// CURRENT — wasteful
let default_secrecy =
    repo_visibility_secrecy(&arg_owner, &arg_repo, &default_repo, ctx);
// ...
let default_secrecy_shared: crate::SharedLabels = default_secrecy.clone().into();  // ← Vec clone here
// ...
return Some(PathLabelResult {
    ...
    default_labels: Some(crate::ResourceLabels {
        secrecy: default_secrecy.into(),   // ← original moved here
        ...
    }),
    ...
});

let default_secrecy =
    repo_visibility_secrecy(&arg_owner, &arg_repo, &default_repo, ctx);
// ...further down...
let default_secrecy_shared: crate::SharedLabels = default_secrecy.clone().into();
// ...in per-item loop...
secrecy: default_secrecy_shared.clone(),
// ...in default_labels...
secrecy: default_secrecy.into(),

let default_secrecy: crate::SharedLabels =
    repo_visibility_secrecy(&arg_owner, &arg_repo, &default_repo, ctx).into();
// ...further down, no separate `clone().into()` needed...
// ...in per-item loop...
secrecy: default_secrecy.clone(),
// ...in default_labels...
secrecy: default_secrecy,   // move (last use)

#[test]
fn list_project_items_issue_type_gets_repo_scoped_secrecy_and_association_integrity() {
    let tool_args = json!({"owner": "octocat"});
    let response = json!({
        "items": [{
            "type": "ISSUE",
            "content": {
                "repository_url": "https://api.github.com/repos/octocat/hello-world",
                "author_association": "CONTRIBUTOR"
            }
        }]
    });
    let result = label_response_paths("list_project_items", &tool_args, &response, &ctx())
        .expect("should produce path labels");
    assert_eq!(result.labeled_paths.len(), 1);
    let entry = &result.labeled_paths[0];
    // CONTRIBUTOR association → at least reader-level integrity (non-empty)
    assert!(!entry.labels.integrity.is_empty(),
        "ISSUE item should have non-empty integrity; got {:?}", entry.labels.integrity);
    assert_eq!(entry.labels.description, "project-item:issue");
}

#[test]
fn list_project_items_draft_issue_gets_writer_integrity_and_empty_secrecy() {
    let tool_args = json!({"owner": "octocat"});
    let response = json!({
        "items": [{"type": "DRAFT_ISSUE", "title": "todo item"}]
    });
    let result = label_response_paths("list_project_items", &tool_args, &response, &ctx())
        .expect("should produce path labels");
    let entry = &result.labeled_paths[0];
    assert!(entry.labels.secrecy.is_empty(),
        "DRAFT_ISSUE should have empty secrecy; got {:?}", entry.labels.secrecy);
    // writer_integrity(owner) must be non-empty
    assert!(!entry.labels.integrity.is_empty(),
        "DRAFT_ISSUE should have non-empty integrity; got {:?}", entry.labels.integrity);
    assert_eq!(entry.labels.description, "project-item:draft_issue");
}

#[test]
fn projects_list_alias_behaves_identically_to_list_project_items() {
    let tool_args = json!({"owner": "octocat"});
    let response = json!({
        "items": [{"type": "PULL_REQUEST", "content": {
            "repository_url": "https://api.github.com/repos/octocat/hello-world",
            "author_association": "MEMBER"
        }}]
    });
    let r1 = label_response_paths("list_project_items", &tool_args, &response, &ctx());
    let r2 = label_response_paths("projects_list", &tool_args, &response, &ctx());
    // Both aliases must produce results with the same number of labeled paths
    assert_eq!(
        r1.as_ref().map(|r| r.labeled_paths.len()),
        r2.as_ref().map(|r| r.labeled_paths.len()),
        "projects_list alias must match list_project_items"
    );
}