forges 0.0.0 → 0.1.0

package/dist/github-B0umL8_f.mjs

@@ -0,0 +1,3259 @@
+import { A as toPage, B as isNamespaceRef, C as requireIssueOrPull, E as summariseChecks, L as REACTION_CONTENTS, M as versionAtLeast, Mt as WebhookVerificationError, Nt as soleMergeMethod, O as toDate, Pt as toMergeError, S as phased, T as resolveToken, V as isResolvedThread, Y as reactionContent, _t as ForgeError, bt as InsufficientScopeError, c as checkRunState, ct as eventAction, d as forgeIterable, dt as fromBase64, f as getManyConcurrently, ft as toFileContent, g as iteratePages, gt as ForgeApiError, h as hostOf, ht as ForbiddenError, i as githubShapedWeb, j as toWarning, jt as UnsupportedOperationError, k as toFileStatus, l as createListing, lt as reviewState, n as perKind, nt as anySignal, ot as sleep, r as verb, rt as createFetcher, s as actorLogin, t as defineForgeProvider, v as memo, w as requireThread, wt as NotFoundError, x as milestoneId, xt as MergeBlockedError, yt as ForgeTimeoutError } from "./define-D3yEXtKK.mjs";
+import { n as headerValue, s as signRs256Jwt, t as bodyText } from "./crypto-CQNEyYHD.mjs";
+import { a as verifyHmacSignature, i as refEvent, r as nativeEventsFor, t as eventKindsOf } from "./webhooks-rn9-8lxT.mjs";
+//#region src/github/auth.ts
+const JWT_LIFETIME_SECONDS = 540;
+const REFRESH_MARGIN_MS = 6e4;
+function createAppCredentials(auth, context) {
+	let jwt;
+	const tokens = /* @__PURE__ */ new Map();
+	async function appJwt() {
+		if (jwt && jwt.expiresAt > Date.now() + REFRESH_MARGIN_MS) return jwt.value;
+		const now = Math.floor(Date.now() / 1e3);
+		const value = await signRs256Jwt(auth.privateKey, {
+			iss: String(auth.appId),
+			iat: now - 60,
+			exp: now + JWT_LIFETIME_SECONDS
+		});
+		jwt = {
+			value,
+			expiresAt: (now + JWT_LIFETIME_SECONDS) * 1e3
+		};
+		return value;
+	}
+	const fetcher = createFetcher({
+		baseUrl: context.baseUrl,
+		fetch: context.fetch,
+		timeout: context.timeout,
+		headers: context.headers,
+		authHeaders: async () => ({ authorization: `Bearer ${await appJwt()}` })
+	});
+	async function installationTokenDetails(installationId, options) {
+		const cached = tokens.get(installationId);
+		if (cached && cached.expiresAt.getTime() > Date.now() + REFRESH_MARGIN_MS) return cached;
+		const { data } = await fetcher.json(`/app/installations/${installationId}/access_tokens`, {
+			method: "POST",
+			signal: options?.signal
+		});
+		const token = {
+			token: data.token,
+			expiresAt: new Date(data.expires_at),
+			permissions: data.permissions ?? {},
+			repositorySelection: data.repository_selection
+		};
+		tokens.set(installationId, token);
+		return token;
+	}
+	return {
+		appJwt,
+		installationTokenDetails,
+		installationToken: async (installationId, options) => (await installationTokenDetails(installationId, options)).token
+	};
+}
+function createAuthHeaders(auth, credentials) {
+	if (!auth || auth.type === "anonymous") return async () => ({});
+	if (auth.type === "token") return async () => ({ authorization: `Bearer ${await resolveToken(auth)}` });
+	const app = credentials;
+	const installationId = auth.installationId;
+	if (installationId === void 0) return async () => ({ authorization: `Bearer ${await app.appJwt()}` });
+	return async () => ({ authorization: `Bearer ${await app.installationToken(String(installationId))}` });
+}
+//#endregion
+//#region src/github/webhook-events.ts
+/** Native GitHub event names per normalised kind, for hook subscriptions. */
+const GITHUB_NATIVE_EVENTS = {
+	comment: [
+		"issue_comment",
+		"commit_comment",
+		"discussion_comment"
+	],
+	review: ["pull_request_review"],
+	review_comment: ["pull_request_review_comment"],
+	state_change: [
+		"issues",
+		"pull_request",
+		"discussion"
+	],
+	label: [
+		"issues",
+		"pull_request",
+		"label"
+	],
+	assignment: ["issues", "pull_request"],
+	push: ["push"],
+	ref: ["create", "delete"],
+	repo: ["repository"],
+	installation: ["installation", "installation_repositories"],
+	membership: [
+		"member",
+		"membership",
+		"organization",
+		"team"
+	],
+	release: ["release"]
+};
+/** Normalised kinds and actions GitHub deliveries translate into. */
+const GITHUB_WEBHOOK_EVENTS = [
+	{
+		kind: "comment",
+		action: "created"
+	},
+	{
+		kind: "comment",
+		action: "edited"
+	},
+	{
+		kind: "comment",
+		action: "deleted"
+	},
+	{
+		kind: "review",
+		action: "submitted"
+	},
+	{
+		kind: "review_comment",
+		action: "created"
+	},
+	{
+		kind: "state_change",
+		action: "opened"
+	},
+	{
+		kind: "state_change",
+		action: "closed"
+	},
+	{
+		kind: "state_change",
+		action: "reopened"
+	},
+	{
+		kind: "state_change",
+		action: "merged"
+	},
+	{
+		kind: "state_change",
+		action: "ready_for_review"
+	},
+	{
+		kind: "state_change",
+		action: "converted_to_draft"
+	},
+	{
+		kind: "label",
+		action: "labelled"
+	},
+	{
+		kind: "label",
+		action: "unlabelled"
+	},
+	{
+		kind: "assignment",
+		action: "assigned"
+	},
+	{
+		kind: "assignment",
+		action: "unassigned"
+	},
+	{
+		kind: "assignment",
+		action: "review_requested"
+	},
+	{ kind: "push" },
+	{
+		kind: "ref",
+		action: "created"
+	},
+	{
+		kind: "ref",
+		action: "deleted"
+	},
+	{
+		kind: "repo",
+		action: "renamed"
+	},
+	{
+		kind: "repo",
+		action: "transferred"
+	},
+	{
+		kind: "repo",
+		action: "archived"
+	},
+	{
+		kind: "repo",
+		action: "unarchived"
+	},
+	{ kind: "installation" },
+	{ kind: "membership" },
+	{
+		kind: "release",
+		action: "published"
+	}
+];
+//#endregion
+//#region src/github/normalise.ts
+const FORGE = "github";
+function toActor(instance, user) {
+	if (!user) return;
+	return {
+		forge: FORGE,
+		instance,
+		login: user.login,
+		id: String(user.id ?? user.login),
+		name: user.name ?? void 0,
+		avatarUrl: user.avatar_url,
+		url: user.html_url,
+		typeRaw: user.type,
+		isBotHint: user.type === "Bot" || user.login.endsWith("[bot]"),
+		...user.type === "Bot" && user.login.endsWith("[bot]") ? { app: { slug: user.login.slice(0, -5) } } : {}
+	};
+}
+function toUser(instance, user) {
+	return {
+		...toActor(instance, user),
+		bio: user.bio ?? void 0,
+		company: user.company ?? void 0,
+		location: user.location ?? void 0,
+		websiteUrl: user.blog || void 0,
+		createdAt: toDate(user.created_at),
+		followers: user.followers,
+		following: user.following,
+		publicRepos: user.public_repos,
+		raw: user
+	};
+}
+function toRepoRef(instance, repo) {
+	const [owner, name] = repo.full_name.split("/");
+	return {
+		forge: FORGE,
+		instance,
+		owner: repo.owner?.login ?? owner ?? "",
+		name: repo.name ?? name ?? "",
+		externalId: repo.id === void 0 ? void 0 : String(repo.id)
+	};
+}
+/** Reads `owner` and `name` out of an API repository URL, which search results carry instead of a nested repository. */
+function repoRefFromApiUrl(instance, url) {
+	const [, owner, name] = url?.match(/\/repos\/([^/]+)\/([^/]+)$/) ?? [];
+	return owner && name ? {
+		forge: FORGE,
+		instance,
+		owner,
+		name
+	} : void 0;
+}
+function toRepo(instance, raw) {
+	const visibility = raw.visibility === "internal" ? "internal" : raw.private || raw.visibility === "private" ? "private" : "public";
+	return {
+		ref: toRepoRef(instance, raw),
+		description: raw.description ?? void 0,
+		defaultBranch: raw.default_branch,
+		visibility,
+		visibilityRaw: raw.visibility ?? (raw.private === void 0 ? void 0 : raw.private ? "private" : "public"),
+		isFork: raw.fork ?? false,
+		isArchived: raw.archived ?? false,
+		parent: raw.parent ? toRepoRef(instance, raw.parent) : void 0,
+		topics: raw.topics ?? [],
+		url: raw.html_url,
+		cloneUrls: raw.clone_url || raw.ssh_url ? {
+			https: raw.clone_url,
+			ssh: raw.ssh_url
+		} : void 0,
+		createdAt: toDate(raw.created_at),
+		updatedAt: toDate(raw.updated_at),
+		pushedAt: toDate(raw.pushed_at),
+		owner: toActor(instance, raw.owner),
+		language: raw.language ?? void 0,
+		homepage: raw.homepage || void 0,
+		licence: raw.license?.spdx_id && raw.license.spdx_id !== "NOASSERTION" ? raw.license.spdx_id : void 0,
+		stars: raw.stargazers_count,
+		forks: raw.forks_count,
+		watchers: raw.subscribers_count,
+		mergeMethods: raw.allow_merge_commit === void 0 && raw.allow_squash_merge === void 0 && raw.allow_rebase_merge === void 0 ? void 0 : [
+			...raw.allow_merge_commit ? ["merge"] : [],
+			...raw.allow_squash_merge ? ["squash"] : [],
+			...raw.allow_rebase_merge ? ["rebase"] : []
+		],
+		features: raw.has_issues === void 0 ? void 0 : {
+			issues: raw.has_issues,
+			pullRequests: true,
+			discussions: raw.has_discussions ?? false,
+			wiki: raw.has_wiki ?? false,
+			projects: raw.has_projects ?? false,
+			releases: true
+		},
+		permissions: raw.permissions ? {
+			admin: raw.permissions.admin,
+			maintain: raw.permissions.maintain ?? raw.permissions.admin,
+			push: raw.permissions.push,
+			triage: raw.permissions.triage ?? raw.permissions.push,
+			pull: raw.permissions.pull
+		} : void 0,
+		raw
+	};
+}
+function toReactions(raw) {
+	if (!raw) return;
+	const counts = Object.fromEntries(REACTION_CONTENTS.flatMap((name) => raw[name] ? [[name, raw[name]]] : []));
+	return {
+		total: raw.total_count ?? Object.values(counts).reduce((sum, count) => sum + count, 0),
+		counts
+	};
+}
+function toMilestone(raw) {
+	return raw ? {
+		id: String(raw.number ?? raw.id ?? ""),
+		title: raw.title,
+		state: raw.state === "closed" ? "closed" : "open",
+		description: raw.description ?? void 0,
+		dueOn: toDate(raw.due_on),
+		url: raw.html_url,
+		raw
+	} : void 0;
+}
+/** GitHub's `role_name`, or the permission block when a listing reports only that. */
+function toRole(raw) {
+	switch (raw.role_name) {
+		case "admin":
+		case "maintain":
+		case "write":
+		case "triage":
+		case "read": return raw.role_name;
+	}
+	const permissions = raw.permissions;
+	if (!permissions) return "none";
+	return permissions.admin ? "admin" : permissions.maintain ? "maintain" : permissions.push ? "write" : permissions.triage ? "triage" : permissions.pull ? "read" : "none";
+}
+function toCollaborator(instance, raw) {
+	return {
+		actor: toActor(instance, raw),
+		role: toRole(raw),
+		roleRaw: raw.role_name,
+		raw
+	};
+}
+function toThreadKind(subjectType) {
+	switch (subjectType) {
+		case "PullRequest": return "pull_request";
+		case "Discussion": return "discussion";
+		case "Commit": return "commit";
+		case "Issue": return "issue";
+		default: return "other";
+	}
+}
+function toThreadState(issue) {
+	if (issue.merged || issue.merged_at || issue.pull_request?.merged_at) return "merged";
+	if (issue.state === "open" || issue.state === "closed") return issue.state;
+	return "unknown";
+}
+function numberFromUrl(url) {
+	return /\/(?:issues|pulls|commits|discussions)\/([^/?#]+)/.exec(url ?? "")?.[1];
+}
+const REASONS = {
+	approval_requested: "approval_requested",
+	assign: "assigned",
+	author: "author",
+	ci_activity: "ci_activity",
+	comment: "comment",
+	invitation: "invitation",
+	manual: "manual",
+	mention: "mention",
+	review_requested: "review_requested",
+	security_alert: "security_alert",
+	security_advisory_credit: "security_alert",
+	state_change: "state_change",
+	subscribed: "subscribed",
+	team_mention: "team_mention"
+};
+function toReason(reason) {
+	return REASONS[reason] ?? "unknown";
+}
+const SECURITY_SUBJECTS = /* @__PURE__ */ new Set([
+	"RepositoryVulnerabilityAlert",
+	"RepositoryDependabotAlertsThread",
+	"SecretScanningAlert",
+	"RepositoryAdvisory"
+]);
+const SECURITY_SUBJECTS_KIND = {
+	RepositoryVulnerabilityAlert: "dependency",
+	RepositoryDependabotAlertsThread: "dependency",
+	SecretScanningAlert: "secret",
+	RepositoryAdvisory: "advisory"
+};
+function lastSegment(url) {
+	return /\/([^/?#]+)\/?$/.exec(url ?? "")?.[1];
+}
+function toSubject(instance, raw) {
+	const repo = toRepoRef(instance, raw.repository);
+	const type = raw.subject.type;
+	const kind = toThreadKind(type);
+	if (kind !== "other") return {
+		type: "thread",
+		thread: {
+			forge: FORGE,
+			instance,
+			repo,
+			kind,
+			typeRaw: type,
+			number: numberFromUrl(raw.subject.url)
+		}
+	};
+	if (type === "Release") return {
+		type: "release",
+		release: {
+			forge: FORGE,
+			instance,
+			repo,
+			id: lastSegment(raw.subject.url) ?? raw.id
+		}
+	};
+	if (SECURITY_SUBJECTS.has(type)) {
+		const kind = SECURITY_SUBJECTS_KIND[type];
+		return {
+			type: "security_alert",
+			alert: {
+				forge: FORGE,
+				instance,
+				repo,
+				id: lastSegment(raw.subject.url) ?? raw.id,
+				...kind ? { kind } : {}
+			}
+		};
+	}
+	if (type === "RepositoryInvitation") return {
+		type: "repo",
+		repo
+	};
+	return {
+		type: "other",
+		typeRaw: type,
+		repo,
+		id: lastSegment(raw.subject.url),
+		url: raw.subject.url ?? void 0
+	};
+}
+function toNotification(instance, raw) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance,
+			id: raw.id
+		},
+		subject: toSubject(instance, raw),
+		subjectTypeRaw: raw.subject.type,
+		reason: toReason(raw.reason),
+		reasonRaw: raw.reason,
+		unread: raw.unread,
+		title: raw.subject.title,
+		subjectState: "unknown",
+		updatedAt: toDate(raw.updated_at) ?? /* @__PURE__ */ new Date(0),
+		lastReadAt: toDate(raw.last_read_at),
+		url: raw.subject.url ?? raw.url,
+		raw
+	};
+}
+function toLabel(raw) {
+	return {
+		name: raw.name,
+		colour: raw.color ?? void 0,
+		description: raw.description ?? void 0
+	};
+}
+function toLabels(labels) {
+	return (labels ?? []).flatMap((label) => {
+		if (typeof label === "string") return [{ name: label }];
+		return label.name ? [{
+			name: label.name,
+			colour: label.color ?? void 0,
+			description: label.description ?? void 0
+		}] : [];
+	});
+}
+function toReviewers(instance, raw) {
+	const users = (raw.requested_reviewers ?? []).flatMap((user) => {
+		const actor = toActor(instance, user);
+		return actor ? [{
+			actor,
+			state: "pending",
+			stateRaw: "requested"
+		}] : [];
+	});
+	const teams = (raw.requested_teams ?? []).map((team) => ({
+		actor: {
+			forge: FORGE,
+			instance,
+			login: team.slug,
+			id: String(team.id),
+			name: team.name,
+			url: team.html_url,
+			typeRaw: "Team",
+			isBotHint: false
+		},
+		state: "pending",
+		stateRaw: "requested",
