunnerStop(ctx context.Context, client computev1betaconnect.ComputeServiceClient, bearer, runnerName, instanceID string, ttl time.Duration) error {
+	if ttl <= 0 {
+		ttl = d.opts.DefaultDuration
+	}
+	deadline := time.Now().Add(ttl)
+	ticker := time.NewTicker(15 * time.Second)
+	defer ticker.Stop()
+
+	for {
+		stopped, err := d.checkComputeInstanceStopped(ctx, client, bearer, instanceID)
+		if err != nil {
+			d.log.Warn("macos runner stop check failed", "runner", runnerName, "instance", instanceID, "err", err)
+		} else if stopped {
+			return nil
+		}
+
+		if time.Now().After(deadline) {
+			return fmt.Errorf("macos runner exceeded ttl (%s) without stopping", ttl)
+		}
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-ticker.C:
+		}
+	}
+}
+
+func (d *Dispatcher) checkComputeInstanceStopped(ctx context.Context, client computev1betaconnect.ComputeServiceClient, bearer, instanceID string) (bool, error) {
+	describeReq := connect.NewRequest(&computev1beta.DescribeInstanceRequest{InstanceId: instanceID})
+	describeReq.Header().Set("Authorization", "Bearer "+bearer)
+	resp, err := client.DescribeInstance(ctx, describeReq)
+	if err != nil {
+		// NotFound means the instance is already gone.
+		if connect.CodeOf(err) == connect.CodeNotFound {
+			return true, nil
+		}
+		return false, err
+	}
+	if resp.Msg == nil || resp.Msg.Metadata == nil {
+		return false, errors.New("describe instance returned no metadata")
+	}
+	switch resp.Msg.Metadata.Status {
+	case computev1beta.InstanceMetadata_DESTROYED:
+		return true, nil
+	case computev1beta.InstanceMetadata_ERROR:
+		// Best-effort include shutdown reasons; do not include unbounded output.
+		var b strings.Builder
+		for _, reason := range resp.Msg.ShutdownReasons {
+			if reason == nil {
+				continue
+			}
+			if b.Len() > 0 {
+				b.WriteString("; ")
+			}
+			b.WriteString(reason.String())
+			if b.Len() > 1024 {
+				break
+			}
+		}
+		msg := strings.TrimSpace(b.String())
+		if msg == "" {
+			msg = "unknown shutdown reason"
+		}
+		return true, fmt.Errorf("instance entered error state: %s", msg)
+	default:
+		if resp.Msg.Metadata.DestroyedAt != nil {
+			return true, nil
+		}
+		return false, nil
+	}
+}
+
+func (d *Dispatcher) destroyComputeInstance(ctx context.Context, client computev1betaconnect.ComputeServiceClient, bearer, runnerName, instanceID string) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
+	destroyReq := connect.NewRequest(&computev1beta.DestroyInstanceRequest{InstanceId: instanceID})
+	destroyReq.Header().Set("Authorization", "Bearer "+bearer)
+	if _, err := client.DestroyInstance(ctx, destroyReq); err != nil {
+		if connect.CodeOf(err) == connect.CodeNotFound {
+			d.log.Info("macos runner destroyed", "runner", runnerName, "instance", instanceID, "status", "not_found")
+			return
+		}
+		d.log.Warn("macos runner destroy failed", "runner", runnerName, "instance", instanceID, "err", err)
+		return
+	}
+	d.log.Info("macos runner destroyed", "runner", runnerName, "instance", instanceID)
+}
+
+func macosBootstrapScript() string {
+	// Keep this script self-contained: it runs on a fresh macOS VM base image.
+	var b strings.Builder
+	b.WriteString(`set -euo pipefail
+
+workdir="${FORGEJO_RUNNER_WORKDIR:-/tmp/forgejo-runner}"
+mkdir -p "${workdir}"
+cd "${workdir}"
+
+export PATH="/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin:/usr/sbin:/sbin:${PATH}"
+
+if ! command -v curl >/dev/null 2>&1; then
+  echo "curl is required" >&2
+  exit 1
+fi
+
+if ! command -v nix >/dev/null 2>&1; then
+  echo "Installing nix (Determinate Systems installer)..."
+  installer="/tmp/nix-installer.$$"
+  curl -fsSL -o "${installer}" https://install.determinate.systems/nix
+  chmod +x "${installer}"
+
+  if command -v sudo >/dev/null 2>&1; then
+    if sudo -n true 2>/dev/null; then
+      sudo -n sh "${installer}" install --no-confirm
+    else
+      sudo sh "${installer}" install --no-confirm
+    fi
+  else
+    sh "${installer}" install --no-confirm
+  fi
+
+  rm -f "${installer}"
+fi
+
+if [[ -f /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh ]]; then
+  # shellcheck disable=SC1091
+  . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+fi
+
+export PATH="/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:${PATH}"
+
+# Flake builds need nix-command + flakes enabled. Workflows may layer additional
+# config, but ensure a sane default exists.
+mkdir -p "${XDG_CONFIG_HOME:-$HOME/.config}/nix"
+cat > "${XDG_CONFIG_HOME:-$HOME/.config}/nix/nix.conf" <<'EOF'
+experimental-features = nix-command flakes
+sandbox = true
+fallback = true
+substituters = https://cache.nixos.org
+trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
+EOF
+
+mkdir -p bin
+export PATH="${PWD}/bin:${PATH}"
+
+runner_version="v12.6.4"
+runner_src_tgz="forgejo-runner-${runner_version}.tar.gz"
+runner_src_url="https://code.forgejo.org/forgejo/runner/archive/${runner_version}.tar.gz"
+runner_src_dir="forgejo-runner-src"
+
+if ! command -v forgejo-runner >/dev/null 2>&1; then
+  rm -rf "${runner_src_dir}"
+  mkdir -p "${runner_src_dir}"
+  curl -fsSL "${runner_src_url}" -o "${runner_src_tgz}"
+  tar -xzf "${runner_src_tgz}" -C "${runner_src_dir}" --strip-components=1
+
+  toolchain="$(grep -E '^toolchain ' "${runner_src_dir}/go.mod" | awk '{print $2}' | head -n 1 || true)"
+  if [ -z "${toolchain}" ]; then
+    toolchain="go1.25.7"
+  fi
+
+  if ! command -v go >/dev/null 2>&1; then
+    go_tgz="${toolchain}.darwin-arm64.tar.gz"
+    go_url="https://go.dev/dl/${go_tgz}"
+    curl -fsSL "${go_url}" -o "${go_tgz}"
+    tar -xzf "${go_tgz}"
+    export GOROOT="${PWD}/go"
+    export PATH="${GOROOT}/bin:${PATH}"
+  fi
+
+  export GOPATH="${PWD}/.gopath"
+  export GOMODCACHE="${PWD}/.gomodcache"
+  export GOCACHE="${PWD}/.gocache"
+  mkdir -p "${GOPATH}" "${GOMODCACHE}" "${GOCACHE}"
+
+  (cd "${runner_src_dir}" && go build -o "${workdir}/bin/forgejo-runner" .)
