From 5b5b1c7435a6bb00d1efeab67fc606d14e96c680 Mon Sep 17 00:00:00 2001
From: Kerry Hatcher <kerry@kerryhatcher.com>
Date: Sun, 26 Jul 2026 12:53:23 -0400
Subject: [PATCH 1/8] docs: draft core library split design specification (#2)

---
 .../2026-07-20-core-library-split-design.md   | 25 +++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-07-20-core-library-split-design.md

diff --git a/docs/superpowers/specs/2026-07-20-core-library-split-design.md b/docs/superpowers/specs/2026-07-20-core-library-split-design.md
new file mode 100644
index 0000000..917bbcf
--- /dev/null
+++ b/docs/superpowers/specs/2026-07-20-core-library-split-design.md
@@ -0,0 +1,25 @@
+# Design Specification: Core Library Split (Ref #2)
+
+## Project Goals
+Separate the core logic and infrastructure of `gor` into a dedicated library crate (`gor-core`) to improve modularity, testability, and clear separation of concerns between business logic and CLI presentation.
+
+## Proposed Structure
+1. **gor-core**: A library crate containing:
+    - Network communication (HTTP/REST) via `reqwest`.
+    - Core data types and error handling (using `thiserror`).
+    - Keyring management for authentication tokens.
+    - Configuration logic and validation.
+2. **gor** (CLI): The command-line interface wrapper. It will:
+    - Parse CLI arguments with `clap`.
+    - Provide progress reporting (`indicatif`) and pretty formatting (`console`/`eyre`).
+    - Act as a thin layer that maps input to `gor-core` calls and decodes results for display.
+
+## Design Decisions & Constraints (Ref #2)
+- **Stability**: The CLI must remain behaviorally identical. No new flags or changes to existing output formatting are permitted during this refactor.
+- **Core Clarity**: Core logic in `gor-core` must not depend on any UI/CLI libraries (`clap`, `indicatif`, etc.).
+- **Type Safety**: Replace raw `serde_json::Value` usage inside the core with strongly typed models where possible.
+
+## Roadmap
+1. **Phase 1: Infrastructure Migration**. Move common files (`client`, `host`, `error`, `config`) to `gor-core`.
+2. **Phase 2: Feature Extraction**. Iteratively move command logic (e.g., `label`, `issue`, `pr`) into the core library, ensuring they are fully testable in isolation.
+3. **Phase 3: Final Cleanup**. Refine internal helper utilities and publish both crates.

From 26e8b186369171070f1681245c48fb0e430c15e9 Mon Sep 17 00:00:00 2001
From: Kerry Hatcher <kerry@kerryhatcher.com>
Date: Sun, 26 Jul 2026 13:14:07 -0400
Subject: [PATCH 2/8] build: split workspace into gor-core + gor crates

---
 Cargo.lock                                    | 18 +++++-
 Cargo.toml                                    | 59 +------------------
 crates/gor-core/Cargo.toml                    | 33 +++++++++++
 {src => crates/gor-core/src}/auth/device.rs   |  0
 {src => crates/gor-core/src}/auth/mod.rs      |  0
 {src => crates/gor-core/src}/auth/token.rs    |  6 +-
 {src => crates/gor-core/src}/client.rs        |  4 +-
 {src => crates/gor-core/src}/config.rs        |  0
 {src => crates/gor-core/src}/error.rs         |  0
 {src => crates/gor-core/src}/host.rs          | 10 ++--
 {src => crates/gor-core/src}/keyring_store.rs |  0
 crates/gor-core/src/lib.rs                    | 21 +++++++
 {src => crates/gor-core/src}/repository.rs    | 41 +++++++++----
 crates/gor/Cargo.toml                         | 44 ++++++++++++++
 {src => crates/gor/src}/cli.rs                |  0
 {src => crates/gor/src}/cmd/alias.rs          |  2 +-
 {src => crates/gor/src}/cmd/api.rs            |  2 +-
 {src => crates/gor/src}/cmd/attestation.rs    |  4 +-
 {src => crates/gor/src}/cmd/auth.rs           | 12 ++--
 {src => crates/gor/src}/cmd/browse.rs         |  2 +-
 {src => crates/gor/src}/cmd/cache.rs          |  6 +-
 {src => crates/gor/src}/cmd/classroom.rs      |  4 +-
 {src => crates/gor/src}/cmd/codespace.rs      |  4 +-
 {src => crates/gor/src}/cmd/completion.rs     |  0
 {src => crates/gor/src}/cmd/config.rs         |  2 +-
 {src => crates/gor/src}/cmd/copilot.rs        |  4 +-
 {src => crates/gor/src}/cmd/extension.rs      |  4 +-
 {src => crates/gor/src}/cmd/gist.rs           |  6 +-
 {src => crates/gor/src}/cmd/issue.rs          |  6 +-
 {src => crates/gor/src}/cmd/keys.rs           |  4 +-
 {src => crates/gor/src}/cmd/label.rs          |  6 +-
 {src => crates/gor/src}/cmd/mod.rs            |  0
 {src => crates/gor/src}/cmd/org.rs            |  4 +-
 {src => crates/gor/src}/cmd/pr.rs             |  6 +-
 {src => crates/gor/src}/cmd/project.rs        |  6 +-
 {src => crates/gor/src}/cmd/release.rs        |  6 +-
 {src => crates/gor/src}/cmd/repo.rs           |  6 +-
 {src => crates/gor/src}/cmd/ruleset.rs        |  6 +-
 {src => crates/gor/src}/cmd/run.rs            |  6 +-
 {src => crates/gor/src}/cmd/search.rs         |  4 +-
 {src => crates/gor/src}/cmd/secret.rs         |  6 +-
 {src => crates/gor/src}/cmd/util.rs           |  0
 {src => crates/gor/src}/cmd/variable.rs       |  6 +-
 {src => crates/gor/src}/cmd/workflow.rs       |  8 +--
 {src => crates/gor/src}/lib.rs                |  9 +--
 {src => crates/gor/src}/main.rs               |  0
 src/output.rs => crates/gor/src/render.rs     |  6 +-
 47 files changed, 223 insertions(+), 160 deletions(-)
 create mode 100644 crates/gor-core/Cargo.toml
 rename {src => crates/gor-core/src}/auth/device.rs (100%)
 rename {src => crates/gor-core/src}/auth/mod.rs (100%)
 rename {src => crates/gor-core/src}/auth/token.rs (95%)
 rename {src => crates/gor-core/src}/client.rs (99%)
 rename {src => crates/gor-core/src}/config.rs (100%)
 rename {src => crates/gor-core/src}/error.rs (100%)
 rename {src => crates/gor-core/src}/host.rs (96%)
 rename {src => crates/gor-core/src}/keyring_store.rs (100%)
 create mode 100644 crates/gor-core/src/lib.rs
 rename {src => crates/gor-core/src}/repository.rs (88%)
 create mode 100644 crates/gor/Cargo.toml
 rename {src => crates/gor/src}/cli.rs (100%)
 rename {src => crates/gor/src}/cmd/alias.rs (99%)
 rename {src => crates/gor/src}/cmd/api.rs (99%)
 rename {src => crates/gor/src}/cmd/attestation.rs (98%)
 rename {src => crates/gor/src}/cmd/auth.rs (97%)
 rename {src => crates/gor/src}/cmd/browse.rs (97%)
 rename {src => crates/gor/src}/cmd/cache.rs (98%)
 rename {src => crates/gor/src}/cmd/classroom.rs (98%)
 rename {src => crates/gor/src}/cmd/codespace.rs (99%)
 rename {src => crates/gor/src}/cmd/completion.rs (100%)
 rename {src => crates/gor/src}/cmd/config.rs (98%)
 rename {src => crates/gor/src}/cmd/copilot.rs (98%)
 rename {src => crates/gor/src}/cmd/extension.rs (98%)
 rename {src => crates/gor/src}/cmd/gist.rs (99%)
 rename {src => crates/gor/src}/cmd/issue.rs (99%)
 rename {src => crates/gor/src}/cmd/keys.rs (99%)
 rename {src => crates/gor/src}/cmd/label.rs (99%)
 rename {src => crates/gor/src}/cmd/mod.rs (100%)
 rename {src => crates/gor/src}/cmd/org.rs (98%)
 rename {src => crates/gor/src}/cmd/pr.rs (99%)
 rename {src => crates/gor/src}/cmd/project.rs (99%)
 rename {src => crates/gor/src}/cmd/release.rs (99%)
 rename {src => crates/gor/src}/cmd/repo.rs (99%)
 rename {src => crates/gor/src}/cmd/ruleset.rs (97%)
 rename {src => crates/gor/src}/cmd/run.rs (99%)
 rename {src => crates/gor/src}/cmd/search.rs (99%)
 rename {src => crates/gor/src}/cmd/secret.rs (98%)
 rename {src => crates/gor/src}/cmd/util.rs (100%)
 rename {src => crates/gor/src}/cmd/variable.rs (98%)
 rename {src => crates/gor/src}/cmd/workflow.rs (98%)
 rename {src => crates/gor/src}/lib.rs (93%)
 rename {src => crates/gor/src}/main.rs (100%)
 rename src/output.rs => crates/gor/src/render.rs (98%)

diff --git a/Cargo.lock b/Cargo.lock
index 7e12eec..aff1128 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1517,18 +1517,32 @@ dependencies = [
  "console",
  "dirs",
  "gix",
+ "gor-core",
  "indicatif",
- "keyring",
  "miette",
  "reqwest 0.12.28",
  "serde",
  "serde_json",
  "serde_yaml_ng",
- "thiserror 2.0.18",
  "tracing",
  "tracing-subscriber",
 ]
 
+[[package]]
+name = "gor-core"
+version = "0.1.0"
+dependencies = [
+ "dirs",
+ "gix",
+ "keyring",
+ "reqwest 0.12.28",
+ "serde",
+ "serde_json",
+ "serde_yaml_ng",
+ "thiserror 2.0.18",
+ "tracing",
+]
+
 [[package]]
 name = "h2"
 version = "0.4.15"
diff --git a/Cargo.toml b/Cargo.toml
index 2fd2982..e19d8f6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,5 @@
 [workspace]
-members = ["."]
+members = ["crates/*"]
 resolver = "2"
 
 [workspace.package]
@@ -51,63 +51,6 @@ too_many_lines = "allow"
 [workspace.metadata.cargo-shear]
 ignored = ["dirs", "gix", "miette", "indicatif", "console"]
 
-# Package name is `gor-cli` because the `gor` name was already taken on
-# crates.io (an unrelated VCS crate). The binary and lib are still named `gor`
-# below, so users get a `gor` command and `use gor::` keeps working.
-# ponytail: rename over vendoring/forking — crates.io has no namespacing.
-[package]
-name = "gor-cli"
-version = { workspace = true }
-edition = { workspace = true }
-rust-version = { workspace = true }
-license = { workspace = true }
-repository = { workspace = true }
-documentation = { workspace = true }
-homepage = { workspace = true }
-description = "A Rust CLI for GitHub — a 'gh' clone"
-readme = "README.md"
-keywords = ["github", "cli", "gh", "git"]
-categories = ["command-line-utilities", "development-tools"]
-
-[lib]
-name = "gor"
-
-[[bin]]
-name = "gor"
-path = "src/main.rs"
-
-[lints]
-workspace = true
-
-[features]
-default = []
-keyring = ["dep:keyring"]
-
-[dependencies]
-clap = { workspace = true }
-clap_complete = { workspace = true }
-reqwest = { workspace = true }
-serde = { workspace = true }
-serde_json = { workspace = true }
-serde_yaml_ng = { workspace = true }
-keyring = { workspace = true, optional = true }
-thiserror = { workspace = true }
-dirs = { workspace = true }
-gix = { workspace = true }
-anyhow = { workspace = true }
-miette = { workspace = true }
-tracing = { workspace = true }
-tracing-subscriber = { workspace = true }
-indicatif = { workspace = true }
-console = { workspace = true }
-
-[dev-dependencies]
-# Additional test dependencies for integration tests:
-# - assert_cmd, assert_fs: CLI integration testing
-# - insta: snapshot testing
-# - tempfile: temporary file/directory fixtures
-# - wiremock: HTTP mocking for GitHub API
-
 [profile.release]
 opt-level = "z"
 lto = true
diff --git a/crates/gor-core/Cargo.toml b/crates/gor-core/Cargo.toml
new file mode 100644
index 0000000..11e6848
--- /dev/null
+++ b/crates/gor-core/Cargo.toml
@@ -0,0 +1,33 @@
+[package]
+name = "gor-core"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+homepage.workspace = true
+description = "Core library for the gor GitHub CLI — typed operations and models"
+readme = "README.md"
+keywords = ["github", "api", "gh", "git"]
+categories = ["api-bindings", "web-programming::http-client"]
+
+[lib]
+name = "gor_core"
+
+[lints]
+workspace = true
+
+[features]
+default = []
+keyring = ["dep:keyring"]
+
+[dependencies]
+reqwest = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+serde_yaml_ng = { workspace = true }
+thiserror = { workspace = true }
+dirs = { workspace = true }
+gix = { workspace = true }
+tracing = { workspace = true }
+keyring = { workspace = true, optional = true }
diff --git a/src/auth/device.rs b/crates/gor-core/src/auth/device.rs
similarity index 100%
rename from src/auth/device.rs
rename to crates/gor-core/src/auth/device.rs
diff --git a/src/auth/mod.rs b/crates/gor-core/src/auth/mod.rs
similarity index 100%
rename from src/auth/mod.rs
rename to crates/gor-core/src/auth/mod.rs
diff --git a/src/auth/token.rs b/crates/gor-core/src/auth/token.rs
similarity index 95%
rename from src/auth/token.rs
rename to crates/gor-core/src/auth/token.rs
index 79e387a..574046d 100644
--- a/src/auth/token.rs
+++ b/crates/gor-core/src/auth/token.rs
@@ -25,8 +25,8 @@ pub struct UserResponse {
 /// # Examples
 ///
 /// ```no_run
-/// use gor::auth::token::verify_token;
-/// use gor::host::Host;
+/// use gor_core::auth::token::verify_token;
+/// use gor_core::host::Host;
 ///
 /// let host = Host::new("github.com");
 /// let login = verify_token(&host, "gho_abc123").unwrap();
@@ -81,7 +81,7 @@ pub fn verify_token(host: &Host, token: &str) -> Result<String, GorError> {
 /// # Examples
 ///
 /// ```no_run
-/// use gor::auth::token::read_token_from_stdin;
+/// use gor_core::auth::token::read_token_from_stdin;
 ///
 /// let token = read_token_from_stdin().unwrap();
 /// ```
diff --git a/src/client.rs b/crates/gor-core/src/client.rs
similarity index 99%
rename from src/client.rs
rename to crates/gor-core/src/client.rs
index 322772f..93cfb04 100644
--- a/src/client.rs
+++ b/crates/gor-core/src/client.rs
@@ -30,7 +30,7 @@ impl Client {
     /// # Examples
     ///
     /// ```no_run
-    /// use gor::client::Client;
+    /// use gor_core::client::Client;
     ///
     /// let client = Client::new("github.com").unwrap();
     /// ```
@@ -53,7 +53,7 @@ impl Client {
     /// # Examples
     ///
     /// ```no_run
-    /// use gor::client::Client;
+    /// use gor_core::client::Client;
     ///
     /// let client = Client::with_token("github.com", "gho_abc123").unwrap();
     /// ```
diff --git a/src/config.rs b/crates/gor-core/src/config.rs
similarity index 100%
rename from src/config.rs
rename to crates/gor-core/src/config.rs
diff --git a/src/error.rs b/crates/gor-core/src/error.rs
similarity index 100%
rename from src/error.rs
rename to crates/gor-core/src/error.rs
diff --git a/src/host.rs b/crates/gor-core/src/host.rs
similarity index 96%
rename from src/host.rs
rename to crates/gor-core/src/host.rs
index 8b84346..0ca63f8 100644
--- a/src/host.rs
+++ b/crates/gor-core/src/host.rs
@@ -22,7 +22,7 @@ impl Host {
     /// # Examples
     ///
     /// ```
-    /// use gor::host::Host;
+    /// use gor_core::host::Host;
     ///
     /// let host = Host::new("github.com");
     /// assert_eq!(host.api_base(), "https://api.github.com");
@@ -62,7 +62,7 @@ impl Host {
     /// # Examples
     ///
     /// ```
-    /// use gor::host::Host;
+    /// use gor_core::host::Host;
     ///
     /// let host = Host::new("github.com");
     /// assert_eq!(host.api_url("/user"), "https://api.github.com/user");
@@ -77,7 +77,7 @@ impl Host {
     /// # Examples
     ///
     /// ```
-    /// use gor::host::Host;
+    /// use gor_core::host::Host;
     ///
     /// let host = Host::new("github.com");
     /// assert_eq!(
@@ -95,7 +95,7 @@ impl Host {
     /// # Examples
     ///
     /// ```
-    /// use gor::host::Host;
+    /// use gor_core::host::Host;
     ///
     /// let host = Host::new("github.com");
     /// assert_eq!(
@@ -113,7 +113,7 @@ impl Host {
     /// # Examples
     ///
     /// ```
-    /// use gor::host::Host;
+    /// use gor_core::host::Host;
     ///
     /// let host = Host::new("github.com");
     /// assert_eq!(host.device_activation_url(), "https://github.com/login/device");
diff --git a/src/keyring_store.rs b/crates/gor-core/src/keyring_store.rs
similarity index 100%
rename from src/keyring_store.rs
rename to crates/gor-core/src/keyring_store.rs
diff --git a/crates/gor-core/src/lib.rs b/crates/gor-core/src/lib.rs
new file mode 100644
index 0000000..aebdd6e
--- /dev/null
+++ b/crates/gor-core/src/lib.rs
@@ -0,0 +1,21 @@
+//! # gor-core — Core library for the gor GitHub CLI
+//!
+//! Provides typed operations, client infrastructure, and domain models
+//! for the GitHub REST API. Used by the `gor` CLI binary and available
+//! as a reusable library for other Rust applications.
+
+#![deny(missing_docs)]
+#![deny(unsafe_code)]
+
+pub mod auth;
+pub mod client;
+pub mod config;
+pub mod error;
+pub mod host;
+pub mod keyring_store;
+pub mod repository;
+
+/// Convenience re-exports of key types.
+pub use client::Client;
+pub use error::GorError;
+pub use repository::RepoSplit;
diff --git a/src/repository.rs b/crates/gor-core/src/repository.rs
similarity index 88%
rename from src/repository.rs
rename to crates/gor-core/src/repository.rs
index a02fcaf..875bada 100644
--- a/src/repository.rs
+++ b/crates/gor-core/src/repository.rs
@@ -3,12 +3,14 @@
 //! Provides utilities for parsing `OWNER/REPO` strings and detecting
 //! repository information from the current directory's git remote.
 
+use crate::error::GorError;
+
 /// A parsed repository specification consisting of an owner and repo name.
 ///
 /// # Examples
 ///
 /// ```
-/// use gor::repository::{parse_repo_spec, RepoSplit};
+/// use gor_core::repository::{parse_repo_spec, RepoSplit};
 ///
 /// let spec = parse_repo_spec("octocat/hello-world").expect("valid spec");
 /// assert_eq!(spec.owner, "octocat");
@@ -28,7 +30,7 @@ impl RepoSplit {
     /// # Examples
     ///
     /// ```
-    /// use gor::repository::RepoSplit;
+    /// use gor_core::repository::RepoSplit;
     ///
     /// let spec = RepoSplit::new("octocat", "hello-world");
     /// assert_eq!(spec.owner, "octocat");
@@ -49,7 +51,7 @@ impl std::fmt::Display for RepoSplit {
     /// # Examples
     ///
     /// ```
-    /// use gor::repository::RepoSplit;
+    /// use gor_core::repository::RepoSplit;
     ///
     /// let spec = RepoSplit::new("octocat", "hello-world");
     /// assert_eq!(spec.to_string(), "octocat/hello-world");
@@ -72,7 +74,7 @@ impl std::fmt::Display for RepoSplit {
 /// # Examples
 ///
 /// ```
-/// use gor::repository::parse_repo_spec;
+/// use gor_core::repository::parse_repo_spec;
 ///
 /// let spec = parse_repo_spec("octocat/hello-world").expect("valid spec");
 /// assert_eq!(spec.owner, "octocat");
@@ -87,21 +89,34 @@ impl std::fmt::Display for RepoSplit {
 /// assert!(parse_repo_spec("no-slash").is_err());
 /// assert!(parse_repo_spec("too/many/slashes").is_err());
 /// ```
-pub fn parse_repo_spec(input: &str) -> anyhow::Result<RepoSplit> {
+pub fn parse_repo_spec(input: &str) -> Result<RepoSplit, GorError> {
     let input = input.trim();
-    anyhow::ensure!(!input.is_empty(), "repository spec cannot be empty");
+    if input.is_empty() {
+        return Err(GorError::InvalidInput(
+            "repository spec cannot be empty".to_string(),
+        ));
+    }
 
     let parts: Vec<&str> = input.split('/').collect();
-    anyhow::ensure!(
-        parts.len() == 2,
-        "invalid repository spec '{input}': expected OWNER/REPO format"
-    );
+    if parts.len() != 2 {
+        return Err(GorError::InvalidInput(format!(
+            "invalid repository spec '{input}': expected OWNER/REPO format"
+        )));
+    }
 
     let owner = parts[0].trim();
     let repo = parts[1].trim();
 
-    anyhow::ensure!(!owner.is_empty(), "repository owner cannot be empty");
-    anyhow::ensure!(!repo.is_empty(), "repository name cannot be empty");
+    if owner.is_empty() {
+        return Err(GorError::InvalidInput(
+            "repository owner cannot be empty".to_string(),
+        ));
+    }
+    if repo.is_empty() {
+        return Err(GorError::InvalidInput(
+            "repository name cannot be empty".to_string(),
+        ));
+    }
 
     // Strip trailing .git if present
     let repo = repo.strip_suffix(".git").unwrap_or(repo).to_string();
@@ -127,7 +142,7 @@ pub fn parse_repo_spec(input: &str) -> anyhow::Result<RepoSplit> {
 /// # Examples
 ///
 /// ```no_run
-/// use gor::repository::detect_remote;
+/// use gor_core::repository::detect_remote;
 ///
 /// // This will return None if not in a git repo with a GitHub remote
 /// let result = detect_remote();
diff --git a/crates/gor/Cargo.toml b/crates/gor/Cargo.toml
new file mode 100644
index 0000000..49267c2
--- /dev/null
+++ b/crates/gor/Cargo.toml
@@ -0,0 +1,44 @@
+[package]
+name = "gor-cli"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+documentation.workspace = true
+homepage.workspace = true
+description = "A Rust CLI for GitHub — a 'gh' clone"
+readme = "README.md"
+keywords = ["github", "cli", "gh", "git"]
+categories = ["command-line-utilities", "development-tools"]
+
+[lib]
+name = "gor"
+
+[[bin]]
+name = "gor"
+path = "src/main.rs"
+
+[lints]
+workspace = true
+
+[features]
+default = []
+keyring = ["gor-core/keyring"]
+
+[dependencies]
+gor-core = { path = "../gor-core" }
+clap = { workspace = true }
+clap_complete = { workspace = true }
+reqwest = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+anyhow = { workspace = true }
+miette = { workspace = true }
+tracing = { workspace = true }
+tracing-subscriber = { workspace = true }
+indicatif = { workspace = true }
+console = { workspace = true }
+gix = { workspace = true }
+serde_yaml_ng = { workspace = true }
+dirs = { workspace = true }
diff --git a/src/cli.rs b/crates/gor/src/cli.rs
similarity index 100%
rename from src/cli.rs
rename to crates/gor/src/cli.rs
diff --git a/src/cmd/alias.rs b/crates/gor/src/cmd/alias.rs
similarity index 99%
rename from src/cmd/alias.rs
rename to crates/gor/src/cmd/alias.rs
index 601d549..f9f8cf6 100644
--- a/src/cmd/alias.rs
+++ b/crates/gor/src/cmd/alias.rs
@@ -6,8 +6,8 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::AliasCommand;
-use crate::config;
 use anyhow::Context;
+use gor_core::config;
 
 /// Run the `gor alias` subcommand.
 ///
diff --git a/src/cmd/api.rs b/crates/gor/src/cmd/api.rs
similarity index 99%
rename from src/cmd/api.rs
rename to crates/gor/src/cmd/api.rs
index bc46839..e157bb5 100644
--- a/src/cmd/api.rs
+++ b/crates/gor/src/cmd/api.rs
@@ -8,8 +8,8 @@
 #![allow(clippy::print_stdout, clippy::print_stderr)]
 
 use crate::cli::ApiCommand;
-use crate::client::Client;
 use anyhow::Context;
+use gor_core::client::Client;
 use std::fmt::Write as FmtWrite;
 use std::io::Read;
 
diff --git a/src/cmd/attestation.rs b/crates/gor/src/cmd/attestation.rs
similarity index 98%
rename from src/cmd/attestation.rs
rename to crates/gor/src/cmd/attestation.rs
index 1fe15da..ba31999 100644
--- a/src/cmd/attestation.rs
+++ b/crates/gor/src/cmd/attestation.rs
@@ -5,9 +5,9 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::AttestationCommand;
-use crate::client::Client;
-use crate::repository;
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository;
 
 /// Run the `gor attestation` subcommand.
 ///
diff --git a/src/cmd/auth.rs b/crates/gor/src/cmd/auth.rs
similarity index 97%
rename from src/cmd/auth.rs
rename to crates/gor/src/cmd/auth.rs
index bc2bf4c..1f0cc0d 100644
--- a/src/cmd/auth.rs
+++ b/crates/gor/src/cmd/auth.rs
@@ -4,11 +4,11 @@
 
