forges 0.0.0 → 0.1.0

package/dist/define-D3yEXtKK.mjs

@@ -0,0 +1,2276 @@
+//#region src/errors.ts
+/** Base class for every error that forges throws. */
+var ForgeError = class extends Error {
+	name = "ForgeError";
+	/** The forge that the request went to. */
+	forge;
+	instance;
+	url;
+	method;
+	constructor(message, context = {}, options) {
+		super(message, options);
+		this.forge = context.forge;
+		this.instance = context.instance;
+		this.url = context.url;
+		this.method = context.method;
+	}
+};
+/** The forge responded with an error. */
+var ForgeApiError = class extends ForgeError {
+	name = "ForgeApiError";
+	status;
+	/** Truncated response body, for diagnostics. */
+	body;
+	constructor(message, status, body, context, options) {
+		super(message, context, options);
+		this.status = status;
+		this.body = body;
+	}
+};
+/** A 404: the resource does not exist, or the credential cannot see it. Many forges respond the same way to both. */
+var NotFoundError = class extends ForgeApiError {
+	name = "NotFoundError";
+};
+/**
+* A 401, or a 403 with a request budget of zero (GitHub GraphQL), for a request
+* sent without credentials. A rejected credential is {@link TokenRevokedError}.
+*/
+var AuthenticationRequiredError = class extends ForgeApiError {
+	name = "AuthenticationRequiredError";
+};
+/** A rate limit was hit and a retry didn't help. */
+var RateLimitedError = class extends ForgeApiError {
+	name = "RateLimitedError";
+	/** When the limit resets, when the forge says. */
+	resetAt;
+	/** A secondary (abuse) limit, which has no remaining-request counter. */
+	secondary;
+	constructor(message, status, body, options = {}, errorOptions) {
+		super(message, status, body, options, errorOptions);
+		this.resetAt = options.resetAt;
+		this.secondary = options.secondary ?? false;
+	}
+};
+/** The credential was revoked or expired. */
+var TokenRevokedError = class extends ForgeApiError {
+	name = "TokenRevokedError";
+};
+/** The credential is valid but lacks the scope or permission for this call. */
+var InsufficientScopeError = class extends ForgeApiError {
+	name = "InsufficientScopeError";
+};
+/**
+* The forge refused the request for a reason other than a missing scope: an
+* organisation policy, an SSO requirement, an abuse limit, a protected
+* resource, or a release the forge has marked immutable. A missing scope is
+* {@link InsufficientScopeError}.
+*/
+var ForbiddenError = class extends ForgeApiError {
+	name = "ForbiddenError";
+	/** Why the forge refused the request. */
+	reason;
+	/** The forge's own wording, for diagnostics and for reasons that have no `ForbiddenReason`. */
+	reasonRaw;
+	constructor(message, status, body, reason, context, options) {
+		super(message, status, body, context, options);
+		this.reason = reason;
+		this.reasonRaw = context?.reasonRaw;
+	}
+};
+/** Body patterns that identify a 403 reason, most specific first. */
+const FORBIDDEN_PATTERNS = [
+	["org_restriction", /third[- ]party application|OAuth App access restrictions|organization has enabled OAuth|not authorized by the organization|blocked by the organization/i],
+	["sso_required", /SAML|single sign[- ]on|\bSSO\b|must be granted .* organization/i],
+	["rate_limit_abuse", /abuse detection|secondary rate limit/i],
+	["resource_protected", /archived|read[- ]only|protected branch|repository has been disabled|is disabled/i]
+];
+/**
+* Classifies a 403 body. Returns `undefined` for a body that names no policy
+* the caller could act on, which stays {@link InsufficientScopeError}.
+*/
+function forbiddenReason(body) {
+	for (const [reason, pattern] of FORBIDDEN_PATTERNS) {
+		const match = body.match(pattern);
+		if (match) return {
+			reason,
+			reasonRaw: match[0]
+		};
+	}
+}
+/** The pull request cannot be merged yet, typically because of failing or pending checks or branch protection. */
+var MergeBlockedError = class extends ForgeApiError {
+	name = "MergeBlockedError";
+};
+/** The merge conflicts with the base branch, or the head moved since `sha` was read. */
+var MergeConflictError = class extends ForgeApiError {
+	name = "MergeConflictError";
+};
+/** A request or a pending merge exceeded `timeout`. */
+var ForgeTimeoutError = class extends ForgeError {
+	name = "ForgeTimeoutError";
+	/** The timeout that was exceeded, in milliseconds. */
+	timeout;
+	constructor(message, timeout, context, options) {
+		super(message, context, options);
+		this.timeout = timeout;
+	}
+};
+/** A subscription connection closed or failed. Resume from `cursor`. */
+var SubscriptionClosedError = class extends ForgeError {
+	name = "SubscriptionClosedError";
+	/** The cursor of the last event received. Pass it to `subscribe()` to resume. */
+	cursor;
+	constructor(message, cursor, context, options) {
+		super(message, context, options);
+		this.cursor = cursor;
+	}
+};
+/** The request never got a response: DNS, TLS, connection refused or a proxy refusal. */
+var ForgeNetworkError = class extends ForgeError {
+	name = "ForgeNetworkError";
+};
+/** A delivery's signature didn't match. */
+var WebhookVerificationError = class extends ForgeError {
+	name = "WebhookVerificationError";
+};
+/** The forge doesn't support the operation. */
+var UnsupportedOperationError = class extends ForgeError {
+	name = "UnsupportedOperationError";
+};
+/** A write was called on a provider constructed with `readOnly: true`. */
+var ReadOnlyError = class extends UnsupportedOperationError {
+	name = "ReadOnlyError";
+};
+/** `contents.file` was asked for text and the file's bytes are not valid UTF-8. */
+var ContentNotTextError = class extends ForgeError {
+	name = "ContentNotTextError";
+};
+/** A ref names a forge instance no registered provider serves. */
+var UnknownForgeError = class extends ForgeError {
+	name = "UnknownForgeError";
+};
+/** Maps a generic merge-endpoint failure onto {@link MergeBlockedError} or {@link MergeConflictError}. */
+function toMergeError(error) {
+	if (!(error instanceof ForgeApiError) || error.constructor !== ForgeApiError) return error;
+	const context = {
+		forge: error.forge,
+		instance: error.instance,
+		url: error.url,
+		method: error.method
+	};
+	if (error.status === 405) return new MergeBlockedError("Pull request is not mergeable yet", error.status, error.body, context, { cause: error });
+	if (error.status === 406 || error.status === 409) return new MergeConflictError("Pull request conflicts with its base or the head has moved", error.status, error.body, context, { cause: error });
+	return error;
+}
+/** The thread ref has no number, or is a kind the provider cannot address. */
+var UnresolvedThreadError = class extends ForgeError {
+	name = "UnresolvedThreadError";
+};
+/** No merge method was given, and the repository allows several or reports none. */
+var MergeMethodRequiredError = class extends ForgeError {
+	name = "MergeMethodRequiredError";
+	/** The merge methods that the repository allows. */
+	allowed;
+	constructor(allowed, context, options) {
+		super(allowed.length ? `Repository allows ${allowed.join(", ")}; pass \`method\` to choose one` : "Repository reports no merge method this provider can use; pass `method` explicitly", context, options);
+		this.allowed = allowed;
+	}
+};
+/** Picks the only allowed merge method, or throws {@link MergeMethodRequiredError}. */
+function soleMergeMethod(allowed, context) {
+	const methods = Object.keys(allowed).filter((method) => allowed[method]);
+	if (methods.length !== 1) throw new MergeMethodRequiredError(methods, context);
+	return methods[0];
+}
+//#endregion
+//#region src/contents.ts
+/** Decodes base64, tolerating the newlines GitHub and Gitea wrap it in. */
+function fromBase64(value) {
+	const binary = atob(value.replaceAll(/\s/g, ""));
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index++) bytes[index] = binary.charCodeAt(index);
+	return bytes;
+}
+/**
+* Shapes bytes as the caller asked: UTF-8 text for `as: 'text'`, bytes
+* otherwise. Rejects with {@link ContentNotTextError} when text was asked for
+* and the bytes are not valid UTF-8.
+*/
+function toFileContent(bytes, file, options, context) {
+	if (options?.as !== "text") return {
+		...file,
+		content: bytes,
+		encoding: "binary"
+	};
+	try {
+		return {
+			...file,
+			content: new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+			encoding: "utf-8"
+		};
+	} catch (cause) {
+		throw new ContentNotTextError(`${file.path} is not valid UTF-8 text`, context, { cause });
+	}
+}
+/** True for a full SHA-1 or SHA-256 commit id, which needs no lookup to resolve. */
+function isSha(ref) {
+	return /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/i.test(ref);
+}
+/**
+* Every capability with the verbs it covers and the flags that gate it, in the order the capability matrix lists them.
