forges 0.0.0 → 0.1.0

package/dist/tangled-ChdPmiv-.mjs

@@ -0,0 +1,1570 @@
+import { At as UnresolvedThreadError, Dt as SubscriptionClosedError, Mt as WebhookVerificationError, O as toDate, Ot as TokenRevokedError, S as phased, Tt as RateLimitedError, _ as mapConcurrent, _t as ForgeError, bt as InsufficientScopeError, ct as eventAction, d as forgeIterable, f as getManyConcurrently, gt as ForgeApiError, j as toWarning, jt as UnsupportedOperationError, n as perKind, pt as AuthenticationRequiredError, r as verb, rt as createFetcher, t as defineForgeProvider, tt as abortable, u as degradesToWarning, w as requireThread, wt as NotFoundError } from "./define-D3yEXtKK.mjs";
+import { n as headerValue, t as bodyText } from "./crypto-CQNEyYHD.mjs";
+import { a as verifyHmacSignature, i as refEvent } from "./webhooks-rn9-8lxT.mjs";
+//#region src/tangled/atproto.ts
+function parseAtUri(uri) {
+	const match = /^at:\/\/(did:[^/]+)\/([^/]+)\/([^/?#]+)$/.exec(uri);
+	return match ? {
+		did: match[1],
+		collection: match[2],
+		rkey: match[3]
+	} : void 0;
+}
+function atUri(did, collection, rkey) {
+	return `at://${did}/${collection}/${rkey}`;
+}
+/**
+* Resolves identities and reads records straight from each author's PDS.
+* Backlinks come from a Constellation-compatible index, since no PDS can
+* list the records that point at a given one.
+*/
+function createAtprotoClient(options) {
+	const identities = /* @__PURE__ */ new Map();
+	function resolveDid(did, signal) {
+		let identity = identities.get(did);
+		if (!identity) {
+			const url = did.startsWith("did:web:") ? `https://${decodeURIComponent(did.slice(8))}/.well-known/did.json` : `${options.plcUrl}/${did}`;
+			identity = options.fetcher.json(url).then(({ data }) => ({
+				did,
+				pds: data.service?.find((service) => service.id.endsWith("#atproto_pds"))?.serviceEndpoint,
+				handle: data.alsoKnownAs?.find((alias) => alias.startsWith("at://"))?.slice(5)
+			}));
+			identity.catch(() => identities.delete(did));
+			identities.set(did, identity);
+		}
+		return abortable(identity, signal);
+	}
+	const handles = /* @__PURE__ */ new Map();
+	function resolveHandle(handle, signal) {
+		const key = handle.toLowerCase();
+		let did = handles.get(key);
+		if (!did) {
+			did = (async () => {
+				const { data } = await options.fetcher.json(`${options.handleResolverUrl}/xrpc/com.atproto.identity.resolveHandle`, { query: { handle: key } });
+				if ((await resolveDid(data.did)).handle?.toLowerCase() !== key) throw new NotFoundError(`${data.did} does not claim the handle ${handle}`, 404, "", options.context);
+				return data.did;
+			})();
+			did.catch(() => handles.delete(key));
+			handles.set(key, did);
+		}
+		return abortable(did, signal);
+	}
+	async function pdsOf(did, signal) {
+		const host = (await resolveDid(did, signal)).pds;
+		if (!host) throw new ForgeError(`No PDS in the DID document for ${did}`, options.context);
+		return host.replace(/\/$/, "");
+	}
+	async function* listRecords(did, collection, signal) {
+		const host = await pdsOf(did, signal);
+		let cursor;
+		do {
+			const { data } = await options.fetcher.json(`${host}/xrpc/com.atproto.repo.listRecords`, {
+				query: {
+					repo: did,
+					collection,
+					limit: 100,
+					cursor
+				},
+				signal
+			});
+			yield* data.records;
+			cursor = data.records.length ? data.cursor : void 0;
+		} while (cursor);
+	}
+	async function getRecord(uri, signal) {
+		const parsed = parseAtUri(uri);
+		if (!parsed) throw new ForgeError(`Not an AT-URI: ${uri}`, options.context);
+		const host = options.recordsUrl ?? await pdsOf(parsed.did, signal);
+		const { data } = await options.fetcher.json(`${host.replace(/\/$/, "")}/xrpc/com.atproto.repo.getRecord`, {
+			query: {
+				repo: parsed.did,
+				collection: parsed.collection,
+				rkey: parsed.rkey
+			},
+			mapError: (error) => error instanceof ForgeApiError && error.status === 400 ? new NotFoundError(`No record at ${uri}`, 400, error.body, options.context) : error,
+			signal
+		});
+		return data;
+	}
+	async function* backlinks(target, collection, path, signal) {
+		let cursor;
+		do {
+			const { data } = await options.fetcher.json(`${options.backlinksUrl}/links`, {
+				query: {
+					target,
+					collection,
+					path,
+					limit: 100,
+					cursor
+				},
+				headers: { accept: "application/json" },
+				signal
+			});
+			for (const link of data.linking_records) yield {
+				did: link.did,
+				collection: link.collection,
+				rkey: link.rkey
+			};
+			cursor = data.cursor ?? void 0;
+		} while (cursor);
+	}
+	return {
+		resolveDid,
+		resolveHandle,
+		getRecord,
+		listRecords,
+		backlinks
+	};
+}
+//#endregion
+//#region src/tangled/normalise.ts
+const FORGE = "tangled";
+const COLLECTIONS = {
+	repo: "sh.tangled.repo",
+	issue: "sh.tangled.repo.issue",
+	pull: "sh.tangled.repo.pull",
+	comment: "sh.tangled.feed.comment",
+	issueComment: "sh.tangled.repo.issue.comment",
+	pullComment: "sh.tangled.repo.pull.comment",
+	issueState: "sh.tangled.repo.issue.state",
+	pullStatus: "sh.tangled.repo.pull.status",
+	reaction: "sh.tangled.feed.reaction",
+	labelOp: "sh.tangled.label.op",
+	subscription: "sh.tangled.feed.subscription"
+};
+/** Collections that describe activity on an issue or pull request. */
+const THREAD_COLLECTIONS = [
+	COLLECTIONS.issue,
+	COLLECTIONS.pull,
+	COLLECTIONS.comment,
+	COLLECTIONS.issueComment,
+	COLLECTIONS.pullComment,
+	COLLECTIONS.issueState,
+	COLLECTIONS.pullStatus,
+	COLLECTIONS.reaction,
+	COLLECTIONS.labelOp
+];
+function threadKindOf(collection) {
+	if (collection === COLLECTIONS.issue) return "issue";
+	return collection === COLLECTIONS.pull ? "pull_request" : void 0;
+}
+function toActor(instance, identity, webUrl) {
+	const login = identity.handle ?? identity.did;
+	return {
+		forge: FORGE,
+		instance,
+		login,
+		id: identity.did,
+		url: `${webUrl}/${login}`,
+		isBotHint: false
+	};
+}
+function toThreadRef(instance, repo, uri) {
+	const value = atUri(uri.did, uri.collection, uri.rkey);
+	return {
+		forge: FORGE,
+		instance,
+		repo,
+		kind: threadKindOf(uri.collection) ?? "other",
+		typeRaw: uri.collection,
+		number: value,
+		externalId: value
+	};
+}
+/** The thread an activity record points at, as an AT-URI. */