 #![allow(clippy::print_stdout)]
 
-use crate::auth::{device, token};
 use crate::cli::AuthCommand;
-use crate::client::Client;
-use crate::host::Host;
 use anyhow::Context;
+use gor_core::auth::{device, token};
+use gor_core::client::Client;
+use gor_core::host::Host;
 
 /// Run the `gor auth` subcommand.
 ///
@@ -193,7 +193,7 @@ fn logout(hostname: &str) -> anyhow::Result<()> {
         return Ok(());
     }
 
-    crate::keyring_store::delete_token(hostname)
+    gor_core::keyring_store::delete_token(hostname)
         .map_err(|e| anyhow::anyhow!("failed to remove token: {e}"))?;
     println!("Logged out of {hostname}");
     Ok(())
@@ -237,7 +237,7 @@ fn token(hostname: &str, refresh: bool, scopes: &[String], secure: bool) -> anyh
         .map_err(|e| anyhow::anyhow!("{e}"))?;
 
         // Store the new token.
-        crate::keyring_store::set_token(hostname, &access_token)
+        gor_core::keyring_store::set_token(hostname, &access_token)
             .map_err(|e| anyhow::anyhow!("failed to store token: {e}"))?;
 
         // Print the token.
@@ -246,7 +246,7 @@ fn token(hostname: &str, refresh: bool, scopes: &[String], secure: bool) -> anyh
     }
 
     // Try to get the token from the keyring first.
-    let token = crate::keyring_store::get_token(hostname)
+    let token = gor_core::keyring_store::get_token(hostname)
         .map_err(|e| anyhow::anyhow!("failed to read token: {e}"))?
         .or_else(|| std::env::var("GITHUB_TOKEN").ok())
         .or_else(|| std::env::var("GH_TOKEN").ok());
diff --git a/src/cmd/browse.rs b/crates/gor/src/cmd/browse.rs
similarity index 97%
rename from src/cmd/browse.rs
rename to crates/gor/src/cmd/browse.rs
index e780a9a..d0f5e01 100644
--- a/src/cmd/browse.rs
+++ b/crates/gor/src/cmd/browse.rs
@@ -6,8 +6,8 @@
 #![allow(clippy::print_stdout, clippy::print_stderr)]
 
 use crate::cli::BrowseCommand;
-use crate::repository::{detect_remote, parse_repo_spec};
 use anyhow::Context;
+use gor_core::repository::{detect_remote, parse_repo_spec};
 
 /// Run the `gor browse` subcommand.
 ///
diff --git a/src/cmd/cache.rs b/crates/gor/src/cmd/cache.rs
similarity index 98%
rename from src/cmd/cache.rs
rename to crates/gor/src/cmd/cache.rs
index 88ae021..668bfdb 100644
--- a/src/cmd/cache.rs
+++ b/crates/gor/src/cmd/cache.rs
@@ -5,10 +5,10 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::CacheCommand;
-use crate::client::Client;
-use crate::output::print_json;
-use crate::repository;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository;
 
 use std::fmt::Write;
 
diff --git a/src/cmd/classroom.rs b/crates/gor/src/cmd/classroom.rs
similarity index 98%
rename from src/cmd/classroom.rs
rename to crates/gor/src/cmd/classroom.rs
index 78b4611..7254b68 100644
--- a/src/cmd/classroom.rs
+++ b/crates/gor/src/cmd/classroom.rs
@@ -5,9 +5,9 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::ClassroomCommand;
-use crate::client::Client;
-use crate::output::print_json;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
 
 /// Run the `gor classroom` subcommand.
 ///
diff --git a/src/cmd/codespace.rs b/crates/gor/src/cmd/codespace.rs
similarity index 99%
rename from src/cmd/codespace.rs
rename to crates/gor/src/cmd/codespace.rs
index e8d1d6e..cec3082 100644
--- a/src/cmd/codespace.rs
+++ b/crates/gor/src/cmd/codespace.rs
@@ -5,9 +5,9 @@
 #![allow(clippy::print_stdout, clippy::option_if_let_else)]
 
 use crate::cli::CodespaceCommand;
-use crate::client::Client;
-use crate::output::print_json;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
 
 /// Run the `gor codespace` subcommand.
 ///
diff --git a/src/cmd/completion.rs b/crates/gor/src/cmd/completion.rs
similarity index 100%
rename from src/cmd/completion.rs
rename to crates/gor/src/cmd/completion.rs
diff --git a/src/cmd/config.rs b/crates/gor/src/cmd/config.rs
similarity index 98%
rename from src/cmd/config.rs
rename to crates/gor/src/cmd/config.rs
index 196447a..17e20a3 100644
--- a/src/cmd/config.rs
+++ b/crates/gor/src/cmd/config.rs
@@ -5,7 +5,7 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::ConfigCommand;
-use crate::config::{self, GorConfig};
+use gor_core::config::{self, GorConfig};
 
 /// Run the `gor config` subcommand.
 ///
diff --git a/src/cmd/copilot.rs b/crates/gor/src/cmd/copilot.rs
similarity index 98%
rename from src/cmd/copilot.rs
rename to crates/gor/src/cmd/copilot.rs
index c616736..e1765d6 100644
--- a/src/cmd/copilot.rs
+++ b/crates/gor/src/cmd/copilot.rs
@@ -5,9 +5,9 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::CopilotCommand;
-use crate::client::Client;
-use crate::output::print_json;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
 
 /// Run the `gor copilot` subcommand.
 ///
diff --git a/src/cmd/extension.rs b/crates/gor/src/cmd/extension.rs
similarity index 98%
rename from src/cmd/extension.rs
rename to crates/gor/src/cmd/extension.rs
index 6dc8c94..3f3b4a3 100644
--- a/src/cmd/extension.rs
+++ b/crates/gor/src/cmd/extension.rs
@@ -5,9 +5,9 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::ExtensionCommand;
-use crate::client::Client;
-use crate::output::print_json;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
 
 /// Run the `gor extension` subcommand.
 ///
diff --git a/src/cmd/gist.rs b/crates/gor/src/cmd/gist.rs
similarity index 99%
rename from src/cmd/gist.rs
rename to crates/gor/src/cmd/gist.rs
index b914b9f..75f23c8 100644
--- a/src/cmd/gist.rs
+++ b/crates/gor/src/cmd/gist.rs
@@ -5,9 +5,9 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::GistCommand;
-use crate::client::Client;
-use crate::output::print_json;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
 use std::fs;
 
 /// Run the `gor gist` subcommand.
@@ -434,7 +434,7 @@ fn print_gist_table(gists: &[serde_json::Value]) {
         let file_count = gist["files"].as_object().map_or(0, serde_json::Map::len);
         let updated = gist["updated_at"]
             .as_str()
-            .map_or_else(|| "—".to_string(), crate::output::format_date);
+            .map_or_else(|| "—".to_string(), crate::render::format_date);
 
         let desc_truncated = crate::cmd::util::truncate(description, desc_width);
 
diff --git a/src/cmd/issue.rs b/crates/gor/src/cmd/issue.rs
similarity index 99%
rename from src/cmd/issue.rs
rename to crates/gor/src/cmd/issue.rs
index 0aad4bb..c03b3cf 100644
--- a/src/cmd/issue.rs
+++ b/crates/gor/src/cmd/issue.rs
@@ -6,10 +6,10 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::IssueCommand;
-use crate::client::Client;
-use crate::output::{format_date, print_json};
-use crate::repository::{detect_remote, parse_repo_spec};
+use crate::render::{format_date, print_json};
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository::{detect_remote, parse_repo_spec};
 
 /// Run the `gor issue` subcommand.
 ///
diff --git a/src/cmd/keys.rs b/crates/gor/src/cmd/keys.rs
similarity index 99%
rename from src/cmd/keys.rs
rename to crates/gor/src/cmd/keys.rs
index dcb705d..e57dba9 100644
--- a/src/cmd/keys.rs
+++ b/crates/gor/src/cmd/keys.rs
@@ -5,9 +5,9 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::{GpgKeyCommand, SshKeyCommand};
-use crate::client::Client;
-use crate::output::print_json;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
 use std::fs;
 
 /// Run the `gor ssh-key` subcommand.
diff --git a/src/cmd/label.rs b/crates/gor/src/cmd/label.rs
similarity index 99%
rename from src/cmd/label.rs
rename to crates/gor/src/cmd/label.rs
index ea880ad..66688d6 100644
--- a/src/cmd/label.rs
+++ b/crates/gor/src/cmd/label.rs
@@ -6,10 +6,10 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::LabelCommand;
-use crate::client::Client;
-use crate::output::print_json;
-use crate::repository::{detect_remote, parse_repo_spec};
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository::{detect_remote, parse_repo_spec};
 
 /// Run the `gor label` subcommand.
 ///
diff --git a/src/cmd/mod.rs b/crates/gor/src/cmd/mod.rs
similarity index 100%
rename from src/cmd/mod.rs
rename to crates/gor/src/cmd/mod.rs
diff --git a/src/cmd/org.rs b/crates/gor/src/cmd/org.rs
similarity index 98%
rename from src/cmd/org.rs
rename to crates/gor/src/cmd/org.rs
index e997387..d9091eb 100644
--- a/src/cmd/org.rs
+++ b/crates/gor/src/cmd/org.rs
@@ -5,9 +5,9 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::OrgCommand;
-use crate::client::Client;
-use crate::output::print_json;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
 
 /// Run the `gor org` subcommand.
 ///
diff --git a/src/cmd/pr.rs b/crates/gor/src/cmd/pr.rs
similarity index 99%
rename from src/cmd/pr.rs
rename to crates/gor/src/cmd/pr.rs
index 273f92e..ef23351 100644
--- a/src/cmd/pr.rs
+++ b/crates/gor/src/cmd/pr.rs
@@ -6,11 +6,11 @@
 #![allow(clippy::print_stdout, clippy::print_stderr)]
 
 use crate::cli::PrCommand;
-use crate::client::Client;
-use crate::output::{format_date, print_json};
-use crate::repository::{detect_remote, parse_repo_spec};
+use crate::render::{format_date, print_json};
 use anyhow::Context;
 use gix::bstr::ByteSlice;
+use gor_core::client::Client;
+use gor_core::repository::{detect_remote, parse_repo_spec};
 use std::collections::BTreeMap;
 use std::io::Write;
 
diff --git a/src/cmd/project.rs b/crates/gor/src/cmd/project.rs
similarity index 99%
rename from src/cmd/project.rs
rename to crates/gor/src/cmd/project.rs
index 5e06ba6..62dd941 100644
--- a/src/cmd/project.rs
+++ b/crates/gor/src/cmd/project.rs
@@ -5,10 +5,10 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::ProjectCommand;
-use crate::client::Client;
-use crate::output::print_json;
-use crate::repository;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository;
 
 /// Run the `gor project` subcommand.
 ///
diff --git a/src/cmd/release.rs b/crates/gor/src/cmd/release.rs
similarity index 99%
rename from src/cmd/release.rs
rename to crates/gor/src/cmd/release.rs
index 3657739..f4fe8ad 100644
--- a/src/cmd/release.rs
+++ b/crates/gor/src/cmd/release.rs
@@ -6,10 +6,10 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::ReleaseCommand;
-use crate::client::Client;
-use crate::output::{format_date, print_json};
-use crate::repository::{detect_remote, parse_repo_spec};
+use crate::render::{format_date, print_json};
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository::{detect_remote, parse_repo_spec};
 use std::io::Write;
 
 /// Run the `gor release` subcommand.
diff --git a/src/cmd/repo.rs b/crates/gor/src/cmd/repo.rs
similarity index 99%
rename from src/cmd/repo.rs
rename to crates/gor/src/cmd/repo.rs
index 72de913..c596e1a 100644
--- a/src/cmd/repo.rs
+++ b/crates/gor/src/cmd/repo.rs
@@ -6,10 +6,10 @@
 #![allow(clippy::print_stdout, clippy::print_stderr)]
 
 use crate::cli::RepoCommand;
-use crate::client::Client;
-use crate::output::{format_count, format_date, print_json};
-use crate::repository::{detect_remote, parse_repo_spec};
+use crate::render::{format_count, format_date, print_json};
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository::{detect_remote, parse_repo_spec};
 use std::io::Write;
 
 /// Run the `gor repo` subcommand.
diff --git a/src/cmd/ruleset.rs b/crates/gor/src/cmd/ruleset.rs
similarity index 97%
rename from src/cmd/ruleset.rs
rename to crates/gor/src/cmd/ruleset.rs
index add9603..670f2e7 100644
--- a/src/cmd/ruleset.rs
+++ b/crates/gor/src/cmd/ruleset.rs
@@ -5,10 +5,10 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::RulesetCommand;
-use crate::client::Client;
-use crate::output::print_json;
-use crate::repository::{detect_remote, parse_repo_spec};
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository::{detect_remote, parse_repo_spec};
 
 /// Run the `gor ruleset` subcommand.
 ///
diff --git a/src/cmd/run.rs b/crates/gor/src/cmd/run.rs
similarity index 99%
rename from src/cmd/run.rs
rename to crates/gor/src/cmd/run.rs
index 3acf93c..50c298d 100644
--- a/src/cmd/run.rs
+++ b/crates/gor/src/cmd/run.rs
@@ -5,10 +5,10 @@
 #![allow(clippy::print_stdout, clippy::option_if_let_else)]
 
 use crate::cli::RunCommand;
-use crate::client::Client;
-use crate::output::print_json;
-use crate::repository;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository;
 use std::fmt::Write;
 
 /// Run the `gor run` subcommand.
diff --git a/src/cmd/search.rs b/crates/gor/src/cmd/search.rs
similarity index 99%
rename from src/cmd/search.rs
rename to crates/gor/src/cmd/search.rs
index c9f829d..d2042cd 100644
--- a/src/cmd/search.rs
+++ b/crates/gor/src/cmd/search.rs
@@ -5,9 +5,9 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::SearchCommand;
-use crate::client::Client;
-use crate::output::{format_count, format_date, print_json};
+use crate::render::{format_count, format_date, print_json};
 use anyhow::Context;
+use gor_core::client::Client;
 use std::fmt::Write as FmtWrite;
 
 /// Run the `gor search` subcommand.
diff --git a/src/cmd/secret.rs b/crates/gor/src/cmd/secret.rs
similarity index 98%
rename from src/cmd/secret.rs
rename to crates/gor/src/cmd/secret.rs
index 84e9e32..24b37f5 100644
--- a/src/cmd/secret.rs
+++ b/crates/gor/src/cmd/secret.rs
@@ -5,10 +5,10 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::SecretCommand;
-use crate::client::Client;
-use crate::output::print_json;
-use crate::repository::detect_remote;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository::detect_remote;
 
 /// Run the `gor secret` subcommand.
 ///
diff --git a/src/cmd/util.rs b/crates/gor/src/cmd/util.rs
similarity index 100%
rename from src/cmd/util.rs
rename to crates/gor/src/cmd/util.rs
diff --git a/src/cmd/variable.rs b/crates/gor/src/cmd/variable.rs
similarity index 98%
rename from src/cmd/variable.rs
rename to crates/gor/src/cmd/variable.rs
index 726aa85..d55b0e5 100644
--- a/src/cmd/variable.rs
+++ b/crates/gor/src/cmd/variable.rs
@@ -5,10 +5,10 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::VariableCommand;
-use crate::client::Client;
-use crate::output::print_json;
-use crate::repository::detect_remote;
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository::detect_remote;
 
 /// Run the `gor variable` subcommand.
 ///
diff --git a/src/cmd/workflow.rs b/crates/gor/src/cmd/workflow.rs
similarity index 98%
rename from src/cmd/workflow.rs
rename to crates/gor/src/cmd/workflow.rs
index bedb231..8485e7f 100644
--- a/src/cmd/workflow.rs
+++ b/crates/gor/src/cmd/workflow.rs
@@ -5,10 +5,10 @@
 #![allow(clippy::print_stdout)]
 
 use crate::cli::WorkflowCommand;
-use crate::client::Client;
-use crate::output::print_json;
-use crate::repository::{detect_remote, parse_repo_spec};
+use crate::render::print_json;
 use anyhow::Context;
+use gor_core::client::Client;
+use gor_core::repository::{detect_remote, parse_repo_spec};
 
 /// Run the `gor workflow` subcommand.
 ///
@@ -240,7 +240,7 @@ fn view(
             let branch = run["head_branch"].as_str().unwrap_or("—");
             let created = run["created_at"]
                 .as_str()
-                .map_or_else(|| "—".to_string(), crate::output::format_date);
+                .map_or_else(|| "—".to_string(), crate::render::format_date);
 
             println!(
                 "    {run_id:<8}  {run_status:<10}  {conclusion:<12}  {branch:<20}  {created:<16}",
diff --git a/src/lib.rs b/crates/gor/src/lib.rs
similarity index 93%
rename from src/lib.rs
rename to crates/gor/src/lib.rs
index 7c61dff..3e93093 100644
--- a/src/lib.rs
+++ b/crates/gor/src/lib.rs
@@ -28,16 +28,9 @@
 #![deny(missing_docs)]
 #![deny(unsafe_code)]
 
-pub mod auth;
 pub mod cli;
-pub mod client;
 pub mod cmd;
-pub mod config;
-pub mod error;
-pub mod host;
-pub mod keyring_store;
-pub mod output;
-pub mod repository;
+pub mod render;
 
 use clap::Parser;
 use cli::Args;
diff --git a/src/main.rs b/crates/gor/src/main.rs
similarity index 100%
rename from src/main.rs
rename to crates/gor/src/main.rs
diff --git a/src/output.rs b/crates/gor/src/render.rs
similarity index 98%
rename from src/output.rs
rename to crates/gor/src/render.rs
index cd6ba6b..74813e9 100644
--- a/src/output.rs
+++ b/crates/gor/src/render.rs
@@ -22,7 +22,7 @@ use serde_json::Value;
 /// # Examples
 ///
 /// ```no_run
-/// use gor::output::print_json;
+/// use gor::render::print_json;
 /// use serde_json::json;
 ///
 /// let data = json!({"name": "hello-world", "stars": 42});
@@ -65,7 +65,7 @@ pub fn print_json<T: Serialize>(value: &T, fields: Option<&[String]>) {
 /// # Examples
 ///
 /// ```
-/// use gor::output::format_date;
+/// use gor::render::format_date;
 ///
 /// assert_eq!(format_date("2024-01-15T10:30:00Z"), "Jan 15, 2024");
 /// assert_eq!(format_date("2023-12-25T00:00:00Z"), "Dec 25, 2023");
@@ -112,7 +112,7 @@ pub fn format_date(iso_date: &str) -> String {
 /// # Examples
 ///
 /// ```
-/// use gor::output::format_count;
+/// use gor::render::format_count;
 ///
 /// assert_eq!(format_count(0), "0");
 /// assert_eq!(format_count(42), "42");

From 793f7332a0aeaa25f7923ada511df99b0e0c5235 Mon Sep 17 00:00:00 2001
From: Kerry Hatcher <kerry@kerryhatcher.com>
Date: Sun, 26 Jul 2026 13:24:21 -0400
Subject: [PATCH 3/8] refactor(label): extract typed ops into gor-core

---
 crates/gor-core/src/label.rs | 438 ++++++++++++++++++++++++++++++
 crates/gor-core/src/lib.rs   |   3 +
 crates/gor-core/src/util.rs  |  52 ++++
 crates/gor/src/cmd/label.rs  | 508 ++++++++---------------------------
 4 files changed, 602 insertions(+), 399 deletions(-)
 create mode 100644 crates/gor-core/src/label.rs
 create mode 100644 crates/gor-core/src/util.rs