+		isTeam: true
+	}));
+	return [...users, ...teams];
+}
+/** Builds a thread from an issue, a pull request, or a pull request as returned by the issues API. */
+function toThread(ref, raw) {
+	const kind = raw.pull_request || raw.head ? "pull_request" : ref.kind;
+	return {
+		ref: {
+			...ref,
+			kind,
+			externalId: raw.node_id ?? ref.externalId
+		},
+		kind,
+		title: raw.title,
+		body: raw.body ?? void 0,
+		state: toThreadState(raw),
+		stateRaw: raw.state,
+		stateReason: raw.state_reason ?? void 0,
+		isDraft: raw.draft ?? false,
+		author: toActor(ref.instance, raw.user),
+		assignees: (raw.assignees ?? []).flatMap((user) => toActor(ref.instance, user) ?? []),
+		reviewers: toReviewers(ref.instance, raw),
+		labels: toLabels(raw.labels),
+		url: raw.html_url,
+		createdAt: toDate(raw.created_at),
+		updatedAt: toDate(raw.updated_at),
+		closedAt: toDate(raw.closed_at),
+		lastActivityAt: toDate(raw.updated_at),
+		locked: raw.locked,
+		commentCount: raw.comments,
+		milestone: toMilestone(raw.milestone),
+		reactions: toReactions(raw.reactions),
+		branches: raw.head && raw.base ? {
+			head: {
+				ref: raw.head.ref,
+				sha: raw.head.sha,
+				repo: raw.head.repo ? toRepoRef(ref.instance, raw.head.repo) : void 0
+			},
+			base: {
+				ref: raw.base.ref,
+				sha: raw.base.sha
+			},
+			mergeCommitSha: raw.merge_commit_sha ?? void 0
+		} : void 0,
+		raw
+	};
+}
+function toComment(thread, raw) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: thread.instance,
+			thread,
+			id: String(raw.id)
+		},
+		body: raw.body ?? "",
+		author: toActor(thread.instance, raw.user),
+		createdAt: toDate(raw.created_at),
+		updatedAt: toDate(raw.updated_at),
+		url: raw.html_url,
+		reactions: toReactions(raw.reactions),
+		raw
+	};
+}
+const EVENT_KINDS = {
+	"commented": "comment",
+	"reviewed": "review",
+	"line_commented": "review_comment",
+	"review_requested": "assignment",
+	"review_request_removed": "assignment",
+	"committed": "commit",
+	"labeled": "label",
+	"unlabeled": "label",
+	"closed": "state_change",
+	"reopened": "state_change",
+	"merged": "state_change",
+	"convert_to_draft": "state_change",
+	"ready_for_review": "state_change",
+	"assigned": "assignment",
+	"unassigned": "assignment",
+	"mentioned": "mention",
+	"cross-referenced": "referenced",
+	"referenced": "referenced",
+	"reaction": "reaction"
+};
+function toEventKind(event) {
+	return EVENT_KINDS[event ?? ""] ?? "other";
+}
+function summarise$1(entry, kind, actor) {
+	const who = actor?.login ?? "someone";
+	switch (kind) {
+		case "comment": return `${who} commented`;
+		case "review": return `${who} reviewed (${entry.state ?? "commented"})`;
+		case "review_comment": return `${who} commented on a line`;
+		case "commit": return `${entry.author?.name ?? who} committed ${entry.sha?.slice(0, 7) ?? "a commit"}`;
+		case "label": return `${who} ${entry.event === "unlabeled" ? "removed" : "added"} label ${entry.label?.name ?? ""}`.trim();
+		case "state_change": return `${who} ${entry.event ?? "changed state"}`;
+		case "referenced": return `${who} referenced this`;
+		case "assignment":
+			if (entry.event === "review_requested" || entry.event === "review_request_removed") return `${who} ${entry.event === "review_requested" ? "requested review from" : "removed the review request for"} ${entry.requested_reviewer?.login ?? ""}`.trim();
+			return `${who} ${entry.event === "unassigned" ? "unassigned" : "assigned"} ${entry.assignee?.login ?? ""}`.trim();
+		default: return `${who} ${entry.event ?? "acted"}`;
+	}
+}
+/** A `cross-referenced` entry names the thread that mentioned this one; a `referenced` entry names a commit. */
+function crossReference(instance, thread, entry) {
+	const source = entry.source?.issue;
+	if (source) {
+		const repo = source.repository ? toRepoRef(instance, source.repository) : thread.repo;
+		return {
+			type: "referenced",
+			from: {
+				forge: FORGE,
+				instance,
+				repo,
+				kind: source.pull_request ? "pull_request" : "issue",
+				number: String(source.number)
+			},
+			fromRepo: repo
+		};
+	}
+	return entry.commit_id ? {
+		type: "referenced",
+		from: {
+			forge: FORGE,
+			instance,
+			repo: thread.repo,
+			sha: entry.commit_id
+		},
+		fromRepo: thread.repo
+	} : { type: "referenced" };
+}
+function timelineDetail(instance, thread, entry, kind) {
+	switch (kind) {
+		case "comment": return {
+			type: "comment",
+			comment: entry.id !== void 0 ? {
+				forge: FORGE,
+				instance,
+				thread,
+				id: String(entry.id)
+			} : void 0,
+			body: entry.body ?? void 0
+		};
+		case "review": return {
+			type: "review",
+			state: reviewState(entry.state),
+			stateRaw: entry.state,
+			body: entry.body ?? void 0
+		};
+		case "label": return entry.label ? {
+			type: "label",
+			label: entry.label.name
+		} : void 0;
+		case "assignment": return {
+			type: "assignment",
+			assignee: toActor(instance, entry.assignee ?? entry.requested_reviewer)
+		};
+		case "referenced": return crossReference(instance, thread, entry);
+		case "state_change": return entry.event === "convert_to_draft" || entry.event === "ready_for_review" ? {
+			type: "state_change",
+			state: "open",
+			draft: entry.event === "convert_to_draft"
+		} : {
+			type: "state_change",
+			state: entry.event === "merged" ? "merged" : entry.event === "closed" ? "closed" : "open"
+		};
+		default: return;
+	}
+}
+function toEvent(instance, thread, entry, source = "poll") {
+	const kind = toEventKind(entry.event);
+	const actor = toActor(instance, entry.actor ?? entry.user);
+	return {
+		forge: FORGE,
+		instance,
+		id: String(entry.node_id ?? entry.id ?? entry.sha ?? `${thread.number ?? ""}-${entry.event}-${entry.created_at}`),
+		kind,
+		kindRaw: entry.event,
+		detail: timelineDetail(instance, thread, entry, kind),
+		summary: summarise$1(entry, kind, actor),
+		occurredAt: toDate(entry.created_at ?? entry.submitted_at ?? entry.author?.date ?? entry.committer?.date) ?? /* @__PURE__ */ new Date(0),
+		actor,
+		repo: thread.repo,
+		thread,
+		source,
+		payload: entry
+	};
+}
+function statusState(state) {
+	return state === "success" ? "success" : state === "pending" ? "pending" : state === "failure" || state === "error" ? "failure" : "unknown";
+}
+function toCheckRun(repo, raw) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			id: String(raw.id),
+			type: "check_run"
+		},
+		name: raw.name,
+		state: checkRunState(raw.status, raw.conclusion),
+		stateRaw: raw.status,
+		conclusionRaw: raw.conclusion ?? void 0,
+		url: raw.html_url ?? raw.details_url ?? void 0,
+		startedAt: toDate(raw.started_at),
+		completedAt: toDate(raw.completed_at),
+		raw
+	};
+}
+function toStatusCheck(repo, raw) {
+	const state = statusState(raw.state);
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			id: String(raw.id),
+			type: "status"
+		},
+		name: raw.context,
+		state,
+		stateRaw: raw.state,
+		url: raw.target_url ?? void 0,
+		startedAt: toDate(raw.created_at),
+		completedAt: state === "pending" ? void 0 : toDate(raw.updated_at),
+		raw
+	};
+}
+function toRelease(repo, raw) {
+	const ref = {
+		forge: FORGE,
+		instance: repo.instance,
+		repo,
+		id: String(raw.id),
+		tag: raw.tag_name
+	};
+	return {
+		ref,
+		name: raw.name ?? void 0,
+		tag: raw.tag_name,
+		body: raw.body ?? void 0,
+		isDraft: raw.draft,
+		isPrerelease: raw.prerelease,
+		immutable: raw.immutable,
+		author: toActor(repo.instance, raw.author),
+		publishedAt: toDate(raw.published_at),
+		createdAt: toDate(raw.created_at),
+		url: raw.html_url,
+		assets: raw.assets?.map((asset) => ({
+			...asset.id === void 0 ? {} : { ref: {
+				forge: FORGE,
+				instance: repo.instance,
+				repo,
+				release: ref,
+				id: String(asset.id)
+			} },
+			name: asset.name,
+			url: asset.browser_download_url,
+			size: asset.size,
+			downloadCount: asset.download_count,
+			contentType: asset.content_type
+		})),
+		raw
+	};
+}
+function toSeverity(raw) {
+	switch (raw?.toLowerCase()) {
+		case "critical": return "critical";
+		case "high":
+		case "error": return "high";
+		case "medium":
+		case "moderate":
+		case "warning": return "medium";
+		case "low":
+		case "note": return "low";
+		default: return "unknown";
+	}
+}
+function alertState(raw) {
+	return raw === "open" ? "open" : raw === "fixed" ? "fixed" : raw === "dismissed" || raw === "auto_dismissed" ? "dismissed" : "unknown";
+}
+function toDependabotAlert(repo, raw) {
+	const severityRaw = raw.security_vulnerability?.severity ?? raw.security_advisory?.severity;
+	const pkg = raw.dependency?.package;
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			id: String(raw.number),
+			kind: "dependency",
+			severityRaw
+		},
+		kind: "dependency",
+		kindRaw: "dependabot",
+		severity: toSeverity(severityRaw),
+		severityRaw,
+		state: alertState(raw.state),
+		stateRaw: raw.state,
+		title: raw.security_advisory?.summary ?? `Vulnerable dependency ${pkg?.name ?? ""}`.trim(),
+		...pkg ? { package: {
+			ecosystem: pkg.ecosystem,
+			name: pkg.name,
+			vulnerableRange: raw.security_vulnerability?.vulnerable_version_range,
+			fixedIn: raw.security_vulnerability?.first_patched_version?.identifier
+		} } : {},
+		url: raw.html_url,
+		createdAt: toDate(raw.created_at),
+		updatedAt: toDate(raw.updated_at),
+		dismissedAt: toDate(raw.dismissed_at),
+		raw
+	};
+}
+function toCodeScanningAlert(repo, raw) {
+	const severityRaw = raw.rule?.security_severity_level ?? raw.rule?.severity ?? void 0;
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			id: String(raw.number),
+			kind: "code_scanning",
+			severityRaw
+		},
+		kind: "code_scanning",
+		kindRaw: raw.tool?.name ?? "code_scanning",
+		severity: toSeverity(severityRaw),
+		severityRaw,
+		state: alertState(raw.state),
+		stateRaw: raw.state,
+		title: raw.rule?.description ?? raw.rule?.name ?? raw.rule?.id ?? "Code scanning alert",
+		url: raw.html_url,
+		createdAt: toDate(raw.created_at),
+		updatedAt: toDate(raw.updated_at),
+		dismissedAt: toDate(raw.dismissed_at),
+		raw
+	};
+}
+/** Secret scanning reports no severity. A revoked secret is fixed; any other resolution dismisses the alert. */
+function toSecretScanningAlert(repo, raw) {
+	const state = raw.state === "open" ? "open" : raw.state === "resolved" ? raw.resolution === "revoked" ? "fixed" : "dismissed" : "unknown";
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			id: String(raw.number),
+			kind: "secret"
+		},
+		kind: "secret",
+		kindRaw: raw.secret_type ?? "secret_scanning",
+		severity: "unknown",
+		state,
+		stateRaw: raw.resolution ? `${raw.state}:${raw.resolution}` : raw.state,
+		title: raw.secret_type_display_name ?? raw.secret_type ?? "Secret scanning alert",
+		url: raw.html_url,
+		createdAt: toDate(raw.created_at),
+		updatedAt: toDate(raw.updated_at),
+		dismissedAt: state === "dismissed" ? toDate(raw.resolved_at) : void 0,
+		raw
+	};
+}
+function toReviewComment(thread, raw, reviewThread) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: thread.instance,
+			thread,
+			id: String(raw.id)
+		},
+		body: raw.body ?? "",
+		author: toActor(thread.instance, raw.user),
+		path: raw.path,
+		line: raw.line ?? raw.original_line ?? void 0,
+		side: raw.side?.toLowerCase() === "left" ? "left" : raw.side ? "right" : void 0,
+		inReplyTo: raw.in_reply_to_id === null || raw.in_reply_to_id === void 0 ? void 0 : String(raw.in_reply_to_id),
+		thread: reviewThread,
+		createdAt: toDate(raw.created_at),
+		url: raw.html_url,
+		raw
+	};
+}
+function toReview(thread, raw, comments) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: thread.instance,
+			thread,
+			id: String(raw.id)
+		},
+		author: toActor(thread.instance, raw.user),
+		state: reviewState(raw.state),
+		stateRaw: raw.state,
+		body: raw.body || void 0,
+		submittedAt: toDate(raw.submitted_at ?? void 0),
+		comments,
+		url: raw.html_url,
+		raw
+	};
+}
+function toWorkflowRun(repo, raw) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			id: String(raw.id)
+		},
+		name: raw.name || raw.display_title || String(raw.id),
+		state: checkRunState(raw.status ?? "queued", raw.conclusion),
+		stateRaw: raw.status ?? "unknown",
+		number: raw.run_number === void 0 ? void 0 : String(raw.run_number),
+		eventRaw: raw.event,
+		branch: raw.head_branch ?? void 0,
+		sha: raw.head_sha,
+		url: raw.html_url,
+		actor: toActor(repo.instance, raw.actor),
+		createdAt: toDate(raw.created_at),
+		startedAt: toDate(raw.run_started_at),
+		completedAt: raw.status === "completed" ? toDate(raw.updated_at) : void 0,
+		raw
+	};
+}
+function toWorkflowJob(run, raw) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: run.instance,
+			repo: run.repo,
+			id: String(raw.id),
+			run
+		},
+		name: raw.name,
+		state: checkRunState(raw.status ?? "queued", raw.conclusion),
+		stateRaw: raw.status ?? "unknown",
+		url: raw.html_url ?? void 0,
+		startedAt: toDate(raw.started_at),
+		completedAt: toDate(raw.completed_at),
+		raw
+	};
+}
+function toChangedFile(raw) {
+	return {
+		path: raw.filename,
+		previousPath: raw.previous_filename,
+		status: toFileStatus(raw.status),
+		statusRaw: raw.status,
+		additions: raw.additions,
+		deletions: raw.deletions,
+		patch: raw.patch,
+		sha: raw.sha
+	};
+}
+function toCommit(repo, raw) {
+	return {
+		ref: {
+			forge: FORGE,
+			instance: repo.instance,
+			repo,
+			sha: raw.sha
+		},
+		sha: raw.sha,
+		message: raw.commit.message,
+		author: {
+			actor: toActor(repo.instance, raw.author),
+			name: raw.commit.author?.name,
+			email: raw.commit.author?.email,
+			date: toDate(raw.commit.author?.date)
+		},
+		committer: {
+			actor: toActor(repo.instance, raw.committer),
+			name: raw.commit.committer?.name,
+			email: raw.commit.committer?.email,
+			date: toDate(raw.commit.committer?.date)
+		},
+		parents: raw.parents?.map((parent) => parent.sha) ?? [],
+		url: raw.html_url,
+		...raw.stats ? { stats: {
+			additions: raw.stats.additions ?? 0,
+			deletions: raw.stats.deletions ?? 0,
+			total: raw.stats.total
+		} } : {},
+		...raw.files ? { files: raw.files.map(toChangedFile) } : {},
+		raw
+	};
+}
+function toBranch(raw, defaultBranch) {
+	return {
+		name: raw.name,
+		sha: raw.commit.sha,