+function subjectOf(collection, record, uri) {
+	switch (collection) {
+		case COLLECTIONS.issue:
+		case COLLECTIONS.pull: return uri;
+		case COLLECTIONS.comment: return record.subject?.uri;
+		case COLLECTIONS.issueComment:
+		case COLLECTIONS.pullComment: return record.issue ?? record.pull;
+		case COLLECTIONS.issueState:
+		case COLLECTIONS.pullStatus: return record.issue ?? record.pull;
+		case COLLECTIONS.reaction:
+		case COLLECTIONS.labelOp: return record.subject;
+		default: return;
+	}
+}
+/** Last segment of a `sh.tangled.repo.issue.state.closed`-style token. */
+function stateToken(record) {
+	return (record.state ?? record.status)?.split(".").at(-1);
+}
+function toThreadState(token) {
+	switch (token) {
+		case "open":
+		case "closed":
+		case "merged": return token;
+		default: return "open";
+	}
+}
+function toEventKind(collection, operation) {
+	if (operation === "delete") return "other";
+	switch (collection) {
+		case COLLECTIONS.comment:
+		case COLLECTIONS.issueComment:
+		case COLLECTIONS.pullComment: return operation === "create" ? "comment" : "other";
+		case COLLECTIONS.issueState:
+		case COLLECTIONS.pullStatus: return "state_change";
+		case COLLECTIONS.issue: return operation === "create" ? "state_change" : "other";
+		case COLLECTIONS.pull: return operation === "create" ? "state_change" : "commit";
+		case COLLECTIONS.reaction: return "reaction";
+		case COLLECTIONS.labelOp: return "label";
+		default: return "other";
+	}
+}
+const STATE_ACTIONS = {
+	open: "reopened",
+	closed: "closed",
+	merged: "merged"
+};
+function toEventAction(activity) {
+	const { collection, operation } = activity;
+	if (operation === "delete") return "deleted";
+	switch (collection) {
+		case COLLECTIONS.issue: return operation === "create" ? "opened" : "edited";
+		case COLLECTIONS.pull: return operation === "create" ? "opened" : "synchronised";
+		case COLLECTIONS.issueState:
+		case COLLECTIONS.pullStatus: return STATE_ACTIONS[stateToken(activity.record) ?? ""] ?? "other";
+		default: return operation === "create" ? "created" : "edited";
+	}
+}
+function summarise(activity, kind, who) {
+	const { collection, record, operation } = activity;
+	if (operation === "delete") return `${who} deleted a ${collection.split(".").at(-1)}`;
+	switch (kind) {
+		case "comment": return `${who} commented`;
+		case "state_change":
+			if (collection === COLLECTIONS.issue) return `${who} opened an issue`;
+			if (collection === COLLECTIONS.pull) return `${who} opened a pull request`;
+			return `${who} marked it ${stateToken(record) ?? "changed"}`;
+		case "commit": return `${who} pushed a new round`;
+		case "reaction": return `${who} reacted ${record.reaction}`;
+		case "label": return `${who} changed labels`;
+		default: return `${who} edited a ${collection.split(".").at(-1)}`;
+	}
+}
+function occurredAt(record) {
+	if (!record) return;
+	return toDate("performedAt" in record ? record.performedAt : record.createdAt);
+}
+function toActivityEvent(instance, activity, actor, thread, source, fallbackTime) {
+	const kind = toEventKind(activity.collection, activity.operation);
+	return {
+		forge: FORGE,
+		instance,
+		id: activity.operation === "create" || !activity.rev ? activity.uri : `${activity.uri}#${activity.rev}`,
+		kind,
+		kindRaw: activity.operation === "create" ? activity.collection : `${activity.collection}:${activity.operation}`,
+		action: toEventAction(activity),
+		actionRaw: activity.operation,
+		detail: kind === "state_change" && (activity.collection === COLLECTIONS.issueState || activity.collection === COLLECTIONS.pullStatus) ? {
+			type: "state_change",
+			state: toThreadState(stateToken(activity.record))
+		} : void 0,
+		summary: summarise(activity, kind, actor.login),
+		occurredAt: occurredAt(activity.record) ?? fallbackTime,
+		actor,
+		repo: thread?.repo,
+		thread,
+		source,
+		payload: activity.record ? {
+			uri: activity.uri,
+			...activity.record
+		} : { uri: activity.uri }
+	};
+}
+function toThread(ref, record, author, state, commentCount, warnings = []) {
+	const value = toThreadState(state.token);
+	const pull = "target" in record ? record : void 0;
+	const updatedAt = toDate(state.at) ?? toDate(pull?.rounds?.at(-1)?.createdAt) ?? toDate(record.createdAt);
+	return {
+		ref,
+		kind: ref.kind,
+		title: record.title,
+		body: record.body,
+		state: value,
+		stateRaw: state.token ?? "open",
+		isDraft: false,
+		author,
+		assignees: [],
+		reviewers: [],
+		createdAt: toDate(record.createdAt),
+		updatedAt,
+		closedAt: value === "open" ? void 0 : toDate(state.at),
+		lastActivityAt: updatedAt,
+		labels: [],
+		commentCount,
+		branches: pull ? {
+			head: { ref: pull.source?.branch ?? "" },
+			base: { ref: pull.target.branch }
+		} : void 0,
+		...warnings.length ? { warnings } : {},
+		raw: record
+	};
+}
+function toRecordComment(thread, uri, record, author) {
+	const body = typeof record.body === "string" ? record.body : record.body.original ?? record.body.text ?? "";
+	return {
+		ref: {
+			forge: FORGE,
+			instance: thread.instance,
+			thread,
+			id: uri
+		},
+		body,
+		author,
+		createdAt: toDate(record.createdAt),
+		raw: {
+			uri,
+			...record
+		}
+	};
+}
+const NOTIFICATION_REASONS = {
+	issue_created: "subscribed",
+	pull_created: "subscribed",
+	issue_commented: "comment",
+	pull_commented: "comment",
+	issue_closed: "state_change",
+	issue_reopen: "state_change",
+	pull_closed: "state_change",
+	pull_reopen: "state_change",
+	pull_merged: "state_change",
+	issue_assigned: "assigned",
+	pull_assigned: "assigned",
+	user_mentioned: "mention",
+	repo_starred: "starred",
+	followed: "followed"
+};
+function toNotificationReason(type) {
+	return NOTIFICATION_REASONS[type] ?? "unknown";
+}
+//#endregion
+//#region src/tangled/notifications.ts
+const NOTIFICATION_NSID = {
+	list: "org.tangled.temp.notification.listNotifications",
+	updateSeen: "org.tangled.temp.notification.updateSeen",
+	markAllRead: "org.tangled.temp.notification.markAllRead",
+	unreadCount: "org.tangled.temp.notification.getUnreadCount"
+};
+/**
+* `org.tangled.temp.notification.*` is served by a separate service that
+* authenticates callers with atproto service-auth tokens minted by their
+* PDS for audience `did:web:<host>`.