+*/
+const CAPABILITY_TABLE = [
+	{
+		capability: "experimental",
+		derived: "experimental"
+	},
+	{
+		capability: "sources.poll",
+		derived: "poll"
+	},
+	{
+		capability: "sources.webhook",
+		derived: "webhook",
+		verbs: ["webhooks.verify", "webhooks.ingest"]
+	},
+	{ capability: "sources.subscribe" },
+	{ capability: "repos.get" },
+	{ capability: "users.get" },
+	{
+		capability: "users.me",
+		account: true
+	},
+	{
+		capability: "repos.list",
+		account: true,
+		listing: true
+	},
+	{
+		capability: "repos.labels",
+		listing: true
+	},
+	{
+		capability: "repos.createLabel",
+		write: true
+	},
+	{
+		capability: "repos.milestones",
+		listing: true
+	},
+	{
+		capability: "repos.collaborators",
+		listing: true
+	},
+	{ capability: "repos.permissionFor" },
+	{
+		capability: "repos.addCollaborator",
+		write: true
+	},
+	{
+		capability: "repos.assignableUsers",
+		listing: true
+	},
+	{
+		capability: "repos.reviewerCandidates",
+		listing: true
+	},
+	{
+		capability: "threads.get",
+		perKind: true
+	},
+	{
+		capability: "threads.list",
+		listing: true,
+		perKind: true
+	},
+	{ capability: "threads.getMany" },
+	{
+		capability: "threads.events",
+		spec: "threads.eventsPage",
+		derived: "threadEvents"
+	},
+	{
+		capability: "comments.list",
+		spec: "threads.commentsPage",
+		perKind: true
+	},
+	{
+		capability: "comments.edit",
+		write: true,
+		spec: "threads.editComment",
+		perKind: true
+	},
+	{
+		capability: "comments.delete",
+		write: true,
+		spec: "threads.deleteComment",
+		perKind: true
+	},
+	{
+		capability: "reactions.list",
+		spec: "threads.reactionsPage",
+		perKind: true
+	},
+	{
+		capability: "notifications.list",
+		account: true,
+		listing: true
+	},
+	{
+		capability: "notifications.markRead",
+		account: true,
+		write: true
+	},
+	{
+		capability: "notifications.markDone",
+		account: true,
+		write: true
+	},
+	{
+		capability: "notifications.unsubscribe",
+		account: true,
+		write: true
+	},
+	{
+		capability: "notifications.markAllRead",
+		account: true,
+		write: true
+	},
+	{
+		capability: "notifications.markAllDone",
+		account: true,
+		write: true
+	},
+	{
+		capability: "notifications.unreadCount",
+		account: true
+	},
+	{
+		capability: "writes.comment",
+		write: true,
+		perKind: true
+	},
+	{
+		capability: "writes.upsertComment",
+		write: true,
+		derived: "upsertComment",
+		verbs: ["threads.upsertComment"]
+	},
+	{
+		capability: "writes.close",
+		write: true,
+		perKind: true
+	},
+	{
+		capability: "writes.reopen",
+		write: true,
+		perKind: true
+	},
+	{
+		capability: "writes.create",
+		write: true,
+		perKind: true
+	},
+	{
+		capability: "writes.update",
+		write: true,
+		perKind: true
+	},
+	{
+		capability: "writes.setLabels",
+		write: true,
+		perKind: true
+	},
+	{
+		capability: "writes.addLabels",
+		write: true,
+		perKind: true
+	},
+	{
+		capability: "writes.removeLabels",
+		write: true,
+		perKind: true
+	},
+	{
+		capability: "writes.setMilestone",
+		write: true,
+		perKind: true
+	},
+	{
+		capability: "writes.react",
+		write: true,
+		spec: "threads.reactions",
+		perKind: true,
+		verbs: ["threads.react", "threads.unreact"]
+	},
+	{
+		capability: "writes.setAssignees",
+		write: true,
+		perKind: true
+	},
+	{
+		capability: "writes.requestReview",
+		write: true,
+		perKind: true
+	},
+	{
+		capability: "writes.merge",
+		write: true
+	},
+	{
+		capability: "writes.approveAndMerge",
+		write: true,
+		derived: "approveAndMerge",
+		verbs: ["threads.approveAndMerge"]
+	},
+	{
+		capability: "writes.transfer",
+		write: true
+	},
+	{
+		capability: "writes.markDuplicate",
+		write: true
+	},
+	{
+		capability: "subscriptions.get",
+		account: true,
+		spec: "threads.subscriptions",
+		perKind: true,
+		verbs: ["threads.subscription"]
+	},
+	{
+		capability: "subscriptions.set",
+		write: true,
+		derived: "subscriptionSet",
+		verbs: ["threads.subscribe", "threads.unsubscribe"]
+	},
+	{
+		capability: "installations",
+		account: true,
+		verbs: [
+			"installations.list",
+			"installations.listPage",
+			"installations.get",
+			"installations.token",
+			"installations.repos",
+			"installations.reposPage",
+			"installations.provider",
+			"installations.providers"
+		]
+	},
+	{
+		capability: "checks.thread",
+		spec: "threads.checks",
+		perKind: true
+	},
+	{ capability: "checks.list" },
+	{
+		capability: "checks.report",
+		write: true
+	},
+	{
+		capability: "checks.rerun",
+		write: true
+	},
+	{
+		capability: "ci.runs",
+		listing: true
+	},
+	{ capability: "ci.run" },
+	{
+		capability: "ci.jobs",
+		listing: true
+	},
+	{ capability: "ci.log" },
+	{ capability: "contents.file" },
+	{
+		capability: "contents.tree",
+		listing: true
+	},
+	{
+		capability: "contents.branches",
+		listing: true
+	},
+	{
+		capability: "contents.tags",
+		listing: true
+	},
+	{ capability: "contents.resolveRef" },
+	{
+		capability: "contents.commits",
+		listing: true
+	},
+	{ capability: "contents.commit" },
+	{ capability: "contents.compare" },
+	{
+		capability: "contents.threadFiles",
+		spec: "threads.filesPage"
+	},
+	{
+		capability: "contents.threadCommits",
+		spec: "threads.commitsPage"
+	},
+	{
+		capability: "reviews.list",
+		spec: "threads.reviewsPage"
+	},
+	{
+		capability: "reviews.create",
+		write: true,
+		spec: "threads.createReview"
+	},
+	{
+		capability: "reviews.submit",
+		write: true,
+		spec: "threads.submitReview"
+	},
+	{
+		capability: "reviews.approve",
+		write: true,
+		spec: "threads.approve",
+		derived: "approve"
+	},
+	{
+		capability: "reviews.resolveThread",
+		write: true,
+		spec: "threads.reviewThreads",
+		verbs: ["threads.resolveReviewThread", "threads.unresolveReviewThread"]
+	},
+	{
+		capability: "releases.list",
+		listing: true
+	},
+	{ capability: "releases.get" },
+	{ capability: "releases.latest" },
+	{ capability: "releases.getByTag" },
+	{ capability: "releases.downloadAsset" },
+	{
+		capability: "releases.create",
+		write: true
+	},
+	{
+		capability: "releases.update",
+		write: true
+	},
+	{
+		capability: "webhooks.list",
+		account: true,
+		listing: true
+	},
+	{
+		capability: "webhooks.create",
+		write: true
+	},
+	{
+		capability: "webhooks.update",
+		write: true
+	},
+	{
+		capability: "webhooks.delete",
+		write: true
+	},
+	{
+		capability: "webhooks.rotateSecret",
+		write: true
+	},
+	{
+		capability: "webhooks.deliveries",
+		account: true,
+		listing: true
+	},
+	{
+		capability: "webhooks.redeliver",
+		write: true
+	},
+	{
+		capability: "search.threads",
+		listing: true
+	},
+	{
+		capability: "search.repos",
+		listing: true
+	},
+	{
+		capability: "search.commits",
+		listing: true
+	},
+	{
+		capability: "search.code",
+		listing: true
+	},
+	{
+		capability: "securityAlerts",
+		derived: "alertKinds",
+		verbs: ["securityAlerts.list", "securityAlerts.listPage"]
+	},
+	{
+		capability: "eventKinds",
+		derived: "eventKinds"
+	},
+	{
+		capability: "authKinds",
+		derived: "authKinds"
+	},
+	{
+		capability: "limits",
+		derived: "limits"
+	}
+].map(({ listing, ...row }) => {
+	const spec = row.spec ?? (row.derived ? void 0 : defaultSpec(row.capability, listing));
+	const verbs = row.verbs ?? (spec?.endsWith("Page") ? [spec.slice(0, -4), spec] : spec ? [spec] : void 0);
+	return {
+		...row,
+		...spec ? { spec } : {},
+		...verbs ? { verbs } : {}
+	};
+});
+function defaultSpec(capability, listing) {
+	const path = capability.startsWith("writes.") ? `threads.${capability.slice(7)}` : capability;
+	return listing ? `${path}Page` : path;
+}
+//#endregion
+//#region src/capabilities.ts
+const ALERT_KINDS = [
+	"dependency",
+	"code_scanning",
+	"secret",
+	"advisory"
+];
+const KINDS = [
+	"issue",
+	"pull_request",
+	"discussion",
+	"commit"
+];
+function resolve(support, env) {
+	return typeof support === "function" ? support(env) : support ?? false;
+}
+function resolveKinds(kinds, env) {
+	return Object.fromEntries(KINDS.map((kind) => [kind, resolve(kinds?.[kind], env)]));
+}
+/** A capability composed of `parts` is `'unverified'` when any part is. */
+function composed(parts, level) {
+	return parts.includes(false) ? false : parts.includes("unverified") ? "unverified" : level;
+}
+/** A thread's events are read for each kind the provider reads threads of, at the weaker of the two levels. */
+function threadEventKinds(spec, env) {
+	const events = resolve(spec.threads.eventsPage.support, env);
+	const threads = resolveKinds(spec.threads.get.kinds, env);
+	return Object.fromEntries(KINDS.map((kind) => [kind, composed([events, threads[kind]], events === true ? threads[kind] : events)]));
+}
+/** `upsertComment` is composed of listing, creating and editing a comment, so it needs all three for the kind. */
+function upsertKinds(spec, env) {
+	const parts = [
+		spec.threads.commentsPage,
+		spec.threads.comment,
+		spec.threads.editComment
+	];
+	return Object.fromEntries(KINDS.map((kind) => [kind, composed(parts.map((part) => resolve(part?.kinds[kind], env)), "emulated")]));
+}
+/** Support for the composed verb, requiring both approval and merging. */
+function approveAndMergeSupport(spec, env) {
+	const merge = resolve(spec.threads.merge?.support, env);
+	return composed([merge, resolve((spec.threads.approve ?? spec.threads.createReview)?.support, env)], resolve(spec.threads.approveAndMerge?.support ?? merge, env));
+}
+function read(source, path) {
+	return path.split(".").reduce((value, key) => value?.[key], source);
+}
+function write(target, path, value) {
+	const keys = path.split(".");
+	const leaf = keys.pop();
+	const parent = keys.reduce((node, key) => node[key] ??= {}, target);
+	parent[leaf] = value;
+}
+/** What `entry` contributes to the capability object; `undefined` leaves the field to core. */
+function valueFor(entry, spec, env, flags) {
+	switch (entry.derived) {
+		case "experimental": return;
+		case "poll": return resolve(spec.notifications?.listPage.support, env);
+		case "webhook": return flags.webhook;
+		case "threadEvents": return threadEventKinds(spec, env);
+		case "upsertComment": return upsertKinds(spec, env);
+		case "subscriptionSet": return resolveKinds(flags.readOnly ? void 0 : spec.threads.subscriptions?.kinds, env);
+		case "approve": return resolve((spec.threads.approve ?? spec.threads.createReview)?.support, env);
+		case "approveAndMerge": return approveAndMergeSupport(spec, env);
+		case "alertKinds": return Object.fromEntries(ALERT_KINDS.map((kind) => [kind, resolve(spec.securityAlerts?.kinds[kind], env)]));
+		case "eventKinds": return spec.traits.eventKinds;
+		case "authKinds": return spec.traits.authKinds;
+		case "limits": return spec.traits.limits;
+	}
+	const declared = read(spec, entry.spec);
+	return entry.perKind ? resolveKinds(declared?.kinds, env) : resolve(declared?.support, env);
+}
+/** The capability object a spec declares, derived from {@link CAPABILITY_TABLE} with every support resolved against `env`. */
+function capabilitiesOf(spec, env, flags) {
+	const capabilities = {
+		version: env.version,
+		...flags.experimental ? { experimental: true } : {}
+	};
+	for (const entry of CAPABILITY_TABLE) {
+		const value = valueFor(entry, spec, env, flags);
+		if (value !== void 0) write(capabilities, entry.capability, value);
+	}
+	return capabilities;
+}
+/** Verbs `readOnly` blocks, by their {@link ForgeVerb} name. */
+const WRITE_VERBS = new Set(CAPABILITY_TABLE.flatMap((entry) => entry.write ? entry.verbs ?? [] : []));
+function update(target, path, change) {
+	const [key, ...rest] = path.split(".");
+	const node = target;
+	if (!key) return change(target);
+	if (node?.[key] === void 0) return target;
+	return {
+		...node,
+		[key]: update(node[key], rest.join("."), change)
+	};
+}
+const unsupported = (declared) => declared && {
+	...declared,
+	support: false
+};
+const unsupportedKinds = (declared) => declared && {
+	...declared,
+	kinds: {}
+};
+/**
+* Marks writes unsupported, with `anonymous` everything that needs an account,
+* and with `webhooksOnly` every declared verb, leaving only webhook ingestion.