+  chmod +x "${workdir}/bin/forgejo-runner"
+fi
+
+cat > runner.yaml <<'EOF'
+log:
+  level: info
+runner:
+  file: .runner
+  capacity: 1
+  name: ${FORGEJO_RUNNER_NAME}
+  labels:
+EOF
+
+runner_exec="${FORGEJO_RUNNER_EXEC:-host}"
+if [ "$runner_exec" = "shell" ]; then
+  runner_exec="host"
+fi
+
+resolved_labels=""
+for label in ${FORGEJO_RUNNER_LABELS//,/ } ; do
+  if [ -z "${label}" ]; then
+    continue
+  fi
+  case "${label}" in
+    *:*) resolved="${label}" ;;
+    *)
+      resolved="${label}:host"
+      ;;
+  esac
+  echo "  - ${resolved}" >> runner.yaml
+  if [ -z "${resolved_labels}" ]; then
+    resolved_labels="${resolved}"
+  else
+    resolved_labels="${resolved_labels},${resolved}"
+  fi
+done
+
+cat >> runner.yaml <<'EOF'
+cache:
+  enabled: false
+EOF
+
+forgejo-runner register \
+  --no-interactive \
+  --instance "${FORGEJO_INSTANCE_URL}" \
+  --token "${FORGEJO_RUNNER_TOKEN}" \
+  --name "${FORGEJO_RUNNER_NAME}" \
+  --labels "${resolved_labels}" \
+  --config runner.yaml
+
+forgejo-runner one-job --config runner.yaml
+`)
+	return b.String()
+}
--- a/services/forgejo-nsc/internal/nsc/macos_nsc.go
+++ b/services/forgejo-nsc/internal/nsc/macos_nsc.go
@ -0,0 +1,373 @@
+package nsc
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+func normalizeMacOSNSCMachineType(machineType string) (normalized string, changed bool, err error) {
+	vcpu, memoryMB, err := parseMachineTypeCPUxMemGB(machineType)
+	if err != nil {
+		return "", false, err
+	}
+	memGB := memoryMB / 1024
+	if memGB <= 0 || vcpu <= 0 {
+		return "", false, fmt.Errorf("invalid machine_type %q after parse: vcpu=%d memGB=%d", machineType, vcpu, memGB)
+	}
+
+	// NSC CLI (and the underlying InstanceService) enforce discrete cpu/mem sets
+	// for macOS. Normalize requested values by rounding up to the closest allowed
+	// values to keep provisioning stable even when configs drift.
+	//
+	// Observed allowed sets from Namespace API error output for macos/arm64:
+	// cpu: [4 6 8 12]
+	// mem: [7 14 28 56] (GB)
+	allowedCPU := []int32{4, 6, 8, 12}
+	allowedMemGB := []int32{7, 14, 28, 56}
+
+	roundUp := func(v int32, allowed []int32) (int32, bool) {
+		for _, a := range allowed {
+			if v <= a {
+				return a, a != v
+			}
+		}
+		// Clamp to max if above all allowed values.
+		return allowed[len(allowed)-1], true
+	}
+
+	newCPU, cpuChanged := roundUp(vcpu, allowedCPU)
+	newMemGB, memChanged := roundUp(memGB, allowedMemGB)
+
+	normalized = fmt.Sprintf("%dx%d", newCPU, newMemGB)
+	changed = cpuChanged || memChanged
+	return normalized, changed, nil
+}
+
+func (d *Dispatcher) launchMacOSRunnerViaNSC(ctx context.Context, runnerName string, req LaunchRequest, ttl time.Duration, machineType string) error {
+	if machineType == "" {
+		return errors.New("machine_type is required for macos runners")
+	}
+	if strings.TrimSpace(os.Getenv("NSC_TOKEN_FILE")) == "" {
+		// The Burrow forge host feeds NSC_TOKEN_FILE from the intake-backed runtime token.
+		return errors.New("NSC_TOKEN_FILE is required for macos runners")
+	}
+
+	selectors := macosSelectorsArg(d.opts.MacosBaseImageID)
+	if selectors == "" {
+		return errors.New("macos selectors resolved empty")
+	}
+
+	normalizedMachineType := machineType
+	if n, changed, err := normalizeMacOSNSCMachineType(machineType); err != nil {
+		return err
+	} else if changed {
+		normalizedMachineType = n
+	}
+
+	// If capacity is constrained for the requested (large) shape, try a small
+	// set of progressively smaller shapes before failing the dispatch request.
+	// This keeps macOS builds flowing even when large runners are scarce.
+	candidates := []string{normalizedMachineType, "8x28", "6x14", "4x7"}
+	seen := map[string]struct{}{}
+	var uniq []string
+	for _, c := range candidates {
+		c = strings.TrimSpace(c)
+		if c == "" {
+			continue
+		}
+		if _, ok := seen[c]; ok {
+			continue
+		}
+		seen[c] = struct{}{}
+		uniq = append(uniq, c)
+	}
+	candidates = uniq
+
+	type attemptCfg struct {
+		waitTimeout   time.Duration
+		createTimeout time.Duration
+	}
+	attempts := []attemptCfg{
+		{waitTimeout: 6 * time.Minute, createTimeout: 8 * time.Minute},
+		{waitTimeout: 4 * time.Minute, createTimeout: 6 * time.Minute},
+		{waitTimeout: 3 * time.Minute, createTimeout: 5 * time.Minute},
+	}
+
+	createInstance := func(mt string, a attemptCfg) (instanceID string, out string, err error) {
+		tmpDir, err := os.MkdirTemp("", "forgejo-nsc-macos-*")
+		if err != nil {
+			return "", "", fmt.Errorf("mktemp: %w", err)
+		}
+		defer os.RemoveAll(tmpDir)
+
+		metaPath := filepath.Join(tmpDir, "create.json")
+		cidPath := filepath.Join(tmpDir, "create.cid")
+
+		arch := strings.TrimSpace(d.opts.MacosMachineArch)
+		if arch == "" {
+			arch = "arm64"
+		}
+		// Namespace CLI requires the "os/arch:" prefix to create a macOS instance.
+		// Without it, `nsc create` defaults to Linux even if selectors include macos.*.
+		machineType := fmt.Sprintf("macos/%s:%s", arch, mt)
+
+		args := []string{
+			"create",
+			"--duration", ttl.String(),
+			"--machine_type", machineType,
+			"--selectors", selectors,
+			"--bare",
+			"--cidfile", cidPath,
+			"--log_actions",
+			"--purpose", fmt.Sprintf("burrow forgejo runner %s", runnerName),
+			// Prefer plain output for debuggability (progress, capacity errors, etc).
+			"--output", "plain",
+			"--output_json_to", metaPath,
+			// macOS instances can take a while to become ready.
+			"--wait_timeout", a.waitTimeout.String(),
+		}
+		args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
+
+		createCtx, cancel := context.WithTimeout(ctx, a.createTimeout)
+		defer cancel()
+
+		cmd := exec.CommandContext(createCtx, d.opts.BinaryPath, args...)
+		var buf bytes.Buffer
+		cmd.Stdout = &buf
+		cmd.Stderr = &buf
+
+		if err := cmd.Run(); err != nil {
+			// Best-effort cleanup: if the instance ID was written before the command failed
+			// (or before we timed it out), attempt to destroy it to avoid idling machines.