+*/
+function createTangledNotifications(url, { instance, context, fetcher, atproto, pdsCall, resolveRepo, actorFor }) {
+	const audience = `did:web:${new URL(url).host}`;
+	const titles = /* @__PURE__ */ new Map();
+	async function call(nsid, init = {}) {
+		const { token } = await pdsCall("com.atproto.server.getServiceAuth", {
+			query: {
+				aud: audience,
+				lxm: nsid
+			},
+			signal: init.signal
+		});
+		const { data } = await fetcher.json(`${url}/xrpc/${nsid}`, {
+			...init,
+			headers: {
+				...init.headers,
+				authorization: `Bearer ${token}`
+			}
+		});
+		return data;
+	}
+	function titleOf(subject) {
+		let title = titles.get(subject);
+		if (!title) {
+			title = atproto.getRecord(subject).then(({ value }) => value.title, () => void 0);
+			titles.set(subject, title);
+		}
+		return title;
+	}
+	async function toItem(item) {
+		const subject = item.issueAt ?? item.pullAt;
+		const parsed = subject ? parseAtUri(subject) : void 0;
+		const repo = item.repoDid ? await resolveRepo(item.repoDid).catch(() => ({
+			forge: FORGE,
+			instance,
+			owner: item.repoDid,
+			name: "",
+			externalId: item.repoDid
+		})) : void 0;
+		let notificationSubject;
+		if (parsed && repo) notificationSubject = {
+			type: "thread",
+			thread: toThreadRef(instance, repo, parsed)
+		};
+		else if (item.type === "followed") notificationSubject = {
+			type: "actor",
+			actor: await actorFor(item.actorDid)
+		};
+		else if (repo) notificationSubject = {
+			type: "repo",
+			repo
+		};
+		else notificationSubject = {
+			type: "other",
+			typeRaw: item.type,
+			id: item.uri
+		};
+		return {
+			ref: {
+				forge: FORGE,
+				instance,
+				id: item.uri
+			},
+			subject: notificationSubject,
+			subjectTypeRaw: item.type,
+			reason: toNotificationReason(item.type),
+			reasonRaw: item.type,
+			unread: !item.read,
+			title: (subject ? await titleOf(subject) : void 0) ?? item.type.replaceAll("_", " "),
+			subjectState: "unknown",
+			updatedAt: toDate(item.createdAt) ?? /* @__PURE__ */ new Date(0),
+			raw: item
+		};
+	}
+	async function page(listOptions = {}) {
+		const data = await call(NOTIFICATION_NSID.list, {
+			query: {
+				read: listOptions.all ? "all" : "unread",
+				limit: listOptions.perPage ?? 100
+			},
+			signal: listOptions.signal
+		});
+		const since = listOptions.since?.getTime();
+		return { items: await Promise.all(data.notifications.filter((item) => since === void 0 || (toDate(item.createdAt)?.getTime() ?? 0) >= since).map(toItem)) };
+	}
+	return {
+		listPage: verb("experimental", page),
+		markRead: verb("experimental", async (ref, options) => {
+			await call(NOTIFICATION_NSID.updateSeen, {
+				method: "POST",
+				json: {
+					uri: ref.id,
+					read: true
+				},
+				signal: options?.signal
+			});
+		}),
+		markAllRead: verb("unverified", async (bulk = {}) => {
+			if (bulk.repo || bulk.before) throw new UnsupportedOperationError("Tangled marks every notification read at once; repo and before filters are not supported", context);
+			await call(NOTIFICATION_NSID.markAllRead, {
+				method: "POST",
+				signal: bulk.signal
+			});
+		}),
+		unreadCount: verb("unverified", async () => (await call(NOTIFICATION_NSID.unreadCount)).count)
+	};
+}
+//#endregion
+//#region src/tangled/records.ts
+const TANGLED_DID = "did:plc:wshs7t2adsemcrrd4snkeqli";
+/** Knots that accept git over SSH on a different host. */
+const DEFAULT_SSH_HOSTS = { "knot1.tangled.sh": "tangled.org" };
+const STATE_COLLECTION = {
+	issue: {
+		collection: COLLECTIONS.issueState,
+		path: ".issue"
+	},
+	pull_request: {
+		collection: COLLECTIONS.pullStatus,
+		path: ".pull"
+	}
+};
+const COMMENT_SOURCES = {
+	issue: [{
+		collection: COLLECTIONS.comment,
+		path: ".subject.uri"
+	}, {
+		collection: COLLECTIONS.issueComment,
+		path: ".issue"
+	}],
+	pull_request: [{
+		collection: COLLECTIONS.comment,
+		path: ".subject.uri"
+	}, {
+		collection: COLLECTIONS.pullComment,
+		path: ".pull"
+	}]
+};
+function ACTIVITY_SOURCES(kind) {
+	return [
+		...COMMENT_SOURCES[kind],
+		STATE_COLLECTION[kind],
+		{
+			collection: COLLECTIONS.reaction,
+			path: ".subject"
+		},
+		{
+			collection: COLLECTIONS.labelOp,
+			path: ".subject"
+		}
+	];
+}
+function createTangledRecords({ options, instance, webUrl, context, atproto, api, fetcher, ownRecords }) {
+	const repos = /* @__PURE__ */ new Map();
+	const collaborators = /* @__PURE__ */ new Map();
+	/**
+	* Repo collaborators, from the knot that hosts the repo DID. Knots older
+	* than v1.15 do not serve this, and an empty set is returned.
+	*/
+	function collaboratorsOf(repo, signal) {
+		const repoDid = repo.externalId;
+		if (!repoDid) return Promise.resolve({ dids: /* @__PURE__ */ new Set() });
+		let found = collaborators.get(repoDid);
+		if (!found) {
+			found = (async () => {
+				const { pds: knot } = await atproto.resolveDid(repoDid);
+				const dids = /* @__PURE__ */ new Set();
+				if (!knot) return { dids };
+				let cursor;
+				do {
+					const { data } = await fetcher.json(`${knot.replace(/\/$/, "")}/xrpc/sh.tangled.repo.listCollaborators`, { query: {
+						subject: repoDid,
+						limit: 1e3,
+						cursor
+					} });
+					for (const item of data.items) dids.add(item.subject);
+					cursor = data.cursor;
+				} while (cursor);
+				return { dids };
+			})().catch((error) => {
+				if (error instanceof ForgeApiError && !(error instanceof RateLimitedError)) return { dids: /* @__PURE__ */ new Set() };
+				if (error instanceof ForgeError) return {
+					dids: /* @__PURE__ */ new Set(),
+					warning: toWarning("collaborators_unreachable", error, repoDid)
+				};
+				throw error;
+			});
+			collaborators.set(repoDid, found);
+		}
+		return abortable(found, signal);
+	}
+	/**
+	* Accounts whose state records the appview accepts: the thread author, the
+	* repo owner, collaborators with push access, and Tangled's own account.
+	*/
+	async function stateAuthors(authorDid, repo, warn, signal) {
+		const { dids, warning } = await collaboratorsOf(repo, signal);
+		if (warning) warn?.(warning);
+		return /* @__PURE__ */ new Set([
+			authorDid,
+			repo.owner,
+			TANGLED_DID,
+			...dids
+		]);
+	}
+	async function actorFor(did, signal) {
+		return toActor(instance, await atproto.resolveDid(did, signal).catch((error) => {
+			if (signal?.aborted) throw error;
+			return { did };
+		}), webUrl);
+	}
+	/** Resolves a record's `repo` field, a repo DID or, in older records, an `sh.tangled.repo` AT-URI. */
+	function resolveRepo(field, signal) {
+		let repo = repos.get(field);
+		if (!repo) {
+			repo = (async () => {
+				const legacy = parseAtUri(field);
+				if (legacy) return {
+					forge: FORGE,
+					instance,
+					owner: legacy.did,
+					name: legacy.rkey
+				};
+				const { value: link } = await atproto.backlinks(field, COLLECTIONS.repo, ".repoDid").next();
+				if (!link) throw new UnresolvedThreadError(`No sh.tangled.repo record declares ${field}`, context);
+				return {
+					forge: FORGE,
+					instance,
+					owner: link.did,
+					name: link.rkey,
+					externalId: field
+				};
+			})();
+			repo.catch(() => repos.delete(field));
+			repos.set(field, repo);
+		}
+		return abortable(repo, signal);
+	}
+	async function threadFor(subject, signal) {
+		const uri = parseAtUri(subject);
+		if (!uri || !threadKindOf(uri.collection)) throw new UnresolvedThreadError(`${subject} is not an issue or pull request`, context);
+		const { value, cid } = await atproto.getRecord(subject, signal);
+		return {
+			ref: toThreadRef(instance, await resolveRepo("target" in value ? value.target.repo : value.repo, signal), uri),
+			record: value,
+			cid
+		};
+	}
+	function subjectUri(thread) {
+		const ref = requireThread(thread, context);
+		const uri = parseAtUri(ref.number);
+		if (!uri || ref.kind !== "issue" && ref.kind !== "pull_request" || threadKindOf(uri.collection) !== ref.kind) throw new UnresolvedThreadError("Tangled thread refs carry the issue or pull AT-URI as their number", context);
+		return {
+			ref,
+			uri,
+			kind: ref.kind
+		};
+	}
+	/**
+	* Reads one record that another record points at. Any failure is a
+	* warning: each record lives on its author's own PDS, and one unreachable
+	* participant must not fail the whole read. Deleted records are skipped
+	* silently.