+		isDefault: defaultBranch === void 0 ? void 0 : raw.name === defaultBranch,
+		isProtected: raw.protected,
+		raw
+	};
+}
+function toTag(raw) {
+	return {
+		name: raw.name,
+		sha: raw.commit.sha,
+		raw
+	};
+}
+const TREE_TYPES = {
+	blob: "file",
+	tree: "directory",
+	commit: "submodule"
+};
+function toTreeEntry(raw) {
+	return {
+		path: raw.path,
+		type: raw.mode === "120000" ? "symlink" : TREE_TYPES[raw.type ?? ""] ?? "file",
+		sha: raw.sha,
+		size: raw.size,
+		mode: raw.mode
+	};
+}
+function toWebhook(target, raw) {
+	const nativeEvents = raw.events ?? [];
+	return {
+		ref: {
+			forge: FORGE,
+			instance: target.instance,
+			target,
+			id: String(raw.id)
+		},
+		url: raw.config?.url ?? "",
+		events: eventKindsOf(GITHUB_NATIVE_EVENTS, nativeEvents),
+		nativeEvents,
+		active: raw.active ?? true,
+		contentType: raw.config?.content_type === "form" ? "form" : "json",
+		createdAt: toDate(raw.created_at),
+		updatedAt: toDate(raw.updated_at),
+		raw
+	};
+}
+function toWebhookDelivery(hook, raw) {
+	const status = raw.status_code ?? 0;
+	return {
+		ref: {
+			forge: FORGE,
+			instance: hook.instance,
+			hook,
+			id: String(raw.id),
+			guid: raw.guid
+		},
+		event: raw.action ? `${raw.event}.${raw.action}` : raw.event ?? "",
+		status,
+		ok: status >= 200 && status < 300,
+		deliveredAt: toDate(raw.delivered_at),
+		duration: raw.duration,
+		raw
+	};
+}
+//#endregion
+//#region src/github/graphql-client.ts
+function graphqlUrl(baseUrl) {
+	const url = new URL(baseUrl);
+	if (url.host === "api.github.com") return "https://api.github.com/graphql";
+	return `${url.origin}${url.pathname.replace(/\/v3\/?$/, "")}/graphql`;
+}
+/** A failed GraphQL response as an error: `InsufficientScopeError` when the token lacks a scope a field needs. */
+function graphqlError(operationName, errors, url, context) {
+	const message = errors?.map((error) => error.message).join("; ") || "Empty GraphQL response";
+	return new (errors?.some((error) => error.type === "INSUFFICIENT_SCOPES") ? InsufficientScopeError : ForgeApiError)(`GraphQL ${operationName ?? "request"} failed: ${message}`, 200, JSON.stringify(errors ?? null).slice(0, 512), {
+		forge: FORGE,
+		instance: context.instance,
+		url,
+		method: "POST"
+	});
+}
+function createGraphQLClient(fetcher, url, context) {
+	return async (document, variables, options) => {
+		const query = typeof document === "string" ? (await import("./graphql-D7uGzZTf.mjs"))[document] : document.query;
+		const operationName = /(?:query|mutation)\s+(\w+)/.exec(query)?.[1];
+		const { data } = await fetcher.json(url, {
+			method: "POST",
+			json: {
+				query,
+				variables,
+				operationName
+			},
+			signal: options?.signal
+		});
+		if (data.errors?.length || !data.data) throw graphqlError(operationName, data.errors, url, context);
+		return data.data;
+	};
+}
+//#endregion
+//#region src/github/webhooks.ts
+const SIGNATURE_HEADER = "x-hub-signature-256";
+const EVENT_HEADER = "x-github-event";
+function verifyGitHubSignature(delivery, secret) {
+	return verifyHmacSignature(delivery, secret, {
+		header: SIGNATURE_HEADER,
+		prefix: "sha256="
+	});
+}
+function repoLevel(instance, event, payload, who) {
+	switch (event) {
+		case "push": return {
+			...refEvent(who, {
+				ref: payload.ref ?? "",
+				before: payload.before,
+				after: payload.after,
+				deleted: payload.deleted,
+				forced: payload.forced,
+				commits: (payload.commits ?? []).map((commit) => ({
+					sha: commit.id,
+					message: commit.message,
+					author: commit.author?.username ?? commit.author?.name,
+					url: commit.url
+				}))
+			}),
+			occurredAt: payload.deleted ? void 0 : toDate(payload.head_commit?.timestamp)
+		};
+		case "create":
+		case "delete": return {
+			kind: "ref",
+			action: event === "create" ? "created" : "deleted",
+			detail: {
+				type: "ref",
+				ref: payload.ref ?? "",
+				refType: payload.ref_type ?? "branch"
+			},
+			summary: `${who} ${event === "create" ? "created" : "deleted"} ${payload.ref_type ?? "ref"} ${payload.ref ?? ""}`.trim()
+		};
+		case "repository":
+			if (payload.action === "renamed") return {
+				kind: "repo",
+				action: "renamed",
+				detail: {
+					type: "repo_renamed",
+					from: payload.changes?.repository?.name?.from ?? "",
+					to: payload.repository?.name ?? ""
+				},
+				summary: `${who} renamed the repository`
+			};
+			if (payload.action === "transferred") {
+				const from = payload.changes?.owner?.from;
+				return {
+					kind: "repo",
+					action: "transferred",
+					detail: {
+						type: "repo_transferred",
+						fromOwner: (from?.organization ?? from?.user)?.login,
+						toOwner: payload.repository?.owner?.login
+					},
+					summary: `${who} transferred the repository`
+				};
+			}
+			if (payload.action === "archived" || payload.action === "unarchived") return {
+				kind: "repo",
+				action: payload.action,
+				detail: {
+					type: "repo_archived",
+					archived: payload.action === "archived"
+				},
+				summary: `${who} ${payload.action} the repository`
+			};
+			return;
+		case "installation":
+		case "installation_repositories": return {
+			kind: "installation",
+			detail: {
+				type: "installation",
+				actionRaw: payload.action ?? event,
+				installationId: payload.installation ? String(payload.installation.id) : void 0,
+				added: (payload.repositories_added ?? (payload.action === "created" ? payload.repositories : void 0) ?? []).map((repo) => toRepoRef(instance, repo)),
+				removed: (payload.repositories_removed ?? []).map((repo) => toRepoRef(instance, repo))
+			},
+			summary: `${who} ${payload.action ?? "changed"} the installation`
+		};
+		case "member":
+		case "membership": return {
+			kind: "membership",
+			detail: {
+				type: "membership",
+				actionRaw: payload.action ?? event,
+				member: toActor(instance, payload.member ?? payload.membership?.user)
+			},
+			summary: `${who} ${payload.action ?? "changed"} a member`
+		};
+		case "release":
+			if (payload.action !== "published" || !payload.release || !payload.repository) return;
+			return {
+				kind: "release",
+				action: "published",
+				detail: {
+					type: "release",
+					release: {
+						forge: FORGE,
+						instance,
+						repo: toRepoRef(instance, payload.repository),
+						id: String(payload.release.id),
+						tag: payload.release.tag_name
+					},
+					name: payload.release.name ?? void 0
+				},
+				summary: `${who} published ${payload.release.name ?? payload.release.tag_name ?? "a release"}`,
+				occurredAt: toDate(payload.release.published_at)
+			};
+		default: return;
+	}
+}
+const THREAD_EVENT_KIND = {
+	issue_comment: "comment",
+	discussion_comment: "comment",
+	commit_comment: "comment",
+	pull_request_review: "review",
+	pull_request_review_comment: "review_comment"
+};
+function threadOf(payload, repo, instance) {
+	if (!repo) return;
+	const candidates = [
+		["pull_request", payload.pull_request],
+		["discussion", payload.discussion],
+		[payload.issue?.pull_request ? "pull_request" : "issue", payload.issue]
+	];
+	for (const [kind, subject] of candidates) if (subject) return {
+		forge: FORGE,
+		instance,
+		repo,
+		kind,
+		number: String(subject.number),
+		externalId: subject.node_id
+	};
+}
+function eventKindFor(event, payload) {
+	const mapped = THREAD_EVENT_KIND[event];
+	if (mapped) return mapped;
+	if (event === "issues" || event === "pull_request" || event === "discussion") switch (payload.action) {
+		case "labeled":
+		case "unlabeled": return "label";
+		case "assigned":
+		case "unassigned": return "assignment";
+		case "closed":
+		case "reopened":
+		case "opened":
+		case "ready_for_review":
+		case "converted_to_draft": return "state_change";
+		case "synchronize": return "commit";
+		case "review_requested":
+		case "review_request_removed": return "assignment";
+		default: return "other";
+	}
+	if (event.endsWith("reaction")) return "reaction";
+	return "other";
+}
+function summarise(event, payload, actor) {
+	switch (event) {
+		case "issue_comment":
+		case "discussion_comment":
+		case "commit_comment": return `${actor} ${payload.action ?? "created"} a comment`;
+		case "pull_request_review": return `${actor} ${payload.action ?? "submitted"} a review (${payload.review?.state ?? "commented"})`;
+		case "pull_request_review_comment": return `${actor} ${payload.action ?? "created"} a review comment`;
+		case "push": return `${actor} pushed ${payload.commits?.length ?? 0} commit(s)`;
+		case "label": return `${actor} ${payload.action ?? "changed"} label ${payload.label?.name ?? ""}`.trim();
+		default: return `${actor} ${payload.action ? `${payload.action} ` : ""}${event}`.trim();
+	}
+}
+function actionOf(event, payload) {
+	if (event === "pull_request" && payload.action === "closed" && payload.pull_request?.merged) return "merged";
+	return eventAction(payload.action);
+}
+function detailOf(kind, thread, instance, payload) {
+	const comment = payload.comment;
+	const commentRef = comment?.id !== void 0 && thread ? {
+		forge: FORGE,
+		instance,
+		thread,
+		id: String(comment.id)
+	} : void 0;
+	switch (kind) {
+		case "comment": return {
+			type: "comment",
+			comment: commentRef,
+			body: comment?.body
+		};
+		case "review_comment": return {
+			type: "review_comment",
+			comment: commentRef,
+			body: comment?.body,
+			path: comment?.path,
+			line: comment?.line ?? void 0
+		};
+		case "review": return {
+			type: "review",
+			state: reviewState(payload.review?.state),
+			stateRaw: payload.review?.state,
+			body: payload.review?.body ?? void 0
+		};
+		case "label": return payload.label?.name ? {
+			type: "label",
+			label: payload.label.name
+		} : void 0;
+		case "assignment": return {
+			type: "assignment",
+			assignee: toActor(instance, payload.assignee ?? payload.requested_reviewer ?? void 0)
+		};
+		case "state_change": {
+			const pull = payload.pull_request;
+			return {
+				type: "state_change",
+				state: pull?.merged ? "merged" : payload.action === "closed" ? "closed" : "open",
+				draft: pull?.draft
+			};
+		}
+		default: return;
+	}
+}
+function translateGitHubWebhook(instance, delivery) {
+	const event = headerValue(delivery.headers, EVENT_HEADER);
+	if (!event) throw new WebhookVerificationError(`Missing ${EVENT_HEADER} header`, {
+		forge: FORGE,
+		instance
+	});
+	const deliveryId = headerValue(delivery.headers, "x-github-delivery") ?? crypto.randomUUID();
+	const payload = JSON.parse(bodyText(delivery.body));
+	const repo = payload.repository ? toRepoRef(instance, payload.repository) : void 0;
+	const thread = threadOf(payload, repo, instance);
+	const actor = toActor(instance, payload.sender);
+	const occurredAt = toDate(payload.comment?.created_at ?? payload.review?.submitted_at ?? payload.head_commit?.timestamp) ?? /* @__PURE__ */ new Date();
+	const installationId = payload.installation ? String(payload.installation.id) : void 0;
+	const level = repoLevel(instance, event, payload, actor?.login ?? "someone");
+	if (level) return [{
+		forge: FORGE,
+		instance,
+		id: deliveryId,
+		kind: level.kind,
+		action: level.action,
+		kindRaw: payload.action ? `${event}.${payload.action}` : event,
+		summary: level.summary,
+		occurredAt: level.occurredAt ?? /* @__PURE__ */ new Date(),
+		actor,
+		repo,
+		detail: level.detail,
+		installationId,
+		source: "webhook",
+		payload
+	}];
+	const kind = eventKindFor(event, payload);
+	return [{
+		forge: FORGE,
+		instance,
+		id: deliveryId,
+		kind,
+		kindRaw: payload.action ? `${event}.${payload.action}` : event,
+		action: actionOf(event, payload),
+		actionRaw: payload.action,
+		detail: detailOf(kind, thread, instance, payload),
+		summary: summarise(event, payload, actor?.login ?? "someone"),
+		occurredAt,
+		actor,
+		repo,
+		thread,
+		installationId,
+		source: "webhook",
+		payload
+	}];
+}
+const githubWebhooks = ({ options, instance }) => ({
+	events: GITHUB_WEBHOOK_EVENTS,
+	verify: (delivery) => verifyGitHubSignature(delivery, options.webhookSecret),
+	translate: (delivery) => translateGitHubWebhook(instance, delivery)
+});
+//#endregion
+//#region src/github/index.ts
+const DISCUSSION_CLOSE_REASONS = {
+	completed: "resolved",
+	duplicate: "duplicate"
+};
+/** GitHub Enterprise Server versions that support marking a notification done. */
+const GHES_MARK_DONE = "3.13";
+/** GitHub Enterprise Server versions with the Dependabot alerts REST API. */
+const GHES_DEPENDABOT_ALERTS = "3.8";
+const GRAPHQL_BATCH = 20;
+const REVIEW_CONTEXT_TTL = 3e5;
+const POLL_DELAYS = [
+	500,
+	1e3,
+	2e3
+];
+const GITHUB_RESERVED_PATHS = [
+	"about",
+	"account",
+	"apps",
+	"codespaces",
+	"collections",
+	"contact",
+	"customer-stories",
+	"dashboard",
+	"enterprise",
+	"enterprises",
+	"events",
+	"explore",
+	"features",
+	"gist",
+	"issues",
+	"join",
+	"login",
+	"logout",
+	"marketplace",
+	"new",
+	"notifications",
+	"organizations",
+	"orgs",
+	"pricing",
+	"pulls",
+	"search",
+	"security",
+	"settings",
+	"signup",
+	"site",
+	"sponsors",
+	"stars",
+	"topics",
+	"trending",
+	"users",
+	"watching"
+];
+const ISSUE_LIKE = {
+	issue: true,
+	pull_request: true,
+	discussion: true
+};
+function repoPath(repo) {
+	return `/repos/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.name)}`;
+}
+function threadPath(ref) {
+	switch (ref.kind) {
+		case "pull_request": return `${repoPath(ref.repo)}/pulls/${encodeURIComponent(ref.number)}`;
+		case "commit": return `${repoPath(ref.repo)}/commits/${encodeURIComponent(ref.number)}`;
+		default: return `${repoPath(ref.repo)}/issues/${encodeURIComponent(ref.number)}`;
+	}
+}
+function isGheCom(host) {
+	return /^api\.[^.]+\.ghe\.com$/.test(host);
+}
+/** The web host for an API host: `api.github.com` and `api.<name>.ghe.com` drop the `api.` prefix. */
+function webHost(host) {
+	return host === "api.github.com" || isGheCom(host) ? host.slice(4) : host;
+}
+function installationId(installation) {
+	return typeof installation === "string" ? installation : installation.id;
+}
+/**
+* Free text as legacy search reads it: advanced search parses parentheses and
+* an unclosed quote as syntax, so those are dropped outside quoted phrases.