+*/
+function restrict(spec, anonymous, webhooksOnly = false) {
+	let restricted = spec;
+	for (const entry of CAPABILITY_TABLE) if (entry.spec && (entry.write || anonymous && (entry.account || webhooksOnly))) restricted = update(restricted, entry.spec, entry.perKind ? unsupportedKinds : unsupported);
+	const result = restricted;
+	return anonymous && webhooksOnly ? {
+		...result,
+		securityAlerts: void 0
+	} : result;
+}
+//#endregion
+//#region src/events.ts
+const ACTIONS = {
+	open: "opened",
+	opened: "opened",
+	close: "closed",
+	closed: "closed",
+	reopen: "reopened",
+	reopened: "reopened",
+	merge: "merged",
+	merged: "merged",
+	edit: "edited",
+	edited: "edited",
+	update: "edited",
+	updated: "edited",
+	create: "created",
+	created: "created",
+	delete: "deleted",
+	deleted: "deleted",
+	submitted: "submitted",
+	labeled: "labelled",
+	labelled: "labelled",
+	label_added: "labelled",
+	unlabeled: "unlabelled",
+	unlabelled: "unlabelled",
+	label_removed: "unlabelled",
+	label_updated: "edited",
+	label_cleared: "unlabelled",
+	assigned: "assigned",
+	unassigned: "unassigned",
+	review_requested: "review_requested",
+	synchronize: "synchronised",
+	synchronized: "synchronised",
+	synchronised: "synchronised",
+	ready_for_review: "ready_for_review",
+	converted_to_draft: "converted_to_draft",
+	convert_to_draft: "converted_to_draft",
+	publish: "published",
+	published: "published",
+	renamed: "renamed",
+	transferred: "transferred",
+	archived: "archived",
+	unarchived: "unarchived",
+	added: "added",
+	removed: "removed"
+};
+/** What a comment or review event means when the forge names no verb. */
+const KIND_DEFAULTS = {
+	comment: "created",
+	review_comment: "created",
+	review: "submitted"
+};
+/** Normalises a forge-native verb (`closed`, `close`, `synchronize`, ...) into an {@link EventAction}. */
+function eventAction(raw) {
+	return raw ? ACTIONS[raw.toLowerCase()] : void 0;
+}
+/**
+* Fills `action` from `actionRaw`, or from the last `.`/`:` segment of
+* `kindRaw`, falling back to the kind's default verb, then `other`.
+*/
+function completeEvent(event) {
+	if (event.action) return event;
+	const raw = event.actionRaw ?? event.kindRaw?.split(/[.:]/).pop();
+	return {
+		...event,
+		action: eventAction(raw) ?? KIND_DEFAULTS[event.kind] ?? "other"
+	};
+}
+const REVIEW_STATES = {
+	approved: "approved",
+	approve: "approved",
+	changes_requested: "changes_requested",
+	request_changes: "changes_requested",
+	commented: "commented",
+	comment: "commented",
+	pending: "pending",
+	dismissed: "dismissed"
+};
+/** Normalises a forge-native review verdict (`APPROVED`, `changes_requested`, ...) into a {@link ReviewState}. */
+function reviewState(raw) {
+	return raw && REVIEW_STATES[raw.toLowerCase()] || "unknown";
+}
+//#endregion
+//#region src/fetch.ts
+const BODY_EXCERPT_LENGTH = 512;
+const REDIRECT_STATUSES = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/** A forge's plain-text rate limit refusal, such as Gitee's `403 Forbidden (Rate Limit Exceeded)`. */
+const PLAIN_RATE_LIMIT_RE = /^[^{<]{0,80}\brate limit exceeded\b/i;
+const DOT_SEGMENT_RE = /^(?:\.|%2e){1,2}$/i;
+/** Parses an RFC 5988 `Link` header into a map of rel to URL. */
+function parseLinkHeader(header) {
+	const links = {};
+	if (!header) return links;
+	for (const part of header.split(",")) {
+		const match = /<([^>]+)>\s*;\s*(.+)/.exec(part.trim());
+		if (!match?.[1] || !match[2]) continue;
+		const rel = /rel\s*=\s*"?([^";]+)"?/.exec(match[2])?.[1];
+		if (rel) links[rel.trim()] = match[1];
+	}
+	return links;
+}
+function cursorFrom(response) {
+	const next = parseLinkHeader(response.headers.get("link")).next;
+	const etag = response.headers.get("etag") ?? void 0;
+	if (!next && !etag) return;
+	return {
+		nextUrl: next,
+		etag
+	};
+}
+function retryAfterMs(response) {
+	const header = response.headers.get("retry-after");
+	if (!header) return;
+	const seconds = Number(header);
+	if (Number.isFinite(seconds)) return seconds * 1e3;
+	const date = Date.parse(header);
+	return Number.isNaN(date) ? void 0 : Math.max(0, date - Date.now());
+}
+/**
+* `x-ratelimit-reset` is a Unix time in seconds. The IETF `ratelimit-reset`
+* is seconds from now, though some forges send a Unix time there too.
+*/
+function resetDate(response) {
+	const epoch = headerNumber(response, "x-ratelimit-reset");
+	if (epoch !== void 0) return /* @__PURE__ */ new Date(epoch * 1e3);
+	const reset = headerNumber(response, "ratelimit-reset");
+	if (reset === void 0) return;
+	return new Date(reset > 1e9 ? reset * 1e3 : Date.now() + reset * 1e3);
+}
+function rateLimitReset(response) {
+	const reset = resetDate(response);
+	if (reset) return reset;
+	const after = retryAfterMs(response);
+	return after === void 0 ? void 0 : new Date(Date.now() + after);
+}
+function headerNumber(response, ...names) {
+	for (const name of names) {
+		const value = response.headers.get(name);
+		if (value !== null && value !== "" && Number.isFinite(Number(value))) return Number(value);
+	}
+}
+/** The request budget a response reports, from `x-ratelimit-*` or `ratelimit-*` headers. */
+function rateLimitOf(response) {
+	const limit = headerNumber(response, "x-ratelimit-limit", "ratelimit-limit");
+	const remaining = headerNumber(response, "x-ratelimit-remaining", "ratelimit-remaining");
+	const reset = resetDate(response);
+	if (limit === void 0 && remaining === void 0 && reset === void 0) return;
+	return {
+		...limit === void 0 ? {} : { limit },
+		...remaining === void 0 ? {} : { remaining },
+		...reset === void 0 ? {} : { resetAt: reset }
+	};
+}
+function isRateLimited(response) {
+	if (response.status === 429) return true;
+	if (response.status !== 403 || headerNumber(response, "x-ratelimit-limit", "ratelimit-limit") === 0) return false;
+	return response.headers.get("x-ratelimit-remaining") === "0" || response.headers.get("ratelimit-remaining") === "0" || response.headers.has("retry-after");
+}
+/**
+* One signal that aborts when any of `signals` does. `AbortSignal.any` would
+* do this, but StarlingMonkey (the wasm runtime) does not implement it.
+*/
+function anySignal(signals) {
+	const aborted = signals.find((signal) => signal.aborted);
+	if (aborted) return aborted;
+	if (signals.length === 1) return signals[0];
+	const controller = new AbortController();
+	const listeners = [];
+	for (const signal of signals) {
+		const listener = () => {
+			controller.abort(signal.reason);
+			for (const [other, removed] of listeners) other.removeEventListener("abort", removed);
+		};
+		listeners.push([signal, listener]);
+		signal.addEventListener("abort", listener, { once: true });
+	}
+	return controller.signal;
+}
+function assertUrl(url) {
+	if (url.protocol !== "https:" && url.protocol !== "http:" || url.username || url.password) throw new TypeError("Invalid request URL");
+	return url;
+}
+function assertInput(input) {
+	for (const char of input) {
+		const code = char.charCodeAt(0);
+		if (code <= 32 || code === 127) throw new TypeError("Invalid request URL");
+	}
+}
+function assertRelativePath(path) {
+	const pathname = path.split("?", 1)[0];
+	if (path.includes("#") || pathname.includes("\\") || pathname.split("/").some((segment) => DOT_SEGMENT_RE.test(segment))) throw new TypeError(`Unsafe request path ${JSON.stringify(path)}; check the refs passed to the provider`);
+	return path;
+}
+function sleep(ms, signal) {
+	return new Promise((resolve, reject) => {
+		if (signal?.aborted) {
+			reject(signal.reason);
+			return;
+		}
+		const timer = setTimeout(() => {
+			signal?.removeEventListener("abort", onAbort);
+			resolve();
+		}, ms);
+		function onAbort() {
+			clearTimeout(timer);
+			reject(signal.reason);
+		}
+		signal?.addEventListener("abort", onAbort, { once: true });
+	});
+}
+/** Settles as `promise` does, or rejects with the signal's reason once it aborts, leaving `promise` running. */
+function abortable(promise, signal) {
+	if (!signal) return promise;
+	if (signal.aborted) return Promise.reject(signal.reason);
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(signal.reason);
+		signal.addEventListener("abort", onAbort, { once: true });
+		promise.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
+	});
+}
+/**
+* Creates a fetcher for one forge API.
+* @param options The base URL and the credentials, timeout and error context of every request.