+	*/
+	async function readLinked(uri, warn, signal) {
+		try {
+			return (await atproto.getRecord(uri, signal)).value;
+		} catch (error) {
+			if (error instanceof NotFoundError) return;
+			if (!degradesToWarning(error)) throw error;
+			warn(toWarning("record_unreachable", error, uri));
+			return;
+		}
+	}
+	async function* activity(target, kind, allowedState, warn, { sources = ACTIVITY_SOURCES(kind), signal } = {}) {
+		for (const source of sources) for await (const link of atproto.backlinks(target, source.collection, source.path, signal)) {
+			if (source === STATE_COLLECTION[kind] && !allowedState.has(link.did)) continue;
+			const uri = atUri(link.did, link.collection, link.rkey);
+			const record = await readLinked(uri, warn, signal);
+			if (record) yield {
+				uri,
+				collection: link.collection,
+				record
+			};
+		}
+	}
+	async function stateOf(target, kind, allowed, warn, signal) {
+		let latest = {};
+		const source = STATE_COLLECTION[kind];
+		for await (const link of atproto.backlinks(target, source.collection, source.path, signal)) {
+			if (!allowed.has(link.did)) continue;
+			const value = await readLinked(atUri(link.did, link.collection, link.rkey), (warning) => {
+				warn({
+					...warning,
+					code: "state_record_unreachable",
+					message: `State may be stale: ${warning.message}`
+				});
+			}, signal);
+			if (!value) continue;
+			if (!latest.at || (toDate(value.createdAt)?.getTime() ?? 0) > (toDate(latest.at)?.getTime() ?? 0)) latest = {
+				token: stateToken(value),
+				at: value.createdAt
+			};
+		}
+		return latest;
+	}
+	async function countComments(target, kind, signal) {
+		let count = 0;
+		for (const source of COMMENT_SOURCES[kind]) for await (const _ of atproto.backlinks(target, source.collection, source.path, signal)) count++;
+		return count;
+	}
+	async function toStreamEvent(message) {
+		const { commit } = message;
+		const uri = atUri(message.did, commit.collection, commit.rkey);
+		const subject = commit.record ? subjectOf(commit.collection, commit.record, uri) : void 0;
+		const thread = subject ? await threadFor(subject).then(({ ref }) => ref, () => void 0) : void 0;
+		return toActivityEvent(instance, {
+			uri,
+			collection: commit.collection,
+			record: commit.record,
+			operation: commit.operation,
+			rev: commit.rev
+		}, await actorFor(message.did), thread, "subscribe", /* @__PURE__ */ new Date(message.time_us / 1e3));
+	}
+	const canonical = /* @__PURE__ */ new Map();
+	/** The repo record `repo` names, where `owner` may be a handle and `name` the record's name rather than its key. */
+	function canonicalRepo(repo, signal) {
+		const key = `${repo.owner}/${repo.name}`;
+		let found = canonical.get(key);
+		if (!found) {
+			found = (async () => {
+				const did = repo.owner.startsWith("did:") ? repo.owner : await atproto.resolveHandle(repo.owner.replace(/^@/, ""));
+				const record = await atproto.getRecord(atUri(did, COLLECTIONS.repo, repo.name)).catch((error) => {
+					if (error instanceof NotFoundError) return;
+					throw error;
+				});
+				if (record) return {
+					ref: {
+						...repo,
+						owner: did
+					},
+					record
+				};
+				for await (const candidate of atproto.listRecords(did, COLLECTIONS.repo)) if (candidate.value.name === repo.name) return {
+					ref: {
+						...repo,
+						owner: did,
+						name: parseAtUri(candidate.uri).rkey
+					},
+					record: candidate
+				};
+				throw new NotFoundError(`No Tangled repo named ${repo.name} for ${repo.owner}`, 404, "", context);
+			})();
+			found.catch(() => canonical.delete(key));
+			canonical.set(key, found);
+		}
+		return abortable(found, signal);
+	}
+	/** `repo` with a DID owner and the record key as `name`; refs this provider returned already are. */
+	async function canonicalRef(repo, signal) {
+		return repo.externalId && repo.owner.startsWith("did:") ? repo : (await canonicalRepo(repo, signal)).ref;
+	}
+	async function repoDidOf(repo, signal) {
+		if (repo.externalId) return repo.externalId;
+		const { record: { value } } = await canonicalRepo(repo, signal);
+		if (!value.repoDid) throw new UnresolvedThreadError(`${repo.owner}/${repo.name} has no repo DID`, context);
+		return value.repoDid;
+	}
+	function sshHost(knot) {
+		return options.sshHosts?.[knot] ?? DEFAULT_SSH_HOSTS[knot] ?? knot;
+	}
+	function toRepo(ref, record, raw) {
+		const parent = record.source ? parseAtUri(record.source) : void 0;
+		const path = `${ref.owner}/${ref.name}`;
+		return {
+			ref: record.repoDid ? {
+				...ref,
+				externalId: record.repoDid
+			} : ref,
+			displayName: record.name && record.name !== ref.name ? record.name : void 0,
+			description: record.description,
+			visibility: "public",
+			isFork: Boolean(record.source),
+			isArchived: false,
+			parent: parent ? {
+				forge: FORGE,
+				instance,
+				owner: parent.did,
+				name: parent.rkey
+			} : void 0,
+			topics: record.topics ?? [],
+			url: `${webUrl}/${path}`,
+			cloneUrls: {
+				https: `${webUrl}/${path}`,
+				ssh: `ssh://git@${sshHost(record.knot)}/${path}`
+			},
+			createdAt: toDate(record.createdAt),
+			homepage: record.website || void 0,
+			raw
+		};
+	}
+	async function readThread(thread, options) {
+		const { uri, kind } = subjectUri(thread);
+		const target = atUri(uri.did, uri.collection, uri.rkey);
+		const { ref, record } = await threadFor(target, options?.signal);
+		const warnings = [];
+		const warn = (warning) => warnings.push(warning);
+		const [author, state, comments] = await Promise.all([
+			actorFor(uri.did, options?.signal),
+			stateAuthors(uri.did, ref.repo, warn, options?.signal).then((allowed) => stateOf(target, kind, allowed, warn, options?.signal)),
+			countComments(target, kind, options?.signal)
+		]);
+		return toThread(ref, record, author, state, comments, warnings);
+	}
+	async function listFromIndex(repo, query) {
+		const warnings = [];
+		if (!query.cursor) {
+			warnings.push({
+				code: "index_possibly_stale",
+				message: "Listed from the Bobbin index; states may lag behind the records"
+			});
+			if (query.sort && query.sort !== "created") warnings.push({
+				code: "sort_unsupported",
+				message: "The index sorts by creation time only"
+			});
+		}
+		const repoDid = await repoDidOf(repo, query.signal);
+		const state = query.state ?? "open";
+		const kinds = query.kind ? [query.kind] : ["issue", "pull_request"];
+		const page = await phased(kinds.map((kind) => async (cursor) => {
+			const pulls = kind === "pull_request";
+			const { data } = await api.json(`/xrpc/sh.tangled.repo.${pulls ? "listPulls" : "listIssues"}`, {
+				query: {
+					subject: repoDid,
+					[pulls ? "status" : "state"]: state === "all" || pulls && state === "closed" ? void 0 : state,
+					author: query.author?.startsWith("did:") ? query.author : void 0,
+					order: query.direction ?? "desc",
+					limit: query.perPage ?? 50,
