[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_701":702,"_703":704},"routes/_app.x.$handle.$name",{"_100":99,"_32":45,"_108":90,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":59,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":25},"version",270,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","app_test.tsx","latestPath","fileId","2a576934-7c0d-11f1-b9ff-1607ee4eb77e","name","fileType","script","content","/** @jsxImportSource npm:hono@4.6.14/jsx */\n\nimport { createRouteHandler } from \"https://esm.town/v/nbbaier/integrations/mod.ts\";\nimport { assert, assertEquals, assertExists } from \"jsr:@std/assert@1.0.19\";\nimport { Hono } from \"npm:hono@4.6.14\";\nimport { issueTracker } from \"./app.tsx\";\nimport { IssueDetailPage } from \"./components.tsx\";\nimport type { Comment, Issue } from \"./db.ts\";\nimport { createIssueStore } from \"./db.ts\";\nimport { createTestSqlite } from \"./test_sqlite.ts\";\n\nDeno.test(\"HTML forms drive create, lifecycle, labels, assignees, blocks, and comments\", async () => {\n const store = createIssueStore(createTestSqlite());\n await store.initSchema();\n const bug = (await store.listLabels()).find((label) => label.name === \"bug\");\n assertExists(bug);\n const fetch = issueTracker(\n {\n auth: false,\n title: \"Test Tracker\",\n apiKey: \"secret\",\n },\n store,\n );\n const form = async (path: string, values: Array<[string, string]>) => {\n const body = new URLSearchParams();\n for (const [key, value] of values) body.append(key, value);\n return await fetch(\n new Request(`http://local${path}`, { method: \"POST\", body }),\n );\n };\n\n const created = await form(\"/new\", [\n [\"title\", \"First\"],\n [\"body\", \"body\"],\n [\"label_id\", String(bug.id)],\n [\"assignees\", \"alice\"],\n ]);\n const firstId = Number(created.headers.get(\"location\")?.split(\"/\").at(-1));\n assert(Number.isInteger(firstId), \"create must redirect to the issue\");\n const second = await form(\"/new\", [[\"title\", \"Second\"]]);\n const secondId = Number(second.headers.get(\"location\")?.split(\"/\").at(-1));\n\n await form(`/issue/${firstId}/close`, [[\"reason\", \"not_planned\"]]);\n let html = await (\n await fetch(new Request(`http://local/issue/${firstId}`))\n ).text();\n assert(html.includes(\"Not planned\"), \"close reason must render\");\n await form(`/issue/${firstId}/reopen`, []);\n await form(`/issue/${firstId}/assignee`, [\n [\"handle\", \"bob\"],\n [\"action\", \"add\"],\n ]);\n await form(`/issue/${firstId}/block`, [\n [\"other_id\", String(secondId)],\n [\"direction\", \"blocks\"],\n [\"action\", \"add\"],\n ]);\n await form(`/issue/${firstId}/comment`, [[\"body\", \"UI comment\"]]);\n const commentId = (await store.listComments(firstId))[0].id;\n await form(`/comment/${commentId}/edit`, [[\"body\", \"Edited UI comment\"]]);\n html = await (\n await fetch(new Request(`http://local/issue/${firstId}`))\n ).text();\n assert(html.includes(\"Reopened\"), \"reopen reason must render\");\n assert(html.includes(\"bug\"), \"selected label must render\");\n assert(\n html.includes(\"@alice\") && html.includes(\"@bob\"),\n \"multiple assignees must render\",\n );\n assert(html.includes(`>#${secondId}<`), \"block relationship must render\");\n assert(html.includes(\"Edited UI comment\"), \"edited comment must render\");\n await form(`/comment/${commentId}/delete`, []);\n html = await (\n await fetch(new Request(`http://local/issue/${firstId}`))\n ).text();\n assert(!html.includes(\"Edited UI comment\"), \"deleted comment must disappear\");\n});\n\nDeno.test(\"shared top bar renders on every page with active surface and auth affordance\", async () => {\n const store = createIssueStore(createTestSqlite());\n await store.initSchema();\n const tracker = issueTracker({ maintainers: [\"boss\"] }, store);\n const routed = (\n path: string,\n user: string | null,\n login: string | null = \"/auth/login\",\n ) =>\n tracker.handler(new Request(`http://local${path}`), {\n user,\n prefix: \"/issues\",\n login,\n });\n\n // The create page is an \"issues\" surface with no Labels link of its own, so\n // seeing both tabs there proves the bar is shared chrome, not per-page nav.\n const newHtml = await (await routed(\"/new\", \"boss\")).text();\n assert(\n newHtml.includes(`href=\"/issues/labels\"`),\n \"top bar Labels tab renders on the new-issue page\",\n );\n assert(\n newHtml.includes(`href=\"/issues/\"`),\n \"top bar Issues tab renders on the new-issue page\",\n );\n\n // The tab for the current surface is visibly active (aria-current).\n const listHtml = await (await routed(\"/\", \"boss\")).text();\n assert(\n listHtml.includes(`href=\"/issues/\" aria-current=\"page\"`),\n \"Issues tab is active on the list surface\",\n );\n const labelsHtml = await (await routed(\"/labels\", \"boss\")).text();\n assert(\n labelsHtml.includes(`href=\"/issues/labels\" aria-current=\"page\"`),\n \"Labels tab is active on the labels surface\",\n );\n\n const missingHtml = await (await routed(\"/issue/999\", \"boss\")).text();\n assert(\n missingHtml.includes(`href=\"/issues/\" aria-current=\"page\"`),\n \"error pages retain the Issues active tab\",\n );\n assert(\n missingHtml.includes(\"@boss\") &&\n missingHtml.includes(`action=\"/auth/logout\"`),\n \"error pages retain the signed-in auth affordance\",\n );\n\n // Signed in: the bar shows the handle and a log out control.\n assert(listHtml.includes(\"@boss\"), \"signed-in handle renders in the bar\");\n assert(\n listHtml.includes(`action=\"/auth/logout\"`),\n \"signed-in bar shows a log out control\",\n );\n\n // Signed out under a login-owning router: log in, no log out.\n const anonHtml = await (await routed(\"/\", null)).text();\n assert(\n anonHtml.includes(`href=\"/auth/login\"`),\n \"signed-out bar shows a log in link\",\n );\n assert(\n !anonHtml.includes(`action=\"/auth/logout\"`),\n \"signed-out bar shows no log out control\",\n );\n\n // Ungated routed mount (no login location): neither log in nor log out.\n const ungatedHtml = await (await routed(\"/\", null, null)).text();\n assert(\n !ungatedHtml.includes(`href=\"/auth/login\"`),\n \"ungated mount shows no log in link\",\n );\n assert(\n !ungatedHtml.includes(`action=\"/auth/logout\"`),\n \"ungated mount shows no log out control\",\n );\n\n // Routed auth can expose a login location other than the standalone\n // middleware's conventional path; the top bar must use that signal rather\n // than inventing an origin-level route.\n const customLoginHtml = await (\n await routed(\"/\", null, \"/sign-in\")\n ).text();\n assert(\n customLoginHtml.includes(`href=\"/sign-in\"`),\n \"top bar uses the router-provided login location\",\n );\n assert(\n !customLoginHtml.includes(`href=\"/auth/login\"`),\n \"top bar does not hard-code the standalone login path\",\n );\n\n const issue = await store.createIssue({\n title: \"Login link detail\",\n body: \"\",\n actor: \"boss\",\n });\n const customDetailHtml = await (\n await routed(`/issue/${issue}`, null, \"/sign-in\")\n ).text();\n assert(\n customDetailHtml.includes('href=\"/sign-in\">Log in to comment.'),\n \"detail-page login affordance uses the router-provided location\",\n );\n});\n\nDeno.test(\"comment edit textarea round-trips multiline markdown through the real Hono form route\", async () => {\n const store = createIssueStore(createTestSqlite());\n await store.initSchema();\n const fetch = issueTracker(\n { auth: false, title: \"Test Tracker\", apiKey: \"secret\" },\n store,\n );\n const form = async (path: string, values: Array<[string, string]>) => {\n const body = new URLSearchParams();\n for (const [key, value] of values) body.append(key, value);\n return await fetch(\n new Request(`http://local${path}`, { method: \"POST\", body }),\n );\n };\n\n const created = await form(\"/new\", [[\"title\", \"Multiline\"]]);\n const issueId = Number(created.headers.get(\"location\")?.split(\"/\").at(-1));\n assert(Number.isInteger(issueId), \"create must redirect to the issue\");\n\n const original = \"First line.\\n\\nThird line after a blank line.\";\n await form(`/issue/${issueId}/comment`, [[\"body\", original]]);\n const commentId = (await store.listComments(issueId))[0].id;\n\n let html = await (\n await fetch(new Request(`http://local/issue/${issueId}`))\n ).text();\n assert(\n html.includes('

{\n  const issue: Issue = {\n    id: 1,\n    title: \"Sample issue\",\n    status: \"open\",\n    state_reason: null,\n    body: \"issue body\",\n    created_at: Date.now(),\n    updated_at: Date.now(),\n    creator: \"creator-bob\",\n    labels: [],\n    assignees: [],\n    blockers: [],\n    blocks: [],\n    blocked: false,\n  };\n  const comment: Comment = {\n    id: 1,\n    issue_id: 1,\n    body: \"alice's comment\",\n    created_at: Date.now(),\n    updated_at: Date.now(),\n    author: \"alice\",\n  };\n\n  async function renderAs(user: string, canModerateComments: boolean) {\n    const testApp = new Hono();\n    testApp.get(\"/\", (c) =>\n      c.html(\n        <IssueDetailPage\n          title=\"Test\"\n          user={user}\n          canManage={false}\n          canDelete={false}\n          canModerateComments={canModerateComments}\n          auth={false}\n          issue={issue}\n          comments={[comment]}\n          labels={[]}\n        />,\n      ));\n    return await (await testApp.fetch(new Request(\"http://local/\"))).text();\n  }\n\n  const hasEditControl = (html: string) => html.includes(\"Edit comment\");\n\n  const maintainerHtml = await renderAs(\"maintainer-mo\", true);\n  assert(\n    hasEditControl(maintainerHtml),\n    \"a maintainer must see edit controls on someone else's comment\",\n  );\n\n  const authorHtml = await renderAs(\"alice\", false);\n  assert(\n    hasEditControl(authorHtml),\n    \"a comment author must see edit controls on their own comment\",\n  );\n\n  const nonAuthorCreatorHtml = await renderAs(\"creator-bob\", false);\n  assert(\n    !hasEditControl(nonAuthorCreatorHtml),\n    \"an issue creator who did not author the comment must not see edit controls\",\n  );\n});\n\nDeno.test(\"routed mode: ctx.user feeds the role model and HTML links carry the prefix\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const tracker = issueTracker({ maintainers: [\"boss\"] }, store);\n  assertEquals(tracker.slug, \"issues\");\n  assertEquals(tracker.name, \"Issue Tracker\");\n  assert(tracker.sessionLess, \"the tracker declares the session-less flag\");\n  // login defaults to the router's login path (a login-owning router); pass null\n  // to model an ungated (auth: false) router that owns no login.\n  const routed = (\n    req: Request,\n    user: string | null,\n    login: string | null = \"/auth/login\",\n  ) => tracker.handler(req, { user, prefix: \"/issues\", login });\n\n  const body = () => new URLSearchParams([[\"title\", \"Routed issue\"]]);\n  const created = await routed(\n    new Request(\"http://local/new\", { method: \"POST\", body: body() }),\n    \"boss\",\n  );\n  assertEquals(created.status, 302);\n  assert(\n    created.headers.get(\"location\")?.startsWith(\"/issue/\"),\n    \"redirects stay integration-local; the router rewrites them (ADR 0002)\",\n  );\n\n  const html = await (\n    await routed(new Request(\"http://local/\"), \"boss\")\n  ).text();\n  assert(\n    html.includes(`href=\"/issues/issue/`),\n    \"issue links must carry the prefix\",\n  );\n  assert(\n    html.includes(`href=\"/issues/new\"`),\n    \"New Issue button must carry the prefix\",\n  );\n  assert(\n    html.includes(`href=\"/issues/source\"`),\n    \"layout links must carry the prefix\",\n  );\n\n  // A logged-in non-maintainer gets defaultRole (contributor): form POST allowed.