+*/
+function createFetcher(options) {
+	const timeout = options.timeout ?? 3e4;
+	const doFetch = options.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	assertInput(options.baseUrl);
+	const base = assertUrl(new URL(options.baseUrl));
+	if (base.search || base.hash) throw new TypeError("Invalid API base URL");
+	base.pathname = `${base.pathname.replace(/\/$/, "")}/`;
+	const baseOrigin = base.origin;
+	function resolve(path, query) {
+		assertInput(path);
+		let url;
+		try {
+			url = new URL(path);
+		} catch {
+			if (path.startsWith("//") || path.split("/", 1)[0].includes(":")) throw new TypeError("Invalid request URL");
+		}
+		url = assertUrl(url ?? new URL(assertRelativePath(path).replace(/^\//, ""), base));
+		for (const [key, value] of Object.entries(query ?? {})) if (value !== void 0) url.searchParams.set(key, String(value));
+		return url.toString();
+	}
+	function withDefaultQuery(url) {
+		if (!options.query) return url;
+		const target = new URL(url);
+		for (const [key, value] of Object.entries(options.query)) if (!target.searchParams.has(key)) target.searchParams.set(key, value);
+		return target.toString();
+	}
+	async function send(url, options_, attempt, authenticated = true, download = false, redirects = 0, streaming = false, follow = false) {
+		const target = assertUrl(new URL(url));
+		const trusted = authenticated && target.origin === baseOrigin;
+		const controller = streaming ? new AbortController() : void 0;
+		const timer = controller ? setTimeout(() => controller.abort(new DOMException("Request timed out", "TimeoutError")), timeout) : void 0;
+		const signals = [controller?.signal ?? AbortSignal.timeout(timeout)];
+		if (options_.signal) signals.push(options_.signal);
+		const headers = new Headers(trusted ? options.headers : void 0);
+		for (const [key, value] of Object.entries(trusted ? await (options.authHeaders?.() ?? {}) : {})) headers.set(key, value);
+		for (const [key, value] of new Headers(options_.headers)) headers.set(key, value);
+		if (options_.etag) headers.set("if-none-match", options_.etag);
+		const { json: payload, mapError: _mapError, ...init } = options_;
+		if (payload !== void 0) headers.set("content-type", "application/json");
+		let response;
+		try {
+			response = await doFetch(trusted ? withDefaultQuery(url) : url, {
+				...init,
+				redirect: follow ? "follow" : "manual",
+				credentials: trusted ? init.credentials : "omit",
+				headers,
+				body: payload === void 0 ? init.body : JSON.stringify(payload),
+				signal: anySignal(signals)
+			});
+		} catch (cause) {
+			if (options_.signal?.aborted) throw options_.signal.reason ?? cause;
+			if (cause instanceof Error && (cause.name === "TimeoutError" || cause.name === "AbortError")) throw new ForgeTimeoutError(`Request to ${url} timed out after ${timeout}ms`, timeout, {
+				...options.context,
+				url,
+				method: options_.method ?? "GET"
+			}, { cause });
+			throw new ForgeNetworkError(`Request to ${url} failed: ${cause instanceof Error ? cause.message : String(cause)}`, {
+				...options.context,
+				url,
+				method: options_.method ?? "GET"
+			}, { cause });
+		} finally {
+			clearTimeout(timer);
+		}
+		if (response.type === "opaqueredirect" && options_.redirect !== "manual") {
+			const method = (options_.method ?? "GET").toUpperCase();
+			if (options_.redirect === "error" || method !== "GET" && method !== "HEAD") throw new TypeError("Hidden redirect refused");
+			return send(url, options_, attempt, authenticated, download, redirects, streaming, true);
+		}
+		if (follow && response.redirected && response.url) {
+			const final = assertUrl(new URL(response.url));
+			if (final.origin !== target.origin && !download || target.protocol === "https:" && final.protocol !== "https:") {
+				await response.body?.cancel();
+				throw new TypeError("Unsafe request redirect");
+			}
+		}
+		const location = REDIRECT_STATUSES.has(response.status) ? response.headers.get("location") : null;
+		if (location && options_.redirect !== "manual") {
+			await response.body?.cancel();
+			if (options_.redirect === "error" || redirects >= 20) throw new TypeError("Request redirect refused");
+			assertInput(location);
+			const next = assertUrl(new URL(location, target));
+			const sameOrigin = next.origin === target.origin;
+			if (!sameOrigin && !download || target.protocol === "https:" && next.protocol !== "https:") throw new TypeError("Unsafe request redirect");
+			const method = (options_.method ?? "GET").toUpperCase();
+			if (!sameOrigin && method !== "GET" && method !== "HEAD") throw new TypeError("Unsafe request redirect");
+			let nextOptions = options_;
+			if (!sameOrigin) nextOptions = {
+				method,
+				signal: options_.signal,
+				credentials: "omit"
+			};
+			else if (response.status === 303 && method !== "HEAD" || (response.status === 301 || response.status === 302) && method === "POST") {
+				const nextHeaders = new Headers(options_.headers);
+				for (const name of [
+					"content-type",
+					"content-length",
+					"content-encoding",
+					"content-language",
+					"content-location"
+				]) nextHeaders.delete(name);
+				nextOptions = {
+					...options_,
+					method: "GET",
+					body: void 0,
+					json: void 0,
+					headers: nextHeaders
+				};
+			}
+			return send(next.toString(), nextOptions, attempt, authenticated && sameOrigin, download, redirects + 1, streaming);
+		}
+		if (response.ok || response.status === 304 || options_.redirect === "manual" && (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400)) return response;
+		const body = (await response.text()).slice(0, BODY_EXCERPT_LENGTH);
+		const context = {
+			...options.context,
+			url,
+			method: options_.method ?? "GET"
+		};
+		const credentialed = trusted && options.authenticated || headers.has("authorization");
+		if (response.status === 401) throw credentialed ? new TokenRevokedError("Credentials were rejected by the forge", 401, body, context) : new AuthenticationRequiredError("Credentials are required for this request", 401, body, context);
+		if (response.status === 403 && !credentialed && headerNumber(response, "x-ratelimit-limit", "ratelimit-limit") === 0) throw new AuthenticationRequiredError("Credentials are required for this request", 403, body, context);
+		if (response.status === 404) throw new NotFoundError(`Nothing found at ${options_.method ?? "GET"} ${url}, or the credential cannot see it`, 404, body, context);
+		if (isRateLimited(response) || response.status === 403 && !rateLimitOf(response) && PLAIN_RATE_LIMIT_RE.test(body.trim())) {
+			const secondary = response.status === 403 || response.headers.has("retry-after");
+			const wait = retryAfterMs(response);
+			if (secondary && attempt === 0 && wait !== void 0 && wait <= 6e4) {
+				options.onRetry?.({
+					url,
+					method: options_.method ?? "GET",
+					wait
+				});
+				await sleep(wait, options_.signal);
+				return send(url, options_, attempt + 1, authenticated, download, redirects, streaming, follow);
+			}
+			throw new RateLimitedError("Rate limited by the forge", response.status, body, {
+				...context,
+				resetAt: rateLimitReset(response),
+				secondary
+			});
+		}
+		if (response.status === 403) {
+			const accepted = response.headers.get("x-accepted-oauth-scopes");
+			const held = response.headers.get("x-oauth-scopes");
+			const forbidden = accepted !== null && accepted !== "" && !accepted.split(",").some((scope) => (held ?? "").split(",").map((value) => value.trim()).includes(scope.trim())) ? void 0 : forbiddenReason(body);
+			if (!forbidden) throw new InsufficientScopeError("Credentials lack the scope or permission for this request", 403, body, context);
+			throw new ForbiddenError(`Forge refused the request (${forbidden.reason})`, 403, body, forbidden.reason, {
+				...context,
+				reasonRaw: forbidden.reasonRaw
+			});
+		}
+		throw new ForgeApiError(`Forge responded with ${response.status} for ${options_.method ?? "GET"} ${url}`, response.status, body, context);
+	}
+	async function raw(path, options_ = {}) {
+		try {
+			return await send(resolve(path, options_.query), options_, 0);
+		} catch (error) {
+			throw options_.mapError ? options_.mapError(error) : error;
+		}
+	}
+	async function json(path, options_ = {}) {
+		const response = await raw(path, options_);
+		if (response.status === 304 || response.status === 204) return {
+			data: void 0,
+			response,
+			notModified: response.status === 304,
+			cursor: cursorFrom(response)
+		};
+		const text = await response.text();
+		return {
+			data: text ? parseJson(text) : void 0,
+			response,
+			notModified: false,
+			cursor: cursorFrom(response)
+		};
+	}
+	async function page(path, options_ = {}) {
+		const { select, cursor, ...requestOptions } = options_;
+		const initial = resolve(path, requestOptions.query);
+		const url = cursor?.nextUrl ? resolve(cursor.nextUrl) : initial;
+		if (new URL(url).origin !== new URL(initial).origin) throw new TypeError("Pagination URL must remain on the requested origin");
+		const result = await json(url, {
+			...requestOptions,
+			etag: cursor?.nextUrl ? void 0 : requestOptions.etag,
+			query: void 0
+		});
+		const next = result.notModified ? void 0 : select ? select(result.data, result.cursor?.nextUrl) : void 0;
+		if (!next) return {
+			...result,
+			data: result.data ?? [],
+			cursor: result.cursor?.nextUrl ? result.cursor : void 0
+		};
+		return {
+			...result,
+			data: next.items,
+			cursor: next.next ? {
+				...result.cursor,
+				nextUrl: next.next
+			} : void 0
+		};
+	}
+	async function* items(path, options_ = {}) {
+		let cursor;
+		do {
+			const result = await page(path, {
+				...options_,
+				cursor
+			});
+			yield* result.data ?? [];
+			cursor = result.notModified ? void 0 : result.cursor;
+		} while (cursor?.nextUrl);
+	}
+	async function stream(path, options_ = {}) {
+		try {
+			const response = await send(resolve(path, options_.query), options_, 0, true, true, 0, true);
+			return {
+				status: response.status,
+				headers: response.headers,
+				body: response.body ?? emptyStream()
+			};
+		} catch (error) {
+			throw options_.mapError ? options_.mapError(error) : error;
+		}
+	}
+	return {
+		raw,
+		stream,
+		json,
+		page,
+		items,
+		resolve
+	};
+}
+const LONG_NUMBER_RE = /\d{16}/;
+const INTEGER_RE = /^-?\d+$/;
+/**
+* Parses JSON, keeping integers beyond `Number.MAX_SAFE_INTEGER` (such as
+* GitHub webhook delivery ids) as their exact digits, where the runtime gives
+* the reviver the source text.
+*/
+function parseJson(text) {
+	if (!LONG_NUMBER_RE.test(text)) return JSON.parse(text);
+	return JSON.parse(text, (_key, value, context) => typeof value === "number" && !Number.isSafeInteger(value) && context?.source && INTEGER_RE.test(context.source) ? context.source : value);
+}
+function emptyStream() {
+	return new Blob([]).stream();
+}
+const SAFE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
+/**
+* Builds a provider's `request()` escape hatch on top of its fetcher.
+* @param fetcher The fetcher to send requests with.
+* @param createOptions Where to reject writes, for a read-only provider.
+*/
+function createRequest(fetcher, createOptions = {}) {
+	const { readOnly } = createOptions;
+	return (async (method, path, options = {}) => {
+		const upperMethod = method.toUpperCase();
+		if (readOnly && (options.mutates ?? !SAFE_METHODS.has(upperMethod))) throw readOnly(upperMethod, path);
+		const json = options.body !== void 0 && isJsonBody(options.body);
+		const init = {
+			method: upperMethod,
+			query: options.query,
+			signal: options.signal,
+			headers: {
+				...json ? { "content-type": "application/json" } : {},
+				...options.headers
+			},
+			body: options.body === void 0 ? void 0 : json ? JSON.stringify(options.body) : options.body
+		};
+		if ("raw" in options && options.raw) return fetcher.stream(path, init);
+		const result = await fetcher.json(path, init);
+		const rateLimit = rateLimitOf(result.response);
+		return {
+			status: result.response.status,
+			data: result.data,
+			headers: result.response.headers,
+			...rateLimit ? { rateLimit } : {}
+		};
+	});
+}
+function isJsonBody(value) {
+	return typeof value !== "string" && !(value instanceof ArrayBuffer) && !ArrayBuffer.isView(value) && !(typeof Blob !== "undefined" && value instanceof Blob) && !(typeof FormData !== "undefined" && value instanceof FormData) && !(value instanceof URLSearchParams) && !(typeof ReadableStream !== "undefined" && value instanceof ReadableStream);
+}
+//#endregion
+//#region src/model.ts
+/** Every name {@link ReactionContent} covers. */
+const REACTION_CONTENTS = [
+	"+1",
+	"-1",
+	"laugh",
+	"confused",
+	"heart",
+	"hooray",
+	"rocket",
+	"eyes"
+];
+/** The normalised name for a forge-native reaction name, or `'other'` where there is none. */
+function reactionContent(raw) {
+	return REACTION_CONTENTS.includes(raw) ? raw : "other";
+}
+/**
+* The hidden marker `threads.upsertComment()` writes into a comment body to
+* find it again. It renders as nothing on every forge that renders Markdown
+* as HTML.