+*/
+function advancedFreeText(text) {
+	const parts = text.split("\"");
+	if (parts.length % 2 === 0) {
+		const unclosed = parts.pop();
+		parts.push(`${parts.pop()} ${unclosed}`);
+	}
+	return parts.map((part, index) => index % 2 ? part : part.replace(/[()\s]+/g, " ")).join("\"").trim();
+}
+function setupGitHub({ options, baseUrl, instance, origin: context, fetcher, createFetcher, derive, state: credentials }) {
+	const list = createListing(fetcher, "per_page");
+	const auth = options.auth ?? { type: "anonymous" };
+	/** GitHub GraphQL needs a credential, so anonymous providers stay on REST. */
+	const anonymous = auth.type === "anonymous";
+	const host = hostOf(baseUrl);
+	/** GitHub Enterprise Server; `ghe.com` data residency hosts follow github.com. */
+	const enterprise = host !== "api.github.com" && !isGheCom(host);
+	const graphql = createGraphQLClient(fetcher, graphqlUrl(baseUrl), { instance });
+	/**
+	* Discussion notification subjects carry no URL. The repo's most recently
+	* updated discussions are listed and matched on an exact, unique title.
+	*/
+	async function resolveDiscussionNumbers(items) {
+		const pending = items.filter((item) => item.subject.type === "thread" && item.subject.thread.kind === "discussion" && !item.subject.thread.number);
+		if (!pending.length) return [];
+		const repos = [...new Map(pending.map((item) => {
+			const repo = item.subject.thread.repo;
+			return [`${repo.owner}/${repo.name}`, repo];
+		})).values()];
+		let result;
+		try {
+			const { query, variables } = (await import("./graphql-D7uGzZTf.mjs")).recentDiscussionsQuery(repos);
+			result = await graphql({ query }, variables);
+		} catch (error) {
+			if (error instanceof InsufficientScopeError || error instanceof ForgeApiError && error.status === 200) return [toWarning("discussion_unresolved", error)];
+			throw error;
+		}
+		for (const item of pending) {
+			const thread = item.subject.thread;
+			const index = repos.findIndex((repo) => repo.owner === thread.repo.owner && repo.name === thread.repo.name);
+			const matches = (result[`r${index}`]?.discussions.nodes ?? []).filter((node) => node.title === item.title);
+			if (matches.length === 1) item.subject = {
+				type: "thread",
+				thread: {
+					...thread,
+					number: String(matches[0].number),
+					externalId: matches[0].id
+				}
+			};
+		}
+		return [];
+	}
+	async function notificationPage(listOptions = {}) {
+		const result = await fetcher.json(listOptions.cursor?.nextUrl ?? "/notifications", {
+			query: listOptions.cursor?.nextUrl ? void 0 : {
+				all: listOptions.all ?? false,
+				since: listOptions.since?.toISOString(),
+				per_page: listOptions.perPage
+			},
+			etag: listOptions.cursor?.nextUrl ? void 0 : listOptions.cursor?.etag,
+			signal: listOptions.signal
+		});
+		const items = (result.data ?? []).map((raw) => toNotification(instance, raw));
+		const warnings = await resolveDiscussionNumbers(items);
+		const etag = listOptions.cursor?.nextUrl ? void 0 : result.cursor?.etag ?? listOptions.cursor?.etag;
+		return {
+			items,
+			cursor: result.cursor?.nextUrl ? result.cursor : void 0,
+			...etag ? { etag } : {},
+			notModified: result.notModified,
+			warnings: warnings.length ? warnings : void 0
+		};
+	}
+	async function discussionId(ref, options) {
+		if (ref.externalId) return ref.externalId;
+		return (await getDiscussion(ref, options)).ref.externalId;
+	}
+	async function getDiscussion(ref, options) {
+		const discussion = (await graphql("DISCUSSION_THREAD", {
+			owner: ref.repo.owner,
+			name: ref.repo.name,
+			number: Number(ref.number)
+		}, options)).repository?.discussion;
+		if (!discussion) throw new NotFoundError(`Discussion ${ref.number} not found`, 404, "", context);
+		return (await import("./graphql-D7uGzZTf.mjs")).toDiscussionThread(ref, discussion);
+	}
+	async function discussionCommentPage(ref, listOptions) {
+		const comments = (await graphql("DISCUSSION_COMMENTS", {
+			owner: ref.repo.owner,
+			name: ref.repo.name,
+			number: Number(ref.number),
+			after: listOptions.cursor?.token ?? null
+		}, listOptions)).repository?.discussion?.comments;
+		return {
+			items: (comments?.nodes ?? []).flatMap((comment) => [{
+				comment,
+				isReply: false
+			}, ...(comment.replies?.nodes ?? []).map((reply) => ({
+				comment: reply,
+				isReply: true
+			}))]),
+			cursor: comments?.pageInfo.hasNextPage && comments.pageInfo.endCursor ? { token: comments.pageInfo.endCursor } : void 0
+		};
+	}
+	async function get(thread, options) {
+		const ref = requireThread(thread, context);
+		if (ref.kind === "discussion") return getDiscussion(ref, options);
+		const { data } = await fetcher.json(threadPath(ref), { signal: options?.signal });
+		const result = toThread(ref, data);
+		if (ref.kind === "pull_request" && data.head?.sha) try {
+			const checks = await headChecks(ref.repo, data.head.sha, options?.signal);
+			result.checks = summariseChecks(checks.items.map((check) => check.state), data.html_url ? `${data.html_url}/checks` : void 0);
+			if (checks.warnings?.length) result.warnings = [...result.warnings ?? [], ...checks.warnings];
+		} catch (error) {
+			if (!(error instanceof ForgeError)) throw error;
+			result.warnings = [...result.warnings ?? [], toWarning("checks_unreadable", error, ref.number)];
+		}
+		return result;
+	}
+	async function headChecks(repo, sha, signal) {
+		const [runs, status] = await Promise.allSettled([Array.fromAsync(fetcher.items(`${repoPath(repo)}/commits/${sha}/check-runs`, {
+			query: { per_page: 100 },
+			select: (body, next) => ({
+				items: body.check_runs,
+				next
+			}),
+			signal
+		}), (raw) => toCheckRun(repo, raw)), fetcher.json(`${repoPath(repo)}/commits/${sha}/status`, {
+			query: { per_page: 100 },
+			signal
+		})]);
+		if (signal?.aborted) throw signal.reason;
+		if (runs.status === "rejected" && status.status === "rejected") throw runs.reason;
+		return {
+			items: [...runs.status === "fulfilled" ? runs.value : [], ...status.status === "fulfilled" ? status.value.data.statuses.map((raw) => toStatusCheck(repo, raw)) : []],
+			warnings: [...runs.status === "rejected" ? [toWarning("checks_unreadable", runs.reason, "check-runs")] : [], ...status.status === "rejected" ? [toWarning("checks_unreadable", status.reason, "statuses")] : []]
+		};
+	}
+	async function getMany(refs, options) {
+		if (anonymous) return getManyConcurrently(refs, (ref, getOptions) => ref.kind === "discussion" ? Promise.reject(new UnsupportedOperationError("github does not read discussions without credentials", context)) : get(ref, getOptions), options);
+		const results = Array.from({ length: refs.length });
+		const batchable = [];
+		const commits = [];
+		for (const [index, ref] of refs.entries()) if (!isResolvedThread(ref) || ref.kind === "other") results[index] = {
+			ok: false,
+			ref,
+			warning: toWarning("thread_unresolved", /* @__PURE__ */ new Error("Thread ref has no number"), ref.number)
+		};
+		else if (ref.kind === "commit") commits.push(index);
+		else batchable.push({
+			index,
+			ref
+		});
+		const read = await getManyConcurrently(commits.map((index) => refs[index]), get, options);
+		commits.forEach((index, position) => {
+			results[index] = read[position];
+		});
+		if (!batchable.length) return results;
+		const g = await import("./graphql-D7uGzZTf.mjs");
+		for (let start = 0; start < batchable.length; start += GRAPHQL_BATCH) {
+			const chunk = batchable.slice(start, start + GRAPHQL_BATCH);
+			const { query, variables } = g.threadsBatchQuery(chunk.map((item) => item.ref));
+			const url = graphqlUrl(baseUrl);
+			const { data } = await fetcher.json(url, {
+				method: "POST",
+				json: {
+					query,
+					variables,
+					operationName: "ThreadsBatch"
+				},
+				signal: options?.signal
+			});
+			const failure = data.data ? void 0 : graphqlError("ThreadsBatch", data.errors, url, { instance });
+			chunk.forEach(({ index, ref }, offset) => {
+				const node = data.data?.[`t${offset}`];
+				const discussion = ref.kind === "discussion" ? node?.discussion : void 0;
+				const issueOrPullRequest = ref.kind === "discussion" ? void 0 : node?.issueOrPullRequest;
+				if (failure) {
+					results[index] = {
+						ok: false,
+						ref,
+						warning: toWarning(failure instanceof InsufficientScopeError ? "insufficient_scope" : "thread_unreadable", failure, ref.number)
+					};
+					return;
+				}
+				if (!discussion && !issueOrPullRequest) {
+					const error = data.errors?.find((error) => error.path?.[0] === `t${offset}`);
+					if (error?.type === "INSUFFICIENT_SCOPES") {
+						results[index] = {
+							ok: false,
+							ref,
+							warning: toWarning("insufficient_scope", graphqlError("ThreadsBatch", [error], url, { instance }), ref.number)
+						};
+						return;
+					}
+					results[index] = {
+						ok: false,
+						ref,
+						warning: {
+							code: "thread_unreadable",
+							message: error?.message ?? "Not found",
+							subject: ref.number
+						}
+					};
+					return;
+				}
+				results[index] = {
+					ok: true,
+					ref,
+					thread: discussion ? g.toDiscussionThread(ref, discussion) : g.toGraphQLThread(ref, issueOrPullRequest)
+				};
+			});
+		}
+		return results;
+	}
+	async function listPage(repo, query = {}) {
+		const state = query.state ?? "open";
+		const direction = query.direction ?? "desc";
+		const createdAfter = query.createdAfter?.getTime();
+		if (query.kind === "discussion") {
+			if (query.assignee) return {
+				items: [],
+				warnings: [{
+					code: "filter_unsupported",
+					message: "Discussions have no assignees"
+				}]
+			};
+			const warnings = !query.cursor && query.sort === "comments" ? [{
+				code: "sort_unsupported",
+				message: "Discussions cannot be sorted by comments; sorted by update time"
+			}] : [];
+			const data = await graphql("DISCUSSIONS_LIST", {
+				owner: repo.owner,
+				name: repo.name,
+				first: Math.min(query.perPage ?? 50, 100),
+				after: query.cursor?.token ?? null,
+				field: query.sort === "created" || !query.sort ? "CREATED_AT" : "UPDATED_AT",
+				direction: direction.toUpperCase()
+			}, query);
+			const { toDiscussionThread } = await import("./graphql-D7uGzZTf.mjs");
+			const discussions = data.repository?.discussions;
+			return {
+				items: (discussions?.nodes ?? []).map((node) => toDiscussionThread({
+					forge: FORGE,
+					instance,
+					repo,
+					kind: "discussion",
+					number: String(node.number)
+				}, node)).filter((thread) => (state === "all" || thread.state === state) && (!query.author || thread.author?.login === query.author) && (!query.labels?.length || query.labels.every((label) => thread.labels.some((item) => item.name === label))) && (!query.since || (thread.updatedAt?.getTime() ?? 0) >= query.since.getTime()) && (createdAfter === void 0 || (thread.createdAt?.getTime() ?? 0) >= createdAfter)),
+				cursor: discussions?.pageInfo.hasNextPage && discussions.pageInfo.endCursor ? { token: discussions.pageInfo.endCursor } : void 0,
+				...warnings.length ? { warnings } : {}
+			};
+		}
+		if (state === "merged") {
+			const page = await searchThreadsPage({
+				repo,
+				kind: "pull_request",
+				labels: query.labels,
+				author: query.author,
+				assignee: query.assignee,
+				involves: query.involves,
+				since: query.since,
+				queryRaw: `is:merged${query.createdAfter ? ` created:>=${query.createdAfter.toISOString()}` : ""}`,
+				sort: query.sort ?? "created",
+				direction,
+				perPage: query.perPage,
+				cursor: query.cursor,
+				signal: query.signal
+			});
+			await withPullChecks(page, query);
+			return page;
+		}
+		const pullsOnly = query.kind === "pull_request" && !query.labels?.length && !query.author && !query.assignee && !query.since && query.sort !== "comments";
+		const result = await fetcher.page(`${repoPath(repo)}/${pullsOnly ? "pulls" : "issues"}`, {
+			query: {
+				state,
+				labels: query.labels?.join(","),
+				creator: query.author,
+				assignee: query.assignee,
+				since: query.since?.toISOString(),
+				sort: query.sort ?? "created",
+				direction,
+				per_page: query.perPage
+			},
+			cursor: query.cursor,
+			signal: query.signal
+		});
+		const older = (raw) => createdAfter !== void 0 && (Date.parse(raw.created_at ?? "") || 0) < createdAfter;
+		const page = toPage(result, (raw) => {
+			const isPull = Boolean(raw.pull_request || raw.head);
+			if (query.kind === "issue" && isPull || query.kind === "pull_request" && !isPull || older(raw)) return;
+			return toThread({
+				forge: FORGE,
+				instance,
+				repo,
+				kind: isPull ? "pull_request" : "issue",
+				number: String(raw.number)
+			}, raw);
+		});
+		const ordered = (query.sort ?? "created") === "created" && direction === "desc";
+		await withPullChecks(page, query);
+		return ordered && (result.data ?? []).some(older) ? {
+			...page,
+			cursor: void 0
+		} : page;
+	}
+	/** Fills `checks`, and a missing `commentCount`, on every pull in the page with one batched read. */
+	async function withPullChecks(page, options) {
+		const pulls = page.items.filter((thread) => thread.kind === "pull_request");
+		if (!pulls.length || anonymous) return;
+		try {
+			const results = await getMany(pulls.map((thread) => thread.ref), options);
+			for (const [index, result] of results.entries()) if (result.ok) {
+				pulls[index].checks = result.thread.checks ?? pulls[index].checks;
+				pulls[index].commentCount ??= result.thread.commentCount;
+			}
+		} catch (error) {
+			if (!(error instanceof ForgeError)) throw error;
+			page.warnings = [...page.warnings ?? [], toWarning("checks_unreadable", error)];
+		}
+	}
+	async function commentsPage(thread, listOptions = {}) {
+		const ref = requireThread(thread, context);
+		if (ref.kind === "discussion") {
+			const [page, { toDiscussionComment }] = await Promise.all([discussionCommentPage(ref, listOptions), import("./graphql-D7uGzZTf.mjs")]);
+			return {
+				...page,
+				items: page.items.map(({ comment }) => toDiscussionComment(ref, comment))
+			};
+		}
+		const path = ref.kind === "commit" ? `${repoPath(ref.repo)}/commits/${encodeURIComponent(ref.number)}/comments` : `${repoPath(ref.repo)}/issues/${encodeURIComponent(ref.number)}/comments`;