\n  const contributor = await routed(\n    new Request(\"http://local/new\", { method: \"POST\", body: body() }),\n    \"drive-by\",\n  );\n  assertEquals(contributor.status, 302);\n\n  // ctx.user null under an ungated router (login: null) is a read-only viewer:\n  // 403, never a redirect into a /auth/login the router doesn't own.\n  const anon = await routed(\n    new Request(\"http://local/new\", { method: \"POST\", body: body() }),\n    null,\n    null,\n  );\n  assertEquals(anon.status, 403);\n  assertEquals(anon.headers.get(\"location\"), null);\n});\n\nDeno.test(\"mounted under the real router, dispatch and Location rewriting compose\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const tracker = issueTracker({ maintainers: [\"boss\"] }, store);\n  const handle = createRouteHandler(\n    { integrations: [tracker], auth: {} },\n    () => Promise.resolve({ user: \"boss\", owner: \"boss\" }),\n  );\n\n  const created = await handle(\n    new Request(\"https://host.test/issues/new\", {\n      method: \"POST\",\n      body: new URLSearchParams([[\"title\", \"Via router\"]]),\n    }),\n  );\n  assertEquals(created.status, 302);\n  const location = created.headers.get(\"location\");\n  assert(\n    location?.startsWith(\"/issues/issue/\"),\n    `Location must be prefix-rewritten, got ${location}`,\n  );\n\n  const html = await (\n    await handle(new Request(`https://host.test${location}`))\n  ).text();\n  assert(html.includes(\"Via router\"), \"the created issue must render\");\n  assert(\n    html.includes(`href=\"/issues/\"`),\n    \"home link must point into the mount\",\n  );\n});\n\nDeno.test(\"flagged under a gated router: anonymous reads the viewer surface, the role model gates writes, and a bearer client reaches /api\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const tracker = issueTracker(\n    { maintainers: [\"boss\"], apiKey: \"secret\" },\n    store,\n  );\n  // One gated router (auth on ⇒ it owns login). The tracker is flagged, so the\n  // router passes session-less requests through with ctx.user: null instead of\n  // walling them. Identity is the only thing that varies between an anonymous\n  // visitor and the owner.\n  const asAnon = createRouteHandler(\n    { integrations: [tracker], auth: {} },\n    () => Promise.resolve({ user: null, owner: \"boss\" }),\n  );\n  const asOwner = createRouteHandler(\n    { integrations: [tracker], auth: {} },\n    () => Promise.resolve({ user: \"boss\", owner: \"boss\" }),\n  );\n\n  // Seed a public issue as the owner so the viewer surface has content.\n  const created = await asOwner(\n    new Request(\"https://host.test/issues/new\", {\n      method: \"POST\",\n      body: new URLSearchParams([[\"title\", \"Public issue\"]]),\n    }),\n  );\n  assertEquals(created.status, 302);\n\n  // An anonymous visitor reads the viewer surface untouched (200), sees the\n  // issue, gets a working log-in link from the login-location signal, and is\n  // offered no write affordance.\n  const list = await asAnon(new Request(\"https://host.test/issues/\"));\n  assertEquals(list.status, 200);\n  const listHtml = await list.text();\n  assert(listHtml.includes(\"Public issue\"), \"anonymous visitor reads issues\");\n  assert(\n    listHtml.includes('href=\"/auth/login\"'),\n    \"a login-owning router yields a working log-in link\",\n  );\n  assert(\n    !listHtml.includes('href=\"/issues/new\"'),\n    \"a viewer is offered no New Issue affordance\",\n  );\n\n  // /new and writes stay gated by the tracker's own role model: an anonymous\n  // POST is refused (403), never silently accepted.\n  const write = await asAnon(\n    new Request(\"https://host.test/issues/new\", {\n      method: \"POST\",\n      body: new URLSearchParams([[\"title\", \"Sneaky\"]]),\n    }),\n  );\n  assertEquals(write.status, 403);\n\n  // A bearer client reaches /api with Authorization intact — the router never\n  // reads or strips the header, and the tracker validates its own key. A valid\n  // key writes (201); a wrong key is the tracker's own 401, proving the header\n  // arrived byte-intact for the tracker to check.\n  const apiOk = await asAnon(\n    new Request(\"https://host.test/issues/api/issues\", {\n      method: \"POST\",\n      headers: {\n        Authorization: \"Bearer secret\",\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify({ title: \"Via bearer\" }),\n    }),\n  );\n  assertEquals(apiOk.status, 201);\n  const apiBad = await asAnon(\n    new Request(\"https://host.test/issues/api/issues\", {\n      method: \"POST\",\n      headers: {\n        Authorization: \"Bearer wrong\",\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify({ title: \"Nope\" }),\n    }),\n  );\n  assertEquals(apiBad.status, 401);\n});\n\nDeno.test(\"login-location signal: link shown under a login-owning router, omitted under an ungated one\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const tracker = issueTracker({ maintainers: [\"boss\"] }, store);\n\n  // Routed under a login-owning router (ctx.login set): an anonymous viewer\n  // gets a working \"log in\" link.\n  const withLogin = await tracker.handler(new Request(\"http://local/\"), {\n    user: null,\n    prefix: \"/issues\",\n    login: \"/auth/login\",\n  });\n  const withLoginHtml = await withLogin.text();\n  assert(\n    withLoginHtml.includes('href=\"/auth/login\"'),\n    \"login link renders from the login-location signal\",\n  );\n\n  // Routed under an ungated router (ctx.login null): there is nowhere to log in,\n  // so the link is omitted.\n  const noLogin = await tracker.handler(new Request(\"http://local/\"), {\n    user: null,\n    prefix: \"/issues\",\n    login: null,\n  });\n  const noLoginHtml = await noLogin.text();\n  assert(\n    !noLoginHtml.includes('href=\"/auth/login\"'),\n    \"no login link when the router owns no login\",\n  );\n});\n","/** @jsxImportSource npm:hono@4.6.14/jsx */\n\nimport { createRouteHandler } from \"https://esm.town/v/nbbaier/integrations/mod.ts\";\nimport { assert, assertEquals, assertExists } from \"jsr:@std/assert@1.0.19\";\nimport { Hono } from \"npm:hono@4.6.14\";\nimport { issueTracker } from \"./app.tsx\";\nimport { IssueDetailPage } from \"./components.tsx\";\nimport type { Comment, Issue } from \"./db.ts\";\nimport { createIssueStore } from \"./db.ts\";\nimport { createTestSqlite } from \"./test_sqlite.ts\";\n\nDeno.test(\"HTML forms drive create, lifecycle, labels, assignees, blocks, and comments\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const bug = (await store.listLabels()).find((label) => label.name === \"bug\");\n  assertExists(bug);\n  const fetch = issueTracker(\n    {\n      auth: false,\n      title: \"Test Tracker\",\n      apiKey: \"secret\",\n    },\n    store,\n  );\n  const form = async (path: string, values: Array<[string, string]>) => {\n    const body = new URLSearchParams();\n    for (const [key, value] of values) body.append(key, value);\n    return await fetch(\n      new Request(`http://local${path}`, { method: \"POST\", body }),\n    );\n  };\n\n  const created = await form(\"/new\", [\n    [\"title\", \"First\"],\n    [\"body\", \"body\"],\n    [\"label_id\", String(bug.id)],\n    [\"assignees\", \"alice\"],\n  ]);\n  const firstId = Number(created.headers.get(\"location\")?.split(\"/\").at(-1));\n  assert(Number.isInteger(firstId), \"create must redirect to the issue\");\n  const second = await form(\"/new\", [[\"title\", \"Second\"]]);\n  const secondId = Number(second.headers.get(\"location\")?.split(\"/\").at(-1));\n\n  await form(`/issue/${firstId}/close`, [[\"reason\", \"not_planned\"]]);\n  let html = await (\n    await fetch(new Request(`http://local/issue/${firstId}`))\n  ).text();\n  assert(html.includes(\"Not planned\"), \"close reason must render\");\n  await form(`/issue/${firstId}/reopen`, []);\n  await form(`/issue/${firstId}/assignee`, [\n    [\"handle\", \"bob\"],\n    [\"action\", \"add\"],\n  ]);\n  await form(`/issue/${firstId}/block`, [\n    [\"other_id\", String(secondId)],\n    [\"direction\", \"blocks\"],\n    [\"action\", \"add\"],\n  ]);\n  await form(`/issue/${firstId}/comment`, [[\"body\", \"UI comment\"]]);\n  const commentId = (await store.listComments(firstId))[0].id;\n  await form(`/comment/${commentId}/edit`, [[\"body\", \"Edited UI comment\"]]);\n  html = await (\n    await fetch(new Request(`http://local/issue/${firstId}`))\n  ).text();\n  assert(html.includes(\"Reopened\"), \"reopen reason must render\");\n  assert(html.includes(\"bug\"), \"selected label must render\");\n  assert(\n    html.includes(\"@alice\") && html.includes(\"@bob\"),\n    \"multiple assignees must render\",\n  );\n  assert(html.includes(`>#${secondId}<`), \"block relationship must render\");\n  assert(html.includes(\"Edited UI comment\"), \"edited comment must render\");\n  await form(`/comment/${commentId}/delete`, []);\n  html = await (\n    await fetch(new Request(`http://local/issue/${firstId}`))\n  ).text();\n  assert(!html.includes(\"Edited UI comment\"), \"deleted comment must disappear\");\n});\n\nDeno.test(\"issue list parses token queries and renders activity rows\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const bug = (await store.listLabels()).find((label) => label.name === \"bug\");\n  assertExists(bug);\n\n  const targetId = await store.createIssue({\n    title: \"Needle target\",\n    body: \"needle in the body\",\n    actor: \"alice\",\n  });\n  await store.addLabel(targetId, bug.id, \"alice\");\n  await store.addAssignee(targetId, \"alice\", \"alice\");\n  await store.createComment({\n    issueId: targetId,\n    body: \"A useful comment\",\n    actor: \"alice\",\n  });\n\n  const closedId = await store.createIssue({\n    title: \"Closed needle\",\n    actor: \"alice\",\n  });\n  await store.addLabel(closedId, bug.id, \"alice\");\n  await store.closeIssue(closedId, \"alice\", \"completed\");\n\n  const blockerId = await store.createIssue({\n    title: \"Open blocker\",\n    actor: \"bob\",\n  });\n  const blockedId = await store.createIssue({\n    title: \"Blocked work\",\n    actor: \"alice\",\n  });\n  await store.addLabel(blockedId, bug.id, \"alice\");\n  await store.addBlock(blockerId, blockedId, \"blocks\", \"bob\");\n\n  const fetch = issueTracker(\n    { auth: false, title: \"Test Tracker\", apiKey: \"secret\" },\n    store,\n  );\n  const get = async (path: string) =>\n    await fetch(new Request(`http://local${path}`));\n\n  let response = await get(\"/\");\n  assertEquals(response.status, 200);\n  let html = await response.text();\n  assert(html.includes(\"Needle target\"), \"default list shows open issues\");\n  assert(\n    !html.includes(\"Closed needle\"),\n    \"default list selects open issues\",\n  );\n  assert(html.includes(\"1 comment\"), \"rows show nonzero comment counts\");\n  assert(\n    html.includes(\"opened\") && html.includes(\"Updated\"),\n    \"rows show opened and updated activity times\",\n  );\n  assert(!html.includes(\"<table\"), \"issue list uses stacked rows\");\n\n  response = await get(`/?q=${encodeURIComponent(\"needle status:closed\")}`);\n  html = await response.text();\n  assert(html.includes(\"Closed needle\"), \"status tokens work in any position\");\n  assert(!html.includes(\"Needle target\"), \"status token narrows the list\");\n\n  response = await get(\n    `/?q=${encodeURIComponent(\"label:bug author:alice is:blocked\")}`,\n  );\n  html = await response.text();\n  assert(\n    html.includes(\"Blocked work\"),\n    \"label, author, and blocked tokens work\",\n  );\n  assert(!html.includes(\"Needle target\"), \"route filters combine\");\n\n  response = await get(`/?q=${encodeURIComponent(\"needle\")}`);\n  html = await response.text();\n  assert(html.includes(\"Needle target\"), \"free text searches issue bodies\");\n  assert(\n    html.includes(\"Closed needle\") === false,\n    \"free text keeps the default open status\",\n  );\n\n  response = await get(\n    `/?q=${encodeURIComponent(\"label:bug assignee:alice needle\")}`,\n  );\n  html = await response.text();\n  assert(\n    html.includes(\n      'href=\"/?q=status%3Aclosed+label%3Abug+assignee%3Aalice+needle\"',\n    ),\n    \"closed tab rewrites only status and preserves other query tokens\",\n  );\n\n  response = await get(\n    `/?status=open&assignee=alice&search=${encodeURIComponent(\"Needle\")}`,\n  );\n  html = await response.text();\n  assert(\n    html.includes(\"Needle target\"),\n    \"legacy status, assignee, and search parameters still work\",\n  );\n\n  assert(targetId !