+*/
+function commentMarker(key) {
+	const end = ["-->", "--!>"].find((token) => key.includes(token));
+	if (end) throw new TypeError(`Comment key ${JSON.stringify(key)} contains \`${end}\`, which would end the hidden marker early`);
+	return `<!-- forges:key=${key} -->`;
+}
+/** Whether `body` carries the marker for `key`. */
+function hasCommentMarker(body, key) {
+	return body.includes(commentMarker(key));
+}
+const CASE_INSENSITIVE = /* @__PURE__ */ new Set([
+	"github",
+	"gitlab",
+	"forgejo",
+	"gitea",
+	"bitbucket",
+	"gitee",
+	"azure-devops"
+]);
+/** Whether `forge` treats owner and repository names case-insensitively. Unknown forges are assumed not to. */
+function namesAreCaseInsensitive(forge) {
+	return CASE_INSENSITIVE.has(forge);
+}
+/** `repo` with `owner` and `name` lowercased where the forge ignores case, so equal repositories compare equal. */
+function normaliseRepoName(repo) {
+	return namesAreCaseInsensitive(repo.forge) ? {
+		...repo,
+		owner: repo.owner.toLowerCase(),
+		name: repo.name.toLowerCase()
+	} : repo;
+}
+/** Whether `ref` addresses an organisation, group or workspace rather than a repository. */
+function isNamespaceRef(ref) {
+	return ref.kind === "namespace" || !ref.name;
+}
+/**
+* Stable identity key for a repository: by `externalId` when known, so renames
+* and transfers keep the key, otherwise by path, lowercased on forges that
+* ignore case. A hand-built ref without `externalId` therefore keys
+* differently from the same repo as a provider returns it.
+*/
+function repoKey(repo) {
+	if (repo.externalId) return `${repo.forge}:${repo.instance}/@${repo.kind === "namespace" ? "namespace:" : ""}${repo.externalId}`;
+	const { owner, name } = normaliseRepoName(repo);
+	return repo.kind === "namespace" ? `${repo.forge}:${repo.instance}/${owner}/` : `${repo.forge}:${repo.instance}/${owner}/${name}`;
+}
+/**
+* Reads a {@link repoKey} back. Keys built from an `externalId` carry no path,
+* so `owner` and `name` are empty on those.
+*/
+function parseRepoKey(key) {
+	const colon = key.indexOf(":");
+	const slash = key.indexOf("/", colon + 1);
+	if (colon <= 0 || slash <= colon + 1) return;
+	const origin = {
+		forge: key.slice(0, colon),
+		instance: key.slice(colon + 1, slash)
+	};
+	const path = key.slice(slash + 1);
+	if (path.startsWith("@")) {
+		const namespace = path.startsWith("@namespace:");
+		const externalId = path.slice(namespace ? 11 : 1);
+		return externalId ? {
+			...origin,
+			owner: "",
+			name: "",
+			externalId,
+			...namespace ? { kind: "namespace" } : {}
+		} : void 0;
+	}
+	if (path.endsWith("/")) return path.length > 1 ? {
+		...origin,
+		owner: path.slice(0, -1),
+		name: "",
+		kind: "namespace"
+	} : void 0;
+	const last = path.lastIndexOf("/");
+	return last > 0 && last < path.length - 1 ? {
+		...origin,
+		owner: path.slice(0, last),
+		name: path.slice(last + 1)
+	} : void 0;
+}
+/** The `owner/name` people read and type; the owner alone for a namespace. */
+function repoSlug(repo) {
+	return repo.kind === "namespace" ? repo.owner : `${repo.owner}/${repo.name}`;
+}
+/** Whether a thread ref has a number, so that it is a `ResolvedThreadRef`. */
+function isResolvedThread(thread) {
+	return typeof thread.number === "string" && thread.number !== "";
+}
+/**
+* Stable identity key for a thread. `'other'` threads are keyed by their
+* forge-native type so unrelated subjects with the same id never collide.
+*/
+function threadKey(thread) {
+	const kind = thread.kind === "other" ? `other:${thread.typeRaw ?? "unknown"}` : thread.kind;
+	return `${repoKey(thread.repo)}#${kind}/${thread.number}`;
+}
+/** A string that identifies a notification, for use as a key in a map or a store. */
+function notificationKey(ref) {
+	return `${ref.forge}:${ref.instance}:notification/${ref.id}`;
+}
+const THREAD_KINDS = /* @__PURE__ */ new Set([
+	"issue",
+	"pull_request",
+	"discussion",
+	"commit"
+]);
+/** Reads a {@link threadKey} back. */
+function parseThreadKey(key) {
+	const hash = key.indexOf("#");
+	const repo = hash > 0 ? parseRepoKey(key.slice(0, hash)) : void 0;
+	const rest = key.slice(hash + 1);
+	const slash = rest.indexOf("/");
+	if (!repo || slash <= 0 || slash === rest.length - 1) return;
+	const kindText = rest.slice(0, slash);
+	const number = rest.slice(slash + 1);
+	const origin = {
+		forge: repo.forge,
+		instance: repo.instance
+	};
+	if (kindText.startsWith("other:")) return {
+		...origin,
+		repo,
+		kind: "other",
+		typeRaw: kindText.slice(6),
+		number
+	};
+	return THREAD_KINDS.has(kindText) ? {
+		...origin,
+		repo,
+		kind: kindText,
+		number
+	} : void 0;
+}
+/** Reads a {@link notificationKey} back. */
+function parseNotificationKey(key) {
+	const marker = key.indexOf(":notification/");
+	const colon = key.indexOf(":");
+	if (colon <= 0 || marker <= colon) return;
+	const id = key.slice(marker + 14);
+	return id ? {
+		forge: key.slice(0, colon),
+		instance: key.slice(colon + 1, marker),
+		id
+	} : void 0;
+}
+/** `acme/widgets#42`, or `acme/widgets@abc1234` for a commit; uses the display number where the forge has one. */
+function threadSlug(ref) {
+	const number = ref.displayNumber ?? ref.number ?? "?";
+	return ref.kind === "commit" ? `${repoSlug(ref.repo)}@${number.slice(0, 7)}` : `${repoSlug(ref.repo)}#${number}`;
+}
+/** The thread a notification concerns, or `undefined` for repo, actor and other subjects. */
+function notificationThread(notification) {
+	return notification.subject.type === "thread" ? notification.subject.thread : void 0;
+}
+/** Every `Date` field in the model, by name. */
+const DATE_FIELDS = /* @__PURE__ */ new Set([
+	"closedAt",
+	"completedAt",
+	"createdAt",
+	"date",
+	"deliveredAt",
+	"dismissedAt",
+	"dueOn",
+	"expiresAt",
+	"lastActivityAt",
+	"lastReadAt",
+	"occurredAt",
+	"publishedAt",
+	"pushedAt",
+	"resetAt",
+	"startedAt",
+	"submittedAt",
+	"updatedAt"
+]);
+const UNNORMALISED_FIELDS = /* @__PURE__ */ new Set(["payload", "raw"]);
+/**
+* Turns the ISO strings `JSON.stringify` left in a model value back into
+* `Date`s, at any depth, for every field in {@link DATE_FIELDS}, skipping
+* `raw` and `payload`. Returns a copy.
+*/
+function reviveDates(value) {
+	if (Array.isArray(value)) return value.map((item) => reviveDates(item));
+	if (!value || typeof value !== "object" || value instanceof Date) return value;
+	return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, reviveField(key, item)]));
+}
+function reviveField(key, item) {
+	if (UNNORMALISED_FIELDS.has(key)) return item;
+	if (DATE_FIELDS.has(key) && typeof item === "string" && !Number.isNaN(Date.parse(item))) return new Date(item);
+	return reviveDates(item);
+}
+//#endregion
+//#region src/supports.ts
+/** Where each verb's support lives in {@link ForgeCapabilities}, from {@link CAPABILITY_TABLE}. */
+const VERBS = new Map(CAPABILITY_TABLE.flatMap((entry) => (entry.verbs ?? []).map((verb) => [verb, entry.capability])));
+/**
+* Whether `verb` is supported according to `capabilities`, for `kind` where
+* support differs by thread kind (or by alert kind for `securityAlerts`).
+* Without `kind`, a per-kind verb counts as supported when any kind is.
+* @param capabilities The capabilities of a provider, such as `provider.capabilities`.
+* @param verb The operation, named by its path on the provider, such as `threads.comment`.
+* @param kind The thread or alert kind, for an operation whose support differs by kind.
+* @example
+* ```ts
+* if (supports(provider.capabilities, 'threads.merge')) {
+*   await provider.threads.merge(ref)
+* }
+* ```
+*/
+function supports(capabilities, verb, kind) {
+	return supportOf(capabilities, verb, kind) !== false;
+}
+/** Levels from strongest to weakest, as the capability matrix ranks them. */
+const LEVELS = [
+	true,
+	"experimental",
+	"emulated",
+	"unverified"
+];
+/**
+* How well `verb` is supported according to `capabilities`: `true`,
+* `'experimental'`, `'emulated'`, `'unverified'` or `false`, for `kind` where support differs
+* by thread kind (or by alert kind for `securityAlerts`). Without `kind`, a
+* per-kind verb reports its strongest level across kinds.
+* @param capabilities The capabilities of a provider, such as `provider.capabilities`.
+* @param verb The operation, named by its path on the provider, such as `threads.comment`.
+* @param kind The thread or alert kind, for an operation whose support differs by kind.
+*/
+function supportOf(capabilities, verb, kind) {
+	const support = capabilityOf(capabilities, verb);
+	if (typeof support !== "object") return support;
+	if (kind) return support[kind] ?? false;
+	const levels = Object.values(support);
+	return LEVELS.find((level) => levels.includes(level)) ?? false;
+}
+/** The capability entry behind `verb`: one support level, or one per kind. */
+function capabilityOf(capabilities, verb) {
+	const capability = VERBS.get(verb);
+	if (!capability) throw new TypeError(`Unknown verb ${JSON.stringify(verb)}; verbs are named by their path on the provider, such as 'threads.comment'`);
+	return capability.split(".").reduce((value, key) => value[key], capabilities);
+}
+//#endregion
+//#region src/utils.ts
+/**
+* Wraps a generator so warnings it reports are collected on the returned
+* iterable rather than interrupting iteration.