+		return list(path, listOptions, (raw) => toComment(ref, raw));
+	}
+	function commentPath(ref) {
+		return ref.thread.kind === "commit" ? `${repoPath(ref.thread.repo)}/comments/${encodeURIComponent(ref.id)}` : `${repoPath(ref.thread.repo)}/issues/comments/${encodeURIComponent(ref.id)}`;
+	}
+	async function setState(thread, state, options_ = {}) {
+		const ref = requireThread(thread, context);
+		if (ref.kind === "commit") throw new UnsupportedOperationError("Commits have no open or closed state", context);
+		if (ref.kind === "discussion") {
+			const reason = options_.reasonRaw ?? (options_.reason && DISCUSSION_CLOSE_REASONS[options_.reason]);
+			if (state === "closed" && options_.reason && !reason) throw new UnsupportedOperationError(`GitHub discussions have no ${options_.reason} close reason; pass reasonRaw: 'outdated'`, context);
+			const id = await discussionId(ref, options_);
+			await (state === "closed" ? graphql("CLOSE_DISCUSSION", {
+				id,
+				reason: reason?.toUpperCase() ?? null
+			}, options_) : graphql("REOPEN_DISCUSSION", { id }, options_));
+			return;
+		}
+		const reason = options_.reasonRaw ?? options_.reason;
+		await fetcher.raw(threadPath(ref), {
+			method: "PATCH",
+			json: ref.kind === "issue" && state === "closed" && reason ? {
+				state,
+				state_reason: reason
+			} : { state },
+			signal: options_.signal
+		});
+	}
+	async function merge(thread, options_ = {}, hooks = {}) {
+		const ref = requireThread(thread, context);
+		if (ref.kind !== "pull_request") throw new UnsupportedOperationError("Only pull requests can be merged", context);
+		if (options_.whenChecksPass) throw new UnsupportedOperationError("GitHub auto-merge is not available through the REST API", context);
+		if (options_.method === "rebase_merge" || options_.method === "fast_forward_only") throw new UnsupportedOperationError(`GitHub does not support the ${options_.method} merge method`, context);
+		let method = options_.method;
+		if (!method) {
+			const { data: repo } = await fetcher.json(repoPath(ref.repo), { signal: options_.signal });
+			method = soleMergeMethod({
+				merge: repo.allow_merge_commit,
+				squash: repo.allow_squash_merge,
+				rebase: repo.allow_rebase_merge
+			}, context);
+		}
+		await hooks.beforeMerge?.();
+		await directMerge(ref, method, options_);
+	}
+	async function directMerge(ref, method, mergeOptions) {
+		const path = `${threadPath(ref)}/merge`;
+		const { sha, title, message } = mergeOptions;
+		const body = {
+			merge_method: method,
+			sha,
+			commit_title: title,
+			commit_message: message
+		};
+		const timeout = options.timeout ?? 3e4;
+		const budget = new AbortController();
+		const signal = mergeOptions.signal ? anySignal([budget.signal, mergeOptions.signal]) : budget.signal;
+		const timer = setTimeout(() => budget.abort(new DOMException("Merge timed out", "TimeoutError")), timeout);
+		const timedOut = (url, requestMethod, cause, uuid) => new ForgeTimeoutError(uuid ? `Merge request ${uuid} for pull request ${ref.number} was still pending after ${timeout}ms; GitHub may still complete it` : `Merge of pull request ${ref.number} got no response within ${timeout}ms; GitHub may still complete it`, timeout, {
+			...context,
+			url,
+			method: requestMethod
+		}, { cause });
+		let url = fetcher.resolve(`${path}-async`);
+		let requestMethod = "PUT";
+		let uuid;
+		try {
+			let state;
+			let status;
+			try {
+				const { data, response } = await fetcher.json(`${path}-async`, {
+					method: "PUT",
+					json: {
+						...body,
+						merge_action: "direct_merge"
+					},
+					signal
+				});
+				state = data;
+				status = response.status;
+			} catch (error) {
+				if (budget.signal.aborted) throw error;
+				if (enterprise && error instanceof NotFoundError) {
+					url = fetcher.resolve(path);
+					await fetcher.raw(path, {
+						method: "PUT",
+						json: body,
+						mapError: toMergeError,
+						signal
+					});
+					return;
+				}
+				state = pendingMergeFrom(error, method, sha, title, message);
+				status = 409;
+			}
+			for (let attempt = 0; state.status === "pending"; attempt++) {
+				uuid = state.details?.uuid;
+				if (!uuid) throw new ForgeApiError("GitHub reported a pending merge without a request id", status, JSON.stringify(state).slice(0, 512), {
+					...context,
+					url,
+					method: requestMethod
+				});
+				const poll = `${path}-async/${encodeURIComponent(uuid)}`;
+				url = fetcher.resolve(poll);
+				requestMethod = "GET";
+				await sleep(POLL_DELAYS[Math.min(attempt, POLL_DELAYS.length - 1)], signal);
+				const { data, response } = await fetcher.json(poll, { signal });
+				state = data;
+				status = response.status;
+			}
+			const errorContext = {
+				...context,
+				url,
+				method: requestMethod
+			};
+			const excerpt = JSON.stringify(state).slice(0, 512);
+			switch (state.status) {
+				case "merged": return;
+				case "enqueued": throw new MergeBlockedError("Pull request was added to a merge queue and has not merged", status, excerpt, errorContext);
+				case "failed": throw new MergeBlockedError(state.details?.message || "GitHub could not merge the pull request", status, excerpt, errorContext);
+				default: throw new ForgeApiError(`GitHub reported an unknown merge status ${JSON.stringify(state.status)}`, status, excerpt, errorContext);
+			}
+		} catch (error) {
+			throw budget.signal.aborted ? timedOut(url, requestMethod, error, uuid) : error;
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+	function pendingMergeFrom(error, method, sha, title, message) {
+		if (!(error instanceof ForgeApiError)) throw error;
+		if (isPlainApiError(error, 400)) throw new MergeBlockedError("Pull request cannot be merged in its current state", 400, error.body, {
+			...context,
+			url: error.url,
+			method: error.method
+		}, { cause: error });
+		if (!isPlainApiError(error, 409)) throw toMergeError(error);
+		let pending;
+		try {
+			pending = JSON.parse(error.body);
+		} catch {}
+		const details = pending?.details;
+		if (!details?.uuid) throw toMergeError(error);
+		if (title !== void 0 || message !== void 0 || details.merge_action !== "direct_merge" || details.merge_method !== method || details.bypass_rules || sha !== void 0 && details.expected_head_sha !== sha) throw new MergeBlockedError("Another merge request is pending whose options do not match or cannot be verified", 409, error.body, {
+			...context,
+			url: error.url,
+			method: error.method
+		}, { cause: error });
+		return {
+			status: "pending",
+			details
+		};
+	}
+	function isPlainApiError(error, status) {
+		return error instanceof ForgeApiError && error.constructor === ForgeApiError && error.status === status;
+	}
+	const REVIEW_EVENTS = {
+		approve: "APPROVE",
+		request_changes: "REQUEST_CHANGES",
+		comment: "COMMENT"
+	};
+	function requirePull(thread, action) {
+		const ref = requireThread(thread, context);
+		if (ref.kind !== "pull_request") throw new UnsupportedOperationError(`Only pull requests can be ${action}`, context);
+		return ref;
+	}
+	function reviewCommentInput(comments) {
+		return comments?.map((comment) => ({
+			path: comment.path,
+			body: comment.body,
+			line: comment.line,
+			start_line: comment.startLine,
+			side: comment.side?.toUpperCase()
+		}));
+	}
+	/** Resolvable conversations, by the id of each comment in them; empty when GraphQL is unreachable. */
+	async function reviewThreadsByComment(ref, options) {
+		const byComment = /* @__PURE__ */ new Map();
+		if (anonymous) return byComment;
+		let data;
+		try {
+			data = await graphql("REVIEW_THREADS", {
+				owner: ref.repo.owner,
+				name: ref.repo.name,
+				number: Number(ref.number)
+			}, options);
+		} catch (error) {
+			if (error instanceof ForgeError) return byComment;
+			throw error;
+		}
+		for (const node of data.repository?.pullRequest?.reviewThreads.nodes ?? []) for (const comment of node.comments.nodes) if (comment.databaseId !== null) byComment.set(String(comment.databaseId), {
+			id: node.id,
+			resolved: node.isResolved
+		});
+		return byComment;
+	}
+	/** Review comments and conversations read for a pull's first page of reviews, reused by its later pages. */
+	const reviewContext = /* @__PURE__ */ new Map();
+	async function reviewsPage(thread, listOptions = {}) {
+		const ref = requirePull(thread, "reviewed");
+		const result = await fetcher.page(`${threadPath(ref)}/reviews`, {
+			query: { per_page: listOptions.perPage },
+			cursor: listOptions.cursor,
+			signal: listOptions.signal
+		});
+		const now = Date.now();
+		for (const [path, entry] of reviewContext) if (now - entry.at >= REVIEW_CONTEXT_TTL) reviewContext.delete(path);
+		const key = threadPath(ref);
+		const kept = listOptions.cursor && reviewContext.get(key) || {
+			at: now,
+			read: Promise.all([Array.fromAsync(fetcher.items(`${key}/comments`, {
+				query: { per_page: 100 },
+				signal: listOptions.signal
+			})), reviewThreadsByComment(ref, listOptions)])
+		};
+		reviewContext.delete(key);
+		const [comments, byComment] = await kept.read;
+		if (result.cursor) reviewContext.set(key, kept);
+		return toPage(result, (raw) => toReview(ref, raw, comments.filter((comment) => String(comment.pull_request_review_id ?? "") === String(raw.id)).map((comment) => toReviewComment(ref, comment, byComment.get(String(comment.id))))));
+	}
+	async function createReview(thread, input, options) {
+		const ref = requirePull(thread, "reviewed");
+		const { data } = await fetcher.json(`${threadPath(ref)}/reviews`, {
+			method: "POST",
+			json: {
+				event: input.event ? REVIEW_EVENTS[input.event] : void 0,
+				body: input.body,
+				comments: reviewCommentInput(input.comments)
+			},
+			signal: options?.signal
+		});
+		return toReview(ref, data, []);
+	}
+	async function subscriptionNode(thread, options) {
+		const ref = requireThread(thread, context);
+		if (ref.kind !== "issue" && ref.kind !== "pull_request" && ref.kind !== "discussion") throw new UnsupportedOperationError(`GitHub has no subscription for a ${ref.kind}`, context);
+		const data = await graphql("SUBSCRIPTION_STATE", {
+			owner: ref.repo.owner,
+			name: ref.repo.name,
+			number: Number(ref.number),
+			discussion: ref.kind === "discussion"
+		}, options);
+		const node = ref.kind === "discussion" ? data.repository?.discussion : data.repository?.issueOrPullRequest;
+		if (!node) throw new NotFoundError(`Thread ${ref.number} not found`, 404, "", context);
+		return {
+			id: node.id,
+			state: node.viewerSubscription
+		};
+	}
+	async function setSubscription(thread, state, options) {
+		const { id } = await subscriptionNode(thread, options);
+		await graphql("UPDATE_SUBSCRIPTION", {
+			id,
+			state
+		}, options);
+	}
+	async function reposPage(repoFetcher, path, wrapped, listOptions = {}) {
+		return toPage(await repoFetcher.page(path, {
+			query: { per_page: listOptions.perPage },
+			cursor: listOptions.cursor,
+			signal: listOptions.signal,
+			select: wrapped ? (body, next) => ({
+				items: body.repositories,
+				next
+			}) : void 0
+		}), (raw) => toRepo(instance, raw));
+	}
+	/** Repository hooks, or organisation hooks for a namespace ref. */
+	function hooksPath(target) {
+		return isNamespaceRef(target) ? `/orgs/${encodeURIComponent(target.owner)}/hooks` : `${repoPath(target)}/hooks`;
+	}
+	function hookConfig(input) {
+		return {
+			...input.url ? { url: input.url } : {},
+			content_type: input.contentType ?? "json",
+			...input.secret ? { secret: input.secret } : {}
+		};
+	}
+	/**
+	* The hook endpoints respond with `404` when the credential lacks
+	* `admin:repo_hook` or `admin:org_hook`, so the status alone is misleading.
+	*/
+	function scopeIs404(error) {
+		if (error instanceof NotFoundError) return new ForbiddenError("GitHub responded with 404 for a webhook endpoint, which it also does when the credential lacks admin:repo_hook or admin:org_hook", 404, error.body, "resource_protected", {
+			forge: error.forge,
+			instance: error.instance,
+			url: error.url,
+			method: error.method,
+			reasonRaw: "hook_scope_404"
+		}, { cause: error });
+		return error;
+	}
+	/** GitHub responds with `422` to a change of the tag, target or draft state of an immutable release. */
+	function immutableReleaseIs422(error) {
+		if (!(error instanceof ForgeApiError) || error.constructor !== ForgeApiError || error.status !== 422) return error;
+		const reasonRaw = error.body.match(/\w+ cannot be changed when release is immutable/)?.[0];
+		if (!reasonRaw) return error;
+		return new ForbiddenError("GitHub refused the change because the release is immutable", error.status, error.body, "immutable_release", {
+			forge: error.forge,
+			instance: error.instance,
+			url: error.url,
+			method: error.method,
+			reasonRaw
+		}, { cause: error });
+	}
+	/** GitHub search qualifiers, in the order the docs list them. */
+	function searchQualifiers(query) {
+		const qualifiers = [];
+		const advanced = !query.kind;
+		/** In advanced search a bare `OR` binds looser than the other qualifiers, so caller syntax is grouped. */
+		const group = (value) => advanced ? `(${value})` : value;
+		const text = advanced && query.text ? advancedFreeText(query.text) : query.text;
+		if (text) qualifiers.push(group(text));
+		if (query.repo) qualifiers.push(`repo:${query.repo.owner}/${query.repo.name}`);
+		qualifiers.push(query.kind ? query.kind === "pull_request" ? "is:pr" : "is:issue" : "(is:issue OR is:pr)");
+		if (query.state && query.state !== "all") qualifiers.push(`state:${query.state}`);
+		for (const [name, value] of [
+			["author", query.author],
+			["involves", query.involves],
+			["assignee", query.assignee]
+		]) if (value) qualifiers.push(`${name}:${value}`);
+		for (const label of query.labels ?? []) qualifiers.push(`label:"${label}"`);
+		if (query.since) qualifiers.push(`updated:>=${query.since.toISOString()}`);
+		if (query.queryRaw) qualifiers.push(group(query.queryRaw));
+		return qualifiers;
+	}
+	/**
+	* GitHub requires a kind in issue search; naming both needs advanced search.