+			if instanceID := strings.TrimSpace(mustReadFile(cidPath)); instanceID != "" {
+				d.destroyNSCInstance(context.Background(), runnerName, instanceID)
+			}
+			if errors.Is(createCtx.Err(), context.DeadlineExceeded) {
+				return "", buf.String(), fmt.Errorf("nsc create timed out after %s", a.createTimeout)
+			}
+			return "", buf.String(), fmt.Errorf("nsc create failed: %w", err)
+		}
+
+		instanceID, err = readNSCCreateInstanceID(metaPath)
+		if err != nil {
+			return "", buf.String(), fmt.Errorf("nsc create output parse failed: %w", err)
+		}
+		if instanceID == "" {
+			return "", buf.String(), fmt.Errorf("nsc create returned empty instance id")
+		}
+		return instanceID, buf.String(), nil
+	}
+
+	var (
+		instanceID string
+		lastOut    string
+		lastErr    error
+	)
+	for i, mt := range candidates {
+		a := attempts[i]
+		if i >= len(attempts) {
+			a = attempts[len(attempts)-1]
+		}
+
+		d.log.Info("launching Namespace macos runner via nsc",
+			"runner", runnerName,
+			"attempt", i+1,
+			"machine_type", mt,
+			"requested_machine_type", machineType,
+			"selectors", selectors,
+		)
+
+		id, out, err := createInstance(mt, a)
+		lastOut = out
+		lastErr = err
+		if err != nil {
+			// Timeouts are treated as retryable (capacity constrained).
+			if strings.Contains(err.Error(), "timed out") || strings.Contains(strings.ToLower(out), "capacity") {
+				continue
+			}
+			return fmt.Errorf("%w\n%s", err, out)
+		}
+		instanceID = id
+		break
+	}
+	if instanceID == "" {
+		if lastErr != nil {
+			return fmt.Errorf("%w\n%s", lastErr, lastOut)
+		}
+		return fmt.Errorf("nsc create failed without producing an instance id\n%s", lastOut)
+	}
+
+	// Always attempt cleanup even if the runner fails.
+	defer d.destroyNSCInstance(context.Background(), runnerName, instanceID)
+
+	script := macosBootstrapWrapperScript(runnerName, req, d.opts.Executor, d.opts.WorkDir)
+	// Use the Compute SSH config endpoint (direct TCP) instead of `nsc ssh`, which
+	// relies on a websocket-based SSH proxy that is not supported by the
+	// revokable tenant token we run the dispatcher with.
+	if err := d.runMacOSComputeSSHScript(ctx, runnerName, instanceID, script); err != nil {
+		return err
+	}
+	return nil
+}
+
+func mustReadFile(path string) string {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return ""
+	}
+	return string(raw)
+}
+
+func macosSelectorsArg(baseImageID string) string {
+	id := strings.TrimSpace(baseImageID)
+	if id == "" {
+		id = "tahoe"
+	}
+	// Allow passing selectors directly via config, e.g. "macos.version=26.x,image.with=xcode-26".
+	if strings.Contains(id, "=") {
+		return id
+	}
+	switch strings.ToLower(id) {
+	case "sonoma", "macos-14", "macos14", "14":
+		return "macos.version=14.x"
+	case "sequoia", "macos-15", "macos15", "15":
+		return "macos.version=15.x"
+	case "tahoe", "macos-26", "macos26", "26":
+		return "macos.version=26.x,image.with=xcode-26"
+	default:
+		return "macos.version=26.x"
+	}
+}
+
+type nscCreateMetadata struct {
+	InstanceID string `json:"instance_id"`
+	ClusterID  string `json:"cluster_id"`
+	ID         string `json:"id"`
+}
+
+func readNSCCreateInstanceID(path string) (string, error) {
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		return "", fmt.Errorf("read %s: %w", path, err)
+	}
+	var meta nscCreateMetadata
+	if err := json.Unmarshal(raw, &meta); err != nil {
+		return "", err
+	}
+	if meta.InstanceID != "" {
+		return meta.InstanceID, nil
+	}
+	if meta.ClusterID != "" {
+		return meta.ClusterID, nil
+	}
+	if meta.ID != "" {
+		return meta.ID, nil
+	}
+	return "", nil
+}
+
+func (d *Dispatcher) destroyNSCInstance(ctx context.Context, runnerName, instanceID string) {
+	if ctx == nil {
+		ctx = context.Background()
+	}
+	ctx, cancel := context.WithTimeout(ctx, 2*time.Minute)
+	defer cancel()
+
+	args := []string{"destroy", "--force", instanceID}
+	args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
+	cmd := exec.CommandContext(ctx, d.opts.BinaryPath, args...)
+	var buf bytes.Buffer
+	cmd.Stdout = &buf
+	cmd.Stderr = &buf
+	if err := cmd.Run(); err != nil {
+		d.log.Warn("nsc destroy failed", "runner", runnerName, "instance", instanceID, "err", err, "output", strings.TrimSpace(buf.String()))
+		return
+	}
+	d.log.Info("nsc instance destroyed", "runner", runnerName, "instance", instanceID)
+}
+
+func macosBootstrapWrapperScript(runnerName string, req LaunchRequest, executor, workdir string) string {
+	if strings.TrimSpace(workdir) == "" {
+		workdir = "/tmp/forgejo-runner"
+	}
+
+	// Pass all values via stdin script so secrets do not appear in the nsc ssh argv.
+	env := map[string]string{
+		"FORGEJO_INSTANCE_URL":   req.InstanceURL,
+		"FORGEJO_RUNNER_TOKEN":   req.Token,
+		"FORGEJO_RUNNER_NAME":    runnerName,
+		"FORGEJO_RUNNER_LABELS":  strings.Join(req.Labels, ","),
+		"FORGEJO_RUNNER_EXEC":    executor,
+		"FORGEJO_RUNNER_WORKDIR": workdir,
+	}
+	for k, v := range req.ExtraEnv {
+		env[k] = v
+	}
+
+	var b strings.Builder
+	b.WriteString("set -euo pipefail\n")
+	for k, v := range env {
+		if strings.TrimSpace(k) == "" {
+			continue
+		}
+		// Single-quote shell escaping: safe for arbitrary tokens.
+		b.WriteString("export ")
+		b.WriteString(k)
+		b.WriteString("=")
+		b.WriteString(shellSingleQuote(v))
+		b.WriteString("\n")
+	}
+	b.WriteString("\n")
+	b.WriteString(macosBootstrapScript())
+	return b.String()
+}
+
+func shellSingleQuote(value string) string {
+	// 'foo' -> '\'' within single quotes: '"'"'
+	return "'" + strings.ReplaceAll(value, "'", `'\"'\"'`) + "'"
+}
+
+func prependNSCRegionArgs(args []string, computeBaseURL string) []string {
+	region := strings.TrimSpace(os.Getenv("NSC_REGION"))
+	if region == "" {
+		region = regionFromComputeBaseURL(computeBaseURL)
+	}
+	if region == "" {
+		// Default to the burrow region used for other Namespace integrations.
+		region = "ord4"
+	}
+	return append([]string{"--region", region}, args...)