+*/
+function forgeIterable(run) {
+	const warnings = [];
+	return {
+		warnings,
+		[Symbol.asyncIterator]: () => run((warning) => warnings.push(warning))[Symbol.asyncIterator]()
+	};
+}
+/** Drives a `page()` function until it reports no further cursor, collecting page warnings. */
+function iteratePages(page, options = {}) {
+	return forgeIterable(async function* (warn) {
+		let cursor = options.cursor;
+		while (true) {
+			const result = await page({
+				...options,
+				cursor
+			});
+			result.warnings?.forEach(warn);
+			yield* result.items;
+			if (!result.cursor?.nextUrl && !result.cursor?.token || result.notModified) return;
+			cursor = result.cursor;
+		}
+	});
+}
+/** Turns a caught error into a serialisable warning. */
+function toWarning(code, error, subject) {
+	const err = error instanceof Error ? error : new Error(String(error));
+	return {
+		code,
+		message: err.message,
+		subject,
+		cause: {
+			name: err.name,
+			message: err.message,
+			status: err instanceof ForgeApiError ? err.status : void 0
+		}
+	};
+}
+/** Whether a failed side read may become a warning; rate limits, revoked tokens and errors from outside forges still stop the read. */
+function degradesToWarning(error) {
+	return error instanceof ForgeError && !(error instanceof RateLimitedError) && !(error instanceof TokenRevokedError);
+}
+/** Maps with at most `limit` calls in flight, preserving order. */
+async function mapConcurrent(items, limit, fn) {
+	const results = Array.from({ length: items.length });
+	let next = 0;
+	await Promise.all(Array.from({ length: Math.min(limit, items.length) }, async () => {
+		while (next < items.length) {
+			const index = next++;
+			results[index] = await fn(items[index]);
+		}
+	}));
+	return results;
+}
+/** `threads.getMany` for forges without a batch endpoint. */
+function getManyConcurrently(refs, get, options = {}) {
+	return mapConcurrent(refs, 4, (ref) => get(ref, options).then((thread) => ({
+		ok: true,
+		ref,
+		thread
+	}), (error) => {
+		if (options.signal?.aborted) throw options.signal.reason;
+		return {
+			ok: false,
+			ref,
+			warning: toWarning(error instanceof UnresolvedThreadError ? "thread_unresolved" : "thread_unreadable", error, ref.number)
+		};
+	}));
+}
+/** Compares dotted numeric versions, ignoring any suffix after the numbers. */
+function versionAtLeast(version, minimum) {
+	if (!version) return false;
+	const parts = (value) => (/^\D*(\d+(?:\.\d+)*)/.exec(value)?.[1] ?? "0").split(".").map(Number);
+	const [a, b] = [parts(version), parts(minimum)];
+	for (let index = 0; index < Math.max(a.length, b.length); index++) {
+		const difference = (a[index] ?? 0) - (b[index] ?? 0);
+		if (difference !== 0) return difference > 0;
+	}
+	return true;
+}
+/** Reads a timestamp from a forge response, or `undefined` when it is empty or not a date. */
+function toDate(value) {
+	if (value === null || value === void 0 || value === "") return;
+	const date = new Date(value);
+	return Number.isNaN(date.getTime()) ? void 0 : date;
+}
+/** The host of `baseUrl`, including the port when there is one. */
+function hostOf(baseUrl) {
+	return new URL(baseUrl).host;
+}
+/** Narrows a ref to one a provider can address, or throws {@link UnresolvedThreadError}. */
+function requireThread(ref, context) {
+	if (ref.kind === "other" || !isResolvedThread(ref)) throw new UnresolvedThreadError(ref.kind === "other" ? `${ref.typeRaw ?? "This"} subject has no thread API` : "Thread ref has no number; resolve it before calling the forge", context ?? {
+		forge: ref.forge,
+		instance: ref.instance
+	});
+	return ref;
+}
+/**
+* Narrows a ref to an issue or pull request, or throws
+* {@link UnsupportedOperationError} naming the verb that needs one.
+*/
+function requireIssueOrPull(ref, context, verb) {
+	const thread = requireThread(ref, context);
+	if (thread.kind !== "issue" && thread.kind !== "pull_request") throw new UnsupportedOperationError(`${context.forge ?? "This forge"} cannot ${verb} a ${thread.kind}`, context);
+	return thread;
+}
+/** The token in `auth`, read again on every call when it is a function. */
+async function resolveToken(auth) {
+	return typeof auth.token === "function" ? await auth.token() : auth.token;
+}
+/**
+* The forge-native id `threads.setMilestone` sends: the milestone's `id`, a
+* string of digits as it is, or the id of the milestone with that title.
+*/
+async function milestoneId(milestone, page, context, options = {}) {
+	const value = typeof milestone === "string" ? milestone : milestone.id;
+	if (/^\d+$/.test(value)) return Number(value);
+	for await (const candidate of iteratePages(page, {
+		state: "all",
+		signal: options.signal
+	})) if (candidate.title === value) return Number(candidate.id);
+	throw new UnsupportedOperationError(`No milestone titled ${value}`, context);
+}
+/** Joins the merge commit title and message for a forge that takes them as one string. */
+function mergeCommitMessage({ title, message }) {
+	return title && message ? `${title}\n\n${message}` : title || message;
+}
+/** A login from either a login string or an actor. */
+function actorLogin(actor) {
+	return typeof actor === "string" ? actor : actor.login;
+}
+/** Maps one fetched page into a {@link Page}. The cursor is kept only when there is a next page. */
+function toPage(result, map, warnings) {
+	return {
+		items: (result.data ?? []).flatMap((raw) => {
+			const item = map(raw);
+			return item === void 0 ? [] : [item];
+		}),
+		cursor: result.cursor?.nextUrl || result.cursor?.token ? result.cursor : void 0,
+		notModified: result.notModified || void 0,
+		...warnings?.length ? { warnings } : {},
+		...rateLimitPart(result.response)
+	};
+}
+/** Builds a {@link Listing} for a forge that names its page-size parameter `pageParam`. */
+function createListing(fetcher, pageParam, defaultPerPage) {
+	return async (path, options, map, { warnings, query, ...extras } = {}) => toPage(await fetcher.page(path, {
+		...extras,
+		query: {
+			...query,
+			[pageParam]: options.perPage ?? defaultPerPage
+		},
+		cursor: options.cursor,
+		signal: options.signal
+	}), map, warnings);
+}
+function rateLimitPart(response) {
+	const rateLimit = response && rateLimitOf(response);
+	return rateLimit ? { rateLimit } : {};
+}
+/**
+* Chains listings that a forge serves from separate endpoints. The cursor
+* `token` records which phase is next, ahead of the phase's own token.
+*/
+async function phased(phases, cursor) {
+	const match = /^(\d+):(.*)$/s.exec(cursor?.token ?? "");
+	const index = match ? Number(match[1]) : 0;
+	const inner = cursor && (cursor.nextUrl || match?.[2]) ? {
+		...cursor,
+		token: match?.[2] || void 0
+	} : void 0;
+	const page = await phases[index](inner);
+	if (page.cursor) return {
+		...page,
+		cursor: {
+			...page.cursor,
+			token: `${index}:${page.cursor.token ?? ""}`
+		}
+	};
+	return index + 1 < phases.length ? {
+		...page,
+		cursor: { token: `${index + 1}:` }
+	} : page;
+}
+/** Whether `labels` include every name in `wanted`; true when nothing is wanted. */
+function hasEveryLabel(labels, wanted) {
+	return !wanted?.length || wanted.every((name) => labels?.some((label) => label.name === name));
+}
+/** Any failure fails, else any pending is pending, else any unknown (or none at all) is unknown, else success. */
+function summariseChecks(states, url) {
+	const failed = states.filter((state) => state === "failure").length;
+	return {
+		state: failed ? "failure" : states.includes("pending") ? "pending" : !states.length || states.includes("unknown") ? "unknown" : "success",
+		total: states.length,
+		failed,
+		...url ? { url } : {}
+	};
+}
+const FAILED_CONCLUSIONS = /* @__PURE__ */ new Set([
+	"failure",
+	"timed_out",
+	"cancelled",
+	"action_required",
+	"startup_failure"
+]);
+/**
+* State of a check run reported as a status plus a conclusion once completed.
+* Cancelled, timed-out, action-required and startup failures count as
+* failures; skipped and neutral runs as neutral.
+*/
+function checkRunState(status, conclusion) {
+	if (status !== "completed") return "pending";
+	if (conclusion === "success") return "success";
+	if (conclusion && FAILED_CONCLUSIONS.has(conclusion)) return "failure";
+	return conclusion === "neutral" || conclusion === "skipped" ? "neutral" : "unknown";
+}
+/** Maps a forge's own file-change word onto {@link FileStatus}; unknown words become `'changed'`. */
+function toFileStatus(raw) {
+	switch (raw?.toLowerCase()) {
+		case "added":
+		case "new":
+		case "add": return "added";
+		case "removed":
+		case "deleted":
+		case "remove": return "removed";
+		case "renamed":
+		case "rename": return "renamed";
+		case "copied":
+		case "copy": return "copied";
+		case "modified":
+		case "edit":
+		case "change": return "modified";
+		default: return "changed";
+	}
+}
+/**
+* Caches the result of `load` after its first call. A rejected load is
+* forgotten so the next call retries; with `ttl` (milliseconds) a resolved
+* value is reloaded once it is older than that.
+*/
+function memo(load, ttl) {
+	let cached;
+	return () => {
+		if (!cached || ttl !== void 0 && Date.now() - cached.at > ttl) {
+			const promise = load();
+			cached = {
+				promise,
+				at: Date.now()
+			};
+			promise.catch(() => {
+				if (cached?.promise === promise) cached = void 0;
+			});
+		}
+		return cached.promise;
+	};
+}
+/** {@link memo} per key. */
+function memoBy(load) {
+	const cache = /* @__PURE__ */ new Map();
+	return (key) => {
+		let entry = cache.get(key);
+		if (!entry) {
+			entry = memo(() => load(key));
+			cache.set(key, entry);
+		}
+		return entry();
+	};
+}
+/**
+* A review standing in for an approval, vote or participant state on a forge
+* that has no review objects. `comments` is `false` because there is nothing
+* to hang inline comments on.