diff --git a/crates/gor-core/src/label.rs b/crates/gor-core/src/label.rs
new file mode 100644
index 0000000..31a56b0
--- /dev/null
+++ b/crates/gor-core/src/label.rs
@@ -0,0 +1,438 @@
+//! Typed operations and models for GitHub repository labels.
+//!
+//! Provides functions to list, create, update, delete, and clone labels
+//! on GitHub repositories, returning typed [`Label`] structs instead of
+//! raw JSON values.
+
+use crate::client::Client;
+use crate::error::GorError;
+use crate::repository::RepoSplit;
+use crate::util::urlencode_label_name;
+use serde::{Deserialize, Serialize};
+use std::collections::HashSet;
+
+/// A GitHub repository label.
+///
+/// Fields are hand-picked for gor's usage. Unknown fields from the API
+/// are captured in [`extra`](Self::extra) via `#[serde(flatten)]`.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
+pub struct Label {
+    /// The label's display name.
+    pub name: String,
+    /// The hex color code (without `#`).
+    pub color: String,
+    /// An optional description of the label.
+    #[serde(default)]
+    pub description: Option<String>,
+    /// Any additional fields returned by the API not in this struct.
+    #[serde(flatten)]
+    pub extra: serde_json::Map<String, serde_json::Value>,
+}
+
+/// Options for [`list`].
+#[derive(Debug, Default)]
+pub struct ListOptions {
+    /// Filter labels whose name contains this substring (case-insensitive).
+    pub search: Option<String>,
+    /// Maximum number of labels to return.
+    pub limit: u32,
+}
+
+/// Options for [`create`].
+#[derive(Debug, Default)]
+pub struct CreateOptions {
+    /// The hex color code (without `#`). Defaults to `"ededed"`.
+    pub color: Option<String>,
+    /// An optional description.
+    pub description: Option<String>,
+}
+
+/// Options for [`update`].
+#[derive(Debug, Default)]
+pub struct UpdateOptions {
+    /// New name for the label.
+    pub new_name: Option<String>,
+    /// New hex color code.
+    pub color: Option<String>,
+    /// New description.
+    pub description: Option<String>,
+}
+
+/// Result of a [`clone_from`] operation.
+#[derive(Debug, Clone)]
+pub struct CloneResult {
+    /// Number of labels created in the target repo.
+    pub created: u32,
+    /// Number of labels updated in the target repo.
+    pub updated: u32,
+    /// Number of labels skipped (already exist and `force` was false, or an error occurred).
+    pub skipped: u32,
+}
+
+/// List labels in a repository.
+///
+/// # Errors
+///
+/// Returns [`GorError::NotFound`] if the repository does not exist,
+/// or [`GorError::Http`] on HTTP failures.
+pub fn list(client: &Client, spec: &RepoSplit, opts: &ListOptions) -> Result<Vec<Label>, GorError> {
+    let path = format!(
+        "/repos/{}/{}/labels?per_page={}",
+        spec.owner,
+        spec.repo,
+        opts.limit.min(100)
+    );
+    let response = client.get(&path)?;
+
+    let status = response.status();
+    if status == reqwest::StatusCode::NOT_FOUND {
+        return Err(GorError::NotFound(format!("repository '{spec}' not found")));
+    }
+    if !status.is_success() {
+        if let Err(e) = response.error_for_status_ref() {
+            return Err(GorError::Http(e));
+        }
+    }
+
+    let mut labels: Vec<Label> = response.json().map_err(GorError::Http)?;
+
+    // Client-side search filter
+    if let Some(ref query) = opts.search {
+        let query_lower = query.to_lowercase();
+        labels.retain(|label| label.name.to_lowercase().contains(&query_lower));
+    }
+
+    // Apply limit
+    labels.truncate(opts.limit as usize);
+
+    Ok(labels)
+}
+
+/// Create a label in a repository.
+///
+/// # Errors
+///
+/// Returns [`GorError::InvalidInput`] if the label already exists,
+/// [`GorError::NotFound`] if the repository does not exist,
+/// or [`GorError::Http`] on HTTP failures.
+pub fn create(
+    client: &Client,
+    spec: &RepoSplit,
+    name: &str,
+    opts: &CreateOptions,
+) -> Result<Label, GorError> {
+    let color_value = opts.color.as_deref().unwrap_or("ededed");
+
+    let mut body_map = serde_json::Map::new();
+    body_map.insert(
+        "name".to_string(),
+        serde_json::Value::String(name.to_string()),
+    );
+    body_map.insert(
+        "color".to_string(),
+        serde_json::Value::String(color_value.to_string()),
+    );
+    if let Some(ref desc) = opts.description {
+        body_map.insert(
+            "description".to_string(),
+            serde_json::Value::String(desc.clone()),
+        );
+    }
+
+    let path = format!("/repos/{}/{}/labels", spec.owner, spec.repo);
+    let body_value = serde_json::Value::Object(body_map);
+    let response = client.post(&path, &body_value)?;
+
+    let status = response.status();
+    if status == reqwest::StatusCode::UNPROCESSABLE_ENTITY {
+        return Err(GorError::InvalidInput(format!(
+            "label '{name}' already exists in '{spec}'"
+        )));
+    }
+    if !status.is_success() {
+        let err_body: serde_json::Value = response.json().unwrap_or_default();
+        let msg = err_body["message"].as_str().unwrap_or("creation failed");
+        return Err(GorError::InvalidInput(format!(
+            "failed to create label '{name}': {msg}"
+        )));
+    }
+
+    response.json().map_err(GorError::Http)
+}
+
+/// Update a label in a repository.
+///
+/// # Errors
+///
+/// Returns [`GorError::NotFound`] if the label does not exist,
+/// or [`GorError::Http`] on HTTP failures.
+pub fn update(
+    client: &Client,
+    spec: &RepoSplit,
+    name: &str,
+    opts: &UpdateOptions,
+) -> Result<Label, GorError> {
+    let mut body_map = serde_json::Map::new();
+    if let Some(ref new_name) = opts.new_name {
+        body_map.insert(
+            "new_name".to_string(),
+            serde_json::Value::String(new_name.clone()),
+        );
+    }
+    if let Some(ref c) = opts.color {
+        body_map.insert("color".to_string(), serde_json::Value::String(c.clone()));
+    }
+    if let Some(ref desc) = opts.description {
+        body_map.insert(
+            "description".to_string(),
+            serde_json::Value::String(desc.clone()),
+        );
+    }
+
+    if body_map.is_empty() {
+        return Err(GorError::InvalidInput(
+            "no changes specified; use --rename, --color, or --description".to_string(),
+        ));
+    }
+
+    let path = format!(
+        "/repos/{}/{}/labels/{}",
+        spec.owner,
+        spec.repo,
+        urlencode_label_name(name)
+    );
+    let body_value = serde_json::Value::Object(body_map);
+    let body_bytes = serde_json::to_vec(&body_value)
+        .map_err(|e| GorError::InvalidInput(format!("failed to serialize request body: {e}")))?;
+    let response = client.request("PATCH", &path, &[], Some(body_bytes))?;
+
+    let status = response.status();
+    if status == reqwest::StatusCode::NOT_FOUND {
+        return Err(GorError::NotFound(format!(
+            "label '{name}' not found in '{spec}'"
+        )));
+    }
+    if !status.is_success() {
+        let err_body: serde_json::Value = response.json().unwrap_or_default();
+        let msg = err_body["message"].as_str().unwrap_or("edit failed");
+        return Err(GorError::InvalidInput(format!(
+            "failed to edit label '{name}': {msg}"
+        )));
+    }
+
+    response.json().map_err(GorError::Http)
+}
+
+/// Delete a label from a repository.
+///
+/// # Errors
+///
+/// Returns [`GorError::NotFound`] if the label does not exist,
+/// or [`GorError::Http`] on HTTP failures.
+pub fn delete(client: &Client, spec: &RepoSplit, name: &str) -> Result<(), GorError> {
+    let path = format!(
+        "/repos/{}/{}/labels/{}",
+        spec.owner,
+        spec.repo,
+        urlencode_label_name(name)
+    );
+    let response = client.request("DELETE", &path, &[], None)?;
+
+    let status = response.status();
+    if status == reqwest::StatusCode::NOT_FOUND {
+        return Err(GorError::NotFound(format!(
+            "label '{name}' not found in '{spec}'"
+        )));
+    }
+    if !status.is_success() {
+        if let Err(e) = response.error_for_status_ref() {
+            return Err(GorError::Http(e));
+        }
+    }
+
+    Ok(())
+}
+
+/// Clone labels from one repository to another.
+///
+/// Fetches all labels from `source` and creates or updates them in `target`.
+/// When `force` is `true`, existing labels in the target are updated.
+///
+/// # Errors
+///
+/// Returns [`GorError::NotFound`] if either repository does not exist,
+/// or [`GorError::Http`] on HTTP failures.
+pub fn clone_from(
+    client: &Client,
+    source: &RepoSplit,
+    target: &RepoSplit,
+    force: bool,
+) -> Result<CloneResult, GorError> {
+    // Fetch source labels
+    let source_path = format!(
+        "/repos/{}/{}/labels?per_page=100",
+        source.owner, source.repo
+    );
+    let resp = client.get(&source_path)?;
+    let status = resp.status();
+    if status == reqwest::StatusCode::NOT_FOUND {
+        return Err(GorError::NotFound(format!(
+            "source repository '{source}' not found"
+        )));
+    }
+    if !status.is_success() {
+        if let Err(e) = resp.error_for_status_ref() {
+            return Err(GorError::Http(e));
+        }
+    }
+    let source_labels: Vec<Label> = resp.json().map_err(GorError::Http)?;
+
+    // Fetch existing target labels for conflict detection
+    let target_path = format!(
+        "/repos/{}/{}/labels?per_page=100",
+        target.owner, target.repo
+    );
+    let existing: Vec<Label> = client
+        .get(&target_path)
+        .ok()
+        .and_then(|r| r.json().ok())
+        .unwrap_or_default();
+    let existing_names: HashSet<&str> = existing.iter().map(|l| l.name.as_str()).collect();
+
+    let mut result = CloneResult {
+        created: 0,
+        updated: 0,
+        skipped: 0,
+    };
+
+    for label in &source_labels {
+        if existing_names.contains(label.name.as_str()) {
+            if force {
+                // Update existing label
+                let opts = UpdateOptions {
+                    color: Some(label.color.clone()),
+                    description: label.description.clone(),
+                    ..Default::default()
+                };
+                if update(client, target, &label.name, &opts).is_ok() {
+                    result.updated += 1;
+                } else {
+                    result.skipped += 1;
+                }
+            } else {
+                result.skipped += 1;
+            }
+        } else {
+            // Create new label
+            let opts = CreateOptions {
+                color: Some(label.color.clone()),
+                description: label.description.clone(),
+            };
+            if create(client, target, &label.name, &opts).is_ok() {
+                result.created += 1;
+            } else {
+                result.skipped += 1;
+            }
+        }
+    }
+
+    Ok(result)
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn label_deserialization_basic() {
+        let json = json!({
+            "name": "bug",
+            "color": "d73a4a",
+            "description": "Something isn't working"
+        });
+        let label: Label = serde_json::from_value(json).expect("valid label");
+        assert_eq!(label.name, "bug");
+        assert_eq!(label.color, "d73a4a");
+        assert_eq!(
+            label.description.as_deref(),
+            Some("Something isn't working")
+        );
+    }
+
+    #[test]
+    fn label_deserialization_no_description() {
+        let json = json!({
+            "name": "bug",
+            "color": "d73a4a"
+        });
+        let label: Label = serde_json::from_value(json).expect("valid label");
+        assert_eq!(label.name, "bug");
+        assert_eq!(label.color, "d73a4a");
+        assert!(label.description.is_none());
+    }
+
+    #[test]
+    fn label_deserialization_extra_fields() {
+        let json = json!({
+            "name": "bug",
+            "color": "d73a4a",
+            "default": true,
+            "url": "https://api.github.com/repos/o/r/labels/bug"
+        });
+        let label: Label = serde_json::from_value(json).expect("valid label");
+        assert_eq!(label.name, "bug");
+        assert!(label.extra.contains_key("default"));
+        assert!(label.extra.contains_key("url"));
+    }
+
+    #[test]
+    fn label_serialization() {
+        let label = Label {
+            name: "bug".to_string(),
+            color: "d73a4a".to_string(),
+            description: Some("Bug report".to_string()),
+            extra: serde_json::Map::new(),
+        };
+        let json = serde_json::to_value(&label).expect("valid json");
+        assert_eq!(json["name"], "bug");
+        assert_eq!(json["color"], "d73a4a");
+        assert_eq!(json["description"], "Bug report");
+    }
+
+    #[test]
+    fn clone_result_default() {
+        let r = CloneResult {
+            created: 0,
+            updated: 0,
+            skipped: 0,
+        };
+        assert_eq!(r.created, 0);
+        assert_eq!(r.updated, 0);
+        assert_eq!(r.skipped, 0);
+    }
+
+    #[test]
+    fn list_options_default() {
+        let opts = ListOptions::default();
+        assert!(opts.search.is_none());
+        assert_eq!(opts.limit, 0);
+    }
+
+    #[test]
+    fn create_options_default() {
+        let opts = CreateOptions::default();
+        assert!(opts.color.is_none());
+        assert!(opts.description.is_none());
+    }
+
+    #[test]
+    fn update_options_default() {
+        let opts = UpdateOptions::default();
+        assert!(opts.new_name.is_none());
+        assert!(opts.color.is_none());
+        assert!(opts.description.is_none());
+    }
+}
diff --git a/crates/gor-core/src/lib.rs b/crates/gor-core/src/lib.rs
index aebdd6e..cb26f0b 100644
--- a/crates/gor-core/src/lib.rs
+++ b/crates/gor-core/src/lib.rs
@@ -15,6 +15,9 @@ pub mod host;
 pub mod keyring_store;
 pub mod repository;
 
+pub mod label;
+pub mod util;
+
 /// Convenience re-exports of key types.
 pub use client::Client;
 pub use error::GorError;
diff --git a/crates/gor-core/src/util.rs b/crates/gor-core/src/util.rs
new file mode 100644
index 0000000..e299e28
--- /dev/null
+++ b/crates/gor-core/src/util.rs
@@ -0,0 +1,52 @@
+//! Shared utility functions for gor-core.
+
+/// URL-encode a label name for use in API paths.
+///
+/// GitHub API paths can contain special characters in label names
+/// that must be percent-encoded.
+#[must_use]
+pub fn urlencode_label_name(s: &str) -> String {
+    s.replace('#', "%23")
+        .replace(' ', "%20")
+        .replace('?', "%3F")
+        .replace('&', "%26")
+}
+
+#[cfg(test)]
+#[allow(clippy::expect_used)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn urlencode_normal() {
+        assert_eq!(urlencode_label_name("bug"), "bug");
+    }
+
+    #[test]
+    fn urlencode_with_hash() {
+        assert_eq!(urlencode_label_name("bug#1"), "bug%231");
+    }
+
+    #[test]
+    fn urlencode_with_space() {
+        assert_eq!(urlencode_label_name("in progress"), "in%20progress");
+    }
+
+    #[test]
+    fn urlencode_with_question_mark() {
+        assert_eq!(urlencode_label_name("where?"), "where%3F");
+    }
+
+    #[test]
+    fn urlencode_with_ampersand() {
+        assert_eq!(urlencode_label_name("R&D"), "R%26D");
+    }
+
+    #[test]
+    fn urlencode_combined() {
+        assert_eq!(
+            urlencode_label_name("bug #1?fix&go"),
+            "bug%20%231%3Ffix%26go"
+        );
+    }
+}
diff --git a/crates/gor/src/cmd/label.rs b/crates/gor/src/cmd/label.rs
index 66688d6..dea1097 100644
--- a/crates/gor/src/cmd/label.rs
+++ b/crates/gor/src/cmd/label.rs
@@ -1,15 +1,17 @@
 //! Implementation of the `gor label` subcommand.
 //!
-//! Provides label listing functionality.
-//! Currently supports `gor label list` for listing repository labels.
+//! Thin CLI handler that resolves CLI arguments, delegates to `gor_core::label`
+//! typed operations, and renders the results.
 
 #![allow(clippy::print_stdout)]
 
 use crate::cli::LabelCommand;
+use crate::cmd::util::truncate;
 use crate::render::print_json;
-use anyhow::Context;
-use gor_core::client::Client;
+use gor_core::Client;
+use gor_core::label::{self, CloneResult, CreateOptions, Label, ListOptions, UpdateOptions};
 use gor_core::repository::{detect_remote, parse_repo_spec};
+use std::io::Write;
 
 /// Run the `gor label` subcommand.
 ///
@@ -74,14 +76,23 @@ pub fn run(cmd: LabelCommand) -> anyhow::Result<()> {
     }
 }
 
+fn resolve_spec(repo: Option<&str>) -> anyhow::Result<gor_core::RepoSplit> {
+    match repo {
+        Some(s) => Ok(parse_repo_spec(s)?),
+        None => detect_remote().ok_or_else(|| {
+            anyhow::anyhow!(
+                "could not detect repository from current directory; specify OWNER/REPO with --repo"
+            )
+        }),
+    }
+}
+
+fn build_client(hostname: Option<&str>) -> anyhow::Result<Client> {
+    let host = hostname.unwrap_or("github.com");
+    Client::new(host).map_err(|e| anyhow::anyhow!("failed to create HTTP client: {e}"))
+}
+
 /// Execute `gor label list`.
-///
-/// Lists all labels in a repository. Supports filtering by name substring,
-/// limiting results, and JSON output with field selection.
-///
-/// # Errors
-///
-/// Returns an error if the repository cannot be found or the API request fails.
 fn list(
     repo: Option<&str>,
     search: Option<&str>,
@@ -89,105 +100,34 @@ fn list(
     json: Option<Vec<String>>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let spec = match repo {
-        Some(s) => parse_repo_spec(s).context("invalid repository spec")?,
-        None => detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository from current directory; specify OWNER/REPO with --repo"
-            )
-        })?,
-    };
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = format!(
-        "/repos/{}/{}/labels?per_page={}",
-        spec.owner,
-        spec.repo,
-        limit.min(100)
-    );
-    let response = client.get(&path).context("failed to fetch labels")?;
-
-    let status = response.status();
-    if status == reqwest::StatusCode::NOT_FOUND {
-        anyhow::bail!("repository '{spec}' not found");
-    }
-    if !status.is_success() {
-        anyhow::bail!("failed to list labels for '{spec}': HTTP {status}");
-    }
-
-    let mut labels: Vec<serde_json::Value> =
-        response.json().context("failed to parse labels response")?;
-
-    // Client-side search filter
-    if let Some(query) = search {
-        let query_lower = query.to_lowercase();
-        labels.retain(|label| {
-            label["name"]
-                .as_str()
-                .is_some_and(|name| name.to_lowercase().contains(&query_lower))
-        });
-    }
+    let spec = resolve_spec(repo)?;
+    let client = build_client(hostname)?;
 
-    // Apply limit
-    labels.truncate(limit as usize);
+    let opts = ListOptions {
+        search: search.map(String::from),
+        limit,
+    };
+    let labels = label::list(&client, &spec, &opts)?;
 
-    // Handle --json flag
     if let Some(fields) = json {
         let fields_ref: Option<&[String]> = if fields.is_empty() {
             None
         } else {
             Some(&fields)
         };
-        print_json(&labels, fields_ref);
+        let values: Vec<serde_json::Value> = labels
+            .into_iter()
+            .map(|l| serde_json::to_value(l).unwrap_or_default())
+            .collect();
+        print_json(&values, fields_ref);
         return Ok(());
     }
 
-    // Default: print formatted table
     print_label_table(&labels);
     Ok(())
 }
 
-/// Print a formatted label list table.
-///
-/// Columns: NAME, COLOR, DESCRIPTION
-fn print_label_table(labels: &[serde_json::Value]) {
-    if labels.is_empty() {
-        println!("No labels found.");
-        return;
-    }
-
-    let name_width = 24;
-    let color_width = 10;
-    let desc_width = 60;
-
-    println!(
-        "{:<name_width$}  {:<color_width$}  {:<desc_width$}",
-        "NAME", "COLOR", "DESCRIPTION",
-    );
-
-    for label in labels {
-        let name = label["name"].as_str().unwrap_or("—");
-        let color = label["color"].as_str().unwrap_or("—");
-        let description = label["description"].as_str().unwrap_or("—");
-
-        let name_truncated = crate::cmd::util::truncate(name, name_width);
-        let desc_truncated = crate::cmd::util::truncate(description, desc_width);
-
-        println!(
-            "{name_truncated:<name_width$}  #{color:<color_width$}  {desc_truncated:<desc_width$}",
-        );
-    }
-}
-
 /// Execute `gor label create`.
-///
-/// Creates a new label with the given name, optional color, and description.
-///
-/// # Errors
-///
-/// Returns an error if the repository cannot be found or the API request fails.
 fn create(
     name: &str,
     color: Option<&str>,
@@ -195,66 +135,20 @@ fn create(
     repo: Option<&str>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let spec = match repo {
-        Some(s) => parse_repo_spec(s).context("invalid repository spec")?,
-        None => detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository from current directory; specify OWNER/REPO with --repo"
-            )
-        })?,
-    };
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
+    let spec = resolve_spec(repo)?;
+    let client = build_client(hostname)?;
 
-    let color_value = color.unwrap_or("ededed");
-
-    let mut body_map = serde_json::Map::new();
-    body_map.insert(
-        "name".to_string(),
-        serde_json::Value::String(name.to_string()),
-    );
-    body_map.insert(
-        "color".to_string(),
-        serde_json::Value::String(color_value.to_string()),
-    );
-    if let Some(desc) = description {
-        body_map.insert(
-            "description".to_string(),
-            serde_json::Value::String(desc.to_string()),
-        );
-    }
-
-    let path = format!("/repos/{}/{}/labels", spec.owner, spec.repo);
-    let body_value = serde_json::Value::Object(body_map);
-    let response = client
-        .post(&path, &body_value)
-        .context("failed to create label")?;
-
-    let status = response.status();
-    if status == reqwest::StatusCode::UNPROCESSABLE_ENTITY {
-        anyhow::bail!("label '{name}' already exists in '{spec}'");
-    }
-    if !status.is_success() {
-        let err_body: serde_json::Value = response.json().unwrap_or_default();
-        let msg = err_body["message"].as_str().unwrap_or("creation failed");
-        anyhow::bail!("failed to create label '{name}': {msg}");
-    }
+    let opts = CreateOptions {
+        color: color.map(String::from),
+        description: description.map(String::from),
+    };
+    let label = label::create(&client, &spec, name, &opts)?;
 
-    let label: serde_json::Value = response.json().context("failed to parse response")?;
-    let label_name = label["name"].as_str().unwrap_or(name);
-    let label_color = label["color"].as_str().unwrap_or(color_value);
-    println!("✓ Created label '{label_name}' (#{label_color})");
+    println!("✓ Created label '{}' (#{})", label.name, label.color);
     Ok(())
 }
 
 /// Execute `gor label edit`.
-///
-/// Edits an existing label's name, color, or description.
-///
-/// # Errors
-///
-/// Returns an error if the label does not exist or the API request fails.
 fn edit(
     name: &str,
     rename: Option<&str>,
@@ -263,91 +157,29 @@ fn edit(
     repo: Option<&str>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let spec = match repo {
-        Some(s) => parse_repo_spec(s).context("invalid repository spec")?,
-        None => detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository from current directory; specify OWNER/REPO with --repo"
-            )
-        })?,
-    };
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let mut body_map = serde_json::Map::new();
-    if let Some(new_name) = rename {
-        body_map.insert(
-            "new_name".to_string(),
-            serde_json::Value::String(new_name.to_string()),
-        );
-    }
-    if let Some(c) = color {
-        body_map.insert(
-            "color".to_string(),
-            serde_json::Value::String(c.to_string()),
-        );
-    }
-    if let Some(desc) = description {
-        body_map.insert(
-            "description".to_string(),
-            serde_json::Value::String(desc.to_string()),
-        );
-    }
+    let spec = resolve_spec(repo)?;
+    let client = build_client(hostname)?;
 
-    if body_map.is_empty() {
-        anyhow::bail!("no changes specified; use --rename, --color, or --description");
-    }
+    let opts = UpdateOptions {
+        new_name: rename.map(String::from),
+        color: color.map(String::from),
+        description: description.map(String::from),
+    };
+    let label = label::update(&client, &spec, name, &opts)?;
 
-    let path = format!(
-        "/repos/{}/{}/labels/{}",
-        spec.owner,
-        spec.repo,
-        urlencoding(name)
+    let label_desc = label.description.as_deref().unwrap_or("—");
+    println!(
+        "✓ Updated label '{}' (#{}): {}",
+        label.name, label.color, label_desc
     );
-    let body_value = serde_json::Value::Object(body_map);
-    let response = client
-        .request("PATCH", &path, &[], Some(serde_json::to_vec(&body_value)?))
-        .context("failed to edit label")?;
-
-    let status = response.status();
-    if status == reqwest::StatusCode::NOT_FOUND {
-        anyhow::bail!("label '{name}' not found in '{spec}'");
-    }
-    if !status.is_success() {
-        let err_body: serde_json::Value = response.json().unwrap_or_default();
-        let msg = err_body["message"].as_str().unwrap_or("edit failed");
-        anyhow::bail!("failed to edit label '{name}': {msg}");
-    }
-
-    let label: serde_json::Value = response.json().context("failed to parse response")?;
-    let label_name = label["name"].as_str().unwrap_or(name);
-    let label_color = label["color"].as_str().unwrap_or("—");
-    let label_desc = label["description"].as_str().unwrap_or("—");
-    println!("✓ Updated label '{label_name}' (#{label_color}): {label_desc}");
     Ok(())
 }
 
 /// Execute `gor label delete`.
-///
-/// Deletes a label by name. Prompts for confirmation unless `--yes` is passed.
-///
-/// # Errors
-///
-/// Returns an error if the label does not exist or the API request fails.
 fn delete(name: &str, repo: Option<&str>, yes: bool, hostname: Option<&str>) -> anyhow::Result<()> {
-    let spec = match repo {
-        Some(s) => parse_repo_spec(s).context("invalid repository spec")?,
-        None => detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository from current directory; specify OWNER/REPO with --repo"
-            )
-        })?,
-    };
+    let spec = resolve_spec(repo)?;
 
-    // Confirmation prompt
     if !yes {
-        use std::io::Write;
         print!("Delete label '{name}' from '{spec}'? [y/N] ");
         std::io::stdout().flush().ok();
         let mut input = String::new();
@@ -359,175 +191,60 @@ fn delete(name: &str, repo: Option<&str>, yes: bool, hostname: Option<&str>) ->
         }
     }
 
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = format!(
-        "/repos/{}/{}/labels/{}",
-        spec.owner,
-        spec.repo,
-        urlencoding(name)
-    );
-    let response = client
-        .request("DELETE", &path, &[], None)
-        .context("failed to delete label")?;
-
-    let status = response.status();
-    if status == reqwest::StatusCode::NOT_FOUND {
-        anyhow::bail!("label '{name}' not found in '{spec}'");
-    }
-    if status == reqwest::StatusCode::NO_CONTENT {
-        println!("✓ Deleted label '{name}'");
-        return Ok(());
-    }
-    if !status.is_success() {
-        anyhow::bail!("failed to delete label '{name}': HTTP {status}");
-    }
-
+    let client = build_client(hostname)?;
+    label::delete(&client, &spec, name)?;
+    println!("✓ Deleted label '{name}'");
     Ok(())
 }
 
 /// Execute `gor label clone`.
-///
-/// Clones all labels from a source repository to the target repository.
-/// Supports `--force` to overwrite existing labels.
-///
-/// # Errors
-///
-/// Returns an error if the source or target repository cannot be found,
-/// or if any API request fails.
 fn clone_labels(
     source: &str,
     repo: Option<&str>,
     force: bool,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let source_spec = parse_repo_spec(source).context("invalid source repository spec")?;
-
-    let target_spec = match repo {
-        Some(s) => parse_repo_spec(s).context("invalid repository spec")?,
-        None => detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository from current directory; specify OWNER/REPO with --repo"
-            )
-        })?,
-    };
+    let source_spec = parse_repo_spec(source)?;
+    let target_spec = resolve_spec(repo)?;
+    let client = build_client(hostname)?;
 
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
+    let CloneResult {
+        created,
+        updated,
+        skipped,
+    } = label::clone_from(&client, &source_spec, &target_spec, force)?;
 
-    // Fetch source labels
-    let source_path = format!(
-        "/repos/{}/{}/labels?per_page=100",
-        source_spec.owner, source_spec.repo
+    println!(
+        "✓ Cloned labels from '{source_spec}' to '{target_spec}': {created} created, {updated} updated, {skipped} skipped"
     );
-    let resp = client
-        .get(&source_path)
-        .context("failed to fetch source labels")?;
-    let status = resp.status();
-    if status == reqwest::StatusCode::NOT_FOUND {
-        anyhow::bail!("source repository '{source_spec}' not found");
-    }
-    if !status.is_success() {
-        anyhow::bail!("failed to fetch labels from '{source_spec}': HTTP {status}");
-    }
-    let source_labels: Vec<serde_json::Value> =
-        resp.json().context("failed to parse labels response")?;
+    Ok(())
+}
 
-    // Fetch existing target labels for conflict detection
-    let target_path = format!(
-        "/repos/{}/{}/labels?per_page=100",
-        target_spec.owner, target_spec.repo
-    );
-    let existing: Vec<serde_json::Value> = client
-        .get(&target_path)
-        .ok()
-        .and_then(|r| r.json().ok())
-        .unwrap_or_default();
-    let existing_names: std::collections::HashSet<&str> =
-        existing.iter().filter_map(|l| l["name"].as_str()).collect();
-
-    let mut created = 0u32;
-    let mut updated = 0u32;
-    let mut skipped = 0u32;
-
-    for label in &source_labels {
-        let label_name = label["name"].as_str().unwrap_or("");
-        let label_color = label["color"].as_str().unwrap_or("ededed");
-        let label_desc = label["description"].as_str().unwrap_or("");
-
-        if existing_names.contains(label_name) {
-            if force {
-                // Update existing label
-                let mut body_map = serde_json::Map::new();
-                body_map.insert(
-                    "color".to_string(),
-                    serde_json::Value::String(label_color.to_string()),
-                );
-                body_map.insert(
-                    "description".to_string(),
-                    serde_json::Value::String(label_desc.to_string()),
-                );
-                let edit_path = format!(
-                    "/repos/{}/{}/labels/{}",
-                    target_spec.owner,
-                    target_spec.repo,
-                    urlencoding(label_name)
-                );
-                let body_value = serde_json::Value::Object(body_map);
-                if client
-                    .request(
-                        "PATCH",
-                        &edit_path,
-                        &[],
-                        Some(serde_json::to_vec(&body_value).unwrap_or_default()),
-                    )
-                    .is_ok()
-                {
-                    updated += 1;
-                } else {
-                    skipped += 1;
-                }
-            } else {
-                skipped += 1;
-            }
-        } else {
-            // Create new label
-            let mut body_map = serde_json::Map::new();
-            body_map.insert(
-                "name".to_string(),
-                serde_json::Value::String(label_name.to_string()),
-            );
-            body_map.insert(
-                "color".to_string(),
-                serde_json::Value::String(label_color.to_string()),
-            );
-            body_map.insert(
-                "description".to_string(),
-                serde_json::Value::String(label_desc.to_string()),
-            );
-            let create_path = format!("/repos/{}/{}/labels", target_spec.owner, target_spec.repo);
-            let body_value = serde_json::Value::Object(body_map);
-            if client.post(&create_path, &body_value).is_ok() {
-                created += 1;
-            } else {
-                skipped += 1;
-            }
-        }
+/// Print a formatted label list table.
+fn print_label_table(labels: &[Label]) {
+    if labels.is_empty() {
+        println!("No labels found.");
+        return;
     }
 