== closedId && blockerId !== blockedId);\n});\n\nDeno.test(\"shared top bar renders on every page with active surface and auth affordance\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const tracker = issueTracker({ maintainers: [\"boss\"] }, store);\n  const routed = (\n    path: string,\n    user: string | null,\n    login: string | null = \"/auth/login\",\n  ) =>\n    tracker.handler(new Request(`http://local${path}`), {\n      user,\n      prefix: \"/issues\",\n      login,\n    });\n\n  // The create page is an \"issues\" surface with no Labels link of its own, so\n  // seeing both tabs there proves the bar is shared chrome, not per-page nav.\n  const newHtml = await (await routed(\"/new\", \"boss\")).text();\n  assert(\n    newHtml.includes(`href=\"/issues/labels\"`),\n    \"top bar Labels tab renders on the new-issue page\",\n  );\n  assert(\n    newHtml.includes(`href=\"/issues/\"`),\n    \"top bar Issues tab renders on the new-issue page\",\n  );\n\n  // The tab for the current surface is visibly active (aria-current).\n  const listHtml = await (await routed(\"/\", \"boss\")).text();\n  assert(\n    listHtml.includes(`href=\"/issues/\" aria-current=\"page\"`),\n    \"Issues tab is active on the list surface\",\n  );\n  const labelsHtml = await (await routed(\"/labels\", \"boss\")).text();\n  assert(\n    labelsHtml.includes(`href=\"/issues/labels\" aria-current=\"page\"`),\n    \"Labels tab is active on the labels surface\",\n  );\n\n  const missingHtml = await (await routed(\"/issue/999\", \"boss\")).text();\n  assert(\n    missingHtml.includes(`href=\"/issues/\" aria-current=\"page\"`),\n    \"error pages retain the Issues active tab\",\n  );\n  assert(\n    missingHtml.includes(\"@boss\") &&\n      missingHtml.includes(`action=\"/auth/logout\"`),\n    \"error pages retain the signed-in auth affordance\",\n  );\n\n  // Signed in: the bar shows the handle and a log out control.\n  assert(listHtml.includes(\"@boss\"), \"signed-in handle renders in the bar\");\n  assert(\n    listHtml.includes(`action=\"/auth/logout\"`),\n    \"signed-in bar shows a log out control\",\n  );\n\n  // Signed out under a login-owning router: log in, no log out.\n  const anonHtml = await (await routed(\"/\", null)).text();\n  assert(\n    anonHtml.includes(`href=\"/auth/login\"`),\n    \"signed-out bar shows a log in link\",\n  );\n  assert(\n    !anonHtml.includes(`action=\"/auth/logout\"`),\n    \"signed-out bar shows no log out control\",\n  );\n\n  // Ungated routed mount (no login location): neither log in nor log out.\n  const ungatedHtml = await (await routed(\"/\", null, null)).text();\n  assert(\n    !ungatedHtml.includes(`href=\"/auth/login\"`),\n    \"ungated mount shows no log in link\",\n  );\n  assert(\n    !ungatedHtml.includes(`action=\"/auth/logout\"`),\n    \"ungated mount shows no log out control\",\n  );\n\n  // Routed auth can expose a login location other than the standalone\n  // middleware's conventional path; the top bar must use that signal rather\n  // than inventing an origin-level route.\n  const customLoginHtml = await (\n    await routed(\"/\", null, \"/sign-in\")\n  ).text();\n  assert(\n    customLoginHtml.includes(`href=\"/sign-in\"`),\n    \"top bar uses the router-provided login location\",\n  );\n  assert(\n    !customLoginHtml.includes(`href=\"/auth/login\"`),\n    \"top bar does not hard-code the standalone login path\",\n  );\n\n  const issue = await store.createIssue({\n    title: \"Login link detail\",\n    body: \"\",\n    actor: \"boss\",\n  });\n  const customDetailHtml = await (\n    await routed(`/issue/${issue}`, null, \"/sign-in\")\n  ).text();\n  assert(\n    customDetailHtml.includes('href=\"/sign-in\">Log in</a> to comment.'),\n    \"detail-page login affordance uses the router-provided location\",\n  );\n});\n\nDeno.test(\"comment edit textarea round-trips multiline markdown through the real Hono form route\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const fetch = issueTracker(\n    { auth: false, title: \"Test Tracker\", apiKey: \"secret\" },\n    store,\n  );\n  const form = async (path: string, values: Array<[string, string]>) => {\n    const body = new URLSearchParams();\n    for (const [key, value] of values) body.append(key, value);\n    return await fetch(\n      new Request(`http://local${path}`, { method: \"POST\", body }),\n    );\n  };\n\n  const created = await form(\"/new\", [[\"title\", \"Multiline\"]]);\n  const issueId = Number(created.headers.get(\"location\")?.split(\"/\").at(-1));\n  assert(Number.isInteger(issueId), \"create must redirect to the issue\");\n\n  const original = \"First line.\\n\\nThird line after a blank line.\";\n  await form(`/issue/${issueId}/comment`, [[\"body\", original]]);\n  const commentId = (await store.listComments(issueId))[0].id;\n\n  let html = await (\n    await fetch(new Request(`http://local/issue/${issueId}`))\n  ).text();\n  assert(\n    html.includes('<textarea name=\"body\"'),\n    \"comment edit control must be a textarea\",\n  );\n  assert(\n    html.includes(original),\n    \"textarea must be populated with the complete multiline body\",\n  );\n\n  const edited = \"Edited first line.\\n\\nEdited third line.\\nFourth line.\";\n  await form(`/comment/${commentId}/edit`, [[\"body\", edited]]);\n\n  const stored = await store.getComment(commentId);\n  assertExists(stored);\n  assert(\n    stored.body === edited,\n    \"stored body must retain its line structure after a multiline edit\",\n  );\n\n  html = await (\n    await fetch(new Request(`http://local/issue/${issueId}`))\n  ).text();\n  assert(\n    html.includes(edited),\n    \"rendered comment body and edit textarea must retain line structure\",\n  );\n});\n\nDeno.test(\"comment controls are visible to maintainers and comment authors, but not to a non-author issue creator\", async () => {\n  const issue: Issue = {\n    id: 1,\n    title: \"Sample issue\",\n    status: \"open\",\n    state_reason: null,\n    body: \"issue body\",\n    created_at: Date.now(),\n    updated_at: Date.now(),\n    creator: \"creator-bob\",\n    labels: [],\n    assignees: [],\n    blockers: [],\n    blocks: [],\n    blocked: false,\n  };\n  const comment: Comment = {\n    id: 1,\n    issue_id: 1,\n    body: \"alice's comment\",\n    created_at: Date.now(),\n    updated_at: Date.now(),\n    author: \"alice\",\n  };\n\n  async function renderAs(user: string, canModerateComments: boolean) {\n    const testApp = new Hono();\n    testApp.get(\"/\", (c) =>\n      c.html(\n        <IssueDetailPage\n          title=\"Test\"\n          user={user}\n          canManage={false}\n          canDelete={false}\n          canModerateComments={canModerateComments}\n          auth={false}\n          issue={issue}\n          comments={[comment]}\n          labels={[]}\n        />,\n      ));\n    return await (await testApp.fetch(new Request(\"http://local/\"))).text();\n  }\n\n  const hasEditControl = (html: string) => html.includes(\"Edit comment\");\n\n  const maintainerHtml = await renderAs(\"maintainer-mo\", true);\n  assert(\n    hasEditControl(maintainerHtml),\n    \"a maintainer must see edit controls on someone else's comment\",\n  );\n\n  const authorHtml = await renderAs(\"alice\", false);\n  assert(\n    hasEditControl(authorHtml),\n    \"a comment author must see edit controls on their own comment\",\n  );\n\n  const nonAuthorCreatorHtml = await renderAs(\"creator-bob\", false);\n  assert(\n    !hasEditControl(nonAuthorCreatorHtml),\n    \"an issue creator who did not author the comment must not see edit controls\",\n  );\n});\n\nDeno.test(\"routed mode: ctx.user feeds the role model and HTML links carry the prefix\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const tracker = issueTracker({ maintainers: [\"boss\"] }, store);\n  assertEquals(tracker.slug, \"issues\");\n  assertEquals(tracker.name, \"Issue Tracker\");\n  assert(tracker.sessionLess, \"the tracker declares the session-less flag\");\n  // login defaults to the router's login path (a login-owning router); pass null\n  // to model an ungated (auth: false) router that owns no login.\n  const routed = (\n    req: Request,\n    user: string | null,\n    login: string | null = \"/auth/login\",\n  ) => tracker.handler(req, { user, prefix: \"/issues\", login });\n\n  const body = () => new URLSearchParams([[\"title\", \"Routed issue\"]]);\n  const created = await routed(\n    new Request(\"http://local/new\", { method: \"POST\", body: body() }),\n    \"boss\",\n  );\n  assertEquals(created.status, 302);\n  assert(\n    created.headers.get(\"location\")?.startsWith(\"/issue/\"),\n    \"redirects stay integration-local; the router rewrites them (ADR 0002)\",\n  );\n\n  const html = await (\n    await routed(new Request(\"http://local/\"), \"boss\")\n  ).text();\n  assert(\n    html.includes(`href=\"/issues/issue/`),\n    \"issue links must carry the prefix\",\n  );\n  assert(\n    html.includes(`href=\"/issues/new\"`),\n    \"New Issue button must carry the prefix\",\n  );\n  assert(\n    html.includes(`href=\"/issues/source\"`),\n    \"layout links must carry the prefix\",\n  );\n\n  // A logged-in non-maintainer gets defaultRole (contributor): form POST allowed.\n  const contributor = await routed(\n    new Request(\"http://local/new\", { method: \"POST\", body: body() }),\n    \"drive-by\",\n  );\n  assertEquals(contributor.status, 302);\n\n  // ctx.user null under an ungated router (login: null) is a read-only viewer:\n  // 403, never a redirect into a /auth/login the router doesn't own.\n  const anon = await routed(\n    new Request(\"http://local/new\", { method: \"POST\", body: body() }),\n    null,\n    null,\n  );\n  assertEquals(anon.status, 403);\n  assertEquals(anon.headers.get(\"location\"), null);\n});\n\nDeno.test(\"mounted under the real router, dispatch and Location rewriting compose\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const tracker = issueTracker({ maintainers: [\"boss\"] }, store);\n  const handle = createRouteHandler(\n    { integrations: [tracker], auth: {} },\n    () => Promise.resolve({ user: \"boss\", owner: \"boss\" }),\n  );\n\n  const created = await handle(\n    new Request(\"https://host.test/issues/new\", {\n      method: \"POST\",\n      body: new URLSearchParams([[\"title\", \"Via router\"]]),\n    }),\n  );\n  assertEquals(created.status, 302);\n  const location = created.headers.get(\"location\");\n  assert(\n    location?.startsWith(\"/issues/issue/\"),\n    `Location must be prefix-rewritten, got ${location}`,\n  );\n\n  const html = await (\n    await handle(new Request(`https://host.test${location}`))\n  ).text();\n  assert(html.includes(\"Via router\"), \"the created issue must render\");\n  assert(\n    html.includes(`href=\"/issues/\"`),\n    \"home link must point into the mount\",\n  );\n});\n\nDeno.test(\"flagged under a gated router: anonymous reads the viewer surface, the role model gates writes, and a bearer client reaches /api\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const tracker = issueTracker(\n    { maintainers: [\"boss\"], apiKey: \"secret\" },\n    store,\n  );\n  // One gated router (auth on ⇒ it owns login). The tracker is flagged, so the\n  // router passes session-less requests through with ctx.user: null instead of\n  // walling them. Identity is the only thing that varies between an anonymous\n  // visitor and the owner.