+}
+
+func regionFromComputeBaseURL(raw string) string {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return ""
+	}
+	u, err := url.Parse(raw)
+	if err != nil {
+		return ""
+	}
+	host := u.Hostname()
+	if host == "" {
+		return ""
+	}
+	parts := strings.Split(host, ".")
+	if len(parts) == 0 {
+		return ""
+	}
+	// ord4.compute.namespaceapis.com -> ord4
+	if strings.HasSuffix(host, ".compute.namespaceapis.com") || strings.Contains(host, ".compute.") {
+		return parts[0]
+	}
+	return ""
+}
--- a/services/forgejo-nsc/internal/nsc/windows.go
+++ b/services/forgejo-nsc/internal/nsc/windows.go
@ -0,0 +1,59 @@
+package nsc
+
+import (
+	"regexp"
+	"strings"
+)
+
+const windowsDefaultMachineType = "windows/amd64:8x16"
+
+var cpuMemShapePattern = regexp.MustCompile(`^\d+x\d+$`)
+
+func hasWindowsLabel(labels []string) bool {
+	for _, label := range labels {
+		l := strings.TrimSpace(label)
+		if l == "" {
+			continue
+		}
+		base := l
+		if before, _, ok := strings.Cut(l, ":"); ok {
+			base = before
+		}
+		if strings.HasPrefix(base, "namespace-profile-windows-") {
+			return true
+		}
+	}
+	return false
+}
+
+func normalizeWindowsMachineType(machineType string, labels []string) string {
+	mt := strings.TrimSpace(machineType)
+	if strings.HasPrefix(mt, "windows/") {
+		return mt
+	}
+	if cpuMemShapePattern.MatchString(mt) {
+		return "windows/amd64:" + mt
+	}
+
+	// Label-derived defaults: keep a simple shape ladder for explicit profile sizes.
+	for _, label := range labels {
+		base := strings.TrimSpace(label)
+		if before, _, ok := strings.Cut(base, ":"); ok {
+			base = before
+		}
+		switch {
+		case strings.HasPrefix(base, "namespace-profile-windows-small"):
+			return "windows/amd64:2x4"
+		case strings.HasPrefix(base, "namespace-profile-windows-medium"):
+			return "windows/amd64:4x8"
+		case strings.HasPrefix(base, "namespace-profile-windows-large"):
+			return windowsDefaultMachineType
+		}
+	}
+	return windowsDefaultMachineType
+}
+
+func powershellSingleQuote(value string) string {
+	// PowerShell single-quoted string escaping: ' -> ''
+	return "'" + strings.ReplaceAll(value, "'", "''") + "'"
+}
--- a/services/forgejo-nsc/internal/nsc/windows_test.go
+++ b/services/forgejo-nsc/internal/nsc/windows_test.go
@ -0,0 +1,98 @@
+package nsc
+
+import "testing"
+
+func TestHasWindowsLabel(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name   string
+		labels []string
+		want   bool
+	}{
+		{
+			name:   "namespace windows label",
+			labels: []string{"namespace-profile-windows-large"},
+			want:   true,
+		},
+		{
+			name:   "namespace windows label with host suffix",
+			labels: []string{"namespace-profile-windows-large:host"},
+			want:   true,
+		},
+		{
+			name:   "non namespace windows-like label",
+			labels: []string{"burrow-winrunner:host"},
+			want:   false,
+		},
+		{
+			name:   "macos label",
+			labels: []string{"namespace-profile-macos-large"},
+			want:   false,
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got := hasWindowsLabel(tc.labels)
+			if got != tc.want {
+				t.Fatalf("hasWindowsLabel(%v) = %v, want %v", tc.labels, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestNormalizeWindowsMachineType(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name       string
+		machine    string
+		labels     []string
+		wantPrefix string
+	}{
+		{
+			name:       "explicit windows machine type keeps value",
+			machine:    "windows/amd64:8x16",
+			labels:     []string{"namespace-profile-windows-large"},
+			wantPrefix: "windows/amd64:8x16",
+		},
+		{
+			name:       "shape only is normalized",
+			machine:    "4x8",
+			labels:     []string{"namespace-profile-windows-large"},
+			wantPrefix: "windows/amd64:4x8",
+		},
+		{
+			name:       "large label default",
+			machine:    "",
+			labels:     []string{"namespace-profile-windows-large"},
+			wantPrefix: "windows/amd64:8x16",
+		},
+		{
+			name:       "medium label default",
+			machine:    "",
+			labels:     []string{"namespace-profile-windows-medium"},
+			wantPrefix: "windows/amd64:4x8",
+		},
+		{
+			name:       "fallback default",
+			machine:    "",
+			labels:     []string{"namespace-profile-windows-custom"},
+			wantPrefix: "windows/amd64:8x16",
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got := normalizeWindowsMachineType(tc.machine, tc.labels)
+			if got != tc.wantPrefix {
+				t.Fatalf("normalizeWindowsMachineType(%q, %v) = %q, want %q", tc.machine, tc.labels, got, tc.wantPrefix)
+			}
+		})
+	}
+}
--- a/services/forgejo-nsc/internal/nsc/windows_winrm.go
+++ b/services/forgejo-nsc/internal/nsc/windows_winrm.go
@ -0,0 +1,499 @@
+package nsc
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+type windowsProxyOutput struct {
+	Endpoint string `json:"endpoint"`
+	RDP      struct {
+		Credentials struct {
+			Username string `json:"username"`
+			Password string `json:"password"`
+		} `json:"credentials"`
+	} `json:"rdp"`
+}
+
+func (d *Dispatcher) launchWindowsRunnerViaWinRM(ctx context.Context, runnerName string, req LaunchRequest, ttl time.Duration, machineType string) error {
+	script := windowsBootstrapScript(runnerName, req, d.opts.Executor, d.opts.WorkDir)
+	return d.launchWindowsScriptViaWinRM(ctx, runnerName, ttl, machineType, req.Labels, script)
+}
+
+func (d *Dispatcher) launchWindowsScriptViaWinRM(ctx context.Context, runnerName string, ttl time.Duration, machineType string, labels []string, script string) error {
+	if ttl <= 0 {
+		ttl = d.opts.DefaultDuration
+	}
+
+	mt := normalizeWindowsMachineType(machineType, labels)
+	instanceID, createOutput, err := d.createWindowsInstance(ctx, runnerName, ttl, mt)
+	if err != nil {
+		return fmt.Errorf("windows create failed: %w\n%s", err, createOutput)
+	}
+	defer d.destroyNSCInstance(context.Background(), runnerName, instanceID)
+
+	username, password, err := d.resolveWindowsCredentials(ctx, instanceID)
+	if err != nil {
+		return err
+	}
+
+	if err := d.probeWindowsWinRMService(ctx, instanceID); err != nil {
+		return err
+	}
+
+	endpoint, stopForward, err := d.startWindowsWinRMPortForward(ctx, instanceID)
+	if err != nil {
+		return err
+	}
+	defer stopForward()
+
+	if err := d.runWindowsWinRMPowerShell(ctx, endpoint, username, password, script); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (d *Dispatcher) createWindowsInstance(ctx context.Context, runnerName string, ttl time.Duration, machineType string) (instanceID string, output string, err error) {
+	tmpDir, err := os.MkdirTemp("", "forgejo-nsc-windows-*")
+	if err != nil {
+		return "", "", fmt.Errorf("mktemp: %w", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	metaPath := filepath.Join(tmpDir, "create.json")
+	cidPath := filepath.Join(tmpDir, "create.cid")
+
+	args := []string{
+		"create",
+		"--duration", ttl.String(),
+		"--machine_type", machineType,
+		"--cidfile", cidPath,
+		"--purpose", fmt.Sprintf("burrow forgejo runner %s", runnerName),
+		"--output", "plain",
+		"--output_json_to", metaPath,
+		"--wait_timeout", "6m",
+	}
+	args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
+
+	createCtx, cancel := context.WithTimeout(ctx, 8*time.Minute)
+	defer cancel()
+
+	cmd := exec.CommandContext(createCtx, d.opts.BinaryPath, args...)