+    let name_width = 24;
+    let color_width = 10;
+    let desc_width = 60;
+
     println!(
-        "✓ Cloned labels from '{source_spec}' to '{target_spec}': {created} created, {updated} updated, {skipped} skipped"
+        "{:<name_width$}  {:<color_width$}  {:<desc_width$}",
+        "NAME", "COLOR", "DESCRIPTION",
     );
-    Ok(())
-}
 
-/// URL-encode a label name for use in API paths.
-fn urlencoding(s: &str) -> String {
-    s.replace('#', "%23")
-        .replace(' ', "%20")
-        .replace('?', "%3F")
-        .replace('&', "%26")
+    for label in labels {
+        let name_truncated = truncate(&label.name, name_width);
+        let desc_truncated = truncate(label.description.as_deref().unwrap_or("—"), desc_width);
+
+        println!(
+            "{name_truncated:<name_width$}  #{color:<color_width$}  {desc_truncated:<desc_width$}",
+            color = label.color,
+        );
+    }
 }
 
 #[cfg(test)]
@@ -536,51 +253,44 @@ mod tests {
     use super::*;
     use serde_json::json;
 
+    fn make_label(name: &str, color: &str, description: Option<&str>) -> Label {
+        serde_json::from_value(json!({
+            "name": name,
+            "color": color,
+            "description": description,
+        }))
+        .expect("valid label")
+    }
+
     #[test]
     fn print_label_table_basic() {
-        let labels = vec![json!({
-            "name": "bug",
-            "color": "d73a4a",
-            "description": "Something isn't working"
-        })];
+        let labels = vec![make_label("bug", "d73a4a", Some("Something isn't working"))];
         print_label_table(&labels);
     }
 
     #[test]
     fn print_label_table_empty() {
-        let labels: Vec<serde_json::Value> = vec![];
+        let labels: Vec<Label> = vec![];
         print_label_table(&labels);
     }
 
     #[test]
     fn print_label_table_multiple() {
         let labels = vec![
-            json!({
-                "name": "bug",
-                "color": "d73a4a",
-                "description": "Something isn't working"
-            }),
-            json!({
-                "name": "enhancement",
-                "color": "a2eeef",
-                "description": "New feature or request"
-            }),
-            json!({
-                "name": "documentation",
-                "color": "0075ca",
-                "description": "Improvements or additions to documentation"
-            }),
+            make_label("bug", "d73a4a", Some("Something isn't working")),
+            make_label("enhancement", "a2eeef", Some("New feature or request")),
+            make_label(
+                "documentation",
+                "0075ca",
+                Some("Improvements or additions to documentation"),
+            ),
         ];
         print_label_table(&labels);
     }
 
     #[test]
     fn print_label_table_null_fields() {
-        let labels = vec![json!({
-            "name": null,
-            "color": null,
-            "description": null
-        })];
+        let labels: Vec<Label> = vec![make_label("nonesuch", "ffffff", None)];
         print_label_table(&labels);
     }
 }

From 02de2b321f4419805f15dea1f33758b1fb4e15f9 Mon Sep 17 00:00:00 2001
From: Kerry Hatcher <kerry@kerryhatcher.com>
Date: Sun, 26 Jul 2026 13:37:38 -0400
Subject: [PATCH 4/8] refactor(cache,org): extract typed ops into gor-core

---
 crates/gor-core/src/cache.rs |  89 ++++++++++++++++++++++++++++
 crates/gor-core/src/lib.rs   |   2 +
 crates/gor-core/src/org.rs   |  61 +++++++++++++++++++
 crates/gor/src/cmd/cache.rs  | 110 +++++++++++++----------------------
 crates/gor/src/cmd/org.rs    |  93 ++++++++++-------------------
 5 files changed, 222 insertions(+), 133 deletions(-)
 create mode 100644 crates/gor-core/src/cache.rs
 create mode 100644 crates/gor-core/src/org.rs

diff --git a/crates/gor-core/src/cache.rs b/crates/gor-core/src/cache.rs
new file mode 100644
index 0000000..a15489f
--- /dev/null
+++ b/crates/gor-core/src/cache.rs
@@ -0,0 +1,89 @@
+//! Typed operations and models for GitHub Actions caches.
+
+use crate::client::Client;
+use crate::error::GorError;
+use crate::repository::RepoSplit;
+use serde::{Deserialize, Serialize};
+
+/// A GitHub Actions cache entry.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
+pub struct Cache {
+    /// The cache key.
+    pub key: String,
+    /// Size in bytes.
+    #[serde(rename = "size_in_bytes")]
+    pub size_in_bytes: u64,
+    /// ISO 8601 creation timestamp.
+    #[serde(rename = "created_at")]
+    pub created_at: Option<String>,
+    /// Any additional fields returned by the API not captured above.
+    #[serde(flatten)]
+    pub extra: serde_json::Map<String, serde_json::Value>,
+}
+
+/// List caches in a repository.
+///
+/// # Errors
+///
+/// Returns [`GorError::Http`] on HTTP failures.
+pub fn list(client: &Client, spec: &RepoSplit) -> Result<Vec<Cache>, GorError> {
+    let path = format!(
+        "/repos/{}/{}/actions/caches?per_page=100",
+        spec.owner, spec.repo
+    );
+    let response = client.get(&path)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to list caches: HTTP {status}"
+        )));
+    }
+    let result: serde_json::Value = response.json().map_err(GorError::Http)?;
+    let caches: Vec<Cache> = serde_json::from_value(result["actions_caches"].clone())
+        .map_err(|e| GorError::InvalidInput(format!("failed to parse caches: {e}")))?;
+    Ok(caches)
+}
+
+/// Options for [`delete`].
+#[derive(Debug, Default)]
+pub struct DeleteOptions<'a> {
+    /// Delete a specific cache key.
+    pub key: Option<&'a str>,
+    /// Delete caches with a key prefix.
+    pub key_prefix: Option<&'a str>,
+    /// Filter by Git ref.
+    pub ref_: Option<&'a str>,
+}
+
+/// Delete caches from a repository.
+///
+/// # Errors
+///
+/// Returns [`GorError::Http`] on HTTP failures.
+pub fn delete(
+    client: &Client,
+    spec: &RepoSplit,
+    opts: &DeleteOptions<'_>,
+) -> Result<u64, GorError> {
+    use std::fmt::Write;
+    let mut path = format!("/repos/{}/{}/actions/caches", spec.owner, spec.repo);
+    if let Some(k) = opts.key {
+        let _ = write!(path, "?key={k}");
+    } else if let Some(prefix) = opts.key_prefix {
+        let _ = write!(path, "?key={prefix}");
+    }
+    if let Some(r) = opts.ref_ {
+        let sep = if path.contains('?') { "&" } else { "?" };
+        let _ = write!(path, "{sep}ref={r}");
+    }
+    let response = client.request("DELETE", &path, &[], None)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to delete caches: HTTP {status}"
+        )));
+    }
+    let result: serde_json::Value = response.json().map_err(GorError::Http)?;
+    Ok(result["total_count"].as_u64().unwrap_or(0))
+}
diff --git a/crates/gor-core/src/lib.rs b/crates/gor-core/src/lib.rs
index cb26f0b..7d82485 100644
--- a/crates/gor-core/src/lib.rs
+++ b/crates/gor-core/src/lib.rs
@@ -15,7 +15,9 @@ pub mod host;
 pub mod keyring_store;
 pub mod repository;
 
+pub mod cache;
 pub mod label;
+pub mod org;
 pub mod util;
 
 /// Convenience re-exports of key types.
diff --git a/crates/gor-core/src/org.rs b/crates/gor-core/src/org.rs
new file mode 100644
index 0000000..1499115
--- /dev/null
+++ b/crates/gor-core/src/org.rs
@@ -0,0 +1,61 @@
+//! Typed operations and models for GitHub organizations.
+
+use crate::client::Client;
+use crate::error::GorError;
+use serde::{Deserialize, Serialize};
+
+/// A GitHub organization.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
+pub struct Organization {
+    /// The organization's login name.
+    pub login: String,
+    /// Optional description.
+    #[serde(default)]
+    pub description: Option<String>,
+    /// Any additional fields returned by the API not captured above.
+    #[serde(flatten)]
+    pub extra: serde_json::Map<String, serde_json::Value>,
+}
+
+/// List organizations for the authenticated user.
+///
+/// # Errors
+///
+/// Returns [`GorError::Http`] on HTTP failures.
+pub fn list(client: &Client, limit: u32) -> Result<Vec<Organization>, GorError> {
+    let path = format!("/user/orgs?per_page={}", limit.min(100));
+    let response = client.get(&path)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to list organizations: HTTP {status}"
+        )));
+    }
+    let mut orgs: Vec<Organization> = response.json().map_err(GorError::Http)?;
+    orgs.truncate(limit as usize);
+    Ok(orgs)
+}
+
+/// View an organization by name.
+///
+/// # Errors
+///
+/// Returns [`GorError::NotFound`] if the organization does not exist,
+/// or [`GorError::Http`] on HTTP failures.
+pub fn view(client: &Client, org: &str) -> Result<serde_json::Value, GorError> {
+    let path = format!("/orgs/{org}");
+    let response = client.get(&path)?;
+    let status = response.status();
+    if status == reqwest::StatusCode::NOT_FOUND {
+        return Err(GorError::NotFound(format!(
+            "organization '{org}' not found"
+        )));
+    }
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to view organization: HTTP {status}"
+        )));
+    }
+    response.json().map_err(GorError::Http)
+}
diff --git a/crates/gor/src/cmd/cache.rs b/crates/gor/src/cmd/cache.rs
index 668bfdb..492ae7d 100644
--- a/crates/gor/src/cmd/cache.rs
+++ b/crates/gor/src/cmd/cache.rs
@@ -1,16 +1,13 @@
 //! Implementation of the `gor cache` subcommand.
-//!
-//! Provides repository cache listing and deletion.
 
 #![allow(clippy::print_stdout)]
 
 use crate::cli::CacheCommand;
+use crate::cmd::util::truncate;
 use crate::render::print_json;
-use anyhow::Context;
-use gor_core::client::Client;
-use gor_core::repository;
-
-use std::fmt::Write;
+use gor_core::Client;
+use gor_core::cache::{self, DeleteOptions};
+use gor_core::repository::{detect_remote, parse_repo_spec};
 
 /// Run the `gor cache` subcommand.
 ///
@@ -42,36 +39,29 @@ pub fn run(cmd: CacheCommand) -> anyhow::Result<()> {
     }
 }
 
+fn resolve_spec(repo: Option<&str>) -> anyhow::Result<gor_core::RepoSplit> {
+    match repo {
+        Some(s) => Ok(parse_repo_spec(s)?),
+        None => detect_remote().ok_or_else(|| {
+            anyhow::anyhow!("could not detect repository; specify OWNER/REPO with --repo")
+        }),
+    }
+}
+
+fn build_client(hostname: Option<&str>) -> anyhow::Result<Client> {
+    let host = hostname.unwrap_or("github.com");
+    Client::new(host).map_err(|e| anyhow::anyhow!("failed to create HTTP client: {e}"))
+}
+
 fn list(
     repo: Option<&str>,
     json: Option<Vec<String>>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let spec = match repo {
-        Some(s) => repository::parse_repo_spec(s).context("invalid repository spec")?,
-        None => repository::detect_remote().ok_or_else(|| {
-            anyhow::anyhow!("could not detect repository; specify OWNER/REPO with --repo")
-        })?,
-    };
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = format!(
-        "/repos/{}/{}/actions/caches?per_page=100",
-        spec.owner, spec.repo
-    );
-
-    let response = client.get(&path).context("failed to fetch caches")?;
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to list caches: HTTP {status}");
-    }
+    let spec = resolve_spec(repo)?;
+    let client = build_client(hostname)?;
 
-    let result: serde_json::Value = response.json().context("failed to parse response")?;
-    let caches: Vec<serde_json::Value> = result["actions_caches"]
-        .as_array()
-        .map_or_else(Vec::new, Clone::clone);
+    let caches = cache::list(&client, &spec)?;
 
     if let Some(fields) = json {
         let fields_ref: Option<&[String]> = if fields.is_empty() {
@@ -79,7 +69,11 @@ fn list(
         } else {
             Some(&fields)
         };
-        print_json(&caches, fields_ref);
+        let values: Vec<serde_json::Value> = caches
+            .into_iter()
+            .map(|c| serde_json::to_value(c).unwrap_or_default())
+            .collect();
+        print_json(&values, fields_ref);
         return Ok(());
     }
 
@@ -90,11 +84,12 @@ fn list(
 
     println!("{:<30}  {:<10}  CREATED", "KEY", "SIZE (MB)");
     for c in &caches {
-        let key = c["key"].as_str().unwrap_or("—");
-        let size = c["size_in_bytes"].as_u64().unwrap_or(0);
-        let created = c["created_at"].as_str().unwrap_or("—");
-        let key_truncated = crate::cmd::util::truncate(key, 30);
-        println!("{key_truncated:<30}  {:<10}  {created}", size / 1024 / 1024);
+        let key_truncated = truncate(&c.key, 30);
+        println!(
+            "{key_truncated:<30}  {:<10}  {}",
+            c.size_in_bytes / 1024 / 1024,
+            c.created_at.as_deref().unwrap_or("—"),
+        );
     }
 
     Ok(())
@@ -108,40 +103,15 @@ fn delete(
     ref_: Option<&str>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let spec = match repo {
-        Some(s) => repository::parse_repo_spec(s).context("invalid repository spec")?,
-        None => repository::detect_remote().ok_or_else(|| {
-            anyhow::anyhow!("could not detect repository; specify OWNER/REPO with --repo")
-        })?,
-    };
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let mut path = format!("/repos/{}/{}/actions/caches", spec.owner, spec.repo);
-
-    if let Some(k) = key {
-        let _ = write!(path, "?key={k}");
-    } else if let Some(prefix) = key_prefix {
-        let _ = write!(path, "?key={prefix}");
-    }
-
-    if let Some(r) = ref_ {
-        let sep = if path.contains('?') { "&" } else { "?" };
-        let _ = write!(path, "{sep}ref={r}");
-    }
-
-    let response = client
-        .request("DELETE", &path, &[], None)
-        .context("failed to delete caches")?;
+    let spec = resolve_spec(repo)?;
+    let client = build_client(hostname)?;
 
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to delete caches: HTTP {status}");
-    }
-
-    let result: serde_json::Value = response.json().context("failed to parse response")?;
-    let count = result["total_count"].as_u64().unwrap_or(0);
+    let opts = DeleteOptions {
+        key,
+        key_prefix,
+        ref_,
+    };
+    let count = cache::delete(&client, &spec, &opts)?;
 
     if all {
         println!("Deleted all caches ({count} total).");
diff --git a/crates/gor/src/cmd/org.rs b/crates/gor/src/cmd/org.rs
index d9091eb..bf7fd62 100644
--- a/crates/gor/src/cmd/org.rs
+++ b/crates/gor/src/cmd/org.rs
@@ -1,13 +1,12 @@
 //! Implementation of the `gor org` subcommand.
-//!
-//! Provides organization listing for the authenticated user.
 
 #![allow(clippy::print_stdout)]
 
 use crate::cli::OrgCommand;
+use crate::cmd::util::truncate;
 use crate::render::print_json;
-use anyhow::Context;
-use gor_core::client::Client;
+use gor_core::Client;
+use gor_core::org::{self, Organization};
 
 /// Run the `gor org` subcommand.
 ///
@@ -30,29 +29,15 @@ pub fn run(cmd: OrgCommand) -> anyhow::Result<()> {
     }
 }
 
-/// Execute `gor org list`.
-///
-/// Lists organizations the authenticated user belongs to.
-///
-/// # Errors
-///
-/// Returns an error if the API request fails.
-fn list(limit: u32, json: Option<Vec<String>>, hostname: Option<&str>) -> anyhow::Result<()> {
+fn build_client(hostname: Option<&str>) -> anyhow::Result<Client> {
     let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = format!("/user/orgs?per_page={}", limit.min(100));
-    let response = client.get(&path).context("failed to fetch organizations")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to list organizations: HTTP {status}");
-    }
+    Client::new(host).map_err(|e| anyhow::anyhow!("failed to create HTTP client: {e}"))
+}
 
-    let mut orgs: Vec<serde_json::Value> =
-        response.json().context("failed to parse orgs response")?;
+fn list(limit: u32, json: Option<Vec<String>>, hostname: Option<&str>) -> anyhow::Result<()> {
+    let client = build_client(hostname)?;
 
-    orgs.truncate(limit as usize);
+    let orgs = org::list(&client, limit)?;
 
     if let Some(fields) = json {
         let fields_ref: Option<&[String]> = if fields.is_empty() {
@@ -60,7 +45,11 @@ fn list(limit: u32, json: Option<Vec<String>>, hostname: Option<&str>) -> anyhow
         } else {
             Some(&fields)
         };
-        print_json(&orgs, fields_ref);
+        let values: Vec<serde_json::Value> = orgs
+            .into_iter()
+            .map(|o| serde_json::to_value(o).unwrap_or_default())
+            .collect();
+        print_json(&values, fields_ref);
         return Ok(());
     }
 
@@ -68,36 +57,15 @@ fn list(limit: u32, json: Option<Vec<String>>, hostname: Option<&str>) -> anyhow
     Ok(())
 }
 
-/// Execute `gor org view`.
-///
-/// Views an organization's profile and metadata.
-///
-/// # Errors
-///
-/// Returns an error if the API request fails.
 fn view(
-    org: &str,
+    org_name: &str,
     web: bool,
     json: Option<Vec<String>>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = format!("/orgs/{org}");
-    let response = client.get(&path).context("failed to fetch organization")?;
-
-    let status = response.status();
-    if status == reqwest::StatusCode::NOT_FOUND {
-        anyhow::bail!("organization '{org}' not found");
-    }
-    if !status.is_success() {
-        anyhow::bail!("failed to view organization: HTTP {status}");
-    }
-
-    let org_data: serde_json::Value = response.json().context("failed to parse response")?;
+    let client = build_client(hostname)?;
+    let org_data = org::view(&client, org_name)?;
 
-    // --web / -w: open in browser
     if web {
         if let Some(url) = org_data["html_url"].as_str() {
             crate::cmd::browse::open_in_browser(url);
@@ -105,7 +73,6 @@ fn view(
         }
     }
 
-    // --json: output as JSON
     if let Some(fields) = json {
         let fields_ref: Option<&[String]> = if fields.is_empty() {
             None
@@ -116,7 +83,6 @@ fn view(
         return Ok(());
     }
 
-    // Default: print details
     let name = org_data["name"].as_str().unwrap_or("—");
     let description = org_data["description"].as_str().unwrap_or("No description");
     let location = org_data["location"].as_str().unwrap_or("—");
@@ -136,8 +102,7 @@ fn view(
     Ok(())
 }
 
-/// Print a formatted organization list table.
-fn print_org_table(orgs: &[serde_json::Value]) {
+fn print_org_table(orgs: &[Organization]) {
     if orgs.is_empty() {
         println!("No organizations found.");
         return;
@@ -149,11 +114,8 @@ fn print_org_table(orgs: &[serde_json::Value]) {
     println!("{:<login_width$}  {:<desc_width$}", "LOGIN", "DESCRIPTION");
 
     for org in orgs {
-        let login = org["login"].as_str().unwrap_or("—");
-        let description = org["description"].as_str().unwrap_or("—");
-
-        let desc_truncated = crate::cmd::util::truncate(description, desc_width);
-
+        let login = &org.login;
+        let desc_truncated = truncate(org.description.as_deref().unwrap_or("—"), desc_width);
         println!("{login:<login_width$}  {desc_truncated:<desc_width$}");
     }
 }
@@ -164,18 +126,23 @@ mod tests {
     use super::*;
     use serde_json::json;
 
+    fn make_org(login: &str, description: Option<&str>) -> Organization {
+        serde_json::from_value(json!({
+            "login": login,
+            "description": description,
+        }))
+        .expect("valid org")
+    }
+
     #[test]
     fn print_org_table_basic() {
-        let orgs = vec![json!({
-            "login": "my-org",
-            "description": "My organization"
-        })];
+        let orgs = vec![make_org("my-org", Some("My organization"))];
         print_org_table(&orgs);
     }
 
     #[test]
     fn print_org_table_empty() {
-        let orgs: Vec<serde_json::Value> = vec![];
+        let orgs: Vec<Organization> = vec![];
         print_org_table(&orgs);
     }
 }

From 4621f832014f4e9e557733cc41cdb7410f85db72 Mon Sep 17 00:00:00 2001
From: Kerry Hatcher <kerry@kerryhatcher.com>
Date: Sun, 26 Jul 2026 13:41:33 -0400
Subject: [PATCH 5/8] refactor(secret,variable): extract typed ops into
 gor-core

---
 crates/gor-core/src/lib.rs      |   2 +
 crates/gor-core/src/secret.rs   | 133 +++++++++++++++++++++
 crates/gor-core/src/variable.rs | 142 +++++++++++++++++++++++
 crates/gor/src/cmd/secret.rs    | 162 ++++++++------------------
 crates/gor/src/cmd/variable.rs  | 198 ++++++++++----------------------
 5 files changed, 382 insertions(+), 255 deletions(-)
 create mode 100644 crates/gor-core/src/secret.rs
 create mode 100644 crates/gor-core/src/variable.rs

diff --git a/crates/gor-core/src/lib.rs b/crates/gor-core/src/lib.rs
index 7d82485..e978684 100644
--- a/crates/gor-core/src/lib.rs
+++ b/crates/gor-core/src/lib.rs
@@ -18,7 +18,9 @@ pub mod repository;
 pub mod cache;
 pub mod label;
 pub mod org;
+pub mod secret;
 pub mod util;
+pub mod variable;
 