\n  const asAnon = createRouteHandler(\n    { integrations: [tracker], auth: {} },\n    () => Promise.resolve({ user: null, owner: \"boss\" }),\n  );\n  const asOwner = createRouteHandler(\n    { integrations: [tracker], auth: {} },\n    () => Promise.resolve({ user: \"boss\", owner: \"boss\" }),\n  );\n\n  // Seed a public issue as the owner so the viewer surface has content.\n  const created = await asOwner(\n    new Request(\"https://host.test/issues/new\", {\n      method: \"POST\",\n      body: new URLSearchParams([[\"title\", \"Public issue\"]]),\n    }),\n  );\n  assertEquals(created.status, 302);\n\n  // An anonymous visitor reads the viewer surface untouched (200), sees the\n  // issue, gets a working log-in link from the login-location signal, and is\n  // offered no write affordance.\n  const list = await asAnon(new Request(\"https://host.test/issues/\"));\n  assertEquals(list.status, 200);\n  const listHtml = await list.text();\n  assert(listHtml.includes(\"Public issue\"), \"anonymous visitor reads issues\");\n  assert(\n    listHtml.includes('href=\"/auth/login\"'),\n    \"a login-owning router yields a working log-in link\",\n  );\n  assert(\n    !listHtml.includes('href=\"/issues/new\"'),\n    \"a viewer is offered no New Issue affordance\",\n  );\n\n  // /new and writes stay gated by the tracker's own role model: an anonymous\n  // POST is refused (403), never silently accepted.\n  const write = await asAnon(\n    new Request(\"https://host.test/issues/new\", {\n      method: \"POST\",\n      body: new URLSearchParams([[\"title\", \"Sneaky\"]]),\n    }),\n  );\n  assertEquals(write.status, 403);\n\n  // A bearer client reaches /api with Authorization intact — the router never\n  // reads or strips the header, and the tracker validates its own key. A valid\n  // key writes (201); a wrong key is the tracker's own 401, proving the header\n  // arrived byte-intact for the tracker to check.\n  const apiOk = await asAnon(\n    new Request(\"https://host.test/issues/api/issues\", {\n      method: \"POST\",\n      headers: {\n        Authorization: \"Bearer secret\",\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify({ title: \"Via bearer\" }),\n    }),\n  );\n  assertEquals(apiOk.status, 201);\n  const apiBad = await asAnon(\n    new Request(\"https://host.test/issues/api/issues\", {\n      method: \"POST\",\n      headers: {\n        Authorization: \"Bearer wrong\",\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify({ title: \"Nope\" }),\n    }),\n  );\n  assertEquals(apiBad.status, 401);\n});\n\nDeno.test(\"login-location signal: link shown under a login-owning router, omitted under an ungated one\", async () => {\n  const store = createIssueStore(createTestSqlite());\n  await store.initSchema();\n  const tracker = issueTracker({ maintainers: [\"boss\"] }, store);\n\n  // Routed under a login-owning router (ctx.login set): an anonymous viewer\n  // gets a working \"log in\" link.\n  const withLogin = await tracker.handler(new Request(\"http://local/\"), {\n    user: null,\n    prefix: \"/issues\",\n    login: \"/auth/login\",\n  });\n  const withLoginHtml = await withLogin.text();\n  assert(\n    withLoginHtml.includes('href=\"/auth/login\"'),\n    \"login link renders from the login-location signal\",\n  );\n\n  // Routed under an ungated router (ctx.login null): there is nowhere to log in,\n  // so the link is omitted.\n  const noLogin = await tracker.handler(new Request(\"http://local/\"), {\n    user: null,\n    prefix: \"/issues\",\n    login: null,\n  });\n  const noLoginHtml = await noLogin.text();\n  assert(\n    !noLoginHtml.includes('href=\"/auth/login\"'),\n    \"no login link when the router owns no login\",\n  );\n});\n","createdAt",["D",1784059508131],"branchVersion","branchId","b6817ee5-03f4-41f2-901e-1bb2efa16e9e","id","abe99189-4851-4aab-ae08-280f66283cac","val-issue-tracker",["D",1783563523910],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Per-val issue tracker — import into any val for scoped issues","imageUrl","5d1042a9-7b0b-499d-8a72-3a8ac7a4e185","pinnedFileId","d1d90306-7b3c-11f1-b527-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","5f80108f-7ca4-4327-b77b-089dbe4b5a82","tursoName","abe9918948514aabae08280f66283cac","tursoHostname","abe9918948514aabae08280f66283cac-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789525245864],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_107":103},"org",{"_100":99,"_101":-5,"_102":103,"_18":55,"_104":105,"_106":25},"branch",{"_13":89,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"isOwned",369,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","nbbaier","handle","displayName","avatar","https://secure.gravatar.com/avatar/0129a541b7b3574e92c4afd06c5e32da&d=identicon","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":696,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":697,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":698,"_84":699,"_86":700,"_88":25},"tree",[326,353,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379],"files",[326,327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379],"counts",{"_316":63,"_317":207,"_318":63,"_319":320,"_321":322},"contents",[130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":310,"_32":311,"_30":312,"_155":-5,"_41":42,"_40":313,"_157":59,"_38":314,"_13":63,"_33":308,"_35":-5,"_24":25,"_161":-5,"_27":315},{"_43":303,"_32":304,"_30":305,"_155":-5,"_41":42,"_40":306,"_157":59,"_38":307,"_13":63,"_33":308,"_35":-5,"_24":25,"_161":-5,"_27":309},{"_43":296,"_32":297,"_30":298,"_155":-5,"_41":42,"_40":299,"_157":59,"_38":300,"_13":63,"_33":20,"_35":301,"_24":25,"_161":-5,"_27":302},{"_43":290,"_32":291,"_30":292,"_155":-5,"_41":42,"_40":293,"_157":25,"_38":294,"_13":207,"_33":20,"_35":288,"_24":25,"_161":-5,"_27":295},{"_43":283,"_32":284,"_30":285,"_155":-5,"_41":42,"_40":286,"_157":25,"_38":287,"_13":207,"_33":20,"_35":288,"_24":25,"_161":-5,"_27":289},{"_43":276,"_32":277,"_30":278,"_155":-5,"_41":42,"_40":279,"_157":59,"_38":280,"_13":258,"_33":20,"_35":281,"_24":25,"_161":-5,"_27":282},{"_43":268,"_32":269,"_30":270,"_155":-5,"_41":42,"_40":271,"_157":25,"_38":272,"_13":273,"_33":20,"_35":274,"_24":25,"_161":-5,"_27":275},{"_43":261,"_32":262,"_30":263,"_155":-5,"_41":42,"_40":264,"_157":25,"_38":265,"_13":258,"_33":34,"_35":266,"_24":25,"_161":-5,"_27":267},{"_43":253,"_32":254,"_30":255,"_155":-5,"_41":42,"_40":256,"_157":25,"_38":257,"_13":258,"_33":34,"_35":259,"_24":25,"_161":-5,"_27":260},{"_43":245,"_32":246,"_30":247,"_155":-5,"_41":42,"_40":248,"_157":25,"_38":249,"_13":250,"_33":34,"_35":251,"_24":25,"_161":-5,"_27":252},{"_43":241,"_32":28,"_30":31,"_155":-5,"_41":42,"_40":14,"_157":25,"_38":242,"_13":243,"_33":34,"_35":37,"_24":25,"_161":-5,"_27":244},{"_43":233,"_32":234,"_30":235,"_155":-5,"_41":42,"_40":236,"_157":25,"_38":237,"_13":238,"_33":34,"_35":239,"_24":25,"_161":-5,"_27":240},{"_43":225,"_32":226,"_30":227,"_155":-5,"_41":42,"_40":228,"_157":25,"_38":229,"_13":230,"_33":34,"_35":231,"_24":25,"_161":-5,"_27":232},{"_43":218,"_32":219,"_30":220,"_155":-5,"_41":42,"_40":221,"_157":25,"_38":222,"_13":175,"_33":34,"_35":223,"_24":25,"_161":-5,"_27":224},{"_43":210,"_32":211,"_30":212,"_155":-5,"_41":42,"_40":213,"_157":25,"_38":214,"_13":215,"_33":20,"_35":216,"_24":25,"_161":-5,"_27":217},{"_43":202,"_32":203,"_30":204,"_155":-5,"_41":42,"_40":205,"_157":25,"_38":206,"_13":207,"_33":34,"_35":208,"_24":25,"_161":-5,"_27":209},{"_43":194,"_32":195,"_30":196,"_155":-5,"_41":42,"_40":197,"_157":25,"_38":198,"_13":199,"_33":34,"_35":200,"_24":25,"_161":-5,"_27":201},{"_43":186,"_32":187,"_30":57,"_155":-5,"_41":42,"_40":188,"_157":59,"_38":189,"_13":190,"_33":191,"_35":192,"_24":25,"_161":-5,"_27":193},{"_43":178,"_32":179,"_30":180,"_155":-5,"_41":42,"_40":181,"_157":59,"_38":182,"_13":183,"_33":34,"_35":184,"_24":25,"_161":-5,"_27":185},{"_43":170,"_32":171,"_30":172,"_155":-5,"_41":42,"_40":173,"_157":59,"_38":174,"_13":175,"_33":34,"_35":176,"_24":25,"_161":-5,"_27":177},{"_43":163,"_32":164,"_30":165,"_155":-5,"_41":42,"_40":166,"_157":25,"_38":167,"_13":63,"_33":34,"_35":168,"_24":25,"_161":-5,"_27":169},{"_43":152,"_32":153,"_30":154,"_155":-5,"_41":42,"_40":156,"_157":25,"_38":158,"_13":159,"_33":34,"_35":160,"_24":25,"_161":-5,"_27":162},"86e5d363-46c5-4772-9428-caacd151457d","ui.tsx","fca19e20-7b48-11f1-8cf9-1607ee4eb77e","parentId",258,"latest",["D",1784057420955],33,"/** @jsxImportSource npm:hono@4.6.14/jsx */\nimport type { FC, PropsWithChildren } from \"npm:hono@4.6.14/jsx\";\nimport type { IssueStatus, Label, StateReason } from \"./db.ts\";\nimport { T } from \"./theme.ts\";\n\nexport const FIELD =\n  `bg-[${T.surface}] border border-[${T.border}] rounded-md min-h-10 px-3.5 text-sm font-medium text-[${T.text}] focus:outline-none focus:border-[${T.link}]`;\nconst BUTTON =\n  \"inline-flex items-center gap-1.5 rounded-md min-h-10 px-3.5 text-sm font-medium cursor-pointer no-underline\";\nconst VARIANTS = {\n  solid:\n    `bg-[${T.accent}] border border-[${T.accent}] text-white hover:brightness-110`,\n  ghost:\n    `bg-transparent border border-[${T.accent}] text-[${T.text}] hover:brightness-110`,\n  danger:\n    `bg-transparent border border-[${T.danger}] text-[${T.danger}] hover:bg-[${T.danger}] hover:text-white`,\n} as const;\n\nexport const STATUS_LABELS: Record<IssueStatus, string> = {\n  open: \"Open\",\n  closed: \"Closed\",\n};\nexport const STATE_REASON_LABELS: Record<Exclude<StateReason, null>, string> = {\n  completed: \"Completed\",\n  not_planned: \"Not planned\",\n  duplicate: \"Duplicate\",\n  reopened: \"Reopened\",\n};\n\nexport const Card: FC<PropsWithChildren<{ class?: string }>> = ({\n  children,\n  class: cls,\n}) => (\n  <div\n    class={`bg-[${T.panel}] border border-[${T.border}] rounded-lg p-4 mb-[18px] ${\n      cls ?? \"\"\n    }`}\n  >\n    {children}\n  </div>\n);\n\nexport const Button: FC<\n  PropsWithChildren<{\n    variant?: keyof typeof VARIANTS;\n    href?: string;\n    type?: \"button\" | \"submit\";\n    class?: string;\n    name?: string;\n    value?: string;\n  }>\n> = ({\n  variant = \"solid\",\n  href,\n  type = \"button\",\n  class: cls,\n  name,\n  value,\n  children,\n}) => {\n  const classes = `${BUTTON} ${VARIANTS[variant]} ${cls ?? \"\"}`;\n  return href\n    ? (\n      <a class={classes} href={href}>\n        {children}\n      </a>\n    )\n    : (\n      <button class={classes} type={type} name={name} value={value}>\n        {children}\n      </button>\n    );\n};\n\nexport const Select: FC<\n  PropsWithChildren<{ name: string; id?: string; class?: string }>\n> = ({ name, id, class: cls, children }) => (\n  <select id={id} name={name} class={`${FIELD} ${cls ?? \"\"}`}>\n    {children}\n  </select>\n);\n\nexport const Banner: FC<{ kind: \"ok\" | \"err\"; msg: string }> = ({\n  kind,\n  msg,\n}) => (\n  <div\n    class={`rounded-lg border px-3.5 py-2.5 mb-4 ${\n      kind === \"err\"\n        ? `bg-[#2a1a1e] border-[${T.danger}] text-[#f7b3bb]`\n        : \"bg-[#15261c] border-[#5fd08a] text-[#a8e6c1]\"\n    }`}\n  >\n    {msg}\n  </div>\n);\n\nexport const StatusBadge: FC<{ status: IssueStatus; reason?: StateReason }> = ({\n  status,\n  reason,\n}) => (\n  <span\n    class={`inline-block rounded-full px-2.5 py-0.5 text-xs font-medium text-white ${\n      status === \"open\" ? \"bg-blue-500\" : \"bg-gray-500\"\n    }`}\n  >\n    {STATUS_LABELS[status]}\n    {reason ? ` · ${STATE_REASON_LABELS[reason]}` : \"\"}\n  </span>\n);\n\nexport const LabelTag: FC<{ label: Label }> = ({ label }) => (\n  <span\n    class=\"inline-block rounded-md border px-1.5 py-px text-[11px] mr-1\"\n    style={`border-color:#${label.color};color:#${label.color}`}\n  >\n    {label.name}\n  </span>\n);\n","label",[153],"475f9406-f7d1-4bd0-bbfd-8ffa2b6974b4","theme.ts","743531d4-7fba-11f1-b433-1607ee4eb77e",260,["D",1784057421314],"/**\n * Single source of truth for the recurring dark-palette hex values used\n * across layout.tsx, ui.tsx, and components.tsx. Presentation-only —\n * no local imports, so importing this file can never create a cycle.