+*/
+function syntheticReview(thread, id, state, extras) {
+	const { author, stateRaw, submittedAt, raw } = extras;
+	return {
+		ref: {
+			forge: thread.forge,
+			instance: thread.instance,
+			thread,
+			id
+		},
+		author,
+		state,
+		stateRaw,
+		submittedAt,
+		comments: false,
+		raw
+	};
+}
+/** A label colour as six hex digits, with the `#` prefix the forge expects. `ededed` when none is given. */
+function hexColour(colour, prefix = "") {
+	return `${prefix}${(colour ?? "ededed").replace(/^#/, "")}`;
+}
+//#endregion
+//#region src/web.ts
+function sameRepo(a, b) {
+	if (!b || a.forge !== b.forge || a.instance !== b.instance) return false;
+	const [left, right] = [normaliseRepoName(a), normaliseRepoName(b)];
+	return left.owner === right.owner && left.name === right.name;
+}
+function encodePath(path) {
+	return path.split("/").map(encodeURIComponent).join("/");
+}
+function webUrlFor(web, target) {
+	let path;
+	if ("repo" in target) path = web.repo(target.repo);
+	else if ("thread" in target) path = isResolvedThread(target.thread) ? web.thread(target.thread) : void 0;
+	else if ("comment" in target) {
+		const { comment } = target;
+		path = isResolvedThread(comment.thread) ? web.comment?.(comment) : void 0;
+	} else if ("release" in target) path = web.release?.(target.release);
+	else if ("file" in target) path = web.file?.(target.file.repo, target.file.path, target.file.at, target.file.line);
+	else path = web.compare?.(target.compare.repo, target.compare.base, target.compare.head);
+	return path === void 0 ? void 0 : `${web.origin}${path}`;
+}
+/** `ssh://user@host:port/path` or `git://host:port/path` with the host in group 1, or `user@host:path` with it in group 2; the path is group 3. */
+const CLONE_URL_RE = /^(?:(?:ssh|git):\/\/(?:[^@/]+@)?([^:/]+)(?::\d+)?\/|(?:[^@/\s]+@)?([^:/\s]+):(?!\/))(.+)$/i;
+/** The `git+` that npm's `repository` field writes before a transport scheme. */
+const GIT_PLUS_RE = /^git\+(?=[a-z]+:\/\/)/i;
+/** The npm `repository` shorthand, https://docs.npmjs.com/cli/configuring-npm/package-json#repository */
+const SHORTHAND_RE = /^(github|gitlab|bitbucket):(?!\/)/i;
+const SHORTHAND_HOSTS = {
+	github: "github.com",
+	gitlab: "gitlab.com",
+	bitbucket: "bitbucket.org"
+};
+function parseWebUrl(web, input, origin) {
+	const base = new URL(web.origin);
+	const prefix = base.pathname.replace(/\/$/, "");
+	const source = String(input).replace(GIT_PLUS_RE, "").replace(SHORTHAND_RE, (_, forge) => `https://${SHORTHAND_HOSTS[forge.toLowerCase()]}/`);
+	const clone = CLONE_URL_RE.exec(source);
+	let url;
+	try {
+		url = new URL(clone && (clone[1] ?? clone[2]).toLowerCase() === base.hostname ? `${base.origin}${prefix}/${clone[3]}` : source);
+	} catch {
+		return;
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:" || url.host !== base.host || url.username || url.password) return;
+	if (prefix && !url.pathname.startsWith(`${prefix}/`)) return;
+	let segments;
+	try {
+		segments = url.pathname.slice(prefix.length).split("/").filter(Boolean).map(decodeURIComponent);
+	} catch {
+		return;
+	}
+	return web.parse(segments, url, origin);
+}
+function referenceFor(web, ref, options = {}) {
+	if (!web || !isResolvedThread(ref)) return;
+	return web.reference?.(ref, sameRepo(ref.repo, options.from), options.expand ?? false) ?? webUrlFor(web, { thread: ref });
+}
+/** Web links for forges laid out like GitHub: `/{owner}/{name}/issues/{n}` and friends. */
+function githubShapedWeb(origin, shape) {
+	const repoPath = (repo) => `/${encodePath(repo.owner)}/${encodeURIComponent(repo.name)}`;
+	const kindPath = {
+		issue: "issues",
+		pull_request: shape.pull,
+		commit: "commit",
+		...shape.discussions ? { discussion: "discussions" } : {}
+	};
+	const kindOf = new Map(Object.entries(kindPath).map(([kind, path]) => [path, kind]));
+	const reserved = new Set(shape.reserved?.map((segment) => segment.toLowerCase()));
+	return {
+		origin,
+		repo: repoPath,
+		thread: (ref) => kindPath[ref.kind] && `${repoPath(ref.repo)}/${kindPath[ref.kind]}/${encodeURIComponent(ref.number)}`,
+		comment: (ref) => ref.thread.kind === "commit" || !kindPath[ref.thread.kind] ? void 0 : `${repoPath(ref.thread.repo)}/${kindPath[ref.thread.kind]}/${encodeURIComponent(ref.thread.number)}#${shape.commentFragment}${ref.id}`,
+		release: (ref) => ref.tag ? `${repoPath(ref.repo)}/releases/tag/${encodeURIComponent(ref.tag)}` : void 0,
+		file: (repo, path, at, line) => `${repoPath(repo)}${shape.file(at)}/${encodePath(path)}${line ? `#${shape.lineFragment(line)}` : ""}`,
+		compare: (repo, base, head) => `${repoPath(repo)}/compare/${encodeURIComponent(base)}...${encodeURIComponent(head)}`,
+		parse: (segments, url, from) => {
+			const [owner, name, section, id] = segments;
+			if (!owner || !name || reserved.has(owner.toLowerCase())) return;
+			const repo = {
+				...from,
+				owner,
+				name: name.replace(/\.git$/, "")
+			};
+			const kind = section ? kindOf.get(section) : void 0;
+			if (section === "releases" && id === "tag" && segments[4]) return {
+				repo,
+				release: {
+					...from,
+					repo,
+					id: segments[4],
+					tag: segments[4]
+				}
+			};
+			if (!kind || !id) return { repo };
+			const thread = {
+				...from,
+				repo,
+				kind,
+				number: id
+			};
+			const comment = url.hash.startsWith(`#${shape.commentFragment}`) ? url.hash.slice(shape.commentFragment.length + 1) : void 0;
+			return {
+				repo,
+				thread,
+				...comment ? { comment: {
+					...from,
+					thread,
+					id: comment
+				} } : {}
+			};
+		},
+		reference: (ref, same) => {
+			if (ref.kind === "commit") return same ? ref.number.slice(0, 7) : `${ref.repo.owner}/${ref.repo.name}@${ref.number.slice(0, 7)}`;
+			const prefix = ref.kind === "pull_request" && shape.pullPrefix ? shape.pullPrefix : "#";
+			return `${same ? "" : `${ref.repo.owner}/${ref.repo.name}`}${prefix}${ref.number}`;
+		}
+	};
+}
+/**
+* Reads `url` with whichever of `providers` serves it.
+* @param url The web URL to read.
+* @param providers The providers to ask. The first that serves the URL answers.
+*/
+function parseForgeUrl(url, providers) {
+	for (const provider of providers) {
+		const parsed = provider.parseUrl(url);
+		if (parsed) return parsed;
+	}
+}
+//#endregion
+//#region src/define.ts
+/**
+* Declares a verb whose support does not depend on the thread kind.
+* @param support How well the verb is supported.
+* @param run The function that implements the verb.
+*/
+function verb(support, run) {
+	return {
+		support,
+		run
+	};
+}
+/**
+* Declares a verb whose support depends on the thread kind.
+* @param kinds How well each thread kind is supported. Kinds that are left out are unsupported.
+* @param run The function that implements the verb.
+* @example
+* ```ts
+* const threads = {
+*   get: perKind({ issue: true, pull_request: true }, getThread),
+* }
+* ```
+*/
+function perKind(kinds, run) {
+	return {
+		kinds,
+		run
+	};
+}
+/** Iterables whose page takes only options, with no target before them. */
+const UNTARGETED = /* @__PURE__ */ new Set([
+	"repos.list",
+	"notifications.list",
+	"installations.list",
+	"search.threads",
+	"search.repos",
+	"search.commits",
+	"search.code"
+]);
+/** The thread kind a per-kind verb is called for, read from its arguments. */
+function kindOf(name, args) {
+	const first = args[0];
+	if (name === "create" || name === "listPage") return args[1]?.kind;
+	return first?.thread?.kind ?? first?.kind;
+}
+async function* completeItems(items) {
+	for await (const item of items) yield {
+		...item,
+		event: completeEvent(item.event)
+	};
+}
+function readPath(source, path) {
+	return path.split(".").reduce((value, key) => value?.[key], source);
+}
+function instanceHost(baseUrl, kind) {
+	try {
+		return hostOf(baseUrl);
+	} catch (cause) {
+		throw new TypeError(`Invalid baseUrl for ${kind}: ${JSON.stringify(baseUrl)}`, { cause });
+	}
+}
+/** Most reads spent looking for a first item when a provider's filtering empties a page. */
+const MAX_EMPTY_READS = 10;
+/**
+* Providers that cannot filter on the forge's side drop items from each page
+* they read, so a page can come back empty with a `cursor`. Reads on until the
+* page has an item, the listing ends or `MAX_EMPTY_READS` reads are spent.
+*/
+async function nonEmptyPage(read, start) {
+	let page = await read(start);
+	const warnings = page.warnings;
+	for (let reads = 1; !page.items.length && page.cursor && !page.notModified && reads < MAX_EMPTY_READS; reads++) page = await read(page.cursor);
+	if (!warnings?.length || page.warnings === warnings) return page;
+	const later = (page.warnings ?? []).filter((warning) => !warnings.some((seen) => seen.code === warning.code && seen.message === warning.message));
+	return {
+		...page,
+		warnings: [...warnings, ...later]
+	};
+}
+function createProvider(definition, givenOptions, givenState) {
+	const givenAuth = givenOptions.auth;
+	const anonymous = Boolean(definition.anonymous) && (!givenAuth || givenAuth.type === "anonymous");
+	const options = anonymous && !givenAuth ? {
+		...givenOptions,
+		auth: { type: "anonymous" }
+	} : givenOptions;
+	const root = (options.baseUrl ?? definition.baseUrl).replace(/\/$/, "");
+	const baseUrl = definition.apiPath && !root.endsWith(definition.apiPath) ? `${root}${definition.apiPath}` : root;
+	const host = instanceHost(baseUrl, definition.forge);
+	const instance = options.instance ?? definition.instance?.(host) ?? host;
+	const origin = {
+		forge: definition.forge,
+		instance
+	};
+	const browser = "document" in globalThis || "WorkerGlobalScope" in globalThis;
+	const userAgent = options.userAgent ?? (browser ? void 0 : "forges");
+	const headers = {
+		...definition.headers,
+		...userAgent ? { "user-agent": userAgent } : {}
+	};
+	const prepared = {
+		options,
+		forge: definition.forge,
+		instance,
+		baseUrl,
+		headers,
+		origin,
+		state: givenState
+	};
+	const state = definition.prepare ? definition.prepare(prepared) : givenState;
+	const base = {
+		...prepared,
+		state
+	};
+	const makeFetcher = (overrides) => createFetcher({
+		fetch: options.fetch,
+		timeout: options.timeout,
+		onRetry: options.onRetry,
+		headers,
+		query: definition.query,
+		context: origin,
+		...overrides
+	});
+	const fetcher = makeFetcher({
+		baseUrl,
+		authHeaders: anonymous ? void 0 : definition.authHeaders?.(base)
+	});
+	const ctx = {
+		...base,
+		fetcher,
+		createFetcher: makeFetcher,
+		derive: (derivedOptions, derivedState) => createProvider(definition, derivedOptions, derivedState ?? state)
+	};
+	const declaredSpec = definition.setup(ctx);
+	const handlers = definition.webhooks?.(ctx);
+	const spec = anonymous || options.readOnly ? restrict(declaredSpec, anonymous, definition.anonymous === "webhooks") : declaredSpec;
+	const authKind = anonymous ? "anonymous" : givenAuth?.type ?? spec.traits.authKinds[0] ?? "anonymous";
+	const env = { version: options.instanceVersion };
+	const probeVersion = spec.probeVersion && memo(spec.probeVersion);