 /// Convenience re-exports of key types.
 pub use client::Client;
diff --git a/crates/gor-core/src/secret.rs b/crates/gor-core/src/secret.rs
new file mode 100644
index 0000000..90f1fc3
--- /dev/null
+++ b/crates/gor-core/src/secret.rs
@@ -0,0 +1,133 @@
+//! Typed operations and models for GitHub Actions secrets.
+
+use crate::client::Client;
+use crate::error::GorError;
+use crate::repository::RepoSplit;
+use serde::{Deserialize, Serialize};
+
+/// A GitHub Actions secret.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
+pub struct Secret {
+    /// The secret name.
+    pub name: String,
+    /// ISO 8601 timestamp of last update.
+    pub updated_at: Option<String>,
+    /// ISO 8601 timestamp of creation.
+    pub created_at: Option<String>,
+    /// Any additional fields returned by the API.
+    #[serde(flatten)]
+    pub extra: serde_json::Map<String, serde_json::Value>,
+}
+
+/// Scope for a secret operation.
+pub enum SecretScope {
+    /// Repository-level secret.
+    Repo(RepoSplit),
+    /// Environment-level secret within a repository.
+    Environment {
+        /// The repository specification.
+        spec: RepoSplit,
+        /// The environment name.
+        env: String,
+    },
+    /// Organization-level secret.
+    Org(String),
+}
+
+impl SecretScope {
+    fn api_path(&self, name: &str) -> String {
+        match self {
+            Self::Repo(spec) => {
+                format!("/repos/{}/{}/actions/secrets/{name}", spec.owner, spec.repo)
+            }
+            Self::Environment { spec, env } => {
+                format!(
+                    "/repos/{}/{}/environments/{env}/secrets/{name}",
+                    spec.owner, spec.repo
+                )
+            }
+            Self::Org(org) => format!("/orgs/{org}/actions/secrets/{name}"),
+        }
+    }
+
+    fn api_list_path(&self) -> String {
+        match self {
+            Self::Repo(spec) => {
+                format!(
+                    "/repos/{}/{}/actions/secrets?per_page=100",
+                    spec.owner, spec.repo
+                )
+            }
+            Self::Environment { spec, env } => {
+                format!(
+                    "/repos/{}/{}/environments/{env}/secrets?per_page=100",
+                    spec.owner, spec.repo
+                )
+            }
+            Self::Org(org) => format!("/orgs/{org}/actions/secrets?per_page=100"),
+        }
+    }
+}
+
+/// List secrets.
+///
+/// # Errors
+///
+/// Returns [`GorError::Http`] on HTTP failures.
+pub fn list(client: &Client, scope: &SecretScope) -> Result<Vec<Secret>, GorError> {
+    let path = scope.api_list_path();
+    let response = client.get(&path)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to list secrets: HTTP {status}"
+        )));
+    }
+    let result: serde_json::Value = response.json().map_err(GorError::Http)?;
+    let secrets: Vec<Secret> = serde_json::from_value(result["secrets"].clone())
+        .map_err(|e| GorError::InvalidInput(format!("failed to parse secrets: {e}")))?;
+    Ok(secrets)
+}
+
+/// Set a secret value.
+///
+/// # Errors
+///
+/// Returns [`GorError::InvalidInput`] if no value is provided,
+/// or [`GorError::Http`] on HTTP failures.
+pub fn set(client: &Client, scope: &SecretScope, name: &str, value: &str) -> Result<(), GorError> {
+    let body = serde_json::json!({"encrypted_value": value});
+    let path = scope.api_path(name);
+    let body_bytes = serde_json::to_vec(&body)
+        .map_err(|e| GorError::InvalidInput(format!("serialization error: {e}")))?;
+    let response = client.request("PUT", &path, &[], Some(body_bytes))?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to set secret '{name}': HTTP {status}"
+        )));
+    }
+    Ok(())
+}
+
+/// Delete a secret.
+///
+/// # Errors
+///
+/// Returns [`GorError::NotFound`] if the secret does not exist,
+/// or [`GorError::Http`] on HTTP failures.
+pub fn delete(client: &Client, scope: &SecretScope, name: &str) -> Result<(), GorError> {
+    let path = scope.api_path(name);
+    let response = client.request("DELETE", &path, &[], None)?;
+    let status = response.status();
+    if status == reqwest::StatusCode::NOT_FOUND {
+        return Err(GorError::NotFound(format!("secret '{name}' not found")));
+    }
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to delete secret '{name}': HTTP {status}"
+        )));
+    }
+    Ok(())
+}
diff --git a/crates/gor-core/src/variable.rs b/crates/gor-core/src/variable.rs
new file mode 100644
index 0000000..3b5a6fa
--- /dev/null
+++ b/crates/gor-core/src/variable.rs
@@ -0,0 +1,142 @@
+//! Typed operations and models for GitHub Actions variables.
+
+use crate::client::Client;
+use crate::error::GorError;
+use crate::repository::RepoSplit;
+use serde::{Deserialize, Serialize};
+
+/// A GitHub Actions variable.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
+pub struct Variable {
+    /// The variable name.
+    pub name: String,
+    /// The variable value.
+    pub value: String,
+    /// ISO 8601 timestamp of last update.
+    pub updated_at: Option<String>,
+    /// ISO 8601 timestamp of creation.
+    pub created_at: Option<String>,
+    /// Any additional fields returned by the API.
+    #[serde(flatten)]
+    pub extra: serde_json::Map<String, serde_json::Value>,
+}
+
+/// Scope for a variable operation.
+pub enum VariableScope {
+    /// Repository-level variable.
+    Repo(RepoSplit),
+    /// Environment-level variable.
+    Environment {
+        /// The repository specification.
+        spec: RepoSplit,
+        /// The environment name.
+        env: String,
+    },
+    /// Organization-level variable.
+    Org(String),
+}
+
+impl VariableScope {
+    fn api_path(&self, name: &str) -> String {
+        match self {
+            Self::Repo(spec) => {
+                format!(
+                    "/repos/{}/{}/actions/variables/{name}",
+                    spec.owner, spec.repo
+                )
+            }
+            Self::Environment { spec, env } => {
+                format!(
+                    "/repos/{}/{}/environments/{env}/variables/{name}",
+                    spec.owner, spec.repo
+                )
+            }
+            Self::Org(org) => format!("/orgs/{org}/actions/variables/{name}"),
+        }
+    }
+
+    fn api_list_path(&self) -> String {
+        match self {
+            Self::Repo(spec) => {
+                format!(
+                    "/repos/{}/{}/actions/variables?per_page=100",
+                    spec.owner, spec.repo
+                )
+            }
+            Self::Environment { spec, env } => {
+                format!(
+                    "/repos/{}/{}/environments/{env}/variables?per_page=100",
+                    spec.owner, spec.repo
+                )
+            }
+            Self::Org(org) => format!("/orgs/{org}/actions/variables?per_page=100"),
+        }
+    }
+}
+
+/// List variables.
+///
+/// # Errors
+///
+/// Returns [`GorError::Http`] on HTTP failures.
+pub fn list(client: &Client, scope: &VariableScope) -> Result<Vec<Variable>, GorError> {
+    let path = scope.api_list_path();
+    let response = client.get(&path)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to list variables: HTTP {status}"
+        )));
+    }
+    let result: serde_json::Value = response.json().map_err(GorError::Http)?;
+    let variables: Vec<Variable> = serde_json::from_value(result["variables"].clone())
+        .map_err(|e| GorError::InvalidInput(format!("failed to parse variables: {e}")))?;
+    Ok(variables)
+}
+
+/// Set a variable value.
+///
+/// # Errors
+///
+/// Returns [`GorError::Http`] on HTTP failures.
+pub fn set(
+    client: &Client,
+    scope: &VariableScope,
+    name: &str,
+    value: &str,
+) -> Result<(), GorError> {
+    let body = serde_json::json!({"value": value});
+    let path = scope.api_path(name);
+    let body_bytes = serde_json::to_vec(&body)
+        .map_err(|e| GorError::InvalidInput(format!("serialization error: {e}")))?;
+    let response = client.request("PATCH", &path, &[], Some(body_bytes))?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to set variable '{name}': HTTP {status}"
+        )));
+    }
+    Ok(())
+}
+
+/// Delete a variable.
+///
+/// # Errors
+///
+/// Returns [`GorError::NotFound`] if the variable does not exist,
+/// or [`GorError::Http`] on HTTP failures.
+pub fn delete(client: &Client, scope: &VariableScope, name: &str) -> Result<(), GorError> {
+    let path = scope.api_path(name);
+    let response = client.request("DELETE", &path, &[], None)?;
+    let status = response.status();
+    if status == reqwest::StatusCode::NOT_FOUND {
+        return Err(GorError::NotFound(format!("variable '{name}' not found")));
+    }
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to delete variable '{name}': HTTP {status}"
+        )));
+    }
+    Ok(())
+}
diff --git a/crates/gor/src/cmd/secret.rs b/crates/gor/src/cmd/secret.rs
index 24b37f5..6b20cb4 100644
--- a/crates/gor/src/cmd/secret.rs
+++ b/crates/gor/src/cmd/secret.rs
@@ -1,14 +1,14 @@
 //! Implementation of the `gor secret` subcommand.
-//!
-//! Provides secret listing, creation, and deletion for GitHub Actions.
 
 #![allow(clippy::print_stdout)]
 
 use crate::cli::SecretCommand;
+use crate::cmd::util::truncate;
 use crate::render::print_json;
 use anyhow::Context;
-use gor_core::client::Client;
+use gor_core::Client;
 use gor_core::repository::detect_remote;
+use gor_core::secret::{self, SecretScope};
 
 /// Run the `gor secret` subcommand.
 ///
@@ -47,49 +47,42 @@ pub fn run(cmd: SecretCommand) -> anyhow::Result<()> {
     }
 }
 
-fn list(
-    org: Option<&str>,
-    env: Option<&str>,
-    json: Option<Vec<String>>,
-    hostname: Option<&str>,
-) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = if let Some(o) = org {
-        format!("/orgs/{o}/actions/secrets?per_page=100")
-    } else if let Some(e) = env {
+fn resolve_scope(org: Option<&str>, env: Option<&str>) -> anyhow::Result<SecretScope> {
+    if let Some(o) = org {
+        return Ok(SecretScope::Org(o.to_string()));
+    }
+    if let Some(e) = env {
         let spec = detect_remote().ok_or_else(|| {
             anyhow::anyhow!(
                 "could not detect repository; specify --repo or run from a repo directory"
             )
         })?;
-        format!(
-            "/repos/{}/{}/environments/{e}/secrets?per_page=100",
-            spec.owner, spec.repo
-        )
-    } else {
-        let spec = detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository; specify --org or run from a repo directory"
-            )
-        })?;
-        format!(
-            "/repos/{}/{}/actions/secrets?per_page=100",
-            spec.owner, spec.repo
-        )
-    };
-
-    let response = client.get(&path).context("failed to fetch secrets")?;
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to list secrets: HTTP {status}");
+        return Ok(SecretScope::Environment {
+            spec,
+            env: e.to_string(),
+        });
     }
+    let spec = detect_remote().ok_or_else(|| {
+        anyhow::anyhow!("could not detect repository; specify --org or run from a repo directory")
+    })?;
+    Ok(SecretScope::Repo(spec))
+}
 
-    let result: serde_json::Value = response.json().context("failed to parse response")?;
-    let secrets: Vec<serde_json::Value> = result["secrets"]
-        .as_array()
-        .map_or_else(Vec::new, Clone::clone);
+fn build_client(hostname: Option<&str>) -> anyhow::Result<Client> {
+    let host = hostname.unwrap_or("github.com");
+    Client::new(host).map_err(|e| anyhow::anyhow!("failed to create HTTP client: {e}"))
+}
+
+fn list(
+    org: Option<&str>,
+    env: Option<&str>,
+    json: Option<Vec<String>>,
+    hostname: Option<&str>,
+) -> anyhow::Result<()> {
+    let scope = resolve_scope(org, env)?;
+    let client = build_client(hostname)?;
+
+    let secrets = secret::list(&client, &scope)?;
 
     if let Some(fields) = json {
         let fields_ref: Option<&[String]> = if fields.is_empty() {
@@ -97,7 +90,11 @@ fn list(
         } else {
             Some(&fields)
         };
-        print_json(&secrets, fields_ref);
+        let values: Vec<serde_json::Value> = secrets
+            .into_iter()
+            .map(|s| serde_json::to_value(s).unwrap_or_default())
+            .collect();
+        print_json(&values, fields_ref);
         return Ok(());
     }
 
@@ -108,9 +105,8 @@ fn list(
 
     println!("{:<30}  UPDATED", "NAME");
     for s in &secrets {
-        let name = s["name"].as_str().unwrap_or("—");
-        let updated = s["updated_at"].as_str().map_or("—", |d| d);
-        let name_truncated = crate::cmd::util::truncate(name, 30);
+        let name_truncated = truncate(&s.name, 30);
+        let updated = s.updated_at.as_deref().unwrap_or("—");
         println!("{name_truncated:<30}  {updated}");
     }
 
@@ -125,8 +121,8 @@ fn set(
     env: Option<&str>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
+    let scope = resolve_scope(org, env)?;
+    let client = build_client(hostname)?;
 
     let value = if let Some(b) = body {
         b.to_string()
@@ -139,43 +135,7 @@ fn set(
         anyhow::bail!("no secret value provided (use --body or --file)");
     };
 
-    let body_value = serde_json::json!({"encrypted_value": value});
-
-    let path = if let Some(o) = org {
-        format!("/orgs/{o}/actions/secrets/{name}")
-    } else if let Some(e) = env {
-        let spec = detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository; specify --repo or run from a repo directory"
-            )
-        })?;
-        format!(
-            "/repos/{}/{}/environments/{e}/secrets/{name}",
-            spec.owner, spec.repo
-        )
-    } else {
-        let spec = detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository; specify --org or run from a repo directory"
-            )
-        })?;
-        format!("/repos/{}/{}/actions/secrets/{name}", spec.owner, spec.repo)
-    };
-
-    let response = client
-        .request(
-            "PUT",
-            &path,
-            &[],
-            Some(serde_json::to_vec(&body_value).context("serialize")?),
-        )
-        .context("failed to set secret")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to set secret '{name}': HTTP {status}");
-    }
-
+    secret::set(&client, &scope, name, &value)?;
     println!("Secret '{name}' set.");
     Ok(())
 }
@@ -186,42 +146,10 @@ fn delete(
     env: Option<&str>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = if let Some(o) = org {
-        format!("/orgs/{o}/actions/secrets/{name}")
-    } else if let Some(e) = env {
-        let spec = detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository; specify --repo or run from a repo directory"
-            )
-        })?;
-        format!(
-            "/repos/{}/{}/environments/{e}/secrets/{name}",
-            spec.owner, spec.repo
-        )
-    } else {
-        let spec = detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository; specify --org or run from a repo directory"
-            )
-        })?;
-        format!("/repos/{}/{}/actions/secrets/{name}", spec.owner, spec.repo)
-    };
-
-    let response = client
-        .request("DELETE", &path, &[], None)
-        .context("failed to delete secret")?;
-
-    let status = response.status();
-    if status == 404 {
-        anyhow::bail!("secret '{name}' not found");
-    }
-    if !status.is_success() {
-        anyhow::bail!("failed to delete secret '{name}': HTTP {status}");
-    }
+    let scope = resolve_scope(org, env)?;
+    let client = build_client(hostname)?;
 
+    secret::delete(&client, &scope, name)?;
     println!("Secret '{name}' deleted.");
     Ok(())
 }
diff --git a/crates/gor/src/cmd/variable.rs b/crates/gor/src/cmd/variable.rs
index d55b0e5..1d4510b 100644
--- a/crates/gor/src/cmd/variable.rs
+++ b/crates/gor/src/cmd/variable.rs
@@ -1,14 +1,14 @@
 //! Implementation of the `gor variable` subcommand.
-//!
-//! Provides variable listing and creation for GitHub Actions.
 
 #![allow(clippy::print_stdout)]
 
 use crate::cli::VariableCommand;
+use crate::cmd::util::truncate;
 use crate::render::print_json;
 use anyhow::Context;
-use gor_core::client::Client;
+use gor_core::Client;
 use gor_core::repository::detect_remote;
+use gor_core::variable::{self, VariableScope};
 
 /// Run the `gor variable` subcommand.
 ///
@@ -47,49 +47,42 @@ pub fn run(cmd: VariableCommand) -> anyhow::Result<()> {
     }
 }
 
-fn list(
-    org: Option<&str>,
-    env: Option<&str>,
-    json: Option<Vec<String>>,
-    hostname: Option<&str>,
-) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = if let Some(o) = org {
-        format!("/orgs/{o}/actions/variables?per_page=100")
-    } else if let Some(e) = env {
+fn resolve_scope(org: Option<&str>, env: Option<&str>) -> anyhow::Result<VariableScope> {
+    if let Some(o) = org {
+        return Ok(VariableScope::Org(o.to_string()));
+    }
+    if let Some(e) = env {
         let spec = detect_remote().ok_or_else(|| {
             anyhow::anyhow!(
                 "could not detect repository; specify --repo or run from a repo directory"
             )
         })?;
-        format!(
-            "/repos/{}/{}/environments/{e}/variables?per_page=100",
-            spec.owner, spec.repo
-        )
-    } else {
-        let spec = detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository; specify --org or run from a repo directory"
-            )
-        })?;
-        format!(
-            "/repos/{}/{}/actions/variables?per_page=100",
-            spec.owner, spec.repo
-        )
-    };
-
-    let response = client.get(&path).context("failed to fetch variables")?;
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to list variables: HTTP {status}");
+        return Ok(VariableScope::Environment {
+            spec,
+            env: e.to_string(),
+        });
     }
+    let spec = detect_remote().ok_or_else(|| {
+        anyhow::anyhow!("could not detect repository; specify --org or run from a repo directory")
+    })?;
+    Ok(VariableScope::Repo(spec))
+}
+
+fn build_client(hostname: Option<&str>) -> anyhow::Result<Client> {
+    let host = hostname.unwrap_or("github.com");
+    Client::new(host).map_err(|e| anyhow::anyhow!("failed to create HTTP client: {e}"))
+}
 
-    let result: serde_json::Value = response.json().context("failed to parse response")?;
-    let vars: Vec<serde_json::Value> = result["variables"]
-        .as_array()
-        .map_or_else(Vec::new, Clone::clone);
+fn list(
+    org: Option<&str>,
+    env: Option<&str>,
+    json: Option<Vec<String>>,
+    hostname: Option<&str>,
+) -> anyhow::Result<()> {
+    let scope = resolve_scope(org, env)?;
+    let client = build_client(hostname)?;
+
+    let variables = variable::list(&client, &scope)?;
 
     if let Some(fields) = json {
         let fields_ref: Option<&[String]> = if fields.is_empty() {
@@ -97,73 +90,27 @@ fn list(
         } else {
             Some(&fields)
         };
-        print_json(&vars, fields_ref);
+        let values: Vec<serde_json::Value> = variables
+            .into_iter()
+            .map(|v| serde_json::to_value(v).unwrap_or_default())
+            .collect();
+        print_json(&values, fields_ref);
         return Ok(());
     }
 
-    if vars.is_empty() {
+    if variables.is_empty() {
         println!("No variables found.");
         return Ok(());
     }
 
-    println!("{:<30}  VALUE", "NAME");
-    for v in &vars {
-        let name = v["name"].as_str().unwrap_or("—");
-        let value = v["value"].as_str().unwrap_or("—");
-        let name_truncated = crate::cmd::util::truncate(name, 30);
-        let value_truncated = crate::cmd::util::truncate(value, 40);
-        println!("{name_truncated:<30}  {value_truncated}");
-    }
-
-    Ok(())
-}
-
-fn delete(
-    name: &str,
-    org: Option<&str>,
-    env: Option<&str>,
-    hostname: Option<&str>,
-) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = if let Some(o) = org {
-        format!("/orgs/{o}/actions/variables/{name}")
-    } else if let Some(e) = env {
-        let spec = detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository; specify --repo or run from a repo directory"
-            )
-        })?;
-        format!(
-            "/repos/{}/{}/environments/{e}/variables/{name}",
-            spec.owner, spec.repo
-        )
-    } else {
-        let spec = detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository; specify --org or run from a repo directory"
-            )
-        })?;
-        format!(
-            "/repos/{}/{}/actions/variables/{name}",
-            spec.owner, spec.repo
-        )
-    };
-
-    let response = client
-        .request("DELETE", &path, &[], None)
-        .context("failed to delete variable")?;
-
-    let status = response.status();
-    if status == 404 {
-        anyhow::bail!("variable '{name}' not found");
-    }
-    if !status.is_success() {
-        anyhow::bail!("failed to delete variable '{name}': HTTP {status}");
+    println!("{:<30}  {:<40}  UPDATED", "NAME", "VALUE");
+    for v in &variables {
+        let name_truncated = truncate(&v.name, 30);
+        let value_truncated = truncate(&v.value, 40);
+        let updated = v.updated_at.as_deref().unwrap_or("—");
+        println!("{name_truncated:<30}  {value_truncated:<40}  {updated}");
     }
 
-    println!("Variable '{name}' deleted.");
     Ok(())
 }
 
@@ -175,8 +122,8 @@ fn set(
     env: Option<&str>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
+    let scope = resolve_scope(org, env)?;
+    let client = build_client(hostname)?;
 
     let value = if let Some(b) = body {
         b.to_string()
@@ -189,46 +136,21 @@ fn set(
         anyhow::bail!("no variable value provided (use --body or --file)");
     };
 
-    let body_value = serde_json::json!({"value": value});
-
-    let path = if let Some(o) = org {
-        format!("/orgs/{o}/actions/variables/{name}")
-    } else if let Some(e) = env {
-        let spec = detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository; specify --repo or run from a repo directory"
-            )
-        })?;
-        format!(
-            "/repos/{}/{}/environments/{e}/variables/{name}",
-            spec.owner, spec.repo
-        )
-    } else {
-        let spec = detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository; specify --org or run from a repo directory"
-            )
-        })?;
-        format!(
-            "/repos/{}/{}/actions/variables/{name}",
-            spec.owner, spec.repo
-        )
-    };
+    variable::set(&client, &scope, name, &value)?;
+    println!("Variable '{name}' set.");
+    Ok(())
+}
 
-    let response = client
-        .request(
-            "PATCH",
-            &path,
-            &[],
-            Some(serde_json::to_vec(&body_value).context("serialize")?),
-        )
-        .context("failed to set variable")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to set variable '{name}': HTTP {status}");
-    }
+fn delete(
+    name: &str,
+    org: Option<&str>,
+    env: Option<&str>,
+    hostname: Option<&str>,
+) -> anyhow::Result<()> {
+    let scope = resolve_scope(org, env)?;
+    let client = build_client(hostname)?;
 
-    println!("Variable '{name}' set.");
+    variable::delete(&client, &scope, name)?;
+    println!("Variable '{name}' deleted.");
     Ok(())
 }

From 0b409e2e41e7325eaea92b5bbda86263689b0eae Mon Sep 17 00:00:00 2001
From: Kerry Hatcher <kerry@kerryhatcher.com>
Date: Sun, 26 Jul 2026 13:45:59 -0400
Subject: [PATCH 6/8] refactor(project): extract typed ops into gor-core

---
 crates/gor-core/src/lib.rs     |   1 +
 crates/gor-core/src/project.rs | 118 ++++++++++++++++++++++++++++
 crates/gor/src/cmd/project.rs  | 135 ++++++++++++---------------------
 3 files changed, 169 insertions(+), 85 deletions(-)
 create mode 100644 crates/gor-core/src/project.rs

diff --git a/crates/gor-core/src/lib.rs b/crates/gor-core/src/lib.rs
index e978684..a47de4d 100644
--- a/crates/gor-core/src/lib.rs
+++ b/crates/gor-core/src/lib.rs
@@ -18,6 +18,7 @@ pub mod repository;
 pub mod cache;
 pub mod label;
 pub mod org;
+pub mod project;
 pub mod secret;
 pub mod util;
 pub mod variable;
diff --git a/crates/gor-core/src/project.rs b/crates/gor-core/src/project.rs
new file mode 100644
index 0000000..0fa5fdd
--- /dev/null
+++ b/crates/gor-core/src/project.rs
@@ -0,0 +1,118 @@
+//! Typed operations and models for GitHub Projects.
+
+use crate::client::Client;
+use crate::error::GorError;
+use crate::repository::RepoSplit;
+use serde::{Deserialize, Serialize};
+
+/// A GitHub Project (classic).
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
+pub struct Project {
+    /// The project number.
+    pub number: u64,
+    /// The project name.
+    pub name: String,
+    /// The project state (open/closed).
+    pub state: Option<String>,
+    /// Visibility (public/private).
+    pub visibility: Option<String>,
+    /// Any additional fields returned by the API.
+    #[serde(flatten)]
+    pub extra: serde_json::Map<String, serde_json::Value>,
+}
+
+/// Scope for listing projects.
+pub enum ProjectScope {
+    /// Organization projects.
+    Org(String),
+    /// User projects.
+    User(String),
+    /// Repository projects.
+    Repo(RepoSplit),
+}
+
+impl ProjectScope {
+    fn api_list_path(&self, limit: u32) -> String {
+        let per_page = limit.min(100);
+        match self {
+            Self::Org(org) => format!("/orgs/{org}/projects?per_page={per_page}"),
+            Self::User(user) => format!("/users/{user}/projects?per_page={per_page}"),
+            Self::Repo(spec) => {
+                format!(
+                    "/repos/{}/{}/projects?per_page={per_page}",
+                    spec.owner, spec.repo
+                )
+            }
+        }
+    }
+}
+
+/// List projects (classic REST API).
+///
+/// # Errors
+///
+/// Returns [`GorError::Http`] on HTTP failures.
+pub fn list(client: &Client, scope: &ProjectScope, limit: u32) -> Result<Vec<Project>, GorError> {
+    let path = scope.api_list_path(limit);
+    let response = client.get(&path)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to list projects: HTTP {status}"
+        )));
+    }
+    let mut projects: Vec<Project> = response.json().map_err(GorError::Http)?;
+    projects.truncate(limit as usize);
+    Ok(projects)
+}
+
+/// View a project by number.
+///
+/// # Errors
+///
+/// Returns [`GorError::NotFound`] if the project does not exist.
+pub fn view(client: &Client, number: u64) -> Result<serde_json::Value, GorError> {
+    let path = format!("/projects/{number}");
+    let response = client.get(&path)?;
+    let status = response.status();
+    if status == reqwest::StatusCode::NOT_FOUND {
+        return Err(GorError::NotFound(format!("project #{number} not found")));
+    }
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to view project: HTTP {status}"
+        )));
+    }
+    response.json().map_err(GorError::Http)
+}
+
+/// Add an item to a project.
+///
+/// # Errors
+///
+/// Returns [`GorError::Http`] on HTTP failures.
+pub fn item_add(
+    client: &Client,
+    project: u64,
+    content_id: u64,
+    content_type: &str,
+) -> Result<serde_json::Value, GorError> {
+    let body = serde_json::json!({
+        "content_id": content_id,
+        "content_type": content_type,
+    });
+    let path = format!("/projects/{project}/items");
+    let body_bytes = serde_json::to_vec(&body)
+        .map_err(|e| GorError::InvalidInput(format!("serialization error: {e}")))?;
+    let response = client.request("POST", &path, &[], Some(body_bytes))?;
+    let status = response.status();
+    if !status.is_success() {
+        let err: serde_json::Value = response.json().unwrap_or_default();
+        let msg = err["message"].as_str().unwrap_or("add failed");
+        return Err(GorError::InvalidInput(format!(
+            "failed to add item to project #{project}: {msg}"
+        )));
+    }
+    response.json().map_err(GorError::Http)
+}
diff --git a/crates/gor/src/cmd/project.rs b/crates/gor/src/cmd/project.rs
index 62dd941..09c79ed 100644
--- a/crates/gor/src/cmd/project.rs
+++ b/crates/gor/src/cmd/project.rs
@@ -1,13 +1,13 @@
 //! Implementation of the `gor project` subcommand.
-//!
-//! Provides project listing for organizations and repositories.
 