+	var buf bytes.Buffer
+	cmd.Stdout = &buf
+	cmd.Stderr = &buf
+
+	if err := cmd.Run(); err != nil {
+		if created := strings.TrimSpace(mustReadFile(cidPath)); created != "" {
+			d.destroyNSCInstance(context.Background(), runnerName, created)
+		}
+		if errors.Is(createCtx.Err(), context.DeadlineExceeded) {
+			return "", buf.String(), fmt.Errorf("nsc create timed out after %s", 8*time.Minute)
+		}
+		return "", buf.String(), fmt.Errorf("nsc create failed: %w", err)
+	}
+
+	instanceID, err = readNSCCreateInstanceID(metaPath)
+	if err != nil {
+		return "", buf.String(), fmt.Errorf("nsc create output parse failed: %w", err)
+	}
+	if instanceID == "" {
+		return "", buf.String(), errors.New("nsc create returned empty instance id")
+	}
+	return instanceID, buf.String(), nil
+}
+
+func (d *Dispatcher) resolveWindowsCredentials(ctx context.Context, instanceID string) (username string, password string, err error) {
+	tmpDir, err := os.MkdirTemp("", "forgejo-nsc-winproxy-*")
+	if err != nil {
+		return "", "", fmt.Errorf("mktemp: %w", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	outPath := filepath.Join(tmpDir, "proxy.json")
+	outFile, err := os.Create(outPath)
+	if err != nil {
+		return "", "", fmt.Errorf("create proxy output file: %w", err)
+	}
+	defer outFile.Close()
+
+	var stderr bytes.Buffer
+	args := []string{"instance", "proxy", instanceID, "-s", "rdp", "-o", "json"}
+	args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
+
+	proxyCtx, cancel := context.WithTimeout(ctx, 90*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(proxyCtx, d.opts.BinaryPath, args...)
+	cmd.Stdout = outFile
+	cmd.Stderr = &stderr
+
+	if err := cmd.Start(); err != nil {
+		return "", "", fmt.Errorf("start nsc instance proxy: %w", err)
+	}
+
+	waitDone := make(chan struct{})
+	var waitErr error
+	go func() {
+		waitErr = cmd.Wait()
+		close(waitDone)
+	}()
+
+	var payload windowsProxyOutput
+	deadline := time.Now().Add(45 * time.Second)
+	for time.Now().Before(deadline) {
+		raw, _ := os.ReadFile(outPath)
+		jsonBlob := extractJSON(string(raw))
+		if jsonBlob != "" {
+			if err := json.Unmarshal([]byte(jsonBlob), &payload); err == nil {
+				username = strings.TrimSpace(payload.RDP.Credentials.Username)
+				password = strings.TrimSpace(payload.RDP.Credentials.Password)
+				if username != "" && password != "" {
+					break
+				}
+			}
+		}
+		select {
+		case <-waitDone:
+			if waitErr != nil {
+				return "", "", fmt.Errorf("nsc instance proxy exited before credentials were available: %w\n%s", waitErr, stderr.String())
+			}
+		default:
+		}
+		time.Sleep(1 * time.Second)
+	}
+
+	if cmd.Process != nil {
+		_ = cmd.Process.Kill()
+	}
+	<-waitDone
+
+	if username == "" || password == "" {
+		raw, _ := os.ReadFile(outPath)
+		return "", "", fmt.Errorf("failed to resolve windows credentials from nsc instance proxy output\nstdout=%s\nstderr=%s", strings.TrimSpace(string(raw)), strings.TrimSpace(stderr.String()))
+	}
+	return username, password, nil
+}
+
+func (d *Dispatcher) probeWindowsWinRMService(ctx context.Context, instanceID string) error {
+	args := []string{"instance", "proxy", instanceID, "-s", "winrm", "-o", "json", "--once"}
+	args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
+
+	probeCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
+	defer cancel()
+
+	cmd := exec.CommandContext(probeCtx, d.opts.BinaryPath, args...)
+	var out bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &out
+
+	err := cmd.Run()
+	raw := strings.TrimSpace(out.String())
+	if endpoint, ok := parseProxyEndpoint(raw); ok && endpoint != "" {
+		return nil
+	}
+
+	if indicatesMissingProxyService(raw, "winrm") {
+		return fmt.Errorf("namespace windows non-interactive channel unavailable: instance does not expose winrm service (rdp-only)\n%s", raw)
+	}
+
+	if errors.Is(probeCtx.Err(), context.DeadlineExceeded) {
+		return fmt.Errorf("timed out probing Namespace winrm service before bootstrap\n%s", raw)
+	}
+
+	if err != nil {
+		return fmt.Errorf("nsc winrm service probe failed: %w\n%s", err, raw)
+	}
+	return fmt.Errorf("nsc winrm service probe did not yield endpoint output\n%s", raw)
+}
+
+func parseProxyEndpoint(raw string) (string, bool) {
+	jsonBlob := extractJSON(raw)
+	if jsonBlob == "" {
+		return "", false
+	}
+	var payload struct {
+		Endpoint string `json:"endpoint"`
+	}
+	if err := json.Unmarshal([]byte(jsonBlob), &payload); err != nil {
+		return "", false
+	}
+	endpoint := strings.TrimSpace(payload.Endpoint)
+	if endpoint == "" {
+		return "", false
+	}
+	return endpoint, true
+}
+
+func indicatesMissingProxyService(raw string, service string) bool {
+	service = strings.TrimSpace(service)
+	if service == "" {
+		return false
+	}
+	token := fmt.Sprintf("does not have service %q", service)
+	return strings.Contains(raw, token)
+}
+
+func (d *Dispatcher) startWindowsWinRMPortForward(ctx context.Context, instanceID string) (endpoint string, stop func(), err error) {
+	args := []string{"instance", "port-forward", instanceID, "--target_port", "5985"}
+	args = prependNSCRegionArgs(args, d.opts.ComputeBaseURL)
+
+	forwardCtx, cancel := context.WithCancel(ctx)
+	cmd := exec.CommandContext(forwardCtx, d.opts.BinaryPath, args...)