\n *\n * Only colors that genuinely recur 2+ times across those files live here.\n * One-off tints (banner ok/err colors, dynamic label colors, Tailwind\n * named colors like `blue-500`) stay inline where they're used.\n */\nexport const T = {\n  /** Page background. */\n  bg: \"#0f1115\",\n  /** Header / card background. */\n  panel: \"#181b22\",\n  /** Inputs, table rows, nested surfaces. */\n  surface: \"#1f232c\",\n  /** Borders and dividers. */\n  border: \"#2a2f3a\",\n  /** Primary text. */\n  text: \"#e6e9ef\",\n  /** Secondary / muted text. */\n  muted: \"#8b93a3\",\n  /** Links and focus rings. */\n  link: \"#6ea8fe\",\n  /** Primary accent (solid buttons). */\n  accent: \"#3d7bf0\",\n  /** Danger / destructive actions. */\n  danger: \"#f06e7b\",\n} as const;\n",[164],"06a3a637-e081-4666-a2b1-479fa57ef458","test_sqlite.ts","2bb2ce86-7c0d-11f1-9a68-1607ee4eb77e",220,["D",1784052697980],3,"import { DatabaseSync } from \"node:sqlite\";\n\nexport interface TestResultSet {\n  columns: string[];\n  rows: Record<string, unknown>[];\n  rowsAffected: number;\n  lastInsertRowid: bigint | undefined;\n}\n\nexport function createTestSqlite() {\n  const database = new DatabaseSync(\":memory:\");\n  database.exec(\"PRAGMA foreign_keys = ON\");\n\n  const execute = (\n    statement: string | { sql: string; args?: unknown[] },\n  ): Promise<TestResultSet> => {\n    try {\n      const sql = typeof statement === \"string\" ? statement : statement.sql;\n      const args = typeof statement === \"string\" ? [] : (statement.args ?? []);\n      const prepared = database.prepare(sql);\n      if (/^\\s*(SELECT|PRAGMA|WITH)\\b/i.test(sql)) {\n        const rows = prepared.all(...(args as never[])) as Record<\n          string,\n          unknown\n        >[];\n        return Promise.resolve({\n          columns: rows[0] ? Object.keys(rows[0]) : [],\n          rows,\n          rowsAffected: 0,\n          lastInsertRowid: undefined,\n        });\n      }\n      const result = prepared.run(...(args as never[]));\n      return Promise.resolve({\n        columns: [],\n        rows: [],\n        rowsAffected: Number(result.changes),\n        lastInsertRowid: BigInt(result.lastInsertRowid),\n      });\n    } catch (error) {\n      return Promise.reject(error);\n    }\n  };\n\n  return {\n    database,\n    execute,\n    /**\n     * Mirror the libsql `transaction(\"write\")` contract on top of node:sqlite:\n     * `BEGIN IMMEDIATE` opens an exclusive write transaction, statements run\n     * sequentially on the single in-memory connection, and `commit`/`rollback`\n     * close it. This is the same atomic-write contract `db.ts` drives in\n     * production, so the store tests exercise the real transaction path.\n     */\n    transaction(_mode?: \"write\" | \"read\" | \"deferred\") {\n      database.exec(\"BEGIN IMMEDIATE\");\n      let settled = false;\n      const finish = (verb: \"COMMIT\" | \"ROLLBACK\") => {\n        if (settled) return Promise.resolve();\n        settled = true;\n        database.exec(verb);\n        return Promise.resolve();\n      };\n      return Promise.resolve({\n        execute,\n        commit: () => finish(\"COMMIT\"),\n        rollback: () => finish(\"ROLLBACK\"),\n      });\n    },\n  };\n}\n",[171],"8d2480e3-0dfc-4ba9-ba40-4da9d6b62915","mod.ts","d1e3fc5c-7b3c-11f1-af1c-1607ee4eb77e",224,["D",1784052697990],13,"export { default, issueTracker, type IssueTrackerOptions } from \"./app.tsx\";\n",[179],"b7ee6e4d-e03e-49f9-b6a3-e9b3852a593e","main.ts",214,["D",1783790091112],11,"http","import { issueTracker } from \"./mod.ts\";\n\n/**\n * This val's own issue tracker — manages THIS val's scoped SQLite database.\n *\n * To add issues to a DIFFERENT val, import the tracker into that val:\n *\n *   import { issueTracker } from \"https://esm.town/v/nbbaier/val-issue-tracker/mod.ts\";\n *   export default issueTracker({ owner: [\"nbbaier\"] });\n *\n * Because scoped SQLite is bound to the running val, the imported tracker\n * reads/writes the host val's database automatically — no per-val config needed.\n */\nexport default issueTracker({});\n",[187],"a8da133e-f3ec-4798-9ac8-7e818889dd8b","layout.tsx","fd6015ee-7b48-11f1-bafe-1607ee4eb77e",265,["D",1784058461137],7,"/** @jsxImportSource npm:hono@4.6.14/jsx */\nimport type { FC, PropsWithChildren } from \"npm:hono@4.6.14/jsx\";\nimport { T } from \"./theme.ts\";\n\nconst TAB =\n  `inline-flex items-center px-3 py-1.5 border-b-2 border-transparent text-sm no-underline`;\nconst TAB_ACTIVE = `text-[${T.text}] font-semibold border-[${T.accent}]`;\nconst TAB_IDLE = `text-[${T.muted}] hover:text-[${T.text}]`;\n\n/** Small avatar + handle chip for the top bar's right edge. */\nconst UserChip: FC<{ user: string }> = ({ user }) => (\n  <span class=\"flex items-center gap-2\">\n    <span\n      class={`w-6 h-6 rounded-full bg-[${T.border}] text-[${T.text}] text-xs flex items-center justify-center uppercase`}\n    >\n      {user.charAt(0) || \"?\"}\n    </span>\n    <span class={`text-[${T.muted}] text-[13px]`}>@{user || \"?\"}</span>\n  </span>\n);\n\nexport const Layout: FC<\n  PropsWithChildren<{\n    title: string;\n    user?: string | null;\n    auth?: boolean;\n    /** Login location supplied by the owning auth surface, when available. */\n    login?: string | null;\n    /** Mount prefix for internal links; \"\" standalone. /auth/* stays\n     * origin-level in both modes, so those links never take it. */\n    base?: string;\n    /** Which top-bar tab is the current surface. */\n    active?: \"issues\" | \"labels\";\n  }>\n> = ({\n  title,\n  user,\n  auth = true,\n  login,\n  base = \"\",\n  active,\n  children,\n}) => {\n  const signedIn = user !== null && user !== undefined;\n  const loginHref = login === undefined ? (auth ? \"/auth/login\" : null) : login;\n  const chip = signedIn ? <UserChip user={user} /> : null;\n  const logoutForm = (\n    <form method=\"post\" action=\"/auth/logout\" class=\"m-0\">\n      <button\n        type=\"submit\"\n        class={`bg-transparent border border-[${T.border}] text-[${T.text}] rounded-md px-3.5 py-2 font-medium cursor-pointer hover:brightness-110`}\n      >\n        Log out\n      </button>\n    </form>\n  );\n  const loginLink = loginHref\n    ? (\n      <a\n        href={loginHref}\n        class={`inline-flex items-center gap-1.5 bg-transparent border border-[${T.border}] text-[${T.text}] rounded-md px-3.5 py-2 font-medium no-underline hover:brightness-110`}\n      >\n        Log in\n      </a>\n    )\n    : null;\n\n  return (\n    <html lang=\"en\">\n      <head>\n        <meta charSet=\"utf-8\" />\n        <meta name=\"viewport\" content=\"width=device-width,initial-scale=1\" />\n        <title>{title}</title>\n        <script src=\"https://cdn.twind.style\" crossorigin=\"anonymous\" />\n        <script src=\"https://esm.town/v/std/catch\" />\n      </head>\n      <body\n        class={`m-0 bg-[${T.bg}] text-[${T.text}] font-sans text-sm leading-relaxed`}\n      >\n        <header\n          class={`flex items-center gap-3 px-5 h-16 border-b border-[${T.border}] bg-[${T.panel}]`}\n        >\n          <nav class=\"flex items-center gap-1\">\n            <a\n              href={`${base}/`}\n              aria-current={active === \"issues\" ? \"page\" : undefined}\n              class={`${TAB} ${active === \"issues\" ? TAB_ACTIVE : TAB_IDLE}`}\n            >\n              Issues\n            </a>\n            <a\n              href={`${base}/labels`}\n              aria-current={active === \"labels\" ? \"page\" : undefined}\n              class={`${TAB} ${active === \"labels\" ? TAB_ACTIVE : TAB_IDLE}`}\n            >\n              Labels\n            </a>\n          </nav>\n          <span class=\"flex-1\" />\n          <a\n            href={`${base}/source`}\n            class={`text-[${T.muted}] text-xs no-underline hover:underline`}\n          >\n            view source\n          </a>\n          {chip}\n          {auth && signedIn ? logoutForm : auth ? loginLink : null}\n        </header>\n        <div class=\"max-w-[960px] mx-auto p-5\">{children}</div>\n      </body>\n    </html>\n  );\n};\n",[195],"149b0c48-4e31-4d15-b61c-4247c382d6dc","env.ts","1d39134a-7c96-11f1-80af-1607ee4eb77e",231,["D",1784052698514],1,"const valTownApiKey = Deno.env.get(\"VAL_TOWN_API_KEY\");\nif (!valTownApiKey) {\n  console.error(\"VAL_TOWN_API_KEY is not set\");\n}\n\nconsole.log(valTownApiKey);\n",[203],"eab636fc-014e-4c3e-9244-93c822f101fa","deno.json","0aa42a7a-7b43-11f1-9001-1607ee4eb77e",259,["D",1784057421224],5,"{\n  \"compilerOptions\": {\n    \"lib\": [\n      \"dom\",\n      \"dom.iterable\",\n      \"dom.asynciterable\",\n      \"deno.ns\",\n      \"deno.unstable\"\n    ],\n    \"noImplicitAny\": false,\n    \"strict\": false,\n    \"types\": [\"https://www.val.town/types/valtown.d.ts\"]\n  },\n  \"experimental\": {\n    \"unstable-node-globals\": true,\n    \"unstable-sloppy-imports\": true,\n    \"unstable-temporal\": true,\n    \"unstable-worker-options\": true\n  },\n  \"imports\": {\n    \"-\": \"npm:-@0.0.1-security.1\",\n    \"@std/assert\": \"jsr:@std/assert@^1.0.19\",\n    \"@types/node\": \"npm:@types/node@^26.1.1\",\n    \"hono\": \"npm:hono@^4.12.27\"\n  },\n  \"lint\": {\n    \"include\": [\"*.ts\", \"*.tsx\"],\n    \"rules\": {\n      \"exclude\": [\"no-explicit-any\", \"no-import-prefix\"]\n    }\n  },\n  \"lock\": false,\n  \"nodeModulesDir\": \"auto\",\n  \"tasks\": {\n    \"lint\": \"deno lint\",\n    \"typecheck\": \"VAL_TOWN_API_KEY=test deno check --allow-import=esm.town,www.val.town,esm.sh,jsr.io main.ts mod.ts api.ts app.tsx components.tsx ui.tsx layout.tsx theme.ts db.ts api_test.ts app_test.tsx db_test.ts\",\n    \"test\": \"VAL_TOWN_API_KEY=test deno test --allow-env=VAL_TOWN_API_KEY --allow-import=esm.town,www.val.town,esm.sh,jsr.io\",\n    \"check\": \"deno fmt && deno task lint && deno task typecheck && deno task test\"\n  }\n}\n",[211],"2ba3a628-df68-4d81-bd5b-cd85eeea936d","db_test.ts","2a3ea20a-7c0d-11f1-b256-1607ee4eb77e",225,["D",1784052698200],"import {\n  assert,\n  assertEquals,\n  assertExists,\n  assertRejects,\n} from \"jsr:@std/assert@1.0.19\";\nimport { createIssueStore } from \"./db.ts\";\nimport { createTestSqlite } from \"./test_sqlite.ts\";\n\nfunction createClock(start = 1_700_000_000_000) {\n  let value = start;\n  return {\n    now: () => value,\n    tick: () => ++value,\n  };\n}\n\nDeno.test(\"issue lifecycle auto-manages status and state reason\", async () => {\n  const client = createTestSqlite();\n  client.database.exec(\"PRAGMA foreign_keys = OFF\");\n  const store = createIssueStore(client, () => 1_700_000_000_000);\n  await store.initSchema();\n  assertEquals(\n    client.database.prepare(\"PRAGMA foreign_keys\").get()?.foreign_keys,\n    1,\n    \"schema initialization must enable production foreign keys\",\n  );\n\n  const id = await store.createIssue({\n    title: \"Lifecycle\",\n    body: \"body\",\n    actor: \"alice\",\n  });\n  assertEquals((await store.getIssue(id))?.state_reason, null);\n\n  await store.closeIssue(id, \"alice\", \"not_planned\");\n  assertEquals(\n    {\n      status: (await store.getIssue(id))?.status,\n      state_reason: (await store.getIssue(id))?.state_reason,\n    },\n    { status: \"closed\", state_reason: \"not_planned\" },\n  );\n\n  await store.reopenIssue(id, \"alice\");\n  assertEquals(\n    {\n      status: (await store.getIssue(id))?.status,\n      state_reason: (await store.getIssue(id))?.state_reason,\n    },\n    { status: \"open\", state_reason: \"reopened\" },\n  );\n\n  let rejected = false;\n  try {\n    await client.execute({\n      sql:\n        \"UPDATE issue_tracker_issues SET state_reason = 'completed' WHERE id = ?