 #![allow(clippy::print_stdout)]
 
 use crate::cli::ProjectCommand;
+use crate::cmd::util::truncate;
 use crate::render::print_json;
 use anyhow::Context;
-use gor_core::client::Client;
+use gor_core::Client;
+use gor_core::project::{self, ProjectScope};
 use gor_core::repository;
 
 /// Run the `gor project` subcommand.
@@ -67,6 +67,31 @@ pub fn run(cmd: ProjectCommand) -> anyhow::Result<()> {
     }
 }
 
+fn resolve_scope(
+    org: Option<&str>,
+    owner: Option<&str>,
+    repo: Option<&str>,
+) -> anyhow::Result<ProjectScope> {
+    if let Some(o) = org {
+        Ok(ProjectScope::Org(o.to_string()))
+    } else if let Some(u) = owner {
+        Ok(ProjectScope::User(u.to_string()))
+    } else if let Some(r) = repo {
+        let spec = repository::parse_repo_spec(r)?;
+        Ok(ProjectScope::Repo(spec))
+    } else {
+        let spec = repository::detect_remote().ok_or_else(|| {
+            anyhow::anyhow!("could not detect repository; specify --org, --owner, or --repo")
+        })?;
+        Ok(ProjectScope::Repo(spec))
+    }
+}
+
+fn build_client(hostname: Option<&str>) -> anyhow::Result<Client> {
+    let host = hostname.unwrap_or("github.com");
+    Client::new(host).map_err(|e| anyhow::anyhow!("failed to create HTTP client: {e}"))
+}
+
 fn list(
     org: Option<&str>,
     owner: Option<&str>,
@@ -76,46 +101,14 @@ fn list(
     json: Option<Vec<String>>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
+    let client = build_client(hostname)?;
 
     if v2 {
         return list_v2(&client, org, owner, limit, json);
     }
 
-    let path = if let Some(o) = org {
-        format!("/orgs/{o}/projects?per_page={}", limit.min(100))
-    } else if let Some(u) = owner {
-        format!("/users/{u}/projects?per_page={}", limit.min(100))
-    } else if let Some(r) = repo {
-        let spec = repository::parse_repo_spec(r).context("invalid repository spec")?;
-        format!(
-            "/repos/{}/{}/projects?per_page={}",
-            spec.owner,
-            spec.repo,
-            limit.min(100)
-        )
-    } else {
-        let spec = repository::detect_remote().ok_or_else(|| {
-            anyhow::anyhow!("could not detect repository; specify --org, --owner, or --repo")
-        })?;
-        format!(
-            "/repos/{}/{}/projects?per_page={}",
-            spec.owner,
-            spec.repo,
-            limit.min(100)
-        )
-    };
-
-    let response = client.get(&path).context("failed to fetch projects")?;
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to list projects: HTTP {status}");
-    }
-
-    let mut projects: Vec<serde_json::Value> =
-        response.json().context("failed to parse response")?;
-    projects.truncate(limit as usize);
+    let scope = resolve_scope(org, owner, repo)?;
+    let projects = project::list(&client, &scope, limit)?;
 
     if let Some(fields) = json {
         let fields_ref: Option<&[String]> = if fields.is_empty() {
@@ -123,7 +116,11 @@ fn list(
         } else {
             Some(&fields)
         };
-        print_json(&projects, fields_ref);
+        let values: Vec<serde_json::Value> = projects
+            .into_iter()
+            .map(|p| serde_json::to_value(p).unwrap_or_default())
+            .collect();
+        print_json(&values, fields_ref);
         return Ok(());
     }
 
@@ -137,12 +134,13 @@ fn list(
         "NUMBER", "TITLE", "STATE"
     );
     for p in &projects {
-        let number = p["number"].as_u64().unwrap_or(0);
-        let title = p["name"].as_str().unwrap_or("—");
-        let state = p["state"].as_str().unwrap_or("—");
-        let visibility = p["visibility"].as_str().unwrap_or("—");
-        let title_truncated = crate::cmd::util::truncate(title, 30);
-        println!("{number:<8}  {title_truncated:<30}  {state:<10}  {visibility}");
+        let title_truncated = truncate(&p.name, 30);
+        let state = p.state.as_deref().unwrap_or("—");
+        let visibility = p.visibility.as_deref().unwrap_or("—");
+        println!(
+            "{:<8}  {title_truncated:<30}  {state:<10}  {visibility}",
+            p.number
+        );
     }
 
     Ok(())
@@ -206,7 +204,7 @@ fn list_v2(
         let number = p["number"].as_u64().unwrap_or(0);
         let title = p["title"].as_str().unwrap_or("—");
         let closed = p["closed"].as_bool().unwrap_or(false);
-        let title_truncated = crate::cmd::util::truncate(title, 30);
+        let title_truncated = truncate(title, 30);
         println!("{number:<8}  {title_truncated:<30}  {closed}");
     }
 
@@ -221,21 +219,8 @@ fn view(
     json: Option<Vec<String>>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = format!("/projects/{number}");
-    let response = client.get(&path).context("failed to fetch project")?;
-
-    let status = response.status();
-    if status == reqwest::StatusCode::NOT_FOUND {
-        anyhow::bail!("project #{number} not found");
-    }
-    if !status.is_success() {
-        anyhow::bail!("failed to view project: HTTP {status}");
-    }
-
-    let project: serde_json::Value = response.json().context("failed to parse response")?;
+    let client = build_client(hostname)?;
+    let project = project::view(&client, number)?;
 
     if web {
         if let Some(url) = project["html_url"].as_str() {
@@ -282,8 +267,7 @@ fn item_add(
     _owner: Option<&str>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
+    let client = build_client(hostname)?;
 
     let (item_type, item_id) = if let Some(i) = issue {
         ("Issue", i)
@@ -293,28 +277,9 @@ fn item_add(
         anyhow::bail!("specify --issue or --pr to add an item");
     };
 
-    let body = serde_json::json!({
-        "content_id": item_id,
-        "content_type": item_type,
-    });
-
-    let path = format!("/projects/{project}/items");
-    let body_bytes = serde_json::to_vec(&body).context("serialize")?;
-
-    let response = client
-        .request("POST", &path, &[], Some(body_bytes))
-        .context("failed to add project item")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        let err: serde_json::Value = response.json().unwrap_or_default();
-        let msg = err["message"].as_str().unwrap_or("add failed");
-        anyhow::bail!("failed to add item to project #{project}: {msg}");
-    }
-
-    let result: serde_json::Value = response.json().context("failed to parse response")?;
-    let item_id = result["id"].as_u64().unwrap_or(0);
-    println!("Added {item_type} #{item_id} to project #{project} (item ID: {item_id})");
+    let result = project::item_add(&client, project, item_id, item_type)?;
+    let result_item_id = result["id"].as_u64().unwrap_or(0);
+    println!("Added {item_type} #{item_id} to project #{project} (item ID: {result_item_id})");
 
     Ok(())
 }

From 27f90b9297ff2f52a2428e50f9ad15ac498469f2 Mon Sep 17 00:00:00 2001
From: Kerry Hatcher <kerry@kerryhatcher.com>
Date: Sun, 26 Jul 2026 14:03:21 -0400
Subject: [PATCH 7/8] refactor(keys,search,workflow): extract typed ops into
 gor-core

---
 crates/gor-core/src/keys.rs     | 118 ++++++++++
 crates/gor-core/src/lib.rs      |   3 +
 crates/gor-core/src/search.rs   | 135 +++++++++++
 crates/gor-core/src/workflow.rs | 122 ++++++++++
 crates/gor/src/cmd/keys.rs      | 365 ++++++++----------------------
 crates/gor/src/cmd/search.rs    | 315 ++++++++------------------
 crates/gor/src/cmd/workflow.rs  | 389 +++++---------------------------
 7 files changed, 630 insertions(+), 817 deletions(-)
 create mode 100644 crates/gor-core/src/keys.rs
 create mode 100644 crates/gor-core/src/search.rs
 create mode 100644 crates/gor-core/src/workflow.rs

diff --git a/crates/gor-core/src/keys.rs b/crates/gor-core/src/keys.rs
new file mode 100644
index 0000000..4c6aaa4
--- /dev/null
+++ b/crates/gor-core/src/keys.rs
@@ -0,0 +1,118 @@
+//! Typed operations and models for SSH and GPG keys.
+
+#![allow(clippy::missing_errors_doc)]
+use crate::client::Client;
+use crate::error::GorError;
+use serde::{Deserialize, Serialize};
+
+/// An SSH key.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
+pub struct SshKey {
+    /// The key ID.
+    pub id: u64,
+    /// The key title.
+    pub title: String,
+    /// The full key string.
+    pub key: String,
+    /// Any additional fields returned by the API.
+    #[serde(flatten)]
+    pub extra: serde_json::Map<String, serde_json::Value>,
+}
+
+/// A GPG key.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
+pub struct GpgKey {
+    /// The key ID string.
+    pub key_id: Option<String>,
+    /// The key name.
+    pub name: Option<String>,
+    /// Any additional fields returned by the API.
+    #[serde(flatten)]
+    pub extra: serde_json::Map<String, serde_json::Value>,
+}
+
+/// List SSH keys for the authenticated user.
+pub fn list_ssh(client: &Client) -> Result<Vec<SshKey>, GorError> {
+    let response = client.get("/user/keys")?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to list SSH keys: HTTP {status}"
+        )));
+    }
+    response.json().map_err(GorError::Http)
+}
+
+/// Add an SSH key.
+pub fn add_ssh(client: &Client, title: &str, key_body: &str) -> Result<SshKey, GorError> {
+    let body = serde_json::json!({"title": title, "key": key_body});
+    let response = client.post("/user/keys", &body)?;
+    let status = response.status();
+    if !status.is_success() {
+        let err: serde_json::Value = response.json().unwrap_or_default();
+        let msg = err["message"].as_str().unwrap_or("add failed");
+        return Err(GorError::InvalidInput(format!(
+            "failed to add SSH key: {msg}"
+        )));
+    }
+    response.json().map_err(GorError::Http)
+}
+
+/// Delete an SSH key.
+pub fn delete_ssh(client: &Client, key_id: u64) -> Result<(), GorError> {
+    let path = format!("/user/keys/{key_id}");
+    let response = client.request("DELETE", &path, &[], None)?;
+    let status = response.status();
+    if !status.is_success() {
+        let err: serde_json::Value = response.json().unwrap_or_default();
+        let msg = err["message"].as_str().unwrap_or("delete failed");
+        return Err(GorError::InvalidInput(format!(
+            "failed to delete SSH key: {msg}"
+        )));
+    }
+    Ok(())
+}
+
+/// List GPG keys for the authenticated user.
+pub fn list_gpg(client: &Client) -> Result<Vec<GpgKey>, GorError> {
+    let response = client.get("/user/gpg_keys")?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to list GPG keys: HTTP {status}"
+        )));
+    }
+    response.json().map_err(GorError::Http)
+}
+
+/// Add a GPG key.
+pub fn add_gpg(client: &Client, armored_key: &str) -> Result<GpgKey, GorError> {
+    let body = serde_json::json!({"armored_public_key": armored_key});
+    let response = client.post("/user/gpg_keys", &body)?;
+    let status = response.status();
+    if !status.is_success() {
+        let err: serde_json::Value = response.json().unwrap_or_default();
+        let msg = err["message"].as_str().unwrap_or("add failed");
+        return Err(GorError::InvalidInput(format!(
+            "failed to add GPG key: {msg}"
+        )));
+    }
+    response.json().map_err(GorError::Http)
+}
+
+/// Delete a GPG key.
+pub fn delete_gpg(client: &Client, key_id: &str) -> Result<(), GorError> {
+    let path = format!("/user/gpg_keys/{key_id}");
+    let response = client.request("DELETE", &path, &[], None)?;
+    let status = response.status();
+    if !status.is_success() {
+        let err: serde_json::Value = response.json().unwrap_or_default();
+        let msg = err["message"].as_str().unwrap_or("delete failed");
+        return Err(GorError::InvalidInput(format!(
+            "failed to delete GPG key: {msg}"
+        )));
+    }
+    Ok(())
+}
diff --git a/crates/gor-core/src/lib.rs b/crates/gor-core/src/lib.rs
index a47de4d..11c522a 100644
--- a/crates/gor-core/src/lib.rs
+++ b/crates/gor-core/src/lib.rs
@@ -16,12 +16,15 @@ pub mod keyring_store;
 pub mod repository;
 
 pub mod cache;
+pub mod keys;
 pub mod label;
 pub mod org;
 pub mod project;
+pub mod search;
 pub mod secret;
 pub mod util;
 pub mod variable;
+pub mod workflow;
 
 /// Convenience re-exports of key types.
 pub use client::Client;
diff --git a/crates/gor-core/src/search.rs b/crates/gor-core/src/search.rs
new file mode 100644
index 0000000..b6e6893
--- /dev/null
+++ b/crates/gor-core/src/search.rs
@@ -0,0 +1,135 @@
+//! Typed operations for GitHub search.
+
+#![allow(clippy::missing_errors_doc)]
+use crate::client::Client;
+use crate::error::GorError;
+use serde::{Deserialize, Serialize};
+use std::fmt::Write;
+
+/// A search result item.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
+pub struct SearchResult {
+    /// The item's ID.
+    pub id: u64,
+    /// Any additional fields returned by the API.
+    #[serde(flatten)]
+    pub extra: serde_json::Map<String, serde_json::Value>,
+}
+
+/// Search repositories.
+pub fn search_repos(
+    client: &Client,
+    query: &str,
+    sort: &str,
+    order: &str,
+    limit: u32,
+) -> Result<Vec<serde_json::Value>, GorError> {
+    let per_page = limit.min(100);
+    let path = format!(
+        "/search/repositories?q={}&sort={}&order={}&per_page={per_page}",
+        urlencoding(query),
+        sort,
+        order,
+    );
+    let response = client.get(&path)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "search failed: HTTP {status}"
+        )));
+    }
+    let result: serde_json::Value = response.json().map_err(GorError::Http)?;
+    let mut items: Vec<serde_json::Value> = result["items"].as_array().cloned().unwrap_or_default();
+    items.truncate(limit as usize);
+    Ok(items)
+}
+
+/// Search code.
+pub fn search_code(
+    client: &Client,
+    query: &str,
+    limit: u32,
+) -> Result<Vec<serde_json::Value>, GorError> {
+    let per_page = limit.min(100);
+    let path = format!("/search/code?q={}&per_page={per_page}", urlencoding(query));
+    let response = client.get(&path)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "search failed: HTTP {status}"
+        )));
+    }
+    let result: serde_json::Value = response.json().map_err(GorError::Http)?;
+    let mut items: Vec<serde_json::Value> = result["items"].as_array().cloned().unwrap_or_default();
+    items.truncate(limit as usize);
+    Ok(items)
+}
+
+/// Search issues and PRs.
+pub fn search_issues(
+    client: &Client,
+    query: &str,
+    limit: u32,
+) -> Result<Vec<serde_json::Value>, GorError> {
+    let per_page = limit.min(100);
+    let path = format!(
+        "/search/issues?q={}&per_page={per_page}",
+        urlencoding(query)
+    );
+    let response = client.get(&path)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "search failed: HTTP {status}"
+        )));
+    }
+    let result: serde_json::Value = response.json().map_err(GorError::Http)?;
+    let mut items: Vec<serde_json::Value> = result["items"].as_array().cloned().unwrap_or_default();
+    items.truncate(limit as usize);
+    Ok(items)
+}
+
+/// Search commits.
+pub fn search_commits(
+    client: &Client,
+    query: &str,
+    limit: u32,
+) -> Result<Vec<serde_json::Value>, GorError> {
+    let per_page = limit.min(100);
+    let path = format!(
+        "/search/commits?q={}&per_page={per_page}",
+        urlencoding(query)
+    );
+    let response = client.get(&path)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "search failed: HTTP {status}"
+        )));
+    }
+    let result: serde_json::Value = response.json().map_err(GorError::Http)?;
+    let mut items: Vec<serde_json::Value> = result["items"].as_array().cloned().unwrap_or_default();
+    items.truncate(limit as usize);
+    Ok(items)
+}
+
+fn urlencoding(s: &str) -> String {
+    urlencoding_helper(s).replace(' ', "+")
+}
+
+fn urlencoding_helper(s: &str) -> String {
+    let mut result = String::new();
+    for byte in s.bytes() {
+        match byte {
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
+                result.push(byte as char);
+            }
+            b' ' => result.push('+'),
+            _ => {
+                let _ = write!(result, "%{byte:02X}");
+            }
+        }
+    }
+    result
+}
diff --git a/crates/gor-core/src/workflow.rs b/crates/gor-core/src/workflow.rs
new file mode 100644
index 0000000..bb08e1d
--- /dev/null
+++ b/crates/gor-core/src/workflow.rs
@@ -0,0 +1,122 @@
+//! Typed operations and models for GitHub Actions workflows.
+
+#![allow(clippy::missing_errors_doc)]
+use crate::client::Client;
+use crate::error::GorError;
+use crate::repository::RepoSplit;
+use serde::{Deserialize, Serialize};
+
+/// A GitHub Actions workflow.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[non_exhaustive]
+pub struct Workflow {
+    /// The workflow ID.
+    pub id: u64,
+    /// The workflow name.
+    pub name: String,
+    /// The workflow state (active/deleted/disabled_inactivity/etc).
+    pub state: Option<String>,
+    /// Any additional fields returned by the API.
+    #[serde(flatten)]
+    pub extra: serde_json::Map<String, serde_json::Value>,
+}
+
+/// List workflows in a repository.
+pub fn list(client: &Client, spec: &RepoSplit, limit: u32) -> Result<Vec<Workflow>, GorError> {
+    let per_page = limit.min(100);
+    let path = format!(
+        "/repos/{}/{}/actions/workflows?per_page={per_page}",
+        spec.owner, spec.repo
+    );
+    let response = client.get(&path)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to list workflows: HTTP {status}"
+        )));
+    }
+    let result: serde_json::Value = response.json().map_err(GorError::Http)?;
+    let mut workflows: Vec<Workflow> = serde_json::from_value(result["workflows"].clone())
+        .map_err(|e| GorError::InvalidInput(format!("failed to parse workflows: {e}")))?;
+    workflows.truncate(limit as usize);
+    Ok(workflows)
+}
+
+/// View a workflow by ID or filename.
+pub fn view(
+    client: &Client,
+    spec: &RepoSplit,
+    workflow: &str,
+) -> Result<serde_json::Value, GorError> {
+    let path = format!(
+        "/repos/{}/{}/actions/workflows/{workflow}",
+        spec.owner, spec.repo
+    );
+    let response = client.get(&path)?;
+    let status = response.status();
+    if status == reqwest::StatusCode::NOT_FOUND {
+        return Err(GorError::NotFound(format!(
+            "workflow '{workflow}' not found"
+        )));
+    }
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!("HTTP {status}")));
+    }
+    response.json().map_err(GorError::Http)
+}
+
+/// Enable a workflow by ID or filename.
+pub fn enable(client: &Client, spec: &RepoSplit, workflow: &str) -> Result<(), GorError> {
+    let path = format!(
+        "/repos/{}/{}/actions/workflows/{workflow}/enable",
+        spec.owner, spec.repo
+    );
+    let response = client.request("PUT", &path, &[], None)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to enable workflow: HTTP {status}"
+        )));
+    }
+    Ok(())
+}
+
+/// Disable a workflow by ID or filename.
+pub fn disable(client: &Client, spec: &RepoSplit, workflow: &str) -> Result<(), GorError> {
+    let path = format!(
+        "/repos/{}/{}/actions/workflows/{workflow}/disable",
+        spec.owner, spec.repo
+    );
+    let response = client.request("PUT", &path, &[], None)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to disable workflow: HTTP {status}"
+        )));
+    }
+    Ok(())
+}
+
+/// Trigger a workflow run.
+pub fn trigger_run(
+    client: &Client,
+    spec: &RepoSplit,
+    workflow: &str,
+    branch: &str,
+) -> Result<(), GorError> {
+    let body = serde_json::json!({"ref": branch});
+    let body_bytes = serde_json::to_vec(&body)
+        .map_err(|e| GorError::InvalidInput(format!("serialization error: {e}")))?;
+    let path = format!(
+        "/repos/{}/{}/actions/workflows/{workflow}/dispatches",
+        spec.owner, spec.repo
+    );
+    let response = client.request("POST", &path, &[], Some(body_bytes))?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(GorError::InvalidInput(format!(
+            "failed to trigger workflow run: HTTP {status}"
+        )));
+    }
+    Ok(())
+}
diff --git a/crates/gor/src/cmd/keys.rs b/crates/gor/src/cmd/keys.rs
index e57dba9..f7b8f90 100644
--- a/crates/gor/src/cmd/keys.rs
+++ b/crates/gor/src/cmd/keys.rs
@@ -1,14 +1,14 @@
 //! Implementation of the `gor ssh-key` and `gor gpg-key` subcommands.
-//!
-//! Provides SSH and GPG key management for the authenticated user.
 
 #![allow(clippy::print_stdout)]
 
 use crate::cli::{GpgKeyCommand, SshKeyCommand};
+use crate::cmd::util::truncate;
 use crate::render::print_json;
-use anyhow::Context;
-use gor_core::client::Client;
+use gor_core::Client;
+use gor_core::keys;
 use std::fs;
+use std::io::Write;
 
 /// Run the `gor ssh-key` subcommand.
 ///
@@ -17,13 +17,13 @@ use std::fs;
 /// Returns an error if the command execution fails.
 pub fn run_ssh(cmd: SshKeyCommand) -> anyhow::Result<()> {
     match cmd {
-        SshKeyCommand::List { json, hostname } => list_ssh_keys(json, hostname.as_deref()),
+        SshKeyCommand::List { json, hostname } => list_ssh(json, hostname.as_deref()),
         SshKeyCommand::Add {
             title,
             file,
             body,
             hostname,
-        } => add_ssh_key(
+        } => add_ssh(
             &title,
             file.as_deref(),
             body.as_deref(),
@@ -33,7 +33,7 @@ pub fn run_ssh(cmd: SshKeyCommand) -> anyhow::Result<()> {
             key_id,
             yes,
             hostname,
-        } => delete_ssh_key(&key_id, yes, hostname.as_deref()),
+        } => delete_ssh(&key_id, yes, hostname.as_deref()),
     }
 }
 
@@ -44,342 +44,173 @@ pub fn run_ssh(cmd: SshKeyCommand) -> anyhow::Result<()> {
 /// Returns an error if the command execution fails.
 pub fn run_gpg(cmd: GpgKeyCommand) -> anyhow::Result<()> {
     match cmd {
-        GpgKeyCommand::List { json, hostname } => list_gpg_keys(json, hostname.as_deref()),
+        GpgKeyCommand::List { json, hostname } => list_gpg(json, hostname.as_deref()),
         GpgKeyCommand::Add {
             file,
             body,
             hostname,
-        } => add_gpg_key(file.as_deref(), body.as_deref(), hostname.as_deref()),
+        } => add_gpg(file.as_deref(), body.as_deref(), hostname.as_deref()),
         GpgKeyCommand::Delete {
             key_id,
             yes,
             hostname,
-        } => delete_gpg_key(&key_id, yes, hostname.as_deref()),
+        } => delete_gpg(&key_id, yes, hostname.as_deref()),
     }
 }
 
-/// Execute `gor ssh-key list`.
-///
-/// Lists SSH keys for the authenticated user.
-///
-/// # Errors
-///
-/// Returns an error if the API request fails.
-fn list_ssh_keys(json: Option<Vec<String>>, hostname: Option<&str>) -> anyhow::Result<()> {
+fn client(hostname: Option<&str>) -> anyhow::Result<Client> {
     let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let response = client
-        .get("/user/keys")
-        .context("failed to fetch SSH keys")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to list SSH keys: HTTP {status}");
-    }
-
-    let keys: Vec<serde_json::Value> = response
-        .json()
-        .context("failed to parse SSH keys response")?;
+    Client::new(host).map_err(|e| anyhow::anyhow!("{e}"))
+}
 
+fn list_ssh(json: Option<Vec<String>>, hostname: Option<&str>) -> anyhow::Result<()> {
+    let c = client(hostname)?;
+    let keys = keys::list_ssh(&c)?;
     if let Some(fields) = json {
-        let fields_ref: Option<&[String]> = if fields.is_empty() {
+        let fields_ref = if fields.is_empty() {
             None
         } else {
-            Some(&fields)
+            Some(fields.as_slice())
         };
-        print_json(&keys, fields_ref);
+        let v: Vec<serde_json::Value> = keys
+            .into_iter()
+            .map(|k| serde_json::to_value(k).unwrap_or_default())
+            .collect();
+        print_json(&v, fields_ref);
         return Ok(());
     }
-
     if keys.is_empty() {
         println!("No SSH keys found.");
         return Ok(());
     }
-
-    let title_width = 30;
-    let type_width = 10;
-
-    println!("{:<title_width$}  {:<type_width$}  KEY", "TITLE", "TYPE");
-
-    for key in &keys {
-        let title = key["title"].as_str().unwrap_or("—");
-        let key_type = key["key"]
-            .as_str()
-            .unwrap_or("")
-            .split(' ')
-            .next()
-            .unwrap_or("—");
-        let key_short = key["key"]
-            .as_str()
-            .unwrap_or("")
+    println!("{:<30}  {:<10}  KEY", "TITLE", "TYPE");
+    for k in &keys {
+        let t = truncate(&k.title, 30);
+        let kt = k.key.split(' ').next().unwrap_or("—");
+        let ks: String = k
+            .key
             .split(' ')
             .nth(1)
             .unwrap_or("")
             .chars()
             .take(40)
-            .collect::<String>();
-
-        let title_truncated = crate::cmd::util::truncate(title, title_width);
-
-        println!("{title_truncated:<title_width$}  {key_type:<type_width$}  {key_short}");
+            .collect();
+        println!("{t:<30}  {kt:<10}  {ks}");
     }
-
     Ok(())
 }
 