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		cancel()
+		return "", nil, fmt.Errorf("port-forward stdout pipe: %w", err)
+	}
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+
+	if err := cmd.Start(); err != nil {
+		cancel()
+		return "", nil, fmt.Errorf("start nsc port-forward: %w", err)
+	}
+
+	waitDone := make(chan struct{})
+	var waitErr error
+	go func() {
+		waitErr = cmd.Wait()
+		close(waitDone)
+	}()
+
+	endpointCh := make(chan string, 1)
+	scanErrCh := make(chan error, 1)
+	go func() {
+		scanner := bufio.NewScanner(stdout)
+		for scanner.Scan() {
+			line := strings.TrimSpace(scanner.Text())
+			if strings.HasPrefix(line, "Listening on ") {
+				endpointCh <- strings.TrimSpace(strings.TrimPrefix(line, "Listening on "))
+				return
+			}
+		}
+		if err := scanner.Err(); err != nil {
+			scanErrCh <- err
+		}
+	}()
+
+	select {
+	case endpoint = <-endpointCh:
+		stop = func() {
+			cancel()
+			if cmd.Process != nil {
+				_ = cmd.Process.Kill()
+			}
+			<-waitDone
+		}
+		return endpoint, stop, nil
+	case err := <-scanErrCh:
+		cancel()
+		if cmd.Process != nil {
+			_ = cmd.Process.Kill()
+		}
+		<-waitDone
+		return "", nil, fmt.Errorf("failed reading port-forward output: %w", err)
+	case <-waitDone:
+		cancel()
+		if waitErr != nil {
+			return "", nil, fmt.Errorf("nsc port-forward exited early: %w\n%s", waitErr, stderr.String())
+		}
+		return "", nil, fmt.Errorf("nsc port-forward exited without endpoint\n%s", stderr.String())
+	case <-time.After(45 * time.Second):
+		cancel()
+		if cmd.Process != nil {
+			_ = cmd.Process.Kill()
+		}
+		<-waitDone
+		return "", nil, fmt.Errorf("timed out waiting for WinRM port-forward endpoint\n%s", stderr.String())
+	case <-ctx.Done():
+		cancel()
+		if cmd.Process != nil {
+			_ = cmd.Process.Kill()
+		}
+		<-waitDone
+		return "", nil, ctx.Err()
+	}
+}
+
+func (d *Dispatcher) runWindowsWinRMPowerShell(ctx context.Context, endpoint, username, password, script string) error {
+	pythonPath, err := exec.LookPath("python3")
+	if err != nil {
+		return fmt.Errorf("python3 is required for windows WinRM bootstrap: %w", err)
+	}
+
+	workdir := strings.TrimSpace(d.opts.WorkDir)
+	if workdir == "" {
+		workdir = "/tmp/forgejo-runner"
+	}
+	if err := os.MkdirAll(workdir, 0o755); err != nil {
+		return fmt.Errorf("create workdir %s: %w", workdir, err)
+	}
+
+	venvPath := filepath.Join(workdir, ".winrm-venv")
+	venvPython := filepath.Join(venvPath, "bin", "python")
+	if _, err := os.Stat(venvPython); err != nil {
+		cmd := exec.CommandContext(ctx, pythonPath, "-m", "venv", venvPath)
+		var out bytes.Buffer
+		cmd.Stdout = &out
+		cmd.Stderr = &out
+		if err := cmd.Run(); err != nil {
+			return fmt.Errorf("create python venv for winrm failed: %w\n%s", err, out.String())
+		}
+	}
+
+	ensurePyWinRM := `
+import importlib.util, subprocess, sys
+if importlib.util.find_spec("winrm") is None:
+    subprocess.check_call([sys.executable, "-m", "pip", "install", "--quiet", "pywinrm"])
+`
+	ensureCmd := exec.CommandContext(ctx, venvPython, "-c", ensurePyWinRM)
+	var ensureOut bytes.Buffer
+	ensureCmd.Stdout = &ensureOut
+	ensureCmd.Stderr = &ensureOut
+	if err := ensureCmd.Run(); err != nil {
+		return fmt.Errorf("install pywinrm failed: %w\n%s", err, ensureOut.String())
+	}
+
+	runScript := `
+import base64, os, sys, time, traceback, winrm
+
+endpoint = os.environ["WINRM_ENDPOINT"]
+user = os.environ["WINRM_USER"]
+password = os.environ["WINRM_PASS"]
+script = base64.b64decode(os.environ["WINRM_SCRIPT_B64"]).decode("utf-8")
+
+deadline = time.time() + 300.0
+last_err = None
+
+while time.time() < deadline:
+    try:
+        session = winrm.Session(f"http://{endpoint}/wsman", auth=(user, password), transport="ntlm")
+        result = session.run_ps(script)
+        sys.stdout.write(result.std_out.decode("utf-8", errors="replace"))
+        sys.stderr.write(result.std_err.decode("utf-8", errors="replace"))
+        print(f"winrm_exit={result.status_code}")
+        sys.exit(result.status_code)
+    except Exception as err:
+        last_err = err
+        time.sleep(5.0)
+
+sys.stderr.write("timed out waiting for WinRM connectivity after 300s\\n")
+if last_err is not None:
+    traceback.print_exception(last_err, file=sys.stderr)
+sys.exit(111)
+`
+	runCmd := exec.CommandContext(ctx, venvPython, "-c", runScript)
+	runCmd.Env = append(os.Environ(),
+		"WINRM_ENDPOINT="+endpoint,
+		"WINRM_USER="+username,
+		"WINRM_PASS="+password,
+		"WINRM_SCRIPT_B64="+base64.StdEncoding.EncodeToString([]byte(script)),
+	)
+	var runOut bytes.Buffer
+	runCmd.Stdout = &runOut
+	runCmd.Stderr = &runOut
+	if err := runCmd.Run(); err != nil {
+		return fmt.Errorf("windows winrm bootstrap command failed: %w\n%s", err, runOut.String())
+	}
+	return nil
+}
+
+func windowsBootstrapScript(runnerName string, req LaunchRequest, executor, workdir string) string {
+	if strings.TrimSpace(workdir) == "" {
+		workdir = `C:\burrow\forgejo-runner`
+	}
+
+	runnerExec := strings.TrimSpace(executor)
+	if runnerExec == "" || runnerExec == "shell" {
+		runnerExec = "host"
+	}
+
+	safeName := strings.NewReplacer(`\`, "-", ":", "-", "/", "-", " ", "-").Replace(runnerName)
+	workRoot := strings.TrimRight(workdir, `\`) + `\` + safeName
+
+	var b strings.Builder
+	b.WriteString("$ErrorActionPreference = 'Stop'\n")
+	b.WriteString("$ProgressPreference = 'SilentlyContinue'\n")
+	b.WriteString("[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\n")
+	b.WriteString("$runnerName = " + powershellSingleQuote(runnerName) + "\n")
+	b.WriteString("$runnerToken = " + powershellSingleQuote(req.Token) + "\n")
+	b.WriteString("$instanceURL = " + powershellSingleQuote(req.InstanceURL) + "\n")
+	b.WriteString("$labelsCsv = " + powershellSingleQuote(strings.Join(req.Labels, ",")) + "\n")
+	b.WriteString("$runnerExec = " + powershellSingleQuote(runnerExec) + "\n")
+	b.WriteString("$workRoot = " + powershellSingleQuote(workRoot) + "\n")
+	b.WriteString(`
+New-Item -Path $workRoot -ItemType Directory -Force | Out-Null
+Set-Location $workRoot
+
+$runnerVersion = "12.6.4"
+$zipUrl = "https://code.forgejo.org/forgejo/runner/releases/download/v${runnerVersion}/forgejo-runner-${runnerVersion}-windows-amd64.zip"