+					cursor: cursor?.token
+				},
+				signal: query.signal
+			});
+			const items = [];
+			for (const item of data.items) {
+				const uri = parseAtUri(item.uri);
+				if (!uri || state === "closed" && item.state === "open") continue;
+				const author = await actorFor(uri.did, query.signal);
+				if (query.author && author.login !== query.author && author.id !== query.author) continue;
+				const thread = toThread(toThreadRef(instance, {
+					...repo,
+					externalId: repoDid
+				}, uri), item.value, author, {
+					token: item.state,
+					at: item.stateUpdatedAt
+				}, item.commentCount);
+				if (query.since && (thread.lastActivityAt?.getTime() ?? 0) < query.since.getTime() || query.createdAfter && (thread.createdAt?.getTime() ?? 0) < query.createdAfter.getTime()) continue;
+				items.push(thread);
+			}
+			return {
+				items,
+				cursor: data.items.length && data.cursor ? { token: data.cursor } : void 0
+			};
+		}), query.cursor);
+		return warnings.length ? {
+			...page,
+			warnings: [...warnings, ...page.warnings ?? []]
+		} : page;
+	}
+	/** Record-based listings read every record to apply the appview's rules, so they return one complete page. */
+	async function wholePage(iterable) {
+		const items = await Array.fromAsync(iterable);
+		return iterable.warnings.length ? {
+			items,
+			warnings: iterable.warnings
+		} : { items };
+	}
+	function listPage(repo, query = {}) {
+		return options.listSource === "index" && query.kind !== "discussion" ? listFromIndex(repo, query) : wholePage(listThreads(repo, query));
+	}
+	function listThreads(repo, query = {}) {
+		return forgeIterable(async function* (warn) {
+			if (query.kind === "discussion") {
+				warn({
+					code: "kind_unsupported",
+					message: "Tangled has no discussions"
+				});
+				return;
+			}
+			if (query.labels?.length || query.assignee) warn({
+				code: "filter_unsupported",
+				message: "Tangled labels and assignees are not read yet; those filters were ignored"
+			});
+			const address = await canonicalRef(repo, query.signal);
+			const targets = [await repoDidOf(repo, query.signal), atUri(address.owner, COLLECTIONS.repo, address.name)];
+			const uris = [];
+			for (const kind of query.kind ? [query.kind] : ["issue", "pull_request"]) {
+				const collection = kind === "issue" ? COLLECTIONS.issue : COLLECTIONS.pull;
+				for (const target of targets) for await (const link of atproto.backlinks(target, collection, kind === "issue" ? ".repo" : ".target.repo", query.signal)) uris.push(atUri(link.did, link.collection, link.rkey));
+			}
+			const threadsRead = await mapConcurrent([...new Set(uris)], 4, async (uri) => {
+				const parsed = parseAtUri(uri);
+				try {
+					const thread = await readThread({
+						forge: FORGE,
+						instance,
+						repo,
+						kind: threadKindOf(parsed.collection),
+						number: uri
+					}, query);
+					thread.warnings?.forEach(warn);
+					return thread;
+				} catch (error) {
+					if (!degradesToWarning(error)) throw error;
+					warn(toWarning("thread_unreadable", error, uri));
+					return;
+				}
+			});
+			const state = query.state ?? "open";
+			const sortKey = (thread) => query.sort === "comments" ? thread.commentCount ?? 0 : (query.sort === "updated" ? thread.lastActivityAt : thread.createdAt)?.getTime() ?? 0;
+			const direction = (query.direction ?? "desc") === "desc" ? -1 : 1;
+			yield* threadsRead.filter((thread) => Boolean(thread)).filter((thread) => state === "all" || (state === "open" ? thread.state === "open" : state === "merged" ? thread.state === "merged" : thread.state !== "open")).filter((thread) => !query.author || thread.author?.login === query.author || thread.author?.id === query.author).filter((thread) => !query.since || (thread.lastActivityAt?.getTime() ?? 0) >= query.since.getTime()).filter((thread) => !query.createdAfter || (thread.createdAt?.getTime() ?? 0) >= query.createdAfter.getTime()).sort((a, b) => (sortKey(a) - sortKey(b)) * direction);
+		});
+	}
+	function listComments(thread, options = {}) {
+		const { ref, uri, kind } = subjectUri(thread);
+		const target = atUri(uri.did, uri.collection, uri.rkey);
+		return forgeIterable(async function* (warn) {
+			const comments = [];
+			for await (const item of activity(target, kind, /* @__PURE__ */ new Set(), warn, {
+				sources: COMMENT_SOURCES[kind],
+				signal: options.signal
+			})) comments.push(toRecordComment(ref, item.uri, item.record, await actorFor(parseAtUri(item.uri).did, options.signal)));
+			yield* comments.sort((a, b) => (a.createdAt?.getTime() ?? 0) - (b.createdAt?.getTime() ?? 0));
+		});
+	}
+	async function findSubscription(thread, signal) {
+		const { uri } = subjectUri(thread);
+		const target = atUri(uri.did, uri.collection, uri.rkey);
+		for await (const record of ownRecords(COLLECTIONS.subscription, signal)) if (record.value.subject.uri === target) return record.uri;
+	}
+	return {
+		stateAuthors,
+		actorFor,
+		resolveRepo,
+		threadFor,
+		subjectUri,
+		activity,
+		toStreamEvent,
+		canonicalRepo,
+		canonicalRef,
+		repoDidOf,
+		toRepo,
+		readThread,
+		wholePage,
+		listPage,
+		listComments,
+		findSubscription
+	};
+}
+//#endregion
+//#region src/tangled/session.ts
+function createTangledSession({ options, fetcher, atproto, context }) {
+	const writable = options.auth !== void 0 && options.auth.type !== "anonymous";
+	let session;
+	let pdsUrl;
+	async function createSession(refresh) {
+		const auth = options.auth;
+		if (!pdsUrl) {
+			const did = auth.pds ? void 0 : auth.identifier.startsWith("did:") ? auth.identifier : await atproto.resolveHandle(auth.identifier).catch(() => void 0);
+			pdsUrl = auth.pds ?? (did ? (await atproto.resolveDid(did)).pds : void 0) ?? "https://bsky.social";
+		}
+		const { data } = await fetcher.json(`${pdsUrl}/xrpc/com.atproto.server.${refresh ? "refreshSession" : "createSession"}`, refresh ? {
+			method: "POST",
+			headers: { authorization: `Bearer ${refresh.refreshJwt}` }
+		} : {
+			method: "POST",
+			json: {
+				identifier: auth.identifier,
+				password: auth.password
+			},
+			mapError: rejectedPassword
+		});
+		return data;
+	}
+	async function currentSession() {
+		session ??= createSession();
+		session.catch(() => {
+			session = void 0;
+		});
+		return session;
+	}
+	async function viewerDid() {
+		const auth = options.auth;
+		return auth.type === "oauth" ? auth.did : (await currentSession()).did;
+	}
+	/** Calls an XRPC method on the authenticated account's PDS, refreshing an expired session once. */
+	async function pdsCall(nsid, init = {}) {
+		const auth = options.auth;
+		if (auth.type === "oauth") return (await createFetcher({
+			baseUrl: auth.pds,
+			fetch: auth.fetch,
+			authenticated: true,
+			timeout: options.timeout,
+			context
+		}).json(`${auth.pds.replace(/\/$/, "")}/xrpc/${nsid}`, init)).data;
+		const send = async (current) => (await fetcher.json(`${pdsUrl}/xrpc/${nsid}`, {