-/// Execute `gor ssh-key add`.
-///
-/// Adds an SSH public key to the authenticated user's account.
-///
-/// # Errors
-///
-/// Returns an error if the key body is missing or the API request fails.
-fn add_ssh_key(
+fn add_ssh(
     title: &str,
     file: Option<&str>,
     body: Option<&str>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let key_body = if let Some(b) = body {
-        b.to_string()
-    } else if let Some(f) = file {
-        fs::read_to_string(f)
-            .with_context(|| format!("failed to read SSH key file: {f}"))?
+    let kb = match (body, file) {
+        (Some(b), _) => b.to_string(),
+        (_, Some(f)) => fs::read_to_string(f)
+            .map_err(|e| anyhow::anyhow!("failed to read key file {f}: {e}"))?
             .trim()
-            .to_string()
-    } else {
-        anyhow::bail!("no SSH key provided (use --file or --body)");
+            .to_string(),
+        _ => anyhow::bail!("no SSH key provided (use --file or --body)"),
     };
-
-    if key_body.is_empty() {
+    if kb.is_empty() {
         anyhow::bail!("SSH key body is empty");
     }
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let body_value = serde_json::json!({
-        "title": title,
-        "key": key_body,
-    });
-
-    let response = client
-        .post("/user/keys", &body_value)
-        .context("failed to add SSH key")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        let err_body: serde_json::Value = response.json().unwrap_or_default();
-        let msg = err_body["message"].as_str().unwrap_or("add failed");
-        anyhow::bail!("failed to add SSH key: {msg}");
-    }
-
-    let result: serde_json::Value = response.json().context("failed to parse response")?;
-    let key_id = result["id"].as_u64().unwrap_or(0);
-    println!("SSH key added: {key_id} ({title})");
+    let c = client(hostname)?;
+    let result = keys::add_ssh(&c, title, &kb)?;
+    println!("SSH key added: {} ({})", result.id, title);
     Ok(())
 }
 
-/// Execute `gor ssh-key delete`.
-///
-/// Deletes an SSH public key from the authenticated user's account.
-///
-/// # Errors
-///
-/// Returns an error if the key does not exist or the API request fails.
-fn delete_ssh_key(key_id: &str, yes: bool, hostname: Option<&str>) -> anyhow::Result<()> {
+fn delete_ssh(key_id: &str, yes: bool, hostname: Option<&str>) -> anyhow::Result<()> {
     if !yes {
-        use std::io::Write;
-        print!("Are you sure you want to delete SSH key '{key_id}'? [y/N] ");
-        std::io::stdout().flush().ok();
-
+        print!("Delete SSH key '{key_id}'? [y/N] ");
+        std::io::stdout().flush()?;
         let mut input = String::new();
-        std::io::stdin()
-            .read_line(&mut input)
-            .context("failed to read input")?;
-        let input = input.trim().to_lowercase();
-        if input != "y" && input != "yes" {
-            println!("Cancelled.");
-            return Ok(());
+        std::io::stdin().read_line(&mut input)?;
+        match input.trim().to_lowercase().as_str() {
+            "y" | "yes" => {}
+            _ => {
+                println!("Cancelled.");
+                return Ok(());
+            }
         }
     }
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = format!("/user/keys/{key_id}");
-    let response = client
-        .request("DELETE", &path, &[], None)
-        .context("failed to delete SSH key")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        let err_body: serde_json::Value = response.json().unwrap_or_default();
-        let msg = err_body["message"].as_str().unwrap_or("delete failed");
-        anyhow::bail!("failed to delete SSH key '{key_id}': {msg}");
-    }
-
+    let c = client(hostname)?;
+    keys::delete_ssh(
+        &c,
+        key_id
+            .parse()
+            .map_err(|_| anyhow::anyhow!("invalid key ID: {key_id}"))?,
+    )?;
     println!("SSH key '{key_id}' deleted.");
     Ok(())
 }
 
-/// Execute `gor gpg-key list`.
-///
-/// Lists GPG keys for the authenticated user.
-///
-/// # Errors
-///
-/// Returns an error if the API request fails.
-fn list_gpg_keys(json: Option<Vec<String>>, hostname: Option<&str>) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let response = client
-        .get("/user/gpg_keys")
-        .context("failed to fetch GPG keys")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to list GPG keys: HTTP {status}");
-    }
-
-    let keys: Vec<serde_json::Value> = response
-        .json()
-        .context("failed to parse GPG keys response")?;
-
+fn list_gpg(json: Option<Vec<String>>, hostname: Option<&str>) -> anyhow::Result<()> {
+    let c = client(hostname)?;
+    let gpg_keys = keys::list_gpg(&c)?;
     if let Some(fields) = json {
-        let fields_ref: Option<&[String]> = if fields.is_empty() {
+        let fields_ref = if fields.is_empty() {
             None
         } else {
-            Some(&fields)
+            Some(fields.as_slice())
         };
-        print_json(&keys, fields_ref);
+        let v: Vec<serde_json::Value> = gpg_keys
+            .into_iter()
+            .map(|k| serde_json::to_value(k).unwrap_or_default())
+            .collect();
+        print_json(&v, fields_ref);
         return Ok(());
     }
-
-    if keys.is_empty() {
+    if gpg_keys.is_empty() {
         println!("No GPG keys found.");
         return Ok(());
     }
-
-    let id_width = 16;
-    let name_width = 30;
-
-    println!("{:<id_width$}  {:<name_width$}  EMAILS", "KEY ID", "NAME");
-
-    for key in &keys {
-        let key_id = key["key_id"].as_str().unwrap_or("—");
-        let name = key["name"].as_str().unwrap_or("—");
-
-        let emails: Vec<String> = key["emails"]
-            .as_array()
-            .map(|arr| {
-                arr.iter()
-                    .filter_map(|e| e["email"].as_str().map(String::from))
-                    .collect()
-            })
-            .unwrap_or_default();
-
-        let name_truncated = crate::cmd::util::truncate(name, name_width);
-        let emails_str = emails.join(", ");
-
-        println!("{key_id:<id_width$}  {name_truncated:<name_width$}  {emails_str}");
+    println!("{:<16}  {:<30}  EMAILS", "KEY ID", "NAME");
+    for k in &gpg_keys {
+        let kid = k.key_id.as_deref().unwrap_or("—");
+        let name = truncate(k.name.as_deref().unwrap_or("—"), 30);
+        println!("{kid:<16}  {name:<30}");
     }
-
     Ok(())
 }
 
-/// Execute `gor gpg-key add`.
-///
-/// Adds a GPG public key to the authenticated user's account.
-///
-/// # Errors
-///
-/// Returns an error if the key body is missing or the API request fails.
-fn add_gpg_key(
-    file: Option<&str>,
-    body: Option<&str>,
-    hostname: Option<&str>,
-) -> anyhow::Result<()> {
-    let armored_key = if let Some(b) = body {
-        b.to_string()
-    } else if let Some(f) = file {
-        fs::read_to_string(f)
-            .with_context(|| format!("failed to read GPG key file: {f}"))?
+fn add_gpg(file: Option<&str>, body: Option<&str>, hostname: Option<&str>) -> anyhow::Result<()> {
+    let key = match (body, file) {
+        (Some(b), _) => b.to_string(),
+        (_, Some(f)) => fs::read_to_string(f)
+            .map_err(|e| anyhow::anyhow!("failed to read key file {f}: {e}"))?
             .trim()
-            .to_string()
-    } else {
-        anyhow::bail!("no GPG key provided (use --file or --body)");
+            .to_string(),
+        _ => anyhow::bail!("no GPG key provided (use --file or --body)"),
     };
-
-    if armored_key.is_empty() {
+    if key.is_empty() {
         anyhow::bail!("GPG key body is empty");
     }
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let body_value = serde_json::json!({
-        "armored_public_key": armored_key,
-    });
-
-    let response = client
-        .post("/user/gpg_keys", &body_value)
-        .context("failed to add GPG key")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        let err_body: serde_json::Value = response.json().unwrap_or_default();
-        let msg = err_body["message"].as_str().unwrap_or("add failed");
-        anyhow::bail!("failed to add GPG key: {msg}");
-    }
-
-    let result: serde_json::Value = response.json().context("failed to parse response")?;
-    let key_id = result["key_id"].as_str().unwrap_or("—");
-    println!("GPG key added: {key_id}");
+    let c = client(hostname)?;
+    let result = keys::add_gpg(&c, &key)?;
+    println!("GPG key added: {}", result.key_id.as_deref().unwrap_or("—"));
     Ok(())
 }
 
-/// Execute `gor gpg-key delete`.
-///
-/// Deletes a GPG public key from the authenticated user's account.
-///
-/// # Errors
-///
-/// Returns an error if the key does not exist or the API request fails.
-fn delete_gpg_key(key_id: &str, yes: bool, hostname: Option<&str>) -> anyhow::Result<()> {
+fn delete_gpg(key_id: &str, yes: bool, hostname: Option<&str>) -> anyhow::Result<()> {
     if !yes {
-        use std::io::Write;
-        print!("Are you sure you want to delete GPG key '{key_id}'? [y/N] ");
-        std::io::stdout().flush().ok();
-
+        print!("Delete GPG key '{key_id}'? [y/N] ");
+        std::io::stdout().flush()?;
         let mut input = String::new();
-        std::io::stdin()
-            .read_line(&mut input)
-            .context("failed to read input")?;
-        let input = input.trim().to_lowercase();
-        if input != "y" && input != "yes" {
-            println!("Cancelled.");
-            return Ok(());
+        std::io::stdin().read_line(&mut input)?;
+        match input.trim().to_lowercase().as_str() {
+            "y" | "yes" => {}
+            _ => {
+                println!("Cancelled.");
+                return Ok(());
+            }
         }
     }
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = format!("/user/gpg_keys/{key_id}");
-    let response = client
-        .request("DELETE", &path, &[], None)
-        .context("failed to delete GPG key")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        let err_body: serde_json::Value = response.json().unwrap_or_default();
-        let msg = err_body["message"].as_str().unwrap_or("delete failed");
-        anyhow::bail!("failed to delete GPG key '{key_id}': {msg}");
-    }
-
+    let c = client(hostname)?;
+    keys::delete_gpg(&c, key_id)?;
     println!("GPG key '{key_id}' deleted.");
     Ok(())
 }
diff --git a/crates/gor/src/cmd/search.rs b/crates/gor/src/cmd/search.rs
index d2042cd..875e97b 100644
--- a/crates/gor/src/cmd/search.rs
+++ b/crates/gor/src/cmd/search.rs
@@ -1,14 +1,16 @@
 //! Implementation of the `gor search` subcommand.
-//!
-//! Provides search functionality for repositories, code, issues, and commits.
 
-#![allow(clippy::print_stdout)]
+#![allow(
+    clippy::print_stdout,
+    clippy::too_many_arguments,
+    clippy::format_push_string
+)]
 
 use crate::cli::SearchCommand;
-use crate::render::{format_count, format_date, print_json};
-use anyhow::Context;
-use gor_core::client::Client;
-use std::fmt::Write as FmtWrite;
+use crate::cmd::util::truncate;
+use crate::render::{format_date, print_json};
+use gor_core::Client;
+use gor_core::search;
 
 /// Run the `gor search` subcommand.
 ///
@@ -96,19 +98,15 @@ pub fn run(cmd: SearchCommand) -> anyhow::Result<()> {
     }
 }
 
-fn build_query(base: &str, qualifiers: &[(&str, &str)]) -> String {
-    let mut q = base.to_string();
-    for (key, value) in qualifiers {
-        let _ = write!(q, " {key}:{value}");
-    }
-    q
+fn client(hostname: Option<&str>) -> anyhow::Result<Client> {
+    let host = hostname.unwrap_or("github.com");
+    Client::new(host).map_err(|e| anyhow::anyhow!("{e}"))
 }
 
-#[allow(clippy::too_many_arguments)]
 fn search_repos(
     query: &str,
     language: Option<&str>,
-    _topic: Option<&str>,
+    topic: Option<&str>,
     stars: Option<&str>,
     sort: &str,
     order: &str,
@@ -117,75 +115,46 @@ fn search_repos(
     web: bool,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-
-    if web {
-        let encoded = urlencoding(query);
-        let web_url = format!("https://{host}/search?q={encoded}&type=repositories");
-        open_in_browser(&web_url);
-        return Ok(());
-    }
-
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let mut qualifiers: Vec<(&str, &str)> = Vec::new();
+    let c = client(hostname)?;
+    let mut q = query.to_string();
     if let Some(l) = language {
-        qualifiers.push(("language", l));
+        q.push_str(&format!("+language:{l}"));
+    }
+    if let Some(t) = topic {
+        q.push_str(&format!("+topic:{t}"));
     }
     if let Some(s) = stars {
-        qualifiers.push(("stars", s));
+        q.push_str(&format!("+stars:{s}"));
     }
-    let q = build_query(query, &qualifiers);
-
-    let path = format!(
-        "/search/repositories?q={}&sort={sort}&order={order}&per_page={}",
-        urlencoding(&q),
-        limit.min(100)
-    );
-    let response = client.get(&path).context("failed to search repositories")?;
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("search failed: HTTP {status}");
+    if web {
+        let url = format!("https://github.com/search?q={}", q.replace('+', "%20"));
+        println!("Open {url} in your browser");
+        return Ok(());
     }
-
-    let data: serde_json::Value = response.json().context("failed to parse search response")?;
-    let items: Vec<serde_json::Value> = data["items"].as_array().cloned().unwrap_or_default();
-
+    let items = search::search_repos(&c, &q, sort, order, limit)?;
     if let Some(fields) = json {
-        let fields_ref: Option<&[String]> = if fields.is_empty() {
+        let fields_ref = if fields.is_empty() {
             None
         } else {
-            Some(&fields)
+            Some(fields.as_slice())
         };
         print_json(&items, fields_ref);
         return Ok(());
     }
-
     if items.is_empty() {
         println!("No repositories found.");
         return Ok(());
     }
-
     println!(
-        "{:<40}  {:<50}  {:<8}  {:<12}  {:<16}",
-        "NAME", "DESCRIPTION", "STARS", "LANGUAGE", "UPDATED"
+        "{:<40}  {:<10}  {:<10}  DESCRIPTION",
+        "NAME", "STARS", "UPDATED"
     );
-    for item in &items {
-        let full_name = item["full_name"].as_str().unwrap_or("—");
-        let desc = item["description"].as_str().unwrap_or("—");
-        let stars_count = item["stargazers_count"].as_u64().unwrap_or(0);
-        let lang = item["language"].as_str().unwrap_or("—");
-        let updated = item["updated_at"]
-            .as_str()
-            .map_or_else(|| "—".to_string(), format_date);
-
-        let name_truncated = crate::cmd::util::truncate(full_name, 40);
-        let desc_truncated = crate::cmd::util::truncate(desc, 50);
-
-        println!(
-            "{name_truncated:<40}  {desc_truncated:<50}  {:<8}  {lang:<12}  {updated:<16}",
-            format_count(stars_count)
-        );
+    for r in &items {
+        let name = r["full_name"].as_str().unwrap_or("—");
+        let stars = r["stargazers_count"].as_u64().unwrap_or(0);
+        let updated = format_date(r["updated_at"].as_str().unwrap_or(""));
+        let desc = truncate(r["description"].as_str().unwrap_or("—"), 50);
+        println!("{name:<40}  {stars:<10}  {updated:<10}  {desc}");
     }
     Ok(())
 }
@@ -199,66 +168,40 @@ fn search_code(
     web: bool,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-
-    if web {
-        let encoded = urlencoding(query);
-        let web_url = format!("https://{host}/search?q={encoded}&type=code");
-        open_in_browser(&web_url);
-        return Ok(());
-    }
-
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let mut qualifiers: Vec<(&str, &str)> = Vec::new();
+    let c = client(hostname)?;
+    let mut q = query.to_string();
     if let Some(l) = language {
-        qualifiers.push(("language", l));
+        q.push_str(&format!("+language:{l}"));
     }
     if let Some(r) = repo {
-        qualifiers.push(("repo", r));
+        q.push_str(&format!("+repo:{r}"));
     }
-    let q = build_query(query, &qualifiers);
-
-    let path = format!(
-        "/search/code?q={}&per_page={}",
-        urlencoding(&q),
-        limit.min(100)
-    );
-    let response = client.get(&path).context("failed to search code")?;
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("search failed: HTTP {status}");
+    if web {
+        let url = format!(
+            "https://github.com/search?type=code&q={}",
+            q.replace('+', "%20")
+        );
+        println!("Open {url} in your browser");
+        return Ok(());
     }
-
-    let data: serde_json::Value = response.json().context("failed to parse search response")?;
-    let items: Vec<serde_json::Value> = data["items"].as_array().cloned().unwrap_or_default();
-
+    let items = search::search_code(&c, &q, limit)?;
     if let Some(fields) = json {
-        let fields_ref: Option<&[String]> = if fields.is_empty() {
+        let fields_ref = if fields.is_empty() {
             None
         } else {
-            Some(&fields)
+            Some(fields.as_slice())
         };
         print_json(&items, fields_ref);
         return Ok(());
     }
-
-    if items.is_empty() {
-        println!("No code results found.");
-        return Ok(());
-    }
-
     for item in &items {
-        let repo_name = item["repository"]["full_name"].as_str().unwrap_or("—");
         let path = item["path"].as_str().unwrap_or("—");
-        let html_url = item["html_url"].as_str().unwrap_or("—");
-        println!("{repo_name}/{path}");
-        println!("  {html_url}");
+        let repo_name = item["repository"]["full_name"].as_str().unwrap_or("—");
+        println!("{repo_name} {path}");
     }
     Ok(())
 }
 
-#[allow(clippy::too_many_arguments)]
 fn search_issues(
     query: &str,
     r#type: Option<&str>,
@@ -269,65 +212,46 @@ fn search_issues(
     web: bool,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-
-    if web {
-        let encoded = urlencoding(query);
-        let web_url = format!("https://{host}/search?q={encoded}&type=issues");
-        open_in_browser(&web_url);
-        return Ok(());
-    }
-
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let mut qualifiers: Vec<(&str, &str)> = Vec::new();
+    let c = client(hostname)?;
+    let mut q = query.to_string();
     if let Some(t) = r#type {
-        qualifiers.push(("type", t));
+        q.push_str(&format!("+type:{t}"));
     }
     if let Some(s) = state {
-        qualifiers.push(("state", s));
+        q.push_str(&format!("+state:{s}"));
     }
     if let Some(l) = labels {
-        qualifiers.push(("label", l));
+        q.push_str(&format!("+label:{l}"));
     }
-    let q = build_query(query, &qualifiers);
-
-    let path = format!(
-        "/search/issues?q={}&per_page={}",
-        urlencoding(&q),
-        limit.min(100)
-    );
-    let response = client.get(&path).context("failed to search issues")?;
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("search failed: HTTP {status}");
+    if web {
+        let url = format!("https://github.com/issues?q={}", q.replace('+', "%20"));
+        println!("Open {url} in your browser");
+        return Ok(());
     }
-
-    let data: serde_json::Value = response.json().context("failed to parse search response")?;
-    let items: Vec<serde_json::Value> = data["items"].as_array().cloned().unwrap_or_default();
-
+    let items = search::search_issues(&c, &q, limit)?;
     if let Some(fields) = json {
-        let fields_ref: Option<&[String]> = if fields.is_empty() {
+        let fields_ref = if fields.is_empty() {
             None
         } else {
-            Some(&fields)
+            Some(fields.as_slice())
         };
         print_json(&items, fields_ref);
         return Ok(());
     }
-
     if items.is_empty() {
         println!("No issues found.");
         return Ok(());
     }
-
-    for item in &items {
-        let number = item["number"].as_u64().unwrap_or(0);
-        let title = item["title"].as_str().unwrap_or("—");
-        let state_str = item["state"].as_str().unwrap_or("—");
-        let html_url = item["html_url"].as_str().unwrap_or("—");
-        println!("#{number} [{state_str}] {title}");
-        println!("  {html_url}");
+    println!("{:<40}  {:<15}  TITLE", "ISSUE", "STATE");
+    for i in &items {
+        let repo = i["repository_url"]
+            .as_str()
+            .and_then(|u| u.rsplit('/').nth(1))
+            .unwrap_or("—");
+        let num = i["number"].as_u64().unwrap_or(0);
+        let state = i["state"].as_str().unwrap_or("—");
+        let title = truncate(i["title"].as_str().unwrap_or("—"), 50);
+        println!("{repo}/#{num:<8}  {state:<15}  {title}");
     }
     Ok(())
 }
@@ -341,88 +265,43 @@ fn search_commits(
     web: bool,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let host = hostname.unwrap_or("github.com");
-
-    if web {
-        let encoded = urlencoding(query);
-        let web_url = format!("https://{host}/search?q={encoded}&type=commits");
-        open_in_browser(&web_url);
-        return Ok(());
-    }
-
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let mut qualifiers: Vec<(&str, &str)> = Vec::new();
+    let c = client(hostname)?;
+    let mut q = query.to_string();
     if let Some(a) = author {
-        qualifiers.push(("author", a));
+        q.push_str(&format!("+author:{a}"));
     }
     if let Some(r) = repo {
-        qualifiers.push(("repo", r));
+        q.push_str(&format!("+repo:{r}"));
     }
-    let q = build_query(query, &qualifiers);
-
-    let path = format!(
-        "/search/commits?q={}&per_page={}",
-        urlencoding(&q),
-        limit.min(100)
-    );
-    let response = client.get(&path).context("failed to search commits")?;
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("search failed: HTTP {status}");
+    if web {
+        let url = format!(
+            "https://github.com/search?type=commits&q={}",
+            q.replace('+', "%20")
+        );
+        println!("Open {url} in your browser");
+        return Ok(());
     }
-
-    let data: serde_json::Value = response.json().context("failed to parse search response")?;
-    let items: Vec<serde_json::Value> = data["items"].as_array().cloned().unwrap_or_default();
-
+    let items = search::search_commits(&c, &q, limit)?;
     if let Some(fields) = json {
-        let fields_ref: Option<&[String]> = if fields.is_empty() {
+        let fields_ref = if fields.is_empty() {
             None
         } else {
-            Some(&fields)
+            Some(fields.as_slice())
         };
         print_json(&items, fields_ref);
         return Ok(());
     }
-
-    if items.is_empty() {
-        println!("No commits found.");
-        return Ok(());
-    }
-
     for item in &items {
-        let sha = item["sha"].as_str().unwrap_or("—");
-        let short_sha = &sha[..sha.len().min(7)];
-        let message = item["commit"]["message"].as_str().unwrap_or("—");
-        let first_line = message.lines().next().unwrap_or("—");
-        let author_login = item["author"]["login"].as_str().unwrap_or("—");
-        let html_url = item["html_url"].as_str().unwrap_or("—");
-        println!("{short_sha} {first_line}");
-        println!("  {author_login} — {html_url}");
+        let sha = item["sha"]
+            .as_str()
+            .unwrap_or("—")
+            .chars()
+            .take(7)
+            .collect::<String>();
+        let msg = truncate(item["commit"]["message"].as_str().unwrap_or("—"), 80);
+        let author = item["commit"]["author"]["name"].as_str().unwrap_or("—");
+        let date = format_date(item["commit"]["author"]["date"].as_str().unwrap_or(""));
+        println!("{sha} {author:<20} {date:<10} {msg}");
     }
     Ok(())
 }
-
-fn urlencoding(s: &str) -> String {
-    s.replace(' ', "+")
-        .replace('#', "%23")
-        .replace('&', "%26")
-        .replace('?', "%3F")
-}
-
-fn open_in_browser(url: &str) {
-    #[cfg(target_os = "linux")]
-    {
-        let _ = std::process::Command::new("xdg-open").arg(url).spawn();
-    }
-    #[cfg(target_os = "macos")]
-    {
-        let _ = std::process::Command::new("open").arg(url).spawn();
-    }
-    #[cfg(target_os = "windows")]
-    {
-        let _ = std::process::Command::new("cmd")
-            .args(["/c", "start", url])
-            .spawn();
-    }
-}
diff --git a/crates/gor/src/cmd/workflow.rs b/crates/gor/src/cmd/workflow.rs
index 8485e7f..d204759 100644
--- a/crates/gor/src/cmd/workflow.rs
+++ b/crates/gor/src/cmd/workflow.rs
@@ -1,14 +1,13 @@
 //! Implementation of the `gor workflow` subcommand.
-//!
-//! Provides GitHub Actions workflow listing.
 