+	* GitHub Enterprise Server may predate it, and GitHub App user access tokens
+	* can't search both kinds at once, so those read issues, then pull requests.
+	*/
+	async function searchThreadsPage(query) {
+		if (!query.kind && (enterprise || auth.type === "token" && (await resolveToken(auth)).startsWith("ghu_"))) return phased(["issue", "pull_request"].map((kind) => (cursor) => searchIssuesPage({
+			...query,
+			kind,
+			cursor
+		})), query.cursor);
+		return searchIssuesPage(query);
+	}
+	async function searchIssuesPage(query) {
+		const result = await fetcher.page("/search/issues", {
+			query: {
+				q: searchQualifiers(query).join(" "),
+				advanced_search: query.kind ? void 0 : "true",
+				sort: query.sort && query.sort !== "relevance" ? query.sort : void 0,
+				order: query.direction,
+				per_page: query.perPage
+			},
+			cursor: query.cursor,
+			signal: query.signal,
+			select: (body, next) => ({
+				items: body.items,
+				next
+			})
+		});
+		return toPage(result, (raw) => {
+			const repo = query.repo ?? repoRefFromApiUrl(instance, raw.repository_url);
+			if (!repo) return;
+			const isPull = Boolean(raw.pull_request);
+			return toThread({
+				forge: FORGE,
+				instance,
+				repo,
+				kind: isPull ? "pull_request" : "issue",
+				number: String(raw.number)
+			}, raw);
+		});
+	}
+	function milestonesPage(repo, listOptions = {}) {
+		return list(`${repoPath(repo)}/milestones`, listOptions, (raw) => toMilestone(raw), { query: { state: listOptions.state ?? "open" } });
+	}
+	const REPO_SEARCH_SORTS = {
+		updated: "updated",
+		stars: "stars"
+	};
+	async function searchReposPage(query) {
+		const qualifiers = [
+			query.text,
+			query.owner && `user:${query.owner}`,
+			query.language && `language:${query.language}`,
+			query.queryRaw
+		].filter(Boolean);
+		const warnings = query.sort === "created" ? [{
+			code: "sort_unsupported",
+			message: "GitHub repository search cannot sort by creation time; sorted by relevance"
+		}] : [];
+		const result = await fetcher.page("/search/repositories", {
+			query: {
+				q: qualifiers.join(" "),
+				sort: query.sort ? REPO_SEARCH_SORTS[query.sort] : void 0,
+				order: query.direction,
+				per_page: query.perPage
+			},
+			cursor: query.cursor,
+			signal: query.signal,
+			select: (body, next) => ({
+				items: body.items,
+				next
+			})
+		});
+		return toPage(result, (raw) => toRepo(instance, raw), warnings);
+	}
+	const COMMIT_SEARCH_SORTS = {
+		author_date: "author-date",
+		committer_date: "committer-date"
+	};
+	async function searchCommitsPage(query) {
+		const qualifiers = [
+			query.text,
+			query.repo && `repo:${query.repo.owner}/${query.repo.name}`,
+			query.author && `author:${query.author}`,
+			query.committer && `committer:${query.committer}`,
+			query.since && `author-date:>=${query.since.toISOString()}`,
+			query.until && `author-date:<=${query.until.toISOString()}`,
+			query.queryRaw
+		].filter(Boolean);
+		const result = await fetcher.page("/search/commits", {
+			query: {
+				q: qualifiers.join(" "),
+				sort: query.sort && COMMIT_SEARCH_SORTS[query.sort],
+				order: query.direction,
+				per_page: query.perPage
+			},
+			cursor: query.cursor,
+			signal: query.signal,
+			select: (body, next) => ({
+				items: body.items,
+				next
+			})
+		});
+		return toPage(result, (raw) => {
+			const repo = query.repo ?? (raw.repository && toRepoRef(instance, raw.repository));
+			return repo && toCommit(repo, raw);
+		});
+	}
+	/** The excerpts only come with the text match media type. */
+	async function searchCodePage(query) {
+		const qualifiers = [
+			query.text,
+			query.repo ? `repo:${query.repo.owner}/${query.repo.name}` : query.owner && `user:${query.owner}`,
+			query.queryRaw
+		].filter(Boolean);
+		let incomplete = false;
+		const result = await fetcher.page("/search/code", {
+			query: {
+				q: qualifiers.join(" "),
+				per_page: query.perPage
+			},
+			headers: { accept: "application/vnd.github.text-match+json" },
+			cursor: query.cursor,
+			signal: query.signal,
+			select: (body, next) => {
+				const { items, incomplete_results } = body;
+				incomplete = incomplete_results === true;
+				return {
+					items,
+					next
+				};
+			}
+		});
+		return toPage(result, (raw) => ({
+			repo: query.repo ?? toRepoRef(instance, raw.repository),
+			path: raw.path,
+			ref: new URL(raw.url).searchParams.get("ref") ?? void 0,
+			fragments: (raw.text_matches ?? []).filter((match) => match.property === "content").map((match) => ({ text: match.fragment })),
+			url: raw.html_url,
+			raw
+		}), incomplete ? [{
+			code: "search_incomplete",
+			message: "GitHub stopped the search before it finished; the page may be missing matches"
+		}] : []);
+	}
+	function createInstallationsApi(app) {
+		const appFetcher = createFetcher({
+			baseUrl,
+			authHeaders: async () => ({ authorization: `Bearer ${await app.appJwt()}` })
+		});
+		const auth = options.auth;
+		function toInstallation(raw) {
+			return {
+				forge: FORGE,
+				instance,
+				id: String(raw.id),
+				account: toActor(instance, raw.account),
+				targetTypeRaw: raw.target_type,
+				repositorySelectionRaw: raw.repository_selection,
+				raw
+			};
+		}
+		function provider(installation) {
+			return derive({
+				...options,
+				auth: {
+					...auth,
+					installationId: installationId(installation)
+				}
+			}, app);
+		}
+		async function listPage(listOptions = {}) {
+			return toPage(await appFetcher.page("/app/installations", {
+				query: { per_page: listOptions.perPage },
+				cursor: listOptions.cursor,
+				signal: listOptions.signal
+			}), toInstallation);
+		}
+		return {
+			listPage,
+			async get(installation, options) {
+				return toInstallation((await appFetcher.json(`/app/installations/${installationId(installation)}`, { signal: options?.signal })).data);
+			},
+			token: (installation, options) => app.installationTokenDetails(installationId(installation), options),
+			reposPage(installation, listOptions) {
+				const id = installationId(installation);
+				return reposPage(createFetcher({
+					baseUrl,
+					authHeaders: async () => ({ authorization: `Bearer ${await app.installationToken(id)}` })
+				}), "/installation/repositories", true, listOptions);
+			},
+			provider,
+			providers() {
+				return forgeIterable(async function* () {
+					for await (const installation of iteratePages(listPage)) yield {
+						installation,
+						provider: provider(installation)
+					};
+				});
+			}
+		};
+	}
+	async function readFile(repo, path, fileOptions = {}) {
+		const { data } = await fetcher.json(`${repoPath(repo)}/contents/${path.split("/").map(encodeURIComponent).join("/")}`, {
+			query: { ref: fileOptions.ref },
+			signal: fileOptions.signal
+		});
+		const file = {
+			path: data.path,
+			sha: data.sha,
+			size: data.size,
+			url: data.html_url ?? void 0
+		};
+		const content = data.encoding === "base64" && data.content !== void 0 ? data.content : (await fetcher.json(`${repoPath(repo)}/git/blobs/${data.sha}`, { signal: fileOptions.signal })).data.content;
+		return toFileContent(fromBase64(content), file, fileOptions, context);
+	}
+	async function treePage(repo, treeOptions = {}) {
+		const ref = treeOptions.ref ?? "HEAD";
+		const target = treeOptions.path ? `${ref}:${treeOptions.path.replace(/^\/|\/$/g, "")}` : ref;
+		const { data, response } = await fetcher.json(`${repoPath(repo)}/git/trees/${encodeURIComponent(target)}`, {
+			query: treeOptions.recursive ? { recursive: "1" } : {},
+			signal: treeOptions.signal
+		});
+		const warnings = data.truncated ? [{
+			code: "tree_truncated",
+			message: "GitHub truncated the tree; read it directory by directory instead",
+			subject: target
+		}] : [];
+		return toPage({
+			data: data.tree,
+			response,
+			notModified: false
+		}, toTreeEntry, warnings);
+	}
+	async function commitsPage(repo, query = {}) {
+		return list(`${repoPath(repo)}/commits`, query, (raw) => toCommit(repo, raw), { query: {
+			sha: query.ref,
+			path: query.path,
+			author: query.author,
+			since: query.since?.toISOString(),
+			until: query.until?.toISOString()
+		} });
+	}
+	async function releasesPage(repo, listOptions = {}) {
+		return list(`${repoPath(repo)}/releases`, listOptions, (raw) => toRelease(repo, raw));
+	}
+	async function writeRelease(repo, path, method, input, options) {
+		const { data } = await fetcher.json(path, {
+			method,
+			json: {
+				tag_name: input.tag,
+				target_commitish: input.target,
+				name: input.name,
+				body: input.body,
+				draft: input.draft,
+				prerelease: input.prerelease
+			},
+			mapError: immutableReleaseIs422,
+			signal: options?.signal
+		});
+		return toRelease(repo, data);
+	}
+	const ALERT_SOURCES = {
+		dependency: {
+			path: "dependabot/alerts",
+			states: {
+				open: "open",
+				closed: "fixed,dismissed,auto_dismissed"
+			},
+			map: toDependabotAlert
+		},
+		code_scanning: {
+			path: "code-scanning/alerts",
+			states: {
+				open: "open",
+				closed: "closed"
+			},
+			map: toCodeScanningAlert
+		},
+		secret: {
+			path: "secret-scanning/alerts",
+			states: {
+				open: "open",
+				closed: "resolved"
+			},
+			map: toSecretScanningAlert
+		}
+	};
+	async function alertsPage(repo, listOptions = {}) {
+		const kinds = listOptions.kind ? [listOptions.kind] : Object.keys(ALERT_SOURCES);
+		return phased(kinds.map((kind) => async (cursor) => {
+			const source = ALERT_SOURCES[kind];
+			const state = listOptions.state ?? "open";
+			try {
+				const result = await fetcher.page(`${repoPath(repo)}/${source.path}`, {
+					query: {
+						state: state === "all" ? void 0 : source.states[state],
+						per_page: listOptions.perPage
+					},
+					cursor,
+					signal: listOptions.signal
+				});
+				return toPage(result, (raw) => source.map(repo, raw));
+			} catch (error) {
+				if (!listOptions.kind && (error instanceof InsufficientScopeError || error instanceof NotFoundError)) return {
+					items: [],
+					warnings: [toWarning(error instanceof InsufficientScopeError ? "insufficient_scope" : "alerts_unavailable", error, kind)]
+				};
+				throw error;
+			}
+		}), listOptions.cursor);
+	}
+	/** The GraphQL node id of an issue, pull request or discussion. */
+	async function nodeId(thread, options) {
+		const ref = requireThread(thread, context);
+		return ref.externalId ?? (await subscriptionNode(ref, options)).id;
+	}
+	function reactionPath(target) {
+		if ("thread" in target) return target.thread.kind === "commit" ? `${repoPath(target.thread.repo)}/comments/${encodeURIComponent(target.id)}/reactions` : `${repoPath(target.thread.repo)}/issues/comments/${encodeURIComponent(target.id)}/reactions`;
+		const ref = requireIssueOrPull(target, context, "react to");
+		return `${repoPath(ref.repo)}/issues/${encodeURIComponent(ref.number)}/reactions`;
+	}
+	/** The authenticated login, read once and reused; reactions are deleted by id, so removing one needs it. */
+	const viewerLogin = memo(async () => (await fetcher.json("/user")).data.login);
+	async function reactionsPage(target, listOptions = {}) {
+		const thread = "thread" in target ? target.thread : target;
+		if (thread.kind === "discussion") {
+			const id = "thread" in target ? target.id : await nodeId(thread, listOptions);
+			const [data, { toGraphQLActor, GRAPHQL_REACTIONS }] = await Promise.all([graphql("NODE_REACTIONS", {
+				id,
+				after: listOptions.cursor?.token ?? null
+			}, listOptions), import("./graphql-D7uGzZTf.mjs")]);
+			const reactions = data.node?.reactions;
+			return {
+				items: (reactions?.nodes ?? []).flatMap((raw) => {
+					const actor = toGraphQLActor(instance, raw.user);
+					return actor ? [{
+						content: reactionContent(GRAPHQL_REACTIONS[raw.content] ?? raw.content),
+						contentRaw: raw.content,
+						actor,
+						createdAt: toDate(raw.createdAt),
+						raw
+					}] : [];
+				}),
+				cursor: reactions?.pageInfo.hasNextPage && reactions.pageInfo.endCursor ? { token: reactions.pageInfo.endCursor } : void 0
+			};
+		}
+		const result = await fetcher.page(reactionPath(target), {
+			query: { per_page: listOptions.perPage },
+			cursor: listOptions.cursor,
+			signal: listOptions.signal
+		});
+		return toPage(result, (raw) => {
+			const actor = toActor(instance, raw.user);
+			return actor && {
+				content: reactionContent(raw.content),
+				contentRaw: raw.content,
+				actor,
+				createdAt: toDate(raw.created_at),
+				raw
+			};
+		});
+	}
+	async function react(target, reaction, options) {
+		const thread = "thread" in target ? target.thread : target;
+		if (thread.kind === "discussion") {
+			await graphql("ADD_REACTION", {
+				id: "thread" in target ? target.id : await nodeId(thread, options),
+				content: (await import("./graphql-D7uGzZTf.mjs")).REACTION_CONTENT[reaction]
+			}, options);
+			return;
+		}
+		await fetcher.raw(reactionPath(target), {
+			method: "POST",
+			json: { content: reaction },
+			signal: options?.signal
+		});
+	}
+	async function unreact(target, reaction, options) {
+		const thread = "thread" in target ? target.thread : target;
+		if (thread.kind === "discussion") {
+			await graphql("REMOVE_REACTION", {
+				id: "thread" in target ? target.id : await nodeId(thread, options),
+				content: (await import("./graphql-D7uGzZTf.mjs")).REACTION_CONTENT[reaction]
+			}, options);
+			return;
+		}
+		const path = reactionPath(target);
+		const { data } = await fetcher.json(path, {
+			query: {
+				content: reaction,
+				per_page: 100
+			},
+			signal: options?.signal
+		});
+		const login = await viewerLogin();
+		const mine = data.find((item) => item.content === reaction && item.user?.login === login);
+		if (mine) await fetcher.raw(`${path}/${encodeURIComponent(mine.id)}`, {
+			method: "DELETE",
+			signal: options?.signal
+		});
+	}
+	async function issuePatch(thread, json, action, signal) {
+		const ref = requireIssueOrPull(thread, context, action);
+		await fetcher.raw(`${repoPath(ref.repo)}/issues/${encodeURIComponent(ref.number)}`, {
+			method: "PATCH",
+			json,
+			signal
+		});
+	}
+	/** Check runs need an installation credential; a token writes a commit status instead. */
+	const canWriteCheckRuns = auth.type === "app" && auth.installationId !== void 0;
+	const STATUS_STATES = {
+		pending: "pending",