+			...init,
+			headers: {
+				...init.headers,
+				authorization: `Bearer ${current.accessJwt}`
+			}
+		})).data;
+		const current = await currentSession();
+		try {
+			return await send(current);
+		} catch (error) {
+			if (!(error instanceof ForgeApiError) || error.status !== 400 || !error.body.includes("ExpiredToken")) throw error;
+			session = createSession(current);
+			return send(await session);
+		}
+	}
+	async function createRecord(collection, record, signal) {
+		return pdsCall("com.atproto.repo.createRecord", {
+			method: "POST",
+			json: {
+				repo: await viewerDid(),
+				collection,
+				record: {
+					$type: collection,
+					...record
+				}
+			},
+			signal
+		});
+	}
+	/** Rewrites one of the account's own records, refusing records it does not own. */
+	async function putOwnRecord(uri, update, signal) {
+		const parsed = parseAtUri(uri);
+		const viewer = await viewerDid();
+		if (!parsed || parsed.did !== viewer) throw new InsufficientScopeError("Records can only be edited by the account that wrote them", 403, "", context);
+		const current = await atproto.getRecord(uri, signal);
+		const record = update(current.value);
+		await pdsCall("com.atproto.repo.putRecord", {
+			method: "POST",
+			json: {
+				repo: viewer,
+				collection: parsed.collection,
+				rkey: parsed.rkey,
+				record,
+				swapRecord: current.cid
+			},
+			signal
+		});
+		return record;
+	}
+	async function deleteOwnRecord(uri, signal) {
+		const parsed = parseAtUri(uri);
+		const viewer = await viewerDid();
+		if (!parsed || parsed.did !== viewer) throw new InsufficientScopeError("Records can only be deleted by the account that wrote them", 403, "", context);
+		await pdsCall("com.atproto.repo.deleteRecord", {
+			method: "POST",
+			json: {
+				repo: viewer,
+				collection: parsed.collection,
+				rkey: parsed.rkey
+			},
+			signal
+		});
+	}
+	async function* ownRecords(collection, signal) {
+		const repo = await viewerDid();
+		let cursor;
+		do {
+			const data = await pdsCall("com.atproto.repo.listRecords", {
+				query: {
+					repo,
+					collection,
+					limit: 100,
+					cursor
+				},
+				signal
+			});
+			yield* data.records;
+			cursor = data.records.length ? data.cursor : void 0;
+		} while (cursor);
+	}
+	return {
+		writable,
+		viewerDid,
+		pdsCall,
+		createRecord,
+		putOwnRecord,
+		deleteOwnRecord,
+		ownRecords
+	};
+}
+function rejectedPassword(error) {
+	if (!(error instanceof AuthenticationRequiredError)) return error;
+	const context = {
+		forge: error.forge,
+		instance: error.instance,
+		url: error.url,
+		method: error.method
+	};
+	return new TokenRevokedError("Identifier or app password was rejected by the PDS", error.status, error.body, context, { cause: error });
+}
+//#endregion
+//#region src/tangled/subscribe.ts
+function jetstreamUrl(base, collections, cursor) {
+	const url = new URL(base);
+	for (const collection of collections) url.searchParams.append("wantedCollections", collection);
+	if (cursor) url.searchParams.set("cursor", cursor);
+	return url.toString();
+}
+/**
+* Streams Jetstream commit events as normalised events. Messages are
+* translated strictly in arrival order, so a yielded cursor never skips an
+* earlier event.
+*/
+function subscribeJetstream(options) {
+	return { [Symbol.asyncIterator]() {
+		const queue = [];
+		const waiters = [];
+		let lastCursor = options.cursor;
+		let finished = false;
+		let chain = Promise.resolve();
+		function settle(settled) {
+			if (finished) return;
+			if ("error" in settled || settled.done) finished = true;
+			const waiter = waiters.shift();
+			if (waiter) waiter(settled);
+			else queue.push(settled);
+		}
+		const socket = options.createWebSocket(jetstreamUrl(options.url, options.collections, options.cursor));
+		function stop() {
+			if (!finished) settle({ done: true });
+			socket.close(1e3);
+		}
+		if (options.signal?.aborted) stop();
+		options.signal?.addEventListener("abort", stop, { once: true });
+		socket.addEventListener("message", ({ data }) => {
+			chain = chain.then(async () => {
+				if (finished) return;
+				const message = JSON.parse(String(data));
+				const cursor = String(message.time_us);
+				if (message.kind !== "commit") {
+					lastCursor = cursor;
+					return;
+				}
+				const event = await options.toEvent(message);
+				lastCursor = cursor;
+				if (event) settle({
+					done: false,
+					value: {
+						event,
+						cursor
+					}
+				});
+			}).catch((error) => {
+				settle({ error: new SubscriptionClosedError("Failed to translate a subscription message", lastCursor, options.context, { cause: error }) });
+				socket.close(1011);
+			});
+		});
+		socket.addEventListener("error", (event) => {
+			chain = chain.then(() => settle({ error: new SubscriptionClosedError("Subscription connection failed", lastCursor, options.context, { cause: event }) }));
+		});
+		socket.addEventListener("close", ({ code, reason }) => {
+			chain = chain.then(() => settle({ error: new SubscriptionClosedError(`Subscription closed (${code ?? "no code"}${reason ? `: ${reason}` : ""})`, lastCursor, options.context) }));
+		});
+		return {
+			next() {
+				const settled = queue.shift();
+				const resolve = (value) => {
+					if ("error" in value) throw value.error;
+					return value.done ? {
+						done: true,
+						value: void 0
+					} : value;
+				};
+				if (settled) return Promise.resolve().then(() => resolve(settled));
+				if (finished) return Promise.resolve({
+					done: true,
+					value: void 0
+				});
+				return new Promise((waiter) => waiters.push(waiter)).then(resolve);
+			},
+			return() {
+				options.signal?.removeEventListener("abort", stop);
+				stop();
+				queue.length = 0;
+				return Promise.resolve({
+					done: true,
+					value: void 0
+				});
+			}
+		};
+	} };
+}
+//#endregion
+//#region src/tangled/web.ts
+const SECTIONS = {
+	issue: "issues",
+	pull_request: "pulls"
+};
+const repoPath = (repo) => `/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.name)}`;
+/** Tangled pages address threads by their display number, so parsed refs carry `displayNumber` and need resolving. */
+function tangledWeb(origin) {
+	return {
+		origin,
+		repo: repoPath,
+		thread: (ref) => SECTIONS[ref.kind] && ref.displayNumber ? `${repoPath(ref.repo)}/${SECTIONS[ref.kind]}/${encodeURIComponent(ref.displayNumber)}` : void 0,
+		parse: (segments, _url, from) => {
+			const [owner, name, section, id] = segments;
+			if (!owner || !name) return;
+			const repo = {
+				...from,
+				owner: owner.replace(/^@/, ""),
+				name
+			};
+			const kind = section === "issues" ? "issue" : section === "pulls" ? "pull_request" : void 0;
+			return kind && id ? {
+				repo,
+				thread: {
+					...from,
+					repo,
+					kind,
+					displayNumber: id
+				}
+			} : { repo };
+		}
+	};
+}
+//#endregion
+//#region src/tangled/webhooks.ts