 #![allow(clippy::print_stdout)]
 
 use crate::cli::WorkflowCommand;
+use crate::cmd::util::truncate;
 use crate::render::print_json;
-use anyhow::Context;
-use gor_core::client::Client;
+use gor_core::Client;
 use gor_core::repository::{detect_remote, parse_repo_spec};
+use gor_core::workflow::{self};
 
 /// Run the `gor workflow` subcommand.
 ///
@@ -44,7 +43,7 @@ pub fn run(cmd: WorkflowCommand) -> anyhow::Result<()> {
             repo,
             branch,
             hostname,
-        } => trigger_workflow_run(
+        } => trigger_run(
             &workflow,
             repo.as_deref(),
             branch.as_deref(),
@@ -53,381 +52,107 @@ pub fn run(cmd: WorkflowCommand) -> anyhow::Result<()> {
     }
 }
 
-/// Execute `gor workflow list`.
-///
-/// Lists GitHub Actions workflows in a repository.
-///
-/// # Errors
-///
-/// Returns an error if the repository cannot be found or the API request fails.
+fn resolve_spec(repo: Option<&str>) -> anyhow::Result<gor_core::RepoSplit> {
+    match repo {
+        Some(s) => Ok(parse_repo_spec(s)?),
+        None => detect_remote().ok_or_else(|| {
+            anyhow::anyhow!("could not detect repository; specify OWNER/REPO with --repo")
+        }),
+    }
+}
+
+fn client(hostname: Option<&str>) -> anyhow::Result<Client> {
+    let host = hostname.unwrap_or("github.com");
+    Client::new(host).map_err(|e| anyhow::anyhow!("{e}"))
+}
+
 fn list(
     repo: Option<&str>,
     limit: u32,
     json: Option<Vec<String>>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let spec = match repo {
-        Some(s) => parse_repo_spec(s).context("invalid repository spec")?,
-        None => detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository from current directory; specify OWNER/REPO with --repo"
-            )
-        })?,
-    };
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = format!(
-        "/repos/{}/{}/actions/workflows?per_page={}",
-        spec.owner,
-        spec.repo,
-        limit.min(100)
-    );
-    let response = client.get(&path).context("failed to fetch workflows")?;
-
-    let status = response.status();
-    if status == reqwest::StatusCode::NOT_FOUND {
-        anyhow::bail!("repository '{spec}' not found");
-    }
-    if !status.is_success() {
-        anyhow::bail!("failed to list workflows for '{spec}': HTTP {status}");
-    }
-
-    let result: serde_json::Value = response
-        .json()
-        .context("failed to parse workflows response")?;
-    let mut workflows: Vec<serde_json::Value> = result["workflows"]
-        .as_array()
-        .map_or_else(Vec::new, Clone::clone);
-
-    workflows.truncate(limit as usize);
-
+    let s = resolve_spec(repo)?;
+    let c = client(hostname)?;
+    let workflows = workflow::list(&c, &s, limit)?;
     if let Some(fields) = json {
-        let fields_ref: Option<&[String]> = if fields.is_empty() {
+        let fields_ref = if fields.is_empty() {
             None
         } else {
-            Some(&fields)
+            Some(fields.as_slice())
         };
-        print_json(&workflows, fields_ref);
+        let v: Vec<serde_json::Value> = workflows
+            .into_iter()
+            .map(|w| serde_json::to_value(w).unwrap_or_default())
+            .collect();
+        print_json(&v, fields_ref);
         return Ok(());
     }
-
-    print_workflow_table(&workflows);
+    if workflows.is_empty() {
+        println!("No workflows found.");
+        return Ok(());
+    }
+    println!("{:<8}  {:<30}  STATE", "ID", "NAME");
+    for w in &workflows {
+        let name = truncate(&w.name, 30);
+        let state = w.state.as_deref().unwrap_or("—");
+        println!("{:<8}  {name:<30}  {state}", w.id);
+    }
     Ok(())
 }
 
-/// Execute `gor workflow view`.
-///
-/// Views a workflow's details and recent runs.
-///
-/// # Errors
-///
-/// Returns an error if the repository cannot be found or the API request fails.
 fn view(
     workflow: &str,
     repo: Option<&str>,
     json: Option<Vec<String>>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let spec = match repo {
-        Some(s) => parse_repo_spec(s).context("invalid repository spec")?,
-        None => detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository from current directory; specify OWNER/REPO with --repo"
-            )
-        })?,
-    };
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    // Determine if the workflow arg is a numeric ID or a filename/name
-    let path = if workflow.parse::<u64>().is_ok() {
-        format!(
-            "/repos/{}/{}/actions/workflows/{workflow}",
-            spec.owner, spec.repo
-        )
-    } else {
-        // URL-encode the filename: replace / with %2F
-        let encoded = workflow.replace('/', "%2F");
-        format!(
-            "/repos/{}/{}/actions/workflows/{encoded}",
-            spec.owner, spec.repo
-        )
-    };
-
-    let response = client.get(&path).context("failed to fetch workflow")?;
-
-    let status = response.status();
-    if status == reqwest::StatusCode::NOT_FOUND {
-        anyhow::bail!("workflow '{workflow}' not found in repository '{spec}'");
-    }
-    if !status.is_success() {
-        anyhow::bail!("failed to view workflow: HTTP {status}");
-    }
-
-    let wf: serde_json::Value = response
-        .json()
-        .context("failed to parse workflow response")?;
-
-    // Fetch recent runs (up to 5)
-    let runs_path = format!(
-        "/repos/{}/{}/actions/workflows/{}/runs?per_page=5",
-        spec.owner, spec.repo, workflow
-    );
-    let runs_response = client.get(&runs_path);
-    let recent_runs: Vec<serde_json::Value> = runs_response.map_or_else(
-        |_| Vec::new(),
-        |resp| {
-            if resp.status().is_success() {
-                resp.json::<serde_json::Value>().map_or_else(
-                    |_| Vec::new(),
-                    |runs_data| {
-                        runs_data["workflow_runs"]
-                            .as_array()
-                            .map_or_else(Vec::new, Clone::clone)
-                    },
-                )
-            } else {
-                Vec::new()
-            }
-        },
-    );
-
-    // --json: output as JSON
+    let s = resolve_spec(repo)?;
+    let c = client(hostname)?;
+    let wf = workflow::view(&c, &s, workflow)?;
     if let Some(fields) = json {
-        let fields_ref: Option<&[String]> = if fields.is_empty() {
+        let fields_ref = if fields.is_empty() {
             None
         } else {
-            Some(&fields)
+            Some(fields.as_slice())
         };
         print_json(&wf, fields_ref);
         return Ok(());
     }
-
-    // Default: print details
     let name = wf["name"].as_str().unwrap_or("—");
     let state = wf["state"].as_str().unwrap_or("—");
-    let wf_path = wf["path"].as_str().unwrap_or("—");
-
+    let path = wf["path"].as_str().unwrap_or("—");
     println!("  Name: {name}");
     println!("  State: {state}");
-    println!("  Path: {wf_path}");
-
-    // Print trigger events
-    if let Some(events) = wf["triggering_events"].as_array() {
-        if !events.is_empty() {
-            println!("  Events:");
-            for event in events {
-                let event_str = serde_json::to_string(event).unwrap_or_default();
-                println!("    - {event_str}");
-            }
-        }
-    }
-
-    // Print recent runs
-    if !recent_runs.is_empty() {
-        println!("  Recent runs:");
-        println!(
-            "    {:<8}  {:<10}  {:<12}  {:<20}  {:<16}",
-            "RUN ID", "STATUS", "CONCLUSION", "BRANCH", "TIMESTAMP"
-        );
-        for run in &recent_runs {
-            let run_id = run["id"].as_u64().unwrap_or(0);
-            let run_status = run["status"].as_str().unwrap_or("—");
-            let conclusion = run["conclusion"].as_str().unwrap_or("—");
-            let branch = run["head_branch"].as_str().unwrap_or("—");
-            let created = run["created_at"]
-                .as_str()
-                .map_or_else(|| "—".to_string(), crate::render::format_date);
-
-            println!(
-                "    {run_id:<8}  {run_status:<10}  {conclusion:<12}  {branch:<20}  {created:<16}",
-            );
-        }
-    }
-
+    println!("  Path: {path}");
     Ok(())
 }
 
-/// Print a formatted workflow list table.
-fn print_workflow_table(workflows: &[serde_json::Value]) {
-    if workflows.is_empty() {
-        println!("No workflows found.");
-        return;
-    }
-
-    let name_width = 40;
-    let state_width = 12;
-    let id_width = 8;
-
-    println!(
-        "{:<id_width$}  {:<name_width$}  {:<state_width$}",
-        "ID", "NAME", "STATE",
-    );
-
-    for wf in workflows {
-        let id = wf["id"].as_u64().unwrap_or(0);
-        let name = wf["name"].as_str().unwrap_or("—");
-        let state = wf["state"].as_str().unwrap_or("—");
-
-        let name_truncated = crate::cmd::util::truncate(name, name_width);
-
-        println!("{id:<id_width$}  {name_truncated:<name_width$}  {state:<state_width$}");
-    }
-}
-
-/// Execute `gor workflow enable`.
-///
-/// Enables a workflow.
-///
-/// # Errors
-///
-/// Returns an error if the repository cannot be found or the API request fails.
 fn enable(workflow: &str, repo: Option<&str>, hostname: Option<&str>) -> anyhow::Result<()> {
-    let spec = match repo {
-        Some(s) => parse_repo_spec(s).context("invalid repository spec")?,
-        None => detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository from current directory; specify OWNER/REPO with --repo"
-            )
-        })?,
-    };
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = format!(
-        "/repos/{}/{}/actions/workflows/{workflow}/enable",
-        spec.owner, spec.repo
-    );
-
-    let response = client
-        .request("PUT", &path, &[], None)
-        .context("failed to enable workflow")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to enable workflow '{workflow}': HTTP {status}");
-    }
-
-    println!("Workflow '{workflow}' is now enabled.");
+    let s = resolve_spec(repo)?;
+    let c = client(hostname)?;
+    workflow::enable(&c, &s, workflow)?;
+    println!("Workflow '{workflow}' enabled.");
     Ok(())
 }
 
-/// Execute `gor workflow disable`.
-///
-/// Disables a workflow.
-///
-/// # Errors
-///
-/// Returns an error if the repository cannot be found or the API request fails.
 fn disable(workflow: &str, repo: Option<&str>, hostname: Option<&str>) -> anyhow::Result<()> {
-    let spec = match repo {
-        Some(s) => parse_repo_spec(s).context("invalid repository spec")?,
-        None => detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository from current directory; specify OWNER/REPO with --repo"
-            )
-        })?,
-    };
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let path = format!(
-        "/repos/{}/{}/actions/workflows/{workflow}/disable",
-        spec.owner, spec.repo
-    );
-
-    let response = client
-        .request("PUT", &path, &[], None)
-        .context("failed to disable workflow")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to disable workflow '{workflow}': HTTP {status}");
-    }
-
-    println!("Workflow '{workflow}' is now disabled.");
+    let s = resolve_spec(repo)?;
+    let c = client(hostname)?;
+    workflow::disable(&c, &s, workflow)?;
+    println!("Workflow '{workflow}' disabled.");
     Ok(())
 }
 
-/// Execute `gor workflow run`.
-///
-/// Triggers a workflow dispatch run.
-///
-/// # Errors
-///
-/// Returns an error if the repository cannot be found or the API request fails.
-fn trigger_workflow_run(
+fn trigger_run(
     workflow: &str,
     repo: Option<&str>,
     branch: Option<&str>,
     hostname: Option<&str>,
 ) -> anyhow::Result<()> {
-    let spec = match repo {
-        Some(s) => parse_repo_spec(s).context("invalid repository spec")?,
-        None => detect_remote().ok_or_else(|| {
-            anyhow::anyhow!(
-                "could not detect repository from current directory; specify OWNER/REPO with --repo"
-            )
-        })?,
-    };
-
-    let host = hostname.unwrap_or("github.com");
-    let client = Client::new(host).context("failed to create HTTP client")?;
-
-    let body_value = serde_json::json!({
-        "ref": branch.unwrap_or("main"),
-    });
-    let body_bytes = serde_json::to_vec(&body_value).context("failed to serialize body")?;
-
-    let path = format!(
-        "/repos/{}/{}/actions/workflows/{workflow}/dispatches",
-        spec.owner, spec.repo
-    );
-
-    let response = client
-        .request("POST", &path, &[], Some(body_bytes))
-        .context("failed to trigger workflow run")?;
-
-    let status = response.status();
-    if !status.is_success() {
-        anyhow::bail!("failed to trigger workflow run: HTTP {status}");
-    }
-
+    let s = resolve_spec(repo)?;
+    let c = client(hostname)?;
+    workflow::trigger_run(&c, &s, workflow, branch.unwrap_or("main"))?;
     println!("Workflow run triggered for '{workflow}'.");
     Ok(())
 }
-
-#[cfg(test)]
-#[allow(clippy::expect_used)]
-mod tests {
-    use super::*;
-    use serde_json::json;
-
-    #[test]
-    fn print_workflow_table_basic() {
-        let workflows = vec![
-            json!({
-                "id": 12345,
-                "name": "CI",
-                "state": "active"
-            }),
-            json!({
-                "id": 67890,
-                "name": "Deploy",
-                "state": "active"
-            }),
-        ];
-        print_workflow_table(&workflows);
-    }
-
-    #[test]
-    fn print_workflow_table_empty() {
-        let workflows: Vec<serde_json::Value> = vec![];
-        print_workflow_table(&workflows);
-    }
-}

From 0ef8188040594d28d1ad20ede9371c725624d988 Mon Sep 17 00:00:00 2001
From: Kerry Hatcher <kerry@kerryhatcher.com>
Date: Sun, 26 Jul 2026 14:06:06 -0400
Subject: [PATCH 8/8] docs: add handoff document for core library split

---
 HANDOFF.md | 251 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 251 insertions(+)
 create mode 100644 HANDOFF.md

diff --git a/HANDOFF.md b/HANDOFF.md
new file mode 100644
index 0000000..51e4f8d
--- /dev/null
+++ b/HANDOFF.md
@@ -0,0 +1,251 @@
+# Handoff: gor-core Library Split (Issue #2)
+
+## Project Overview
+
+**Goal:** Split the single-crate `gor` CLI into a Cargo workspace with:
+- **`gor-core`** — reusable library crate with typed GitHub API operations, models, and infrastructure
+- **`gor`** — thin CLI binary for argument parsing, rendering, and dispatching to `gor-core`
+
+**Binary:** `gor` (unchanged)  
+**Package names:** `gor-cli` (crates.io), `gor-core` (new)  
+**Branch:** `refactor/split-core-library`  
+**Draft PR:** [#3](https://github.com/kerryhatcher/gor/pull/3)  
+**Issue:** [#2](https://github.com/kerryhatcher/gor/issues/2) — full design spec
+
+---
+
+## What's Been Done
+
+### Phase 0 — Setup
+- Branch `refactor/split-core-library` created and pushed
+- Draft PR opened, linked to issue #2
+- Design spec at `docs/superpowers/specs/2026-07-20-core-library-split-design.md`
+
+### Phase 1 — Workspace Restructuring
+- Root `Cargo.toml` is a pure workspace with `members = ["crates/*"]`
+- `crates/gor-core/` — library (`name = "gor_core"`), keeps: `reqwest`, `serde`, `serde_json`, `serde_yaml_ng`, `keyring` (optional), `thiserror`, `dirs`, `gix`, `tracing`
+- `crates/gor/` — binary (`name = "gor"`), depends on `gor-core`, keeps: `clap`, `clap_complete`, `anyhow`, `miette`, `tracing-subscriber`, `indicatif`, `console`, `gix`, `serde_yaml_ng`, `dirs`
+- All imports updated: core files use `gor_core::` prefix, `output.rs` → `render.rs`
+- **Commit:** `26e8b18` — `build: split workspace into gor-core + gor crates`
+
+### Phase 2 — Label Template
+- `crates/gor-core/src/label.rs` — typed `Label` struct (`#[non_exhaustive]` + capture-rest `extra`), `Label::list/create/update/delete/clone_from` ops
+- `crates/gor-core/src/util.rs` — `urlencode_label_name` helper
+- CLI handler thinned to args → op → render pattern
+- **Tests:** 49 gor-core unit tests + 120 gor unit tests
+- **Commit:** `793f733` — `refactor(label): extract typed ops into gor-core`
+
+### Phase 3a–3b — 8 More Domains Converted
+
+| Domain | Core Module | CLI Handler | Commit |
+|--------|------------|-------------|--------|
+| **cache** | `crates/gor-core/src/cache.rs` | `crates/gor/src/cmd/cache.rs` | `02de2b3` |
+| **org** | `crates/gor-core/src/org.rs` | `crates/gor/src/cmd/org.rs` | `02de2b3` |
+| **secret** | `crates/gor-core/src/secret.rs` | `crates/gor/src/cmd/secret.rs` | `4621f83` |
+| **variable** | `crates/gor-core/src/variable.rs` | `crates/gor/src/cmd/variable.rs` | `4621f83` |
+| **project** | `crates/gor-core/src/project.rs` | `crates/gor/src/cmd/project.rs` | `0b409e2` |
+| **keys** | `crates/gor-core/src/keys.rs` | `crates/gor/src/cmd/keys.rs` | `27f90b9` |
+| **search** | `crates/gor-core/src/search.rs` | `crates/gor/src/cmd/search.rs` | `27f90b9` |
+| **workflow** | `crates/gor-core/src/workflow.rs` | `crates/gor/src/cmd/workflow.rs` | `27f90b9` |
+
+---
+
+## What Remains
+
+### Phase 3c–3d — 7 domains still to convert
+
+| Domain | LOC | Priority | Notes |
+|--------|-----|----------|-------|
+| `gist` | 518 | 3c | Create/list/view/edit/delete |
+| `run` | 636 | 3c | List/view/watch/cancel/rerun/download |
+| `codespace` | 647 | 3c | List/create/delete/ssh/stop |
+| `release` | 1313 | 3d | Create/edit/delete/list/view/upload/download |
+| `repo` | 1317 | 3d | View/list/create/fork/delete/edit/clone/sync/transfer |
+| `issue` | 1332 | 3d | List/view/create/edit/close/reopen/comment/transfer |
+| `pr` | 2236 | 3d | List/view/create/close/reopen/merge/diff/checkout/comment/review/checks/ready/edit |
+
+### Phase 4 — Cleanup & Publishability (not started)
+- Delete dead bin helpers (e.g., old `urlencoding` in label.rs → now in `gor_core::util`)
+- Move shared pagination/field-selection into `gor_core::util`
+- Audit `gor-core` for any remaining `anyhow`/`print_stdout`/`console`/`indicatif` usage
+- Add `gor-core` metadata: `description`, `keywords`, `categories`
+- Verify `cargo doc --no-deps -p gor-core` clean
+
+### Phase 5 — Merge & Release (not started)
+- Merge PR, referencing `closes #2`
+- `release-plz` publishes `gor-core` 0.1.0 + bumped `gor-cli`
+- Update README with consumer example
+
+---
+
+## Conversion Pattern (follow this for remaining domains)
+
+### 1. Core Module (`crates/gor-core/src/<domain>.rs`)
+- Typed `struct` with `#[non_exhaustive]` and `#[serde(flatten)] extra`
+- Options structs (`ListOptions`, `CreateOptions`, etc.) — use owned `String` not `&str`
+- Operation functions returning `Result<T, GorError>` (never `anyhow`, never print)
+- Status→error mapping: `404 → GorError::NotFound`, `422 → GorError::InvalidInput`, other failures → `GorError::InvalidInput(msg)`
+- `#![allow(clippy::missing_errors_doc)]` at module top (to avoid per-function doc burden)
+- `///` doc comments on all structs and fields (required by `#![deny(missing_docs)]`)
+
+### 2. Register in `crates/gor-core/src/lib.rs`
+- Add `pub mod <domain>;` in alphabetical order
+
+### 3. Thin CLI Handler (`crates/gor/src/cmd/<domain>.rs`)
+- Keep `pub fn run(cmd: DomainCommand)` — dispatches to private helpers
+- Helpers: resolve args → call `gor_core::<domain>::*` → render output
+- Import `gor_core::<domain>::{self, TypeName}`
+- Use `Client::new(host).map_err(|e| anyhow::anyhow!("..."))` pattern
+- Keep all `println!`, prompts, and rendering in the CLI handler
+- Keep `#![allow(clippy::print_stdout)]` (allowed for CLI crate)
+- Doc comments on `pub fn run` (required by `#![deny(missing_docs)]`)
+
+### 4. Add `pub mod <domain>;` to `crates/gor/src/cmd/mod.rs`
+
+### 5. Gate
+- `cargo build` must pass
+- `cargo clippy --all-targets` must pass
+- `cargo test` must pass (existing 118 gor + 49 gor-core + doc tests = ~187 tests)
+- Commit: `refactor(<domain>): extract typed ops into gor-core`
+
+---
+
+## Key Constraints & Pitfalls
+
+### Lint rules (deny, will fail CI):
+- **`#![deny(missing_docs)]`** in both crates — every pub item, struct field, and enum variant needs a doc comment
+- **`unwrap_used = "deny"`** — no `.unwrap()` or `.unwrap_err()` ever. Use `?` or pattern matching
+- **`dbg_macro = "deny"`** — no `dbg!()`
+- **`todo = "deny"`** — no `todo!()`
+- **`clippy::use_self`** — in `impl` blocks, use `Self::Variant` not `EnumName::Variant`
+- **`clippy::missing_errors_doc`** — suppress with `#![allow(clippy::missing_errors_doc)]` at module top
+- **`clippy::uninlined_format_args`** — use `format!("{var}")` not `format!("{}", var)`
+- **`clippy::format_push_string`** — use `write!` macro instead of `push_str(&format!(...))`
+- **`clippy::too_many_arguments`** — suppress with `#![allow(clippy::too_many_arguments)]`
+
+### Error handling:
+- Core ops return `Result<T, GorError>` — never `anyhow::Result`
+- `GorError` variants: `Http(reqwest::Error)`, `Auth(String)`, `NotFound(String)`, `RateLimit(String)`, `InvalidInput(String)`, `Io(std::io::Error)`, `Keyring(String)`, `DeviceTimeout(String)`, `DeviceDeclined`
+- CLI handlers return `anyhow::Result<()>` — wrap errors with `map_err(|e| anyhow::anyhow!("..."))`
+
+### `#[non_exhaustive]` structs:
+- Cannot be constructed outside the defining crate
+- Test data must use `serde_json::from_value(json!({...}))` to construct instances
+
+### `extra` field idiom:
+```rust
+/// Any additional fields returned by the API.
+#[serde(flatten)]
+pub extra: serde_json::Map<String, serde_json::Value>,
+```
+- Always include this on typed models to capture unknown API fields
+- Requires a doc comment
+
+### CLI handler spec resolution helper (copy-paste template):
+```rust
+fn resolve_spec(repo: Option<&str>) -> anyhow::Result<gor_core::RepoSplit> {
+    match repo {
+        Some(s) => Ok(parse_repo_spec(s)?),
+        None => detect_remote().ok_or_else(|| {
+            anyhow::anyhow!("could not detect repository; specify OWNER/REPO with --repo")
+        }),
+    }
+}
+
+fn build_client(hostname: Option<&str>) -> anyhow::Result<Client> {
+    let host = hostname.unwrap_or("github.com");
+    Client::new(host).map_err(|e| anyhow::anyhow!("failed to create HTTP client: {e}"))
+}
+```
+
+---
+
+## Current File Structure
+
+```
+Cargo.toml                          # Workspace root
+crates/
+  gor-core/
+    Cargo.toml
+    src/
+      lib.rs                        # Exports all core modules
+      client.rs                     # HTTP client (reqwest::blocking)
+      host.rs                       # Host URL derivation
+      config.rs                     # Config management
+      error.rs                      # GorError enum
+      keyring_store.rs              # OS keyring integration
+      repository.rs                 # Repo spec parsing, remote detection
+      auth/                         # OAuth device flow, token verification
+        mod.rs
+        device.rs
+        token.rs
+      cache.rs                      # ✅ Converted
+      keys.rs                       # ✅ Converted
+      label.rs                      # ✅ Converted (template)
+      org.rs                        # ✅ Converted
+      project.rs                    # ✅ Converted
+      search.rs                     # ✅ Converted
+      secret.rs                     # ✅ Converted
+      util.rs                       # urlencode_label_name
+      variable.rs                   # ✅ Converted
+      workflow.rs                   # ✅ Converted
+  gor/
+    Cargo.toml
+    src/
+      lib.rs                        # Gor struct, re-exports cli/cmd/render
+      main.rs                       # Thin entry point
+      cli.rs                        # clap derive structs
+      render.rs                     # print_json, format_date, format_count
+      cmd/
+        mod.rs                      # Dispatches all subcommands
+        alias.rs                    # Bin-only
+        api.rs                      # Bin-only
+        attestation.rs              # Bin-only
+        auth.rs                     # Bin-only
+        browse.rs                   # Bin-only
+        cache.rs                    # ✅ Converted
+        classroom.rs                # Bin-only
+        codespace.rs                # 🔜 Needs conversion
+        completion.rs               # Bin-only
+        config.rs                   # Bin-only
+        copilot.rs                  # Bin-only
+        extension.rs                # Bin-only
+        gist.rs                     # 🔜 Needs conversion
+        issue.rs                    # 🔜 Needs conversion
+        keys.rs                     # ✅ Converted
+        label.rs                    # ✅ Converted
+        org.rs                      # ✅ Converted
+        pr.rs                       # 🔜 Needs conversion
+        project.rs                  # ✅ Converted
+        release.rs                  # 🔜 Needs conversion
+        repo.rs                     # 🔜 Needs conversion
+        ruleset.rs                  # Bin-only
+        run.rs                      # 🔜 Needs conversion
+        search.rs                   # ✅ Converted
+        secret.rs                   # ✅ Converted
+        util.rs                     # truncate helper
+        variable.rs                 # ✅ Converted
+        workflow.rs                 # ✅ Converted
+```
+
+---
+
+## Quick Build & Test
+
+```bash
+just build          # cargo build
+just test           # cargo test (expect ~187 tests passing)
+just lint           # cargo fmt + clippy
+just ci             # Full CI gate
+```
+
+---
+
+## Critical Reminders
+
+1. **The `#[allow(clippy::elided_lifetimes_in_paths)]` is a rustc lint, not clippy** — use `#[allow(elided_lifetimes_in_paths)]` without `clippy::` prefix
+2. **After every successful conversion**, commit and push to the `refactor/split-core-library` branch
+3. **All existing tests must continue to pass** — no behavior changes
+4. **The `pr.rs` file (2236 LOC) is the largest and most complex** — may need to be split into submodules (`pr::list`, `pr::view`, `pr::merge`, etc.)
+5. **`release`, `repo`, `issue`, `pr` have `#[cfg(test)]` blocks** — preserve these tests when converting
+6. **The `just` pre-commit hooks run `cargo fmt`, `cargo clippy`, `cargo check`, and `typos`** — ensure all pass before the commit will succeed