\",\n      args: [id],\n    });\n  } catch {\n    rejected = true;\n  }\n  assertEquals(rejected, true, \"the schema must reject open + completed\");\n\n  const completedId = await store.createIssue({\n    title: \"Default close\",\n    actor: \"alice\",\n  });\n  await store.closeIssue(completedId, \"alice\");\n  assertEquals((await store.getIssue(completedId))?.state_reason, \"completed\");\n  const duplicateId = await store.createIssue({\n    title: \"Duplicate\",\n    actor: \"alice\",\n  });\n  await store.closeIssue(duplicateId, \"alice\", \"duplicate\");\n  assertEquals((await store.getIssue(duplicateId))?.state_reason, \"duplicate\");\n});\n\nDeno.test(\"issue lifecycle emits boundary snapshots and one delta per changed field\", async () => {\n  const client = createTestSqlite();\n  const clock = createClock();\n  const store = createIssueStore(client, clock.now);\n  await store.initSchema();\n  const id = await store.createIssue({\n    title: \"Audit\",\n    body: \"first\",\n    actor: \"alice\",\n  });\n  clock.tick();\n  await store.updateIssue(id, { title: \"Audited\", body: \"second\" }, \"bob\");\n  clock.tick();\n  await store.closeIssue(id, \"carol\", \"not_planned\");\n\n  const events = await store.listEvents({ entity: \"issue\", entityId: id });\n  assertEquals(\n    events.map((event) => event.event_type),\n    [\n      \"issue.created\",\n      \"issue.updated\",\n      \"issue.updated\",\n      \"issue.updated\",\n      \"issue.updated\",\n    ],\n  );\n  assertEquals(events[0].data, {\n    id,\n    title: \"Audit\",\n    body: \"first\",\n    status: \"open\",\n    state_reason: null,\n    created_at: 1_700_000_000_000,\n    updated_at: 1_700_000_000_000,\n  });\n  assertEquals(\n    events.slice(1).map((event) => event.data),\n    [\n      { update_target: \"title\", from: \"Audit\", to: \"Audited\" },\n      { update_target: \"body\", from: \"first\", to: \"second\" },\n      { update_target: \"status\", from: \"open\", to: \"closed\" },\n      { update_target: \"state_reason\", from: null, to: \"not_planned\" },\n    ],\n  );\n  assertEquals(\n    events.slice(3).map((event) => [event.actor, event.event_timestamp]),\n    [\n      [\"carol\", 1_700_000_000_002],\n      [\"carol\", 1_700_000_000_002],\n    ],\n  );\n\n  clock.tick();\n  await store.deleteIssue(id, \"dana\");\n  const deleted = (\n    await store.listEvents({ entity: \"issue\", entityId: id })\n  ).at(-1);\n  assertExists(deleted);\n  assertEquals(deleted.event_type, \"issue.deleted\");\n  assertEquals(deleted.actor, \"dana\");\n  assertEquals(Object.keys(deleted.data as object).sort(), [\n    \"body\",\n    \"created_at\",\n    \"id\",\n    \"state_reason\",\n    \"status\",\n    \"title\",\n    \"updated_at\",\n  ]);\n  await assertRejects(\n    () => client.execute(\"DELETE FROM issue_tracker_events WHERE id = 1\"),\n    \"append-only\",\n  );\n});\n\nDeno.test(\"labels are seeded once and relationship changes are audited and touch the issue\", async () => {\n  const client = createTestSqlite();\n  const clock = createClock();\n  const store = createIssueStore(client, clock.now);\n  await store.initSchema();\n  const defaults = await store.listLabels();\n  assertEquals(\n    defaults.map((label) => label.name),\n    [\"bug\", \"documentation\", \"duplicate\", \"enhancement\", \"question\"],\n  );\n\n  const question = defaults.find((label) => label.name === \"question\");\n  assertExists(question);\n  const seeded = await store.listEvents({\n    entity: \"label\",\n    entityId: question.id,\n  });\n  assertEquals(\n    { type: seeded[0].event_type, actor: seeded[0].actor },\n    { type: \"label.created\", actor: \"system\" },\n  );\n  assertEquals(seeded[0].data, {\n    id: question.id,\n    name: question.name,\n    color: question.color,\n    created_at: question.created_at,\n    updated_at: question.updated_at,\n  });\n  await store.deleteLabel(question.id, \"alice\");\n  const deleted = (\n    await store.listEvents({\n      entity: \"label\",\n      entityId: question.id,\n    })\n  ).at(-1);\n  assertExists(deleted);\n  assertEquals(\n    { type: deleted.event_type, actor: deleted.actor },\n    { type: \"label.deleted\", actor: \"alice\" },\n  );\n  assertEquals(deleted.data, {\n    id: question.id,\n    name: question.name,\n    color: question.color,\n    created_at: question.created_at,\n    updated_at: question.updated_at,\n  });\n  await store.initSchema();\n  assertEquals(\n    (await store.listLabels()).some((label) => label.name === \"question\"),\n    false,\n  );\n  const enhancement = defaults.find((label) => label.name === \"enhancement\");\n  assertExists(enhancement);\n  clock.tick();\n  await store.updateLabel(\n    enhancement.id,\n    { name: \"feature\", color: \"123456\" },\n    \"alice\",\n  );\n  const updatedLabel = await store.getLabel(enhancement.id);\n  assertEquals(\n    { name: updatedLabel?.name, color: updatedLabel?.color },\n    { name: \"feature\", color: \"123456\" },\n  );\n  assertEquals(\n    (await store.listEvents({ entity: \"label\", entityId: enhancement.id }))\n      .slice(-2)\n      .map((event) => event.data),\n    [\n      { update_target: \"name\", from: \"enhancement\", to: \"feature\" },\n      { update_target: \"color\", from: \"a2eeef\", to: \"123456\" },\n    ],\n  );\n  await assertRejects(\n    () => store.createLabel({ name: \"unsafe\", color: \"red;\", actor: \"alice\" }),\n    \"six hexadecimal\",\n  );\n\n  const issueId = await store.createIssue({ title: \"Labels\", actor: \"alice\" });\n  const bug = (await store.listLabels()).find((label) => label.name === \"bug\");\n  assertExists(bug);\n  const createdIssue = await store.getIssue(issueId);\n  assertExists(createdIssue);\n  const createdAt = createdIssue.updated_at;\n  clock.tick();\n  await store.addLabel(issueId, bug.id, \"bob\");\n  const labeled = await store.getIssue(issueId);\n  assertExists(labeled);\n  assertEquals(\n    labeled.labels.map((label) => label.name),\n    [\"bug\"],\n  );\n  assert(labeled.updated_at > createdAt, \"adding a label must touch the issue\");\n  clock.tick();\n  const beforeRemovalIssue = await store.getIssue(issueId);\n  assertExists(beforeRemovalIssue);\n  const beforeLabelRemoval = beforeRemovalIssue.updated_at;\n  await store.removeLabel(issueId, bug.id, \"bob\");\n  const afterRemoval = await store.getIssue(issueId);\n  assertExists(afterRemoval);\n  assertEquals(afterRemoval.labels, []);\n  assert(\n    afterRemoval.updated_at > beforeLabelRemoval,\n    \"label removal must touch the issue\",\n  );\n  clock.tick();\n  await store.addLabel(issueId, bug.id, \"bob\");\n  clock.tick();\n  const beforeDeleteIssue = await store.getIssue(issueId);\n  assertExists(beforeDeleteIssue);\n  const beforeLabelDelete = beforeDeleteIssue.updated_at;\n  await store.deleteLabel(bug.id, \"carol\");\n  const afterDelete = await store.getIssue(issueId);\n  assertExists(afterDelete);\n  assertEquals(afterDelete.labels, []);\n  assert(\n    afterDelete.updated_at > beforeLabelDelete,\n    \"deleting an in-use label must touch the issue\",\n  );\n\n  const deltas = (\n    await store.listEvents({ entity: \"issue\", entityId: issueId })\n  )\n    .filter((event) => event.event_type === \"issue.updated\")\n    .map((event) => event.data);\n  assertEquals(deltas, [\n    { update_target: \"label\", from: null, to: \"bug\" },\n    { update_target: \"label\", from: \"bug\", to: null },\n    { update_target: \"label\", from: null, to: \"bug\" },\n    { update_target: \"label\", from: \"bug\", to: null },\n  ]);\n});\n\nDeno.test(\"assignees are a set and assigned-to-me queries the relationship\", async () => {\n  const client = createTestSqlite();\n  const clock = createClock();\n  const store = createIssueStore(client, clock.now);\n  await store.initSchema();\n  const first = await store.createIssue({ title: \"First\", actor: \"alice\" });\n  const second = await store.createIssue({ title: \"Second\", actor: \"alice\" });\n  const beforeAssignIssue = await store.getIssue(first);\n  assertExists(beforeAssignIssue);\n  const beforeAssign = beforeAssignIssue.updated_at;\n  clock.tick();\n  await store.addAssignee(first, \"alice\", \"maintainer\");\n  const afterAssign = await store.getIssue(first);\n  assertExists(afterAssign);\n  assert(\n    afterAssign.updated_at > beforeAssign,\n    \"assignment must touch the issue\",\n  );\n  await store.addAssignee(first, \"bob\", \"maintainer\");\n  await store.addAssignee(second, \"bob\", \"maintainer\");\n  const assigned = await store.getIssue(first);\n  assertExists(assigned);\n  assertEquals(assigned.assignees, [\"alice\", \"bob\"]);\n  assertEquals(\n    (await store.listIssues({ assignee: \"alice\" })).map((issue) => issue.id),\n    [first],\n  );\n  assertEquals(\n    (await store.listIssues({ assignee: \"bob\" }))\n      .map((issue) => issue.id)\n      .sort(),\n    [first, second],\n  );\n  clock.tick();\n  const beforeRemove = (await store.getIssue(first))?.updated_at ?? 0;\n  await store.removeAssignee(first, \"alice\", \"maintainer\");\n  assert(\n    (await store.getIssue(first))?.updated_at &&\n      (await store.getIssue(first))?.updated_at > beforeRemove,\n    \"unassignment must touch the issue\",\n  );\n  assertEquals(await store.listIssues({ assignee: \"alice\" }), []);\n  const deltas = (\n    await store.listEvents({ entity: \"issue\", entityId: first })\n  ).map((event) => event.data);\n  assert(\n    deltas.some(\n      (data) =>\n        JSON.stringify(data) ===\n          JSON.stringify({\n            update_target: \"assignee\",\n            from: \"alice\",\n            to: null,\n          }),\n    ),\n    \"unassignment delta missing\",\n  );\n});\n\nDeno.test(\"blocking relationships form a strict DAG and blocked state is derived\", async () => {\n  const client = createTestSqlite();\n  const clock = createClock();\n  const store = createIssueStore(client, clock.now);\n  await store.initSchema();\n  const a = await store.createIssue({ title: \"A\", actor: \"alice\" });\n  const b = await store.createIssue({ title: \"B\", actor: \"alice\" });\n  const c = await store.createIssue({ title: \"C\", actor: \"alice\" });\n  const d = await store.createIssue({ title: \"D\", actor: \"alice\" });\n\n  await assertRejects(\n    () => store.addBlock(a, a, \"blocks\", \"alice\"),\n    \"cannot block itself\",\n  );\n  const beforeBlock = (await store.getIssue(a))?.updated_at ?? 