+	const flags = {
+		experimental: Boolean(definition.experimental),
+		readOnly: Boolean(options.readOnly),
+		webhook: Boolean(handlers)
+	};
+	let capabilities = capabilitiesOf(spec, env, flags);
+	const unsupported = (verb) => options.readOnly && WRITE_VERBS.has(verb) ? new ReadOnlyError(`${verb} is a write and this ${definition.forge} provider is read-only`, origin) : new UnsupportedOperationError(`${definition.forge} does not support ${verb}`, origin);
+	/** An iterable that rejects on first read, for listings the forge does not have. */
+	const emptyIterable = (verb) => forgeIterable(async function* () {
+		throw unsupported(verb);
+	});
+	/** Support is resolved at call time, so a version gate is honoured once the version is known. */
+	function gate(verb, support, run) {
+		return (...args) => run && resolve(support, env) ? run(...args) : Promise.reject(unsupported(verb));
+	}
+	/** A per-kind verb: rejects for kinds it does not support, or entirely when undeclared. */
+	function kindGate(verb, kinds, run) {
+		const name = verb.slice(verb.indexOf(".") + 1);
+		return (...args) => {
+			if (!run || options.readOnly && WRITE_VERBS.has(verb)) return Promise.reject(unsupported(verb));
+			const kind = kindOf(name, args);
+			if (kind && KINDS.includes(kind) && !resolve(kinds?.[kind], env)) return Promise.reject(new UnsupportedOperationError(`${definition.forge} does not support ${verb} for a ${kind.replace("_", " ")}`, origin));
+			return run(...args);
+		};
+	}
+	const api = {};
+	const set = (verb, value) => {
+		const [group, name] = verb.split(".");
+		(api[group] ??= {})[name] = value;
+	};
+	const call = (verb) => readPath(api, verb);
+	const subscriptions = spec.threads.subscriptions;
+	const createReview = spec.threads.createReview;
+	const approve = spec.threads.approve ?? (createReview && {
+		support: createReview.support,
+		run: async (ref, body, options) => {
+			await createReview.run(ref, {
+				event: "approve",
+				body
+			}, options);
+		}
+	});
+	const declaredSubscribe = spec.sources?.subscribe;
+	const alerts = spec.securityAlerts;
+	const declaredInstallations = spec.installations;
+	const installationsSupported = () => Boolean(declaredInstallations && resolve(declaredInstallations.support, env));
+	const listThreads = kindGate("threads.listPage", spec.threads.listPage.kinds, spec.threads.listPage.run);
+	const listEvents = kindGate("threads.eventsPage", Object.fromEntries(KINDS.map((kind) => [kind, (kindEnv) => threadEventKinds(spec, kindEnv)[kind]])), spec.threads.eventsPage.run);
+	const native = spec.search?.queryRaw;
+	const search = (name) => {
+		const run = gate(`search.${name}`, spec.search?.[name]?.support, spec.search?.[name]?.run);
+		return async ({ queryRaw, ...query } = {}) => {
+			const page = await run(native ? {
+				queryRaw,
+				...query
+			} : query);
+			return !queryRaw || native || query.cursor ? page : {
+				...page,
+				warnings: [{
+					code: "filter_unsupported",
+					message: "This search has no query syntax; queryRaw was ignored"
+				}, ...page.warnings ?? []]
+			};
+		};
+	};
+	const special = {
+		"search.threadsPage": search("threadsPage"),
+		"search.reposPage": search("reposPage"),
+		"search.commitsPage": search("commitsPage"),
+		"search.codePage": search("codePage"),
+		"threads.listPage": async (repo, query = {}) => {
+			if (query.state === "merged" && query.kind && query.kind !== "pull_request") return { items: [] };
+			const run = (cursor) => listThreads(repo, {
+				...query,
+				...query.state === "merged" ? { kind: "pull_request" } : {},
+				cursor
+			});
+			return nonEmptyPage(run, query.cursor);
+		},
+		"threads.eventsPage": async (ref, listOptions) => {
+			const page = await listEvents(ref, listOptions);
+			return {
+				...page,
+				items: page.items.map(completeEvent)
+			};
+		},
+		"threads.upsertComment": kindGate("threads.upsertComment", Object.fromEntries(KINDS.map((kind) => [kind, (kindEnv) => upsertKinds(spec, kindEnv)[kind]])), upsertComment),
+		"threads.subscribe": kindGate("threads.subscribe", subscriptions?.kinds, subscriptions?.run.subscribe),
+		"threads.unsubscribe": kindGate("threads.unsubscribe", subscriptions?.kinds, subscriptions?.run.unsubscribe),
+		"threads.approve": gate("threads.approve", approve?.support, approve?.run),
+		"threads.approveAndMerge": gate("threads.approveAndMerge", (mergeEnv) => approveAndMergeSupport(spec, mergeEnv), async (ref, { body, ...mergeOptions } = {}) => {
+			await spec.threads.merge.run(ref, mergeOptions, { beforeMerge: () => call("threads.approve")(ref, body, { signal: mergeOptions.signal }) });
+		}),
+		"contents.resolveRef": (repo, ref, options) => isSha(ref) ? Promise.resolve(ref.toLowerCase()) : gate("contents.resolveRef", spec.contents?.resolveRef?.support, spec.contents?.resolveRef?.run)(repo, ref, options),
+		"webhooks.verify": handlers ? handlers.verify : () => Promise.reject(unsupported("webhooks.verify")),
+		"webhooks.ingest": async (delivery) => {
+			if (!handlers) throw unsupported("webhooks.ingest");
+			if (!await handlers.verify(delivery)) throw new WebhookVerificationError("Webhook signature verification failed", origin);
+			return (await handlers.translate(delivery)).map(completeEvent);
+		},
+		"sources.subscribe": (subscribeOptions) => declaredSubscribe && resolve(declaredSubscribe.support, env) ? completeItems(declaredSubscribe.run(subscribeOptions)) : emptyIterable("sources.subscribe"),
+		"securityAlerts.listPage": (repo, listOptions = {}) => {
+			if (!(alerts && (listOptions.kind ? resolve(alerts.kinds[listOptions.kind], env) : ALERT_KINDS.some((kind) => resolve(alerts.kinds[kind], env))))) return Promise.reject(listOptions.kind ? new UnsupportedOperationError(`${definition.forge} cannot list ${listOptions.kind.replace("_", " ")} alerts`, origin) : unsupported("securityAlerts.list"));
+			return alerts.listPage(repo, listOptions);
+		},
+		"installations.provider": (installation) => {
+			if (!installationsSupported()) throw unsupported("installations.provider");
+			return declaredInstallations.run.provider(installation);
+		},
+		"installations.providers": () => installationsSupported() ? declaredInstallations.run.providers() : emptyIterable("installations.providers")
+	};
+	for (const entry of CAPABILITY_TABLE) {
+		const declared = entry.spec ? readPath(spec, entry.spec) : void 0;
+		for (const verb of entry.verbs ?? []) if (verb in special) set(verb, special[verb]);
+		else if (entry.verbs.includes(`${verb}Page`)) {
+			const untargeted = UNTARGETED.has(verb);
+			set(verb, (...args) => {
+				return iteratePages((page) => call(`${verb}Page`)(...untargeted ? [] : [args[0]], page), (untargeted ? args[0] : args[1]) ?? {});
+			});
+		} else {
+			const run = typeof declared?.run === "function" ? declared.run : declared?.run?.[verb.slice(verb.indexOf(".") + 1)];
+			set(verb, entry.perKind ? kindGate(verb, declared?.kinds, run) : gate(verb, declared?.support, run));
+		}
+	}
+	api.webhooks.events = handlers?.events ?? [];
+	const threads = api.threads;
+	async function upsertComment(ref, input, options) {
+		const body = hasCommentMarker(input.body, input.key) ? input.body : `${input.body}\n\n${commentMarker(input.key)}`;
+		let existing;
+		for await (const candidate of threads.comments(ref, options)) if (hasCommentMarker(candidate.body, input.key)) existing = candidate;
+		return existing ? {
+			comment: await threads.editComment(existing.ref, body, options),
+			created: false
+		} : {
+			comment: await threads.comment(ref, body, options),
+			created: true
+		};
+	}
+	return {
+		...api,
+		forge: definition.forge,
+		instance,
+		baseUrl,
+		authKind,
+		request: createRequest(spec.request ?? fetcher, options.readOnly ? { readOnly: (method, path) => new ReadOnlyError(`${method} ${path} is a write and this ${definition.forge} provider is read-only; pass \`mutates: false\` if it only reads`, origin) } : {}),
+		get capabilities() {
+			return capabilities;
+		},
+		async refreshCapabilities() {
+			if (!options.instanceVersion && probeVersion) {
+				env.version = await probeVersion();
+				capabilities = capabilitiesOf(spec, env, flags);
+			}
+			return capabilities;
+		},
+		normaliseMarkdown: spec.normaliseMarkdown ?? ((body) => body),
+		scopesFor: (verb) => spec.scopes?.(verb) ?? {},
+		can: (verb, kind) => supports(capabilities, verb, kind),
+		support: (verb, kind) => supportOf(capabilities, verb, kind),
+		urlFor: (target) => spec.web ? webUrlFor(spec.web, target) : void 0,
+		parseUrl: (url) => spec.web ? parseWebUrl(spec.web, url, origin) : void 0,
+		referenceTo: (ref, referenceOptions) => referenceFor(spec.web, ref, referenceOptions)
+	};
+}
+/**
+* Defines a forge provider. Returns the factory end users call, for example
+* `github({ auth })`. Nothing touches the network until `create()`.
+* @param definition The defaults, authentication and setup of the forge.
+*/
+function defineForgeProvider(definition) {
+	return ((options = {}) => ({
+		forge: definition.forge,
+		...definition.experimental ? { experimental: true } : {},
+		create: () => createProvider(definition, options)
+	}));
+}
+//#endregion
+export { threadKey as $, toPage as A, UnresolvedThreadError as At, isNamespaceRef as B, requireIssueOrPull as C, MergeMethodRequiredError as Ct, syntheticReview as D, SubscriptionClosedError as Dt, summariseChecks as E, ReadOnlyError as Et, supports as F, notificationThread as G, namesAreCaseInsensitive as H, DATE_FIELDS as I, parseThreadKey as J, parseNotificationKey as K, REACTION_CONTENTS as L, versionAtLeast as M, WebhookVerificationError as Mt, capabilityOf as N, soleMergeMethod as Nt, toDate as O, TokenRevokedError as Ot, supportOf as P, toMergeError as Pt, reviveDates as Q, commentMarker as R, phased as S, MergeConflictError as St, resolveToken as T, RateLimitedError as Tt, normaliseRepoName as U, isResolvedThread as V, notificationKey as W, repoKey as X, reactionContent as Y, repoSlug as Z, mapConcurrent as _, ForgeError as _t, parseForgeUrl as a, parseLinkHeader as at, mergeCommitMessage as b, InsufficientScopeError as bt, checkRunState as c, eventAction as ct, forgeIterable as d, fromBase64 as dt, threadSlug as et, getManyConcurrently as f, toFileContent as ft, iteratePages as g, ForgeApiError as gt, hostOf as h, ForbiddenError as ht, githubShapedWeb as i, createRequest as it, toWarning as j, UnsupportedOperationError as jt, toFileStatus as k, UnknownForgeError as kt, createListing as l, reviewState as lt, hexColour as m, ContentNotTextError as mt, perKind as n, anySignal as nt, webUrlFor as o, sleep as ot, hasEveryLabel as p, AuthenticationRequiredError as pt, parseRepoKey as q, verb as r, createFetcher as rt, actorLogin as s, completeEvent as st, defineForgeProvider as t, abortable as tt, degradesToWarning as u, CAPABILITY_TABLE as ut, memo as v, ForgeNetworkError as vt, requireThread as w, NotFoundError as wt, milestoneId as x, MergeBlockedError as xt, memoBy as y, ForgeTimeoutError as yt, hasCommentMarker as z };