+$zipPath = Join-Path $workRoot "forgejo-runner.zip"
+$extractDir = Join-Path $workRoot "forgejo-runner"
+
+if (Test-Path $extractDir) {
+  Remove-Item -Path $extractDir -Recurse -Force
+}
+
+Invoke-WebRequest -Uri $zipUrl -OutFile $zipPath
+Expand-Archive -Path $zipPath -DestinationPath $extractDir -Force
+
+$runnerExe = Join-Path $extractDir "forgejo-runner.exe"
+if (-not (Test-Path $runnerExe)) {
+  throw "Missing forgejo-runner.exe after extract: $runnerExe"
+}
+
+$labels = @()
+foreach ($label in ($labelsCsv -split ",")) {
+  $trimmed = $label.Trim()
+  if ([string]::IsNullOrWhiteSpace($trimmed)) { continue }
+  if ($trimmed.Contains(":")) {
+    $labels += $trimmed
+  } else {
+    $labels += ("{0}:{1}" -f $trimmed, $runnerExec)
+  }
+}
+if ($labels.Count -eq 0) {
+  throw "No runner labels resolved for windows bootstrap"
+}
+
+$labelLines = ($labels | ForEach-Object { "  - $_" }) -join [Environment]::NewLine
+$configPath = Join-Path $workRoot "runner.yaml"
+$runnerYaml = @"
+log:
+  level: info
+runner:
+  file: .runner
+  capacity: 1
+  name: $runnerName
+  labels:
+$labelLines
+cache:
+  enabled: false
+"@
+Set-Content -Path $configPath -Value $runnerYaml -Encoding UTF8
+
+$labelsArg = ($labels -join ",")
+& $runnerExe register --no-interactive --instance $instanceURL --token $runnerToken --name $runnerName --labels $labelsArg --config $configPath
+if ($LASTEXITCODE -ne 0) {
+  throw ("forgejo-runner register failed: {0}" -f $LASTEXITCODE)
+}
+
+& $runnerExe one-job --config $configPath
+if ($LASTEXITCODE -ne 0) {
+  throw ("forgejo-runner one-job failed: {0}" -f $LASTEXITCODE)
+}
+`)
+	return b.String()
+}
--- a/services/forgejo-nsc/internal/nsc/windows_winrm_integration_test.go
+++ b/services/forgejo-nsc/internal/nsc/windows_winrm_integration_test.go
@ -0,0 +1,59 @@
+package nsc
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestWindowsWinRMScriptRoundTrip(t *testing.T) {
+	if os.Getenv("NSC_WINDOWS_E2E") != "1" {
+		t.Skip("set NSC_WINDOWS_E2E=1 to run Namespace Windows integration test")
+	}
+
+	nscBinary, err := exec.LookPath("nsc")
+	if err != nil {
+		t.Skipf("nsc not found in PATH: %v", err)
+	}
+
+	authCheck := exec.Command(nscBinary, "auth", "check-login")
+	if out, err := authCheck.CombinedOutput(); err != nil {
+		t.Skipf("nsc auth check-login failed: %v (%s)", err, strings.TrimSpace(string(out)))
+	}
+
+	machineType := strings.TrimSpace(os.Getenv("NSC_WINDOWS_E2E_MACHINE_TYPE"))
+	if machineType == "" {
+		machineType = "windows/amd64:4x8"
+	}
+
+	dispatcher, err := NewDispatcher(Options{
+		BinaryPath:      nscBinary,
+		DefaultImage:    "code.forgejo.org/forgejo/runner:11",
+		DefaultMachine:  machineType,
+		DefaultDuration: 20 * time.Minute,
+		MaxParallel:     1,
+		WorkDir:         t.TempDir(),
+		ComputeBaseURL:  strings.TrimSpace(os.Getenv("NSC_COMPUTE_BASE_URL")),
+		Logger:          slog.New(slog.NewTextHandler(io.Discard, nil)),
+	})
+	if err != nil {
+		t.Fatalf("NewDispatcher() error: %v", err)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
+	defer cancel()
+
+	script := "Write-Output ('winrm-ok:' + $env:COMPUTERNAME)"
+	labels := []string{"namespace-profile-windows-medium"}
+	if err := dispatcher.launchWindowsScriptViaWinRM(ctx, "nsc-winrm-itest", 20*time.Minute, machineType, labels, script); err != nil {
+		if strings.Contains(err.Error(), "does not expose winrm service (rdp-only)") {
+			t.Skipf("namespace windows control channel is rdp-only: %v", err)
+		}
+		t.Fatalf("launchWindowsScriptViaWinRM() error: %v", err)
+	}
+}
--- a/services/forgejo-nsc/internal/nsc/windows_winrm_test.go
+++ b/services/forgejo-nsc/internal/nsc/windows_winrm_test.go
@ -0,0 +1,65 @@
+package nsc
+
+import "testing"
+
+func TestParseProxyEndpoint(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		raw    string
+		want   string
+		wantOK bool
+	}{
+		{
+			name:   "plain json payload",
+			raw:    `{"endpoint":"127.0.0.1:61234"}`,
+			want:   "127.0.0.1:61234",
+			wantOK: true,
+		},
+		{
+			name: "json wrapped with extra output",
+			raw: `Connected.
+{"endpoint":"127.0.0.1:61235","rdp":{"credentials":{"username":"runneradmin","password":"runneradmin"}}}`,
+			want:   "127.0.0.1:61235",
+			wantOK: true,
+		},
+		{
+			name:   "missing endpoint field",
+			raw:    `{"rdp":{"credentials":{"username":"runneradmin"}}}`,
+			wantOK: false,
+		},
+		{
+			name:   "non-json output",
+			raw:    `Failed: instance does not have service "winrm"`,
+			wantOK: false,
+		},
+	}
+
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			got, ok := parseProxyEndpoint(tc.raw)
+			if ok != tc.wantOK {
+				t.Fatalf("parseProxyEndpoint(%q) ok=%v, want %v", tc.raw, ok, tc.wantOK)
+			}
+			if got != tc.want {
+				t.Fatalf("parseProxyEndpoint(%q) endpoint=%q, want %q", tc.raw, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestIndicatesMissingProxyService(t *testing.T) {
+	t.Parallel()
+
+	raw := `Failed: instance does not have service "winrm"`
+	if !indicatesMissingProxyService(raw, "winrm") {
+		t.Fatalf("indicatesMissingProxyService should return true for missing winrm message")
+	}
+	if indicatesMissingProxyService(raw, "ssh") {
+		t.Fatalf("indicatesMissingProxyService should be false when service name does not match")
+	}
+}
--- a/services/forgejo-nsc/internal/server/server.go
+++ b/services/forgejo-nsc/internal/server/server.go
@ -0,0 +1,151 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
+
+	"github.com/burrow/forgejo-nsc/internal/app"
+)
+
+type Server struct {
+	httpServer *http.Server
+	app        *app.Service
+	log        *slog.Logger
+}
+
+func New(listen string, svc *app.Service, logger *slog.Logger) *Server {
+	if logger == nil {
+		logger = slog.Default()
+	}
+
+	router := chi.NewRouter()
+	router.Use(middleware.RequestID)
+	router.Use(middleware.RealIP)
+	router.Use(middleware.Logger)
+	router.Use(middleware.Recoverer)
+
+	s := &Server{
+		app: svc,
+		log: logger,
+		httpServer: &http.Server{
+			Addr:        listen,
+			Handler:     router,
+			ReadTimeout: 30 * time.Second,
+			// Dispatch requests can legitimately run for the duration of a build.