0;\n  clock.tick();\n  await store.addBlock(a, b, \"blocks\", \"alice\");\n  const afterBlockA = await store.getIssue(a);\n  assertExists(afterBlockA);\n  assert(\n    afterBlockA.updated_at > beforeBlock,\n    \"block addition must touch the acting issue\",\n  );\n  const blockedB = await store.getIssue(b);\n  assertExists(blockedB);\n  assertEquals(blockedB.blocked, true);\n  await assertRejects(() => store.addBlock(b, a, \"blocks\", \"alice\"), \"cycle\");\n  await assertRejects(\n    () =>\n      client.execute({\n        sql:\n          \"INSERT INTO issue_tracker_issue_blocks (blocker_id, blocked_id) VALUES (?, ?)\",\n        args: [b, a],\n      }),\n    \"cycle\",\n  );\n  clock.tick();\n  await store.addBlock(b, c, \"blocks\", \"alice\");\n  await assertRejects(() => store.addBlock(c, a, \"blocks\", \"alice\"), \"cycle\");\n\n  clock.tick();\n  await store.closeIssue(b, \"alice\", \"completed\");\n  const closedBlocked = await store.getIssue(b);\n  assertExists(closedBlocked);\n  assertEquals(\n    closedBlocked.blocked,\n    true,\n    \"blocked state must not prevent close\",\n  );\n  clock.tick();\n  await store.closeIssue(a, \"alice\", \"completed\");\n  const unblocked = await store.getIssue(b);\n  assertExists(unblocked);\n  assertEquals(unblocked.blocked, false);\n  const blockEvents = (\n    await store.listEvents({ entity: \"issue\", entityId: a })\n  ).filter(\n    (event) =>\n      (event.data as { update_target?: string }).update_target === \"blocks\",\n  );\n  assertEquals(blockEvents.length, 1, \"one block edge must emit one event\");\n  assertEquals(blockEvents[0].data, {\n    update_target: \"blocks\",\n    from: null,\n    to: b,\n  });\n  clock.tick();\n  await store.addBlock(d, c, \"blocked_by\", \"alice\");\n  assertEquals(\n    (await store.listEvents({ entity: \"issue\", entityId: d })).at(-1)?.data,\n    { update_target: \"blocked_by\", from: null, to: c },\n  );\n  clock.tick();\n  const beforeUnlinkIssue = await store.getIssue(d);\n  assertExists(beforeUnlinkIssue);\n  const beforeUnlink = beforeUnlinkIssue.updated_at;\n  await store.removeBlock(d, c, \"blocked_by\", \"alice\");\n  const afterUnlink = await store.getIssue(d);\n  assertExists(afterUnlink);\n  assert(\n    afterUnlink.updated_at > beforeUnlink,\n    \"block removal must touch the acting issue\",\n  );\n});\n\nDeno.test(\"comments are editable and deletable, with snapshots, deltas, and parent touches\", async () => {\n  const client = createTestSqlite();\n  const clock = createClock();\n  const store = createIssueStore(client, clock.now);\n  await store.initSchema();\n  const issueId = await store.createIssue({\n    title: \"Comments\",\n    actor: \"alice\",\n  });\n  const initialIssue = await store.getIssue(issueId);\n  assertExists(initialIssue);\n  const initialTouch = initialIssue.updated_at;\n  clock.tick();\n  const commentId = await store.createComment({\n    issueId,\n    body: \"first\",\n    actor: \"bob\",\n  });\n  const afterComment = await store.getIssue(issueId);\n  assertExists(afterComment);\n  assert(\n    afterComment.updated_at > initialTouch,\n    \"comment creation must touch parent\",\n  );\n  assertEquals((await store.listComments(issueId))[0].author, \"bob\");\n  const createdTouch = afterComment.updated_at;\n  clock.tick();\n  await store.updateComment(commentId, \"edited\", \"carol\");\n  assertEquals((await store.listComments(issueId))[0].body, \"edited\");\n  const afterEdit = await store.getIssue(issueId);\n  assertExists(afterEdit);\n  const editedTouch = afterEdit.updated_at;\n  assert(\n    editedTouch > createdTouch,\n    \"comment editing must touch the parent issue\",\n  );\n  clock.tick();\n  await store.deleteComment(commentId, \"dana\");\n  const afterDeleteComment = await store.getIssue(issueId);\n  assertExists(afterDeleteComment);\n  assert(\n    afterDeleteComment.updated_at > editedTouch,\n    \"comment deletion must touch the parent issue\",\n  );\n  assertEquals(await store.listComments(issueId), []);\n  const events = await store.listEvents({\n    entity: \"comment\",\n    entityId: commentId,\n  });\n  assertEquals(\n    events.map((event) => event.event_type),\n    [\"comment.created\", \"comment.updated\", \"comment.deleted\"],\n  );\n  assertEquals(events[1].data, {\n    update_target: \"body\",\n    from: \"first\",\n    to: \"edited\",\n  });\n  assertEquals((events[2].data as { body: string }).body, \"edited\");\n\n  clock.tick();\n  const cascadedId = await store.createComment({\n    issueId,\n    body: \"cascade\",\n    actor: \"erin\",\n  });\n  const otherId = await store.createIssue({ title: \"Other\", actor: \"erin\" });\n  const bug = (await store.listLabels()).find((label) => label.name === \"bug\");\n  assertExists(bug);\n  await store.addLabel(issueId, bug.id, \"erin\");\n  await store.addAssignee(issueId, \"erin\", \"erin\");\n  await store.addBlock(issueId, otherId, \"blocks\", \"erin\");\n  clock.tick();\n  await store.deleteIssue(issueId, \"maintainer\");\n  assertEquals(\n    (await store.listEvents({ entity: \"comment\", entityId: cascadedId })).at(-1)\n      ?.event_type,\n    \"comment.deleted\",\n  );\n  const deletionDeltas = (\n    await store.listEvents({\n      entity: \"issue\",\n      entityId: issueId,\n    })\n  )\n    .filter((event) => event.event_type === \"issue.updated\")\n    .map((event) => event.data);\n  for (\n    const expected of [\n      { update_target: \"label\", from: \"bug\", to: null },\n      { update_target: \"assignee\", from: \"erin\", to: null },\n      { update_target: \"blocks\", from: otherId, to: null },\n    ]\n  ) {\n    assert(\n      deletionDeltas.some(\n        (data) => JSON.stringify(data) === JSON.stringify(expected),\n      ),\n      `issue deletion delta missing: ${JSON.stringify(expected)}`,\n    );\n  }\n});\n\nDeno.test(\"old-schema migration is lossless and idempotent\", async () => {\n  const client = createTestSqlite();\n  client.database.exec(`\n\t\tCREATE TABLE issue_tracker_issues (\n\t\t\tid INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\ttitle TEXT NOT NULL,\n\t\t\tdescription TEXT DEFAULT '',\n\t\t\tstatus TEXT DEFAULT 'open',\n\t\t\tpriority TEXT DEFAULT 'normal',\n\t\t\tlabels TEXT DEFAULT '[]',\n\t\t\tassignee TEXT,\n\t\t\tcreated_by TEXT NOT NULL,\n\t\t\tcreated_at INTEGER NOT NULL,\n\t\t\tupdated_at INTEGER NOT NULL\n\t\t);\n\t\tCREATE TABLE issue_tracker_comments (\n\t\t\tid INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\tissue_id INTEGER NOT NULL,\n\t\t\tbody TEXT NOT NULL,\n\t\t\tauthor TEXT NOT NULL,\n\t\t\tcreated_at INTEGER NOT NULL,\n\t\t\tFOREIGN KEY (issue_id) REFERENCES issue_tracker_issues(id) ON DELETE CASCADE\n\t\t);\n\t\tINSERT INTO issue_tracker_issues VALUES\n\t\t\t(1, 'Working', 'legacy body', 'in_progress', 'urgent', '[\"bug\",\"custom\"]', '@alice', 'owner', 100, 200),\n\t\t\t(2, 'Done', '', 'closed', 'low', '[]', NULL, 'owner', 110, 210);\n\t\tINSERT INTO issue_tracker_comments VALUES (7, 1, 'legacy comment', 'commenter', 150);\n\t`);\n  const clock = createClock(1_800_000_000_000);\n  const store = createIssueStore(client, clock.now);\n  await store.initSchema();\n\n  const first = await store.getIssue(1);\n  assertExists(first);\n  assertEquals(\n    {\n      body: first.body,\n      status: first.status,\n      state_reason: first.state_reason,\n      labels: first.labels.map((label) => label.name),\n      assignees: first.assignees,\n      creator: first.creator,\n    },\n    {\n      body: \"legacy body\",\n      status: \"open\",\n      state_reason: null,\n      labels: [\"bug\", \"custom\"],\n      assignees: [\"alice\"],\n      creator: \"owner\",\n    },\n  );\n  const second = await store.getIssue(2);\n  assertExists(second);\n  assertEquals(second.state_reason, \"completed\");\n  assertEquals((await store.listComments(1))[0], {\n    id: 7,\n    issue_id: 1,\n    body: \"legacy comment\",\n    created_at: 150,\n    updated_at: 150,\n    author: \"commenter\",\n  });\n  assertEquals(\n    (await store.listEvents({ entity: \"issue\", entityId: 1 }))[0].event_type,\n    \"issue.created\",\n  );\n  assertEquals(\n    (await store.listEvents({ entity: \"comment\", entityId: 7 }))[0].event_type,\n    \"comment.created\",\n  );\n\n  const eventCount = (await store.listEvents()).length;\n  const labels = (await store.listLabels()).map((label) => label.name);\n  await store.initSchema();\n  assertEquals((await store.listEvents()).length, eventCount);\n  assertEquals(\n    (await store.listLabels()).map((label) => label.name),\n    labels,\n  );\n  const columns = client.database\n    .prepare(\"PRAGMA table_info(issue_tracker_issues)\")\n    .all()\n    .map((row) => String(row.name));\n  assertEquals(columns, [\n    \"id\",\n    \"title\",\n    \"body\",\n    \"status\",\n    \"state_reason\",\n    \"created_at\",\n    \"updated_at\",\n  ]);\n  assertEquals(\n    client.database\n      .prepare(\"SELECT name FROM sqlite_master WHERE name LIKE '%_legacy'\")\n      .all(),\n    [],\n  );\n});\n\nDeno.test(\"old-schema migration resumes after the issue table was already renamed\", async () => {\n  const client = createTestSqlite();\n  client.database.exec(`\n    CREATE TABLE issue_tracker_issues (\n      id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT NOT NULL,\n      description TEXT, status TEXT, priority TEXT, labels TEXT,\n      assignee TEXT, created_by TEXT, created_at INTEGER, updated_at INTEGER\n    );\n    CREATE TABLE issue_tracker_comments (\n      id INTEGER PRIMARY KEY AUTOINCREMENT, issue_id INTEGER NOT NULL,\n      body TEXT NOT NULL, author TEXT NOT NULL, created_at INTEGER NOT NULL\n    );\n    INSERT INTO issue_tracker_issues VALUES\n      (1, 'Interrupted', 'body', 'open', 'normal', '[]', NULL, 'owner', 1, 2);\n    INSERT INTO issue_tracker_comments VALUES (1, 1, 'still here', 'alice', 2);\n    ALTER TABLE issue_tracker_issues RENAME TO issue_tracker_issues_legacy;\n  `);\n  const store = createIssueStore(client);\n  await store.initSchema();\n  assertEquals((await store.getIssue(1))?.body, \"body\");\n  assertEquals((await store.listComments(1))[0].author, \"alice\");\n  await store.initSchema();\n  assertEquals((await store.listComments(1)).length, 1);\n});\n\nDeno.test(\"store drives writes through transactions, never top-level batch\", async () => {\n  const base = createTestSqlite();\n  // A client whose top-level `batch` throws: if `db.ts` still depended on it,\n  // every multi-statement write below would fail.