+const SIGNATURE_HEADER = "x-tangled-signature-256";
+const EVENT_HEADER = "x-tangled-event";
+const PULL_ACTIONS = {
+	created: "opened",
+	resubmitted: "synchronised"
+};
+function verifyTangledSignature(delivery, secret) {
+	return verifyHmacSignature(delivery, secret, {
+		header: SIGNATURE_HEADER,
+		prefix: "sha256="
+	});
+}
+/** A ref that did not exist before the push, or no longer exists after it. */
+const ZERO_SHA = "0000000000000000000000000000000000000000";
+const PULL_KINDS = {
+	created: "state_change",
+	merged: "state_change",
+	closed: "state_change",
+	reopened: "state_change",
+	resubmitted: "commit"
+};
+function translateTangledWebhook(instance, delivery, webUrl) {
+	const event = headerValue(delivery.headers, EVENT_HEADER);
+	if (!event) throw new WebhookVerificationError(`Missing ${EVENT_HEADER} header`, {
+		forge: FORGE,
+		instance
+	});
+	const deliveryId = headerValue(delivery.headers, "x-tangled-delivery") ?? crypto.randomUUID();
+	const payload = JSON.parse(bodyText(delivery.body));
+	const ownerDid = payload.repository?.owner?.did ?? payload.repository?.full_name?.split("/")[0];
+	const repo = payload.repository && ownerDid ? {
+		forge: FORGE,
+		instance,
+		owner: ownerDid,
+		name: payload.repository.name
+	} : void 0;
+	const actorDid = payload.sender?.did ?? payload.pusher?.did;
+	const actor = actorDid ? {
+		forge: FORGE,
+		instance,
+		login: actorDid,
+		id: actorDid,
+		url: `${webUrl}/${actorDid}`,
+		isBotHint: false
+	} : void 0;
+	const who = actor?.login ?? "someone";
+	if (event.startsWith("pull_request:") && payload.pull_request) {
+		const action = payload.action ?? event.slice(13);
+		return [{
+			forge: FORGE,
+			instance,
+			id: deliveryId,
+			kind: PULL_KINDS[action] ?? "other",
+			kindRaw: event,
+			action: PULL_ACTIONS[action] ?? eventAction(action),
+			actionRaw: action,
+			summary: `${who} ${action === "resubmitted" ? "pushed a new round to" : action} pull request #${payload.pull_request.number}`,
+			occurredAt: action === "created" ? toDate(payload.pull_request.created_at) ?? /* @__PURE__ */ new Date() : /* @__PURE__ */ new Date(),
+			actor,
+			repo,
+			thread: repo ? {
+				forge: FORGE,
+				instance,
+				repo,
+				kind: "pull_request",
+				typeRaw: "sh.tangled.repo.pull",
+				displayNumber: String(payload.pull_request.number)
+			} : void 0,
+			source: "webhook",
+			payload
+		}];
+	}
+	const base = {
+		forge: FORGE,
+		instance,
+		id: deliveryId,
+		kindRaw: event,
+		occurredAt: /* @__PURE__ */ new Date(),
+		actor,
+		repo,
+		source: "webhook",
+		payload
+	};
+	if (event === "push" && payload.ref) return [{
+		...base,
+		...refEvent(who, {
+			ref: payload.ref,
+			before: payload.before,
+			after: payload.after,
+			created: payload.before === ZERO_SHA,
+			deleted: payload.after === ZERO_SHA,
+			commits: (payload.commits ?? []).map((commit) => ({
+				sha: commit.sha ?? commit.id ?? "",
+				message: commit.message,
+				author: commit.author?.did ?? commit.author?.name
+			}))
+		})
+	}];
+	return [{
+		...base,
+		kind: "other",
+		summary: `${who} ${event}`
+	}];
+}
+const TANGLED_WEBHOOK_EVENTS = [
+	{
+		kind: "comment",
+		action: "created"
+	},
+	{
+		kind: "state_change",
+		action: "opened"
+	},
+	{
+		kind: "state_change",
+		action: "closed"
+	},
+	{
+		kind: "state_change",
+		action: "merged"
+	},
+	{ kind: "push" }
+];
+const tangledWebhooks = ({ options, instance, baseUrl }) => ({
+	events: TANGLED_WEBHOOK_EVENTS,
+	verify: (delivery) => verifyTangledSignature(delivery, options.webhookSecret),
+	translate: async (delivery) => {
+		const events = await translateTangledWebhook(instance, delivery, baseUrl);
+		if (!options.resolveDisplayNumber) return events;
+		for (const event of events) {
+			const thread = event.thread;
+			if (thread?.displayNumber && !thread.number) {
+				const number = await options.resolveDisplayNumber(thread.repo, thread.kind, thread.displayNumber);
+				if (number) event.thread = {
+					...thread,
+					number,
+					externalId: number
+				};
+			}
+		}
+		return events;
+	}
+});
+//#endregion
+//#region src/tangled/index.ts
+const ISSUE_AND_PULL = {
+	issue: true,
+	pull_request: true
+};
+const TANGLED = {
+	forge: FORGE,
+	experimental: true,
+	baseUrl: "https://tangled.org",
+	headers: { accept: "application/json" },
+	setup({ options, instance, baseUrl: webUrl, origin: context, fetcher, createFetcher: fetcherFor }) {
+		const atproto = createAtprotoClient({
+			fetcher,
+			plcUrl: (options.plcUrl ?? "https://plc.directory").replace(/\/$/, ""),
+			backlinksUrl: (options.backlinksUrl ?? "https://constellation.microcosm.blue").replace(/\/$/, ""),
+			handleResolverUrl: (options.handleResolverUrl ?? "https://public.api.bsky.app").replace(/\/$/, ""),
+			recordsUrl: options.recordsUrl?.replace(/\/$/, ""),
+			context
+		});
+		const api = fetcherFor({ baseUrl: (options.apiUrl ?? "https://api.tangled.org").replace(/\/$/, "") });
+		const { writable, viewerDid, pdsCall, createRecord, putOwnRecord, deleteOwnRecord, ownRecords } = createTangledSession({
+			options,
+			fetcher,
+			atproto,
+			context
+		});
+		/** The repo DID a thread record must reference, from the ref or the repo record. */
+		const { stateAuthors, actorFor, resolveRepo, threadFor, subjectUri, activity, toStreamEvent, canonicalRepo, canonicalRef, repoDidOf, toRepo, readThread, wholePage, listPage, listComments, findSubscription } = createTangledRecords({
+			options,
+			instance,
+			webUrl,
+			context,
+			atproto,
+			api,
+			fetcher,
+			ownRecords
+		});
+		const threads = {
+			get: perKind(ISSUE_AND_PULL, readThread),
+			getMany: verb(true, (refs, options) => getManyConcurrently(refs, readThread, options)),
+			listPage: perKind({
+				issue: true,
+				pull_request: true
+			}, listPage),
+			eventsPage: verb(true, async (thread, listOptions = {}) => {
+				const { ref, uri, kind } = subjectUri(thread);
+				const target = atUri(uri.did, uri.collection, uri.rkey);
+				return wholePage(forgeIterable(async function* (warn) {
+					const events = [];
+					for await (const item of activity(target, kind, await stateAuthors(uri.did, ref.repo, warn, listOptions.signal), warn, listOptions)) {
+						const author = parseAtUri(item.uri).did;
+						events.push(toActivityEvent(instance, {
+							...item,
+							operation: "create"
+						}, await actorFor(author, listOptions.signal), ref, "poll", /* @__PURE__ */ new Date(0)));
+					}
+					yield* events.sort((a, b) => a.occurredAt.getTime() - b.occurredAt.getTime());
+				}));
+			}),
+			commentsPage: perKind(ISSUE_AND_PULL, (thread, listOptions) => wholePage(listComments(thread, listOptions)))
+		};
+		const comment = async (thread, body, options) => {
+			const { ref, uri } = subjectUri(thread);
+			const target = atUri(uri.did, uri.collection, uri.rkey);
+			const { cid } = await atproto.getRecord(target, options?.signal);