+		success: "success",
+		failure: "failure",
+		neutral: "success",
+		unknown: "pending"
+	};
+	const CHECK_RUN_CONCLUSIONS = {
+		success: "success",
+		failure: "failure",
+		neutral: "neutral"
+	};
+	async function report(repo, sha, input, options) {
+		if (canWriteCheckRuns) {
+			const conclusion = CHECK_RUN_CONCLUSIONS[input.state];
+			const { data } = await fetcher.json(`${repoPath(repo)}/check-runs`, {
+				method: "POST",
+				json: {
+					name: input.name,
+					head_sha: sha,
+					status: conclusion ? "completed" : "in_progress",
+					conclusion,
+					details_url: input.url,
+					external_id: input.externalId,
+					output: input.description ? {
+						title: input.name,
+						summary: input.description
+					} : void 0
+				},
+				signal: options?.signal
+			});
+			return toCheckRun(repo, data);
+		}
+		const { data } = await fetcher.json(`${repoPath(repo)}/statuses/${sha}`, {
+			method: "POST",
+			json: {
+				state: STATUS_STATES[input.state],
+				context: input.name,
+				description: input.description,
+				target_url: input.url
+			},
+			signal: options?.signal
+		});
+		return toStatusCheck(repo, data);
+	}
+	async function runsPage(repo, query = {}) {
+		const result = await fetcher.page(`${repoPath(repo)}/actions/runs`, {
+			query: {
+				branch: query.branch,
+				status: query.state === "pending" ? "in_progress" : query.state === "success" ? "success" : query.state === "failure" ? "failure" : void 0,
+				per_page: query.perPage
+			},
+			cursor: query.cursor,
+			signal: query.signal,
+			select: (body, next) => ({
+				items: body.workflow_runs,
+				next
+			})
+		});
+		return toPage(result, (raw) => toWorkflowRun(repo, raw));
+	}
+	return {
+		checks: {
+			list: verb(true, (repo, sha, options) => headChecks(repo, sha, options?.signal)),
+			report: verb(true, report),
+			rerun: verb(true, async (ref, options) => {
+				if (ref.type !== "check_run") throw new UnsupportedOperationError(`GitHub cannot re-run a ${ref.type}; only check runs can be re-requested`, context);
+				try {
+					await fetcher.raw(`${repoPath(ref.repo)}/check-runs/${encodeURIComponent(ref.id)}/rerequest`, {
+						method: "POST",
+						signal: options?.signal
+					});
+				} catch (error) {
+					if (!(error instanceof ForgeApiError) || error.status !== 422) throw error;
+					try {
+						await fetcher.raw(`${repoPath(ref.repo)}/actions/jobs/${encodeURIComponent(ref.id)}/rerun`, {
+							method: "POST",
+							signal: options?.signal
+						});
+					} catch (rerunError) {
+						throw rerunError instanceof NotFoundError ? error : rerunError;
+					}
+				}
+			})
+		},
+		ci: {
+			runsPage: verb(true, runsPage),
+			run: verb(true, async (ref, options) => toWorkflowRun(ref.repo, (await fetcher.json(`${repoPath(ref.repo)}/actions/runs/${encodeURIComponent(ref.id)}`, { signal: options?.signal })).data)),
+			jobsPage: verb(true, (ref, listOptions = {}) => list(`${repoPath(ref.repo)}/actions/runs/${encodeURIComponent(ref.id)}/jobs`, listOptions, (raw) => toWorkflowJob(ref, raw), { select: (body, next) => ({
+				items: body.jobs,
+				next
+			}) })),
+			log: verb(!anonymous, async (ref, options) => (await fetcher.stream(`${repoPath(ref.repo)}/actions/jobs/${encodeURIComponent(ref.id)}/logs`, { signal: options?.signal })).body)
+		},
+		contents: {
+			file: verb(true, readFile),
+			treePage: verb(true, treePage),
+			branchesPage: verb(true, (repo, listOptions = {}) => list(`${repoPath(repo)}/branches`, listOptions, (raw) => toBranch(raw))),
+			tagsPage: verb(true, (repo, listOptions = {}) => list(`${repoPath(repo)}/tags`, listOptions, toTag)),
+			resolveRef: verb(true, async (repo, ref, options) => (await fetcher.json(`${repoPath(repo)}/commits/${encodeURIComponent(ref)}`, { signal: options?.signal })).data.sha),
+			commitsPage: verb(true, commitsPage),
+			commit: verb(true, async (repo, sha, options) => toCommit(repo, (await fetcher.json(`${repoPath(repo)}/commits/${sha}`, { signal: options?.signal })).data)),
+			compare: verb(true, async (repo, base, head, options) => {
+				const { data } = await fetcher.json(`${repoPath(repo)}/compare/${encodeURIComponent(base)}...${encodeURIComponent(head)}`, { signal: options?.signal });
+				return {
+					base,
+					head,
+					aheadBy: data.ahead_by,
+					behindBy: data.behind_by,
+					mergeBaseSha: data.merge_base_commit?.sha,
+					commits: (data.commits ?? []).map((raw) => toCommit(repo, raw)),
+					files: (data.files ?? []).map(toChangedFile),
+					raw: data
+				};
+			})
+		},
+		search: {
+			threadsPage: verb(true, searchThreadsPage),
+			reposPage: verb(true, searchReposPage),
+			commitsPage: verb(true, searchCommitsPage),
+			codePage: verb(!anonymous, searchCodePage),
+			queryRaw: true
+		},
+		releases: {
+			listPage: verb(true, releasesPage),
+			get: verb(true, async (ref, options) => toRelease(ref.repo, (await fetcher.json(`${repoPath(ref.repo)}/releases/${encodeURIComponent(ref.id)}`, { signal: options?.signal })).data)),
+			getByTag: verb(true, async (repo, tag, options) => toRelease(repo, (await fetcher.json(`${repoPath(repo)}/releases/tags/${encodeURIComponent(tag)}`, { signal: options?.signal })).data)),
+			downloadAsset: verb(true, async (ref, downloadOptions = {}) => (await fetcher.stream(`${repoPath(ref.repo)}/releases/assets/${encodeURIComponent(ref.id)}`, {
+				headers: { accept: "application/octet-stream" },
+				signal: downloadOptions.signal
+			})).body),
+			latest: verb(true, async (repo, options) => {
+				try {
+					return toRelease(repo, (await fetcher.json(`${repoPath(repo)}/releases/latest`, { signal: options?.signal })).data);
+				} catch (error) {
+					if (error instanceof NotFoundError) return;
+					throw error;
+				}
+			}),
+			create: verb(true, (repo, input, options) => writeRelease(repo, `${repoPath(repo)}/releases`, "POST", input, options)),
+			update: verb(true, (ref, update, options) => writeRelease(ref.repo, `${repoPath(ref.repo)}/releases/${encodeURIComponent(ref.id)}`, "PATCH", update, options))
+		},
+		securityAlerts: {
+			kinds: {
+				dependency: !anonymous && (enterprise ? ({ version }) => versionAtLeast(version, GHES_DEPENDABOT_ALERTS) && "unverified" : true),
+				code_scanning: !anonymous,
+				secret: !anonymous
+			},
+			listPage: alertsPage
+		},
+		traits: {
+			eventKinds: "native",
+			authKinds: [
+				"token",
+				"app",
+				"anonymous"
+			],
+			limits: {
+				bodyLength: 65536,
+				commentLength: 65536,
+				labelLength: 50
+			}
+		},
+		probeVersion: enterprise ? async () => (await fetcher.json("/meta")).data.installed_version : void 0,
+		installations: credentials ? verb(true, createInstallationsApi(credentials)) : void 0,
+		web: githubShapedWeb(enterprise ? baseUrl.replace(/\/api\/v3$/, "") : `https://${webHost(host)}`, {
+			pull: "pull",
+			discussions: true,
+			commentFragment: "issuecomment-",
+			file: (at) => `/blob/${encodeURIComponent(at)}`,
+			lineFragment: (line) => `L${line}`,
+			reserved: GITHUB_RESERVED_PATHS
+		}),
+		webhooks: {
+			listPage: verb(true, (target, listOptions = {}) => list(hooksPath(target), listOptions, (raw) => toWebhook(target, raw), { mapError: scopeIs404 })),
+			create: verb(true, async (target, input, options) => toWebhook(target, (await fetcher.json(hooksPath(target), {
+				method: "POST",
+				json: {
+					name: "web",
+					active: input.active ?? true,
+					events: nativeEventsFor(GITHUB_NATIVE_EVENTS, input.events, input.nativeEvents),
+					config: hookConfig(input)
+				},
+				mapError: scopeIs404,
+				signal: options?.signal
+			})).data)),
+			update: verb(true, async (ref, update, options) => toWebhook(ref.target, (await fetcher.json(`${hooksPath(ref.target)}/${encodeURIComponent(ref.id)}`, {
+				method: "PATCH",
+				json: {
+					...update.active === void 0 ? {} : { active: update.active },
+					...update.events || update.nativeEvents ? { events: nativeEventsFor(GITHUB_NATIVE_EVENTS, update.events, update.nativeEvents) } : {},
+					...update.url || update.secret || update.contentType ? { config: hookConfig(update) } : {}
+				},
+				mapError: scopeIs404,
+				signal: options?.signal
+			})).data)),
+			delete: verb(true, async (ref, options) => {
+				await fetcher.raw(`${hooksPath(ref.target)}/${encodeURIComponent(ref.id)}`, {
+					method: "DELETE",
+					mapError: scopeIs404,
+					signal: options?.signal
+				});
+			}),
+			rotateSecret: verb(true, async (ref, secret, options) => {
+				const current = toWebhook(ref.target, (await fetcher.json(`${hooksPath(ref.target)}/${encodeURIComponent(ref.id)}`, {
+					mapError: scopeIs404,
+					signal: options?.signal
+				})).data);
+				const { data } = await fetcher.json(`${hooksPath(ref.target)}/${encodeURIComponent(ref.id)}`, {
+					method: "PATCH",
+					json: { config: hookConfig({
+						url: current.url,
+						contentType: current.contentType,
+						secret
+					}) },
+					mapError: scopeIs404,
+					signal: options?.signal
+				});
+				return toWebhook(ref.target, data);
+			}),
+			deliveriesPage: verb(true, (ref, listOptions = {}) => list(`${hooksPath(ref.target)}/${encodeURIComponent(ref.id)}/deliveries`, listOptions, (raw) => toWebhookDelivery(ref, raw), { mapError: scopeIs404 })),
+			redeliver: verb(true, async (ref, options) => {
+				await fetcher.raw(`${hooksPath(ref.hook.target)}/${encodeURIComponent(ref.hook.id)}/deliveries/${encodeURIComponent(ref.id)}/attempts`, {
+					method: "POST",
+					mapError: scopeIs404,
+					signal: options?.signal
+				});
+			})
+		},
+		scopes: githubScopesFor,
+		users: {
+			get: verb(true, async (login, options) => toUser(instance, (await fetcher.json(`/users/${encodeURIComponent(login)}`, { signal: options?.signal })).data)),
+			me: verb(auth.type === "token", async (options) => toUser(instance, (await fetcher.json("/user", { signal: options?.signal })).data))
+		},
+		repos: {
+			get: verb(true, async (ref, options) => {
+				return toRepo(instance, (await fetcher.json(repoPath(ref), { signal: options?.signal })).data);
+			}),
+			listPage: verb(auth.type === "token" || auth.type === "app" && auth.installationId !== void 0, async (listOptions = {}) => {
+				if (auth.type === "app") {
+					if (auth.installationId === void 0) throw new UnsupportedOperationError("An app without an installation has no repositories; use installations.repos()", context);
+					return reposPage(fetcher, "/installation/repositories", true, listOptions);
+				}
+				return reposPage(fetcher, "/user/repos", false, listOptions);
+			}),
+			labelsPage: verb(true, (repo, listOptions = {}) => list(`${repoPath(repo)}/labels`, listOptions, toLabel)),
+			createLabel: verb(true, async (repo, label, options) => toLabel((await fetcher.json(`${repoPath(repo)}/labels`, {
+				method: "POST",
+				json: {
+					name: label.name,
+					color: label.colour,
+					description: label.description
+				},
+				signal: options?.signal
+			})).data)),
+			milestonesPage: verb(true, milestonesPage),
+			collaboratorsPage: verb(!anonymous, (repo, listOptions = {}) => list(`${repoPath(repo)}/collaborators`, listOptions, (raw) => toCollaborator(instance, raw))),
+			permissionFor: verb(!anonymous, async (repo, actor, options) => {
+				const { data } = await fetcher.json(`${repoPath(repo)}/collaborators/${encodeURIComponent(actorLogin(actor))}/permission`, { signal: options?.signal });
+				return toRole({
+					role_name: data.role_name ?? (data.permission === "none" ? void 0 : data.permission),
+					permissions: data.user?.permissions
+				});
+			}),
+			addCollaborator: verb(true, async (repo, actor, role, options) => {
+				await fetcher.raw(`${repoPath(repo)}/collaborators/${encodeURIComponent(actorLogin(actor))}`, {
+					method: "PUT",
+					json: { permission: role },
+					signal: options?.signal
+				});
+			}),
+			assignableUsersPage: verb(true, (repo, listOptions = {}) => list(`${repoPath(repo)}/assignees`, listOptions, (raw) => toActor(instance, raw))),
+			reviewerCandidatesPage: verb(!anonymous && "emulated", async (thread, listOptions = {}) => {
+				const ref = requireThread(thread, context);
+				const page = await fetcher.page(`${repoPath(ref.repo)}/collaborators`, {
+					query: { per_page: listOptions.perPage },
+					cursor: listOptions.cursor,
+					signal: listOptions.signal
+				});
+				const author = (await get(ref, listOptions)).author?.login;
+				return toPage(page, (raw) => raw.login === author ? void 0 : toActor(instance, raw));
+			})
+		},
+		notifications: {
+			listPage: verb(true, notificationPage),
+			markRead: verb(true, async (ref, options) => {
+				await fetcher.raw(`/notifications/threads/${encodeURIComponent(ref.id)}`, {
+					method: "PATCH",
+					signal: options?.signal
+				});
+			}),
+			markDone: verb(enterprise ? ({ version }) => versionAtLeast(version, GHES_MARK_DONE) : true, async (ref, options) => {
+				await fetcher.raw(`/notifications/threads/${encodeURIComponent(ref.id)}`, {
+					method: "DELETE",
+					signal: options?.signal
+				});
+			}),
+			unsubscribe: verb(true, async (ref, options) => {
+				await fetcher.raw(`/notifications/threads/${encodeURIComponent(ref.id)}/subscription`, {
+					method: "DELETE",
+					signal: options?.signal
+				});
+			}),
+			markAllRead: verb(true, async (bulk = {}) => {
+				await fetcher.raw(bulk.repo ? `${repoPath(bulk.repo)}/notifications` : "/notifications", {
+					method: "PUT",
+					...bulk.before ? { json: { last_read_at: bulk.before.toISOString() } } : {},
+					signal: bulk.signal
+				});
+			})
+		},
+		threads: {
+			get: perKind({
+				issue: true,
+				pull_request: true,
+				discussion: !anonymous,
+				commit: true
+			}, get),
+			getMany: verb(true, getMany),
+			listPage: perKind({
+				...ISSUE_LIKE,
+				discussion: !anonymous
+			}, listPage),
+			eventsPage: verb(true, async (thread, listOptions = {}) => {
+				const ref = requireThread(thread, context);
+				if (ref.kind === "discussion") {
+					const [page, { toDiscussionCommentEvent }] = await Promise.all([discussionCommentPage(ref, listOptions), import("./graphql-D7uGzZTf.mjs")]);
+					return {
+						...page,
+						items: page.items.map(({ comment, isReply }) => toDiscussionCommentEvent(ref, comment, isReply))
+					};
+				}