+			// A short WriteTimeout will kill the request context mid-provisioning.
+			WriteTimeout: 2 * time.Hour,
+			IdleTimeout:  60 * time.Second,
+		},
+	}
+
+	router.Get("/healthz", s.handleHealthz)
+	router.Post("/api/v1/dispatch", s.handleDispatch)
+
+	return s
+}
+
+func (s *Server) ListenAndServe() error {
+	return s.httpServer.ListenAndServe()
+}
+
+func (s *Server) Shutdown(ctx context.Context) error {
+	return s.httpServer.Shutdown(ctx)
+}
+
+// Handler exposes the underlying HTTP handler for tests.
+func (s *Server) Handler() http.Handler {
+	return s.httpServer.Handler
+}
+
+type dispatchRequest struct {
+	Count   int               `json:"count"`
+	Labels  []string          `json:"labels"`
+	Scope   *dispatchScope    `json:"scope"`
+	TTL     string            `json:"ttl"`
+	Machine string            `json:"machine_type"`
+	Image   string            `json:"image"`
+	Env     map[string]string `json:"env"`
+}
+
+type dispatchScope struct {
+	Level string `json:"level"`
+	Owner string `json:"owner"`
+	Name  string `json:"name"`
+}
+
+func (s *Server) handleDispatch(w http.ResponseWriter, r *http.Request) {
+	var payload dispatchRequest
+	if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+		s.writeError(w, http.StatusBadRequest, err)
+		return
+	}
+
+	duration, err := parseDuration(payload.TTL)
+	if err != nil {
+		s.writeError(w, http.StatusBadRequest, err)
+		return
+	}
+
+	var scope *app.Scope
+	if payload.Scope != nil {
+		scope = &app.Scope{
+			Level: payload.Scope.Level,
+			Owner: payload.Scope.Owner,
+			Name:  payload.Scope.Name,
+		}
+	}
+
+	resp, err := s.app.Dispatch(r.Context(), app.DispatchRequest{
+		Count:    payload.Count,
+		Labels:   payload.Labels,
+		Scope:    scope,
+		TTL:      duration,
+		Machine:  payload.Machine,
+		Image:    payload.Image,
+		ExtraEnv: payload.Env,
+	})
+	if err != nil {
+		s.writeError(w, http.StatusInternalServerError, err)
+		return
+	}
+
+	s.writeJSON(w, http.StatusOK, resp)
+}
+
+func parseDuration(value string) (time.Duration, error) {
+	if value == "" {
+		return 0, nil
+	}
+	dur, err := time.ParseDuration(value)
+	if err != nil {
+		return 0, err
+	}
+	if dur <= 0 {
+		return 0, errors.New("ttl must be positive")
+	}
+	return dur, nil
+}
+
+func (s *Server) handleHealthz(w http.ResponseWriter, _ *http.Request) {
+	s.writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
+}
+
+func (s *Server) writeError(w http.ResponseWriter, code int, err error) {
+	s.log.Error("request failed", "err", err, "status", code)
+	s.writeJSON(w, code, map[string]string{
+		"error": err.Error(),
+	})
+}
+
+func (s *Server) writeJSON(w http.ResponseWriter, code int, payload any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	_ = json.NewEncoder(w).Encode(payload)
+}
--- a/services/forgejo-nsc/internal/server/server_test.go
+++ b/services/forgejo-nsc/internal/server/server_test.go
@ -0,0 +1,111 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/burrow/forgejo-nsc/internal/app"
+	"github.com/burrow/forgejo-nsc/internal/forgejo"
+	"github.com/burrow/forgejo-nsc/internal/nsc"
+)
+
+type serverForgejoMock struct {
+	mu     sync.Mutex
+	token  string
+	scopes []forgejo.Scope
+}
+
+func (m *serverForgejoMock) RegistrationToken(ctx context.Context, scope forgejo.Scope) (string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.scopes = append(m.scopes, scope)
+	return m.token, nil
+}
+
+type serverDispatcherMock struct {
+	mu       sync.Mutex
+	requests []nsc.LaunchRequest
+	result   string
+}
+
+func (m *serverDispatcherMock) LaunchRunner(ctx context.Context, req nsc.LaunchRequest) (string, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.requests = append(m.requests, req)
+	if m.result != "" {
+		return m.result, nil
+	}
+	return "runner", nil
+}
+
+func TestDispatchEndpoint(t *testing.T) {
+	forgejoMock := &serverForgejoMock{token: "token"}
+	dispatcherMock := &serverDispatcherMock{result: "runner-http"}
+
+	cfg := app.Config{
+		DefaultScope:  forgejo.Scope{Level: forgejo.ScopeInstance},
+		DefaultLabels: []string{"fallback"},
+		InstanceURL:   "https://forgejo.example.com",
+		DefaultTTL:    30 * time.Minute,
+	}
+
+	service := app.NewService(cfg, forgejoMock, dispatcherMock, nil)
+	srv := New(":0", service, nil)
+	ts := httptest.NewServer(srv.Handler())
+	defer ts.Close()
+
+	body := map[string]any{
+		"count":        1,
+		"ttl":          "45m",
+		"labels":       []string{"nscloud-arm"},
+		"scope":        map[string]string{"level": string(forgejo.ScopeOrganization), "owner": "acme"},
+		"machine_type": "8x16",
+		"image":        "runner:http",
+		"env":          map[string]string{"FOO": "bar"},
+	}
+
+	payload, _ := json.Marshal(body)
+
+	resp, err := http.Post(ts.URL+"/api/v1/dispatch", "application/json", bytes.NewReader(payload))
+	if err != nil {
+		t.Fatalf("POST failed: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("expected 200 OK, got %d", resp.StatusCode)
+	}
+
+	var decoded app.DispatchResponse
+	if err := json.NewDecoder(resp.Body).Decode(&decoded); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+
+	if len(decoded.Runners) != 1 || decoded.Runners[0].Name != "runner-http" {
+		t.Fatalf("unexpected response: %+v", decoded)
+	}
+
+	if len(forgejoMock.scopes) != 1 || forgejoMock.scopes[0].Level != forgejo.ScopeOrganization {
+		t.Fatalf("expected organization scope, got %+v", forgejoMock.scopes)
+	}
+
+	if len(dispatcherMock.requests) != 1 {
+		t.Fatalf("expected dispatcher call")
+	}
+	call := dispatcherMock.requests[0]
+	if call.Duration != 45*time.Minute {
+		t.Fatalf("expected ttl override, got %v", call.Duration)
+	}
+	if call.Labels[0] != "nscloud-arm" {
+		t.Fatalf("expected labels passthrough, got %v", call.Labels)
+	}
+	if call.ExtraEnv["FOO"] != "bar" {
+		t.Fatalf("expected env passthrough")
+	}
+}