+			const record = {
+				body: {
+					$type: "sh.tangled.markup.markdown",
+					text: body,
+					original: body
+				},
+				subject: {
+					uri: target,
+					cid: cid ?? ""
+				},
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			return toRecordComment(ref, (await createRecord(COLLECTIONS.comment, { ...record }, options?.signal)).uri, record, await actorFor(await viewerDid(), options?.signal));
+		};
+		const editComment = async (ref, body, options) => {
+			const record = await putOwnRecord(ref.id, (current) => ({
+				...current,
+				body: typeof current.body === "string" ? body : {
+					$type: "sh.tangled.markup.markdown",
+					text: body,
+					original: body
+				}
+			}), options?.signal);
+			return toRecordComment(ref.thread, ref.id, record, await actorFor(await viewerDid(), options?.signal));
+		};
+		const deleteComment = (ref, options) => deleteOwnRecord(ref.id, options?.signal);
+		const create = async (repo, input, options) => {
+			if (input.kind !== "issue") throw new UnsupportedOperationError("Tangled pull requests are patches; only issues can be created", context);
+			if (input.labels?.length || input.assignees?.length) throw new UnsupportedOperationError("Tangled labels and assignees are not written yet", context);
+			const [address, repoDid] = await Promise.all([canonicalRef(repo, options?.signal), repoDidOf(repo, options?.signal)]);
+			const record = {
+				repo: repoDid,
+				title: input.title,
+				body: input.body,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			const created = await createRecord(COLLECTIONS.issue, { ...record }, options?.signal);
+			return toThread(toThreadRef(instance, {
+				...address,
+				externalId: repoDid
+			}, parseAtUri(created.uri)), record, await actorFor(await viewerDid(), options?.signal), {}, 0);
+		};
+		const update = async (thread, input, options) => {
+			const { ref, uri } = subjectUri(thread);
+			return toThread(ref, await putOwnRecord(atUri(uri.did, uri.collection, uri.rkey), (current) => ({
+				...current,
+				...input.title === void 0 ? {} : { title: input.title },
+				...input.body === void 0 ? {} : { body: input.body }
+			}), options?.signal), await actorFor(uri.did, options?.signal), {}, 0);
+		};
+		const subscription = async (thread, options) => await findSubscription(thread, options?.signal) ? "subscribed" : "none";
+		const subscribe = async (thread, options) => {
+			if (await findSubscription(thread, options?.signal)) return;
+			const { uri } = subjectUri(thread);
+			await createRecord(COLLECTIONS.subscription, {
+				subject: {
+					$type: `${COLLECTIONS.subscription}#uri`,
+					uri: atUri(uri.did, uri.collection, uri.rkey)
+				},
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			}, options?.signal);
+		};
+		const unsubscribe = async (thread, options) => {
+			const existing = await findSubscription(thread, options?.signal);
+			if (existing) await deleteOwnRecord(existing, options?.signal);
+		};
+		const setState = async (thread, state, signal) => {
+			const { uri, kind } = subjectUri(thread);
+			const target = atUri(uri.did, uri.collection, uri.rkey);
+			const { ref } = await threadFor(target, signal);
+			const [viewer, allowed] = await Promise.all([viewerDid(), stateAuthors(uri.did, ref.repo, void 0, signal)]);
+			if (!allowed.has(viewer)) throw new InsufficientScopeError("Only the author, the repo owner or a collaborator can change this state; the appview would ignore the record", 403, "", context);
+			await createRecord(STATE_COLLECTION[kind].collection, kind === "issue" ? {
+				issue: target,
+				state: `${COLLECTIONS.issueState}.${state}`,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			} : {
+				pull: target,
+				status: `${COLLECTIONS.pullStatus}.${state}`,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
+			}, signal);
+		};
+		const close = (thread, options) => setState(thread, "closed", options?.signal);
+		const reopen = (thread, options) => setState(thread, "open", options?.signal);
+		const notificationsUrl = options.notificationsUrl?.replace(/\/$/, "");
+		const notifications = writable && notificationsUrl ? createTangledNotifications(notificationsUrl, {
+			instance,
+			context,
+			fetcher,
+			atproto,
+			pdsCall,
+			resolveRepo,
+			actorFor
+		}) : void 0;
+		const createWebSocket = options.webSocket ?? ((url) => new globalThis.WebSocket(url));
+		const signedIn = {
+			issue: writable,
+			pull_request: writable
+		};
+		return {
+			traits: {
+				eventKinds: "native",
+				authKinds: [
+					"anonymous",
+					"app_password",
+					"oauth"
+				]
+			},
+			request: api,
+			repos: {
+				get: verb(true, async (ref, options) => {
+					const { ref: found, record } = await canonicalRepo(ref, options?.signal);
+					return toRepo(found, record.value, record);
+				}),
+				listPage: verb(writable, async (listOptions = {}) => {
+					if (!writable) throw new UnsupportedOperationError("Listing your repositories needs auth", context);
+					return wholePage(forgeIterable(async function* () {
+						const owner = await viewerDid();
+						for await (const record of ownRecords(COLLECTIONS.repo, listOptions.signal)) {
+							const rkey = parseAtUri(record.uri).rkey;
+							yield toRepo({
+								forge: FORGE,
+								instance,
+								owner,
+								name: rkey
+							}, record.value, record);
+						}
+					}));
+				})
+			},
+			notifications,
+			users: { me: verb(writable, async (options) => ({
+				...await actorFor(await viewerDid(), options?.signal),
+				raw: void 0
+			})) },
+			threads: {
+				...threads,
+				comment: perKind(signedIn, comment),
+				editComment: perKind(signedIn, editComment),
+				deleteComment: perKind(signedIn, deleteComment),
+				create: perKind({ issue: writable }, create),
+				update: perKind(signedIn, update),
+				close: perKind(signedIn, close),
+				reopen: perKind(signedIn, reopen),
+				subscriptions: perKind(signedIn, {
+					subscription,
+					subscribe,
+					unsubscribe
+				})
+			},
+			sources: { subscribe: verb(true, (subscribeOptions) => subscribeJetstream({
+				...subscribeOptions,
+				url: options.jetstreamUrl ?? "wss://jetstream2.us-east.bsky.network/subscribe",
+				collections: THREAD_COLLECTIONS,
+				createWebSocket,
+				toEvent: toStreamEvent,
+				context
+			})) },
+			web: tangledWeb(webUrl),
+			scopes: () => ({ note: "An atproto app password or OAuth session; Tangled has no per-verb scopes" }),
+			webhooks: {}
+		};
+	}
+};
+/** Creates a Tangled provider. Records are read from PDSes; pushes arrive through Jetstream. */
+const tangled = /* @__PURE__ */ defineForgeProvider({
+	...TANGLED,
+	webhooks: tangledWebhooks
+});
+/** `tangled()` without webhook ingestion, for bundles that never receive a delivery. */
+const tangledLite = /* @__PURE__ */ defineForgeProvider(TANGLED);
+//#endregion
+export { tangledLite as n, tangled as t };