+				if (ref.kind === "commit") return list(`${repoPath(ref.repo)}/commits/${encodeURIComponent(ref.number)}/comments`, listOptions, (comment) => toEvent(instance, ref, {
+					...comment,
+					event: "commented"
+				}));
+				return list(`${repoPath(ref.repo)}/issues/${encodeURIComponent(ref.number)}/timeline`, listOptions, (entry) => toEvent(instance, ref, entry));
+			}),
+			commentsPage: perKind({
+				issue: true,
+				pull_request: true,
+				discussion: !anonymous,
+				commit: true
+			}, commentsPage),
+			reviewsPage: verb(true, reviewsPage),
+			filesPage: verb(true, (ref, listOptions = {}) => list(`${threadPath(requirePull(ref, "read for changed files"))}/files`, listOptions, toChangedFile)),
+			commitsPage: verb(true, (ref, listOptions = {}) => list(`${threadPath(requirePull(ref, "read for commits"))}/commits`, listOptions, (raw) => toCommit(ref.repo, raw))),
+			createReview: verb(true, createReview),
+			submitReview: verb(true, async (ref, event, body, options) => {
+				const pull = requirePull(ref.thread, "reviewed");
+				const { data } = await fetcher.json(`${threadPath(pull)}/reviews/${encodeURIComponent(ref.id)}/events`, {
+					method: "POST",
+					json: {
+						event: REVIEW_EVENTS[event],
+						body
+					},
+					signal: options?.signal
+				});
+				return toReview(pull, data, []);
+			}),
+			reviewThreads: verb(true, {
+				resolveReviewThread: async (_ref, id, options) => {
+					await graphql("RESOLVE_REVIEW_THREAD", { id }, options);
+				},
+				unresolveReviewThread: async (_ref, id, options) => {
+					await graphql("UNRESOLVE_REVIEW_THREAD", { id }, options);
+				}
+			}),
+			checks: perKind({ pull_request: true }, async (thread, options) => {
+				const ref = requireThread(thread, context);
+				const { data } = await fetcher.json(threadPath(ref), { signal: options?.signal });
+				return data.head?.sha ? headChecks(ref.repo, data.head.sha, options?.signal) : { items: [] };
+			}),
+			comment: perKind({
+				issue: true,
+				pull_request: true,
+				discussion: true,
+				commit: true
+			}, async (thread, body, options) => {
+				const ref = requireThread(thread, context);
+				if (ref.kind === "discussion") {
+					const data = await graphql("ADD_DISCUSSION_COMMENT", {
+						id: await discussionId(ref, options),
+						body
+					}, options);
+					return (await import("./graphql-D7uGzZTf.mjs")).toDiscussionComment(ref, data.addDiscussionComment.comment);
+				}
+				const path = ref.kind === "commit" ? `${repoPath(ref.repo)}/commits/${encodeURIComponent(ref.number)}/comments` : `${repoPath(ref.repo)}/issues/${encodeURIComponent(ref.number)}/comments`;
+				const { data } = await fetcher.json(path, {
+					method: "POST",
+					json: { body },
+					signal: options?.signal
+				});
+				return toComment(ref, data);
+			}),
+			editComment: perKind({
+				issue: true,
+				pull_request: true,
+				discussion: true,
+				commit: true
+			}, async (ref, body, options) => {
+				if (ref.thread.kind === "discussion") {
+					const data = await graphql("UPDATE_DISCUSSION_COMMENT", {
+						id: ref.id,
+						body
+					}, options);
+					return (await import("./graphql-D7uGzZTf.mjs")).toDiscussionComment(ref.thread, data.updateDiscussionComment.comment);
+				}
+				const { data } = await fetcher.json(commentPath(ref), {
+					method: "PATCH",
+					json: { body },
+					signal: options?.signal
+				});
+				return toComment(ref.thread, data);
+			}),
+			deleteComment: perKind({
+				issue: true,
+				pull_request: true,
+				discussion: true,
+				commit: true
+			}, async (ref, options) => {
+				if (ref.thread.kind === "discussion") {
+					await graphql("DELETE_DISCUSSION_COMMENT", { id: ref.id }, options);
+					return;
+				}
+				await fetcher.raw(commentPath(ref), {
+					method: "DELETE",
+					signal: options?.signal
+				});
+			}),
+			create: perKind({
+				issue: true,
+				pull_request: true
+			}, async (repo, input, options) => {
+				const assignees = input.assignees?.map(actorLogin);
+				if (input.kind === "issue") {
+					const { data } = await fetcher.json(`${repoPath(repo)}/issues`, {
+						method: "POST",
+						json: {
+							title: input.title,
+							body: input.body,
+							labels: input.labels,
+							assignees
+						},
+						signal: options?.signal
+					});
+					return toThread({
+						forge: FORGE,
+						instance,
+						repo,
+						kind: "issue",
+						number: String(data.number)
+					}, data);
+				}
+				if (input.kind !== "pull_request") throw new UnsupportedOperationError("GitHub discussions cannot be created through this API yet", context);
+				if (!input.head || !input.base) throw new UnsupportedOperationError("Creating a pull request needs head and base branches", context);
+				const { data: pull } = await fetcher.json(`${repoPath(repo)}/pulls`, {
+					method: "POST",
+					json: {
+						title: input.title,
+						body: input.body,
+						head: input.head,
+						base: input.base,
+						draft: input.draft
+					},
+					signal: options?.signal
+				});
+				const ref = {
+					forge: FORGE,
+					instance,
+					repo,
+					kind: "pull_request",
+					number: String(pull.number)
+				};
+				if (!input.labels?.length && !assignees?.length) return toThread(ref, pull);
+				const { data: issue } = await fetcher.json(`${repoPath(repo)}/issues/${encodeURIComponent(pull.number)}`, {
+					method: "PATCH",
+					json: {
+						labels: input.labels,
+						assignees
+					},
+					signal: options?.signal
+				});
+				return toThread(ref, {
+					...pull,
+					labels: issue.labels,
+					assignees: issue.assignees
+				});
+			}),
+			update: perKind({
+				issue: true,
+				pull_request: true,
+				discussion: true
+			}, async (thread, input, options) => {
+				const ref = requireThread(thread, context);
+				if (ref.kind === "discussion") {
+					const data = await graphql("UPDATE_DISCUSSION", {
+						id: await discussionId(ref, options),
+						title: input.title,
+						body: input.body
+					}, options);
+					return (await import("./graphql-D7uGzZTf.mjs")).toDiscussionThread(ref, data.updateDiscussion.discussion);
+				}
+				const target = requireIssueOrPull(ref, context, "update");
+				const { data } = await fetcher.json(threadPath(target), {
+					method: "PATCH",
+					json: input,
+					signal: options?.signal
+				});
+				return toThread(target, data);
+			}),
+			addLabels: perKind({
+				issue: true,
+				pull_request: true
+			}, async (thread, labels, options) => {
+				const ref = requireIssueOrPull(thread, context, "label");
+				await fetcher.raw(`${repoPath(ref.repo)}/issues/${encodeURIComponent(ref.number)}/labels`, {
+					method: "POST",
+					json: { labels },
+					signal: options?.signal
+				});
+			}),
+			removeLabels: perKind({
+				issue: true,
+				pull_request: true
+			}, async (thread, labels, options) => {
+				const ref = requireIssueOrPull(thread, context, "label");
+				for (const label of labels) await fetcher.raw(`${repoPath(ref.repo)}/issues/${encodeURIComponent(ref.number)}/labels/${encodeURIComponent(label)}`, {
+					method: "DELETE",
+					signal: options?.signal
+				});
+			}),
+			setMilestone: perKind({
+				issue: true,
+				pull_request: true
+			}, async (thread, milestone, options) => issuePatch(thread, { milestone: milestone === void 0 ? null : await milestoneId(milestone, (page) => milestonesPage(requireThread(thread, context).repo, page), context, options) }, "set the milestone of", options?.signal)),
+			reactions: perKind({
+				issue: true,
+				pull_request: true,
+				discussion: true
+			}, {
+				react,
+				unreact
+			}),
+			reactionsPage: perKind({
+				issue: true,
+				pull_request: true,
+				discussion: !anonymous
+			}, reactionsPage),
+			transfer: verb(true, async (thread, repo, options) => {
+				const ref = requireThread(thread, context);
+				if (ref.kind !== "issue") throw new UnsupportedOperationError("GitHub transfers issues only", context);
+				const target = await graphql("REPOSITORY_ID", {
+					owner: repo.owner,
+					name: repo.name
+				}, options);
+				if (!target.repository) throw new NotFoundError(`Repository ${repo.owner}/${repo.name} not found`, 404, "", context);
+				const data = await graphql("TRANSFER_ISSUE", {
+					issue: await nodeId(ref, options),
+					repo: target.repository.id
+				}, options);
+				return {
+					forge: FORGE,
+					instance,
+					repo,
+					kind: "issue",
+					number: String(data.transferIssue.issue.number),
+					externalId: data.transferIssue.issue.id
+				};
+			}),
+			markDuplicate: verb(true, async (thread, canonical, options) => {
+				await graphql("MARK_DUPLICATE", {
+					canonical: await nodeId(canonical, options),
+					duplicate: await nodeId(thread, options)
+				}, options);
+			}),
+			setLabels: perKind({
+				issue: true,
+				pull_request: true
+			}, async (thread, labels, options) => {
+				const ref = requireIssueOrPull(thread, context, "label");
+				await fetcher.raw(`${repoPath(ref.repo)}/issues/${encodeURIComponent(ref.number)}/labels`, {
+					method: "PUT",
+					json: { labels },
+					signal: options?.signal
+				});
+			}),
+			setAssignees: perKind({
+				issue: true,
+				pull_request: true
+			}, async (thread, assignees, options) => {
+				const ref = requireIssueOrPull(thread, context, "assign");
+				await fetcher.raw(`${repoPath(ref.repo)}/issues/${encodeURIComponent(ref.number)}`, {
+					method: "PATCH",
+					json: { assignees: assignees.map(actorLogin) },
+					signal: options?.signal
+				});
+			}),
+			requestReview: perKind({ pull_request: true }, async (thread, reviewers, options) => {
+				const ref = requireThread(thread, context);
+				if (ref.kind !== "pull_request") throw new UnsupportedOperationError("Only pull requests have reviewers", context);
+				const teams = reviewers.filter((reviewer) => typeof reviewer !== "string" && reviewer.typeRaw === "Team").map(actorLogin);
+				const users = reviewers.filter((reviewer) => typeof reviewer === "string" || reviewer.typeRaw !== "Team").map(actorLogin);
+				await fetcher.raw(`${threadPath(ref)}/requested_reviewers`, {
+					method: "POST",
+					json: {
+						reviewers: users,
+						...teams.length ? { team_reviewers: teams } : {}
+					},
+					signal: options?.signal
+				});
+			}),
+			close: perKind(ISSUE_LIKE, (ref, options_) => setState(ref, "closed", options_)),
+			reopen: perKind({
+				issue: true,
+				pull_request: true,
+				discussion: true
+			}, (ref, options) => setState(ref, "open", options)),
+			merge: verb(true, merge),
+			subscriptions: perKind(ISSUE_LIKE, {
+				subscription: async (thread, options) => {
+					const { state } = await subscriptionNode(thread, options);
+					return state === "SUBSCRIBED" ? "subscribed" : state === "IGNORED" ? "ignored" : "none";
+				},
+				subscribe: (thread, options) => setSubscription(thread, "SUBSCRIBED", options),
+				unsubscribe: (thread, options) => setSubscription(thread, "UNSUBSCRIBED", options)
+			})
+		}
+	};
+}
+const GITHUB = {
+	forge: FORGE,
+	baseUrl: "https://api.github.com",
+	anonymous: true,
+	instance: webHost,
+	headers: {
+		"accept": "application/vnd.github+json",
+		"x-github-api-version": "2022-11-28"
+	},
+	prepare: ({ options, baseUrl, headers, state }) => options.auth?.type === "app" ? state ?? createAppCredentials(options.auth, {
+		baseUrl,
+		fetch: options.fetch,
+		timeout: options.timeout,
+		headers
+	}) : void 0,
+	authHeaders: ({ options, state }) => createAuthHeaders(options.auth, state),
+	setup: setupGitHub
+};
+/** Creates a GitHub provider for github.com or a GitHub Enterprise Server instance. */
+const github = /* @__PURE__ */ defineForgeProvider({
+	...GITHUB,
+	webhooks: githubWebhooks
+});
+/** `github()` without webhook ingestion, for bundles that never receive a delivery. */
+const githubLite = /* @__PURE__ */ defineForgeProvider(GITHUB);
+/**
+* Token scopes and fine-grained permissions GitHub documents per endpoint
+* group. Classic scopes are the ones an OAuth consent screen asks for; the
+* permissions are the fine-grained token and app equivalents.
+*/
+function githubScopesFor(verb) {
+	const [group = "", name = ""] = verb.split(".");
+	if (group === "webhooks") return name === "verify" || name === "ingest" ? {} : {
+		token: ["admin:repo_hook", "admin:org_hook"],
+		permissions: { webhooks: "admin" }
+	};
+	if (group === "notifications") return {
+		token: ["notifications"],
+		permissions: { notifications: name.startsWith("mark") || name === "unsubscribe" ? "write" : "read" }
+	};
+	if (group === "securityAlerts") return {
+		token: ["security_events", "repo"],
+		permissions: {
+			vulnerability_alerts: "read",
+			secret_scanning_alerts: "read",
+			code_scanning_alerts: "read"
+		}
+	};
+	if (group === "installations") return { note: "App credentials: an app JWT signed with the app private key" };
+	if (group === "users" || group === "search") return {
+		token: ["read:user"],
+		permissions: {}
+	};
+	if (group === "ci" || group === "checks" && name !== "report") return {
+		token: ["repo"],
+		permissions: {
+			actions: "read",
+			checks: name === "rerun" ? "write" : "read"
+		}
+	};
+	if (verb === "checks.report") return {
+		token: ["repo:status"],
+		permissions: {
+			checks: "write",
+			statuses: "write"
+		}
+	};
+	const write = (/* @__PURE__ */ new Set([
+		"comment",
+		"upsertComment",
+		"editComment",
+		"deleteComment",
+		"create",
+		"update",
+		"close",
+		"reopen",
+		"setLabels",
+		"addLabels",
+		"removeLabels",
+		"setMilestone",
+		"react",
+		"unreact",
+		"setAssignees",
+		"requestReview",
+		"merge",
+		"approveAndMerge",
+		"createReview",
+		"submitReview",
+		"approve",
+		"transfer",
+		"markDuplicate",
+		"resolveReviewThread",
+		"unresolveReviewThread",
+		"createLabel",
+		"addCollaborator",
+		"subscribe",
+		"unsubscribe"
+	])).has(name);
+	if (group === "threads") return {
+		token: ["repo", "public_repo"],
+		permissions: {
+			issues: write ? "write" : "read",
+			pull_requests: write ? "write" : "read"
+		}
+	};
+	if (group === "repos" || group === "contents" || group === "releases") return {
+		token: ["repo", "public_repo"],
+		permissions: {
+			contents: write ? "write" : "read",
+			metadata: "read"
+		}
+	};
+	return {};
+}
+//#endregion
+export { FORGE as i, githubLite as n, githubScopesFor as r, github as t };