\n  const client = {\n    database: base.database,\n    execute: base.execute,\n    transaction: base.transaction,\n    batch() {\n      throw new Error(\"top-level batch must never be called\");\n    },\n  };\n  const store = createIssueStore(client, createClock().now);\n  await store.initSchema();\n\n  const issueId = await store.createIssue({\n    title: \"No batch\",\n    body: \"b\",\n    actor: \"alice\",\n  });\n  await store.updateIssue(issueId, { title: \"Renamed\" }, \"bob\");\n  const bug = (await store.listLabels()).find((label) => label.name === \"bug\");\n  assertExists(bug);\n  await store.addLabel(issueId, bug.id, \"bob\");\n  await store.addAssignee(issueId, \"carol\", \"bob\");\n  const otherId = await store.createIssue({ title: \"Other\", actor: \"alice\" });\n  await store.addBlock(issueId, otherId, \"blocks\", \"bob\");\n  const commentId = await store.createComment({\n    issueId,\n    body: \"hi\",\n    actor: \"bob\",\n  });\n  await store.updateComment(commentId, \"edited\", \"bob\");\n  await store.closeIssue(issueId, \"bob\", \"completed\");\n  await store.reopenIssue(issueId, \"bob\");\n  const labelId = await store.createLabel({\n    name: \"extra\",\n    color: \"aabbcc\",\n    actor: \"bob\",\n  });\n  await store.updateLabel(labelId, { name: \"extra2\" }, \"bob\");\n  await store.removeLabel(issueId, bug.id, \"bob\");\n  await store.deleteLabel(labelId, \"bob\");\n  await store.deleteComment(commentId, \"bob\");\n  await store.deleteIssue(issueId, \"bob\");\n\n  // Everything above succeeded without the throwing batch ever firing.\n  assertEquals(\n    (await store.listIssues()).map((issue) => issue.id),\n    [otherId],\n  );\n});\n\nDeno.test(\"a forced event-insert failure rolls back the entity mutation\", async () => {\n  const base = createTestSqlite();\n  await createIssueStore(base, createClock().now).initSchema();\n\n  // Same in-memory database, but every event insert inside a transaction fails.\n  const faulty = createIssueStore(\n    {\n      execute: base.execute,\n      async transaction(mode?: \"write\" | \"read\" | \"deferred\") {\n        const tx = await base.transaction(mode);\n        return {\n          execute(statement: string | { sql: string; args?: unknown[] }) {\n            const sql = typeof statement === \"string\"\n              ? statement\n              : statement.sql;\n            if (/INSERT INTO issue_tracker_events/i.test(sql)) {\n              return Promise.reject(new Error(\"forced event insert failure\"));\n            }\n            return tx.execute(statement);\n          },\n          commit: () => tx.commit(),\n          rollback: () => tx.rollback(),\n        };\n      },\n    },\n    createClock().now,\n  );\n\n  await assertRejects(\n    () => faulty.createIssue({ title: \"Doomed\", actor: \"alice\" }),\n    Error,\n    \"forced event insert failure\",\n  );\n  // The issue INSERT that preceded the failing event insert must be rolled back.\n  assertEquals(\n    Number(\n      base.database\n        .prepare(\"SELECT COUNT(*) AS n FROM issue_tracker_issues\")\n        .get()?.n,\n    ),\n    0,\n  );\n  assertEquals(\n    Number(\n      base.database\n        .prepare(\n          \"SELECT COUNT(*) AS n FROM issue_tracker_events WHERE event_type = 'issue.created'\",\n        )\n        .get()?.n,\n    ),\n    0,\n  );\n});\n\nDeno.test(\"createIssue and createLabel return the entity id, not an event id\", async () => {\n  const client = createTestSqlite();\n  const store = createIssueStore(client, createClock().now);\n  await store.initSchema();\n\n  // Accumulate many event rows so the events table's rowid diverges sharply\n  // from the entity rowids. A broken aggregate batch would surface an event id.\n  for (let i = 0; i < 5; i++) {\n    const seedId = await store.createIssue({ title: `Seed ${i}`, actor: \"al\" });\n    await store.updateIssue(seedId, { body: `body ${i}` }, \"al\");\n    await store.createComment({ issueId: seedId, body: \"c\", actor: \"al\" });\n  }\n\n  const issueId = await store.createIssue({ title: \"Fresh\", actor: \"al\" });\n  const issue = await store.getIssue(issueId);\n  assertExists(issue);\n  assertEquals(issue.title, \"Fresh\");\n  const maxEventIdAfterIssue = Math.max(\n    ...(await store.listEvents()).map((event) => event.id),\n  );\n  assert(\n    issueId < maxEventIdAfterIssue,\n    \"createIssue returned an event id instead of the issue id\",\n  );\n\n  const labelId = await store.createLabel({\n    name: \"triage\",\n    color: \"abcdef\",\n    actor: \"al\",\n  });\n  const label = await store.getLabel(labelId);\n  assertExists(label);\n  assertEquals(label.name, \"triage\");\n  const maxEventIdAfterLabel = Math.max(\n    ...(await store.listEvents()).map((event) => event.id),\n  );\n  assert(\n    labelId < maxEventIdAfterLabel,\n    \"createLabel returned an event id instead of the label id\",\n  );\n});\n",[219],"4ca36858-2bef-47b1-91ba-5183abc6ede2","db.ts","8f4470ca-7b3c-11f1-b527-1607ee4eb77e",232,["D",1784052698661],6,"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport const ISSUE_STATUSES = [\"open\", \"closed\"] as const;\nexport const CLOSED_STATE_REASONS = [\n  \"completed\",\n  \"not_planned\",\n  \"duplicate\",\n] as const;\nexport type IssueStatus = (typeof ISSUE_STATUSES)[number];\nexport type ClosedStateReason = (typeof CLOSED_STATE_REASONS)[number];\nexport type StateReason = ClosedStateReason | \"reopened\" | null;\n\nexport type HttpErrorStatus = 400 | 404 | 409;\n\n/** A domain error carrying the HTTP status the JSON API should map it to. */\nexport class HttpError extends Error {\n  readonly status: HttpErrorStatus;\n  constructor(status: HttpErrorStatus, message: string) {\n    super(message);\n    this.name = \"HttpError\";\n    this.status = status;\n  }\n}\n\nexport interface Label {\n  id: number;\n  name: string;\n  color: string;\n  created_at: number;\n  updated_at: number;\n}\n\nexport interface IssueReference {\n  id: number;\n  title: string;\n  status: IssueStatus;\n  state_reason: StateReason;\n}\n\nexport interface Issue extends IssueReference {\n  body: string;\n  created_at: number;\n  updated_at: number;\n  creator: string | null;\n  labels: Label[];\n  assignees: string[];\n  blockers: IssueReference[];\n  blocks: IssueReference[];\n  blocked: boolean;\n}\n\nexport interface Comment {\n  id: number;\n  issue_id: number;\n  body: string;\n  created_at: number;\n  updated_at: number;\n  author: string | null;\n}\n\nexport type EventType =\n  | \"issue.created\"\n  | \"issue.updated\"\n  | \"issue.deleted\"\n  | \"comment.created\"\n  | \"comment.updated\"\n  | \"comment.deleted\"\n  | \"label.created\"\n  | \"label.updated\"\n  | \"label.deleted\";\n\nexport interface TrackerEvent {\n  id: number;\n  event_type: EventType;\n  entity_id: number;\n  actor: string;\n  data: unknown;\n  event_timestamp: number;\n}\n\ntype SqlValue = null | string | number | bigint | boolean | Uint8Array;\ntype Statement = string | { sql: string; args?: SqlValue[] };\n\nexport interface ExecuteResult {\n  rows: Record<string, unknown>[];\n  rowsAffected: number;\n  lastInsertRowid?: bigint;\n}\n\n/**\n * The subset of the libsql `Transaction` contract `db.ts` relies on. A\n * transaction shares one connection, so sequential `execute` calls see each\n * other's writes (including `last_insert_rowid()`) and are isolated until\n * `commit`. `rollback` discards every buffered statement.\n */\nexport interface SqliteTransaction {\n  execute(statement: Statement): Promise<ExecuteResult>;\n  commit(): Promise<void>;\n  rollback(): Promise<void>;\n}\n\nexport interface SqliteClient {\n  execute(statement: Statement): Promise<ExecuteResult>;\n  transaction(mode?: \"write\" | \"read\" | \"deferred\"): Promise<SqliteTransaction>;\n}\n\nconst TABLES = {\n  issues: \"issue_tracker_issues\",\n  comments: \"issue_tracker_comments\",\n  labels: \"issue_tracker_labels\",\n  issueLabels: \"issue_tracker_issue_labels\",\n  assignees: \"issue_tracker_issue_assignees\",\n  blocks: \"issue_tracker_issue_blocks\",\n  events: \"issue_tracker_events\",\n} as const;\n\nexport const DEFAULT_LABELS = [\n  { name: \"bug\", color: \"d73a4a\" },\n  { name: \"enhancement\", color: \"a2eeef\" },\n  { name: \"documentation\", color: \"0075ca\" },\n  { name: \"question\", color: \"d876e3\" },\n  { name: \"duplicate\", color: \"cfd3d7\" },\n] as const;\n\nfunction number(value: unknown): number {\n  return Number(value);\n}\n\nfunction parseJson(value: unknown): unknown {\n  if (typeof value !== \"string\") return value;\n  try {\n    return JSON.parse(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction normalizeColor(color: string): string {\n  const normalized = color.replace(/^#/, \"\").toLowerCase();\n  if (!/^[0-9a-f]{6}$/.test(normalized)) {\n    throw new HttpError(\n      400,\n      \"Label color must be exactly six hexadecimal characters.\",\n    );\n  }\n  return normalized;\n}\n\nfunction labelSnapshot(label: Label) {\n  return {\n    id: label.id,\n    name: label.name,\n    color: label.color,\n    created_at: label.created_at,\n    updated_at: label.updated_at,\n  };\n}\n\nfunction commentSnapshot(comment: Omit<Comment, \"author\">) {\n  return {\n    id: comment.id,\n    issue_id: comment.issue_id,\n    body: comment.body,\n    created_at: comment.created_at,\n    updated_at: comment.updated_at,\n  };\n}\n\nexport function createIssueStore(\n  client: SqliteClient,\n  now: () => number = Date.now,\n) {\n  /**\n   * Run every statement inside a single atomic `\"write\"` transaction, mirroring\n   * the guarantee `sqlite.batch(stmts, \"write\")` was assumed to provide but\n   * never did for the resolved adapter. Statements execute sequentially on one\n   * connection, so parameterized args, `last_insert_rowid()`, and one result\n   * per statement are preserved. Any failure rolls the whole batch back and\n   * rethrows the original error; success commits.\n   */\n  async function atomicWrite(\n    statements: Statement[],\n  ): Promise<ExecuteResult[]> {\n    const transaction = await client.transaction(\"write\");\n    try {\n      const results: ExecuteResult[] = [];\n      for (const statement of statements) {\n        results.push(await transaction.execute(statement));\n      }\n      await transaction.commit();\n      return results;\n    } catch (error) {\n      try {\n        await transaction.rollback();\n      } catch {\n        // Preserve the original failure; a rollback error must not mask it.\n      }\n      throw error;\n    }\n  }\n\n  async function tableExists(name: string): Promise<boolean> {\n    const result = await client.execute({\n      sql:\n        \"SELECT 1 AS found FROM sqlite_master WHERE type = 'table' AND name = ?\",\n      args: [name],\n    });\n    return result.rows.length > 0;\n  }\n\n  async function tableColumns(name: string): Promise<string[]> {\n    if (!(await tableExists(name))) return [];\n    const result = await client.execute(`PRAGMA table_info(${name})`);\n    return result.rows.map((row) => String(row.name));\n  }\n\n  async function createFinalTables(): Promise<void> {\n    const labelsAreNew = !(await tableExists(TABLES.labels));\n    const statements: Statement[] = [\n      {\n        sql: `CREATE TABLE IF NOT EXISTS ${TABLES.issues} (\n\t\t\t\t\t\tid INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\t\t\ttitle TEXT NOT NULL,\n\t\t\t\t\t\tbody TEXT NOT NULL DEFAULT '',\n\t\t\t\t\t\tstatus TEXT NOT NULL DEFAULT 'open' CHECK (status IN ('open', 'closed')),\n\t\t\t\t\t\tstate_reason TEXT CHECK (\n\t\t\t\t\t\t\t(status = 'open' AND (state_reason IS NULL OR state_reason = 'reopened')) OR\n\t\t\t\t\t\t\t(status = 'closed' AND state_reason IN ('completed', 'not_planned', 'duplicate'))\n\t\t\t\t\t\t),\n\t\t\t\t\t\tcreated_at INTEGER NOT NULL,\n\t\t\t\t\t\tupdated_at INTEGER NOT NULL\n\t\t\t\t\t)`,\n      },\n      {\n        sql: `CREATE TABLE IF NOT EXISTS ${TABLES.comments} (\n\t\t\t\t\t\tid INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\t\t\tissue_id INTEGER NOT NULL,\n\t\t\t\t\t\tbody TEXT NOT NULL,\n\t\t\t\t\t\tcreated_at INTEGER NOT NULL,\n\t\t\t\t\t\tupdated_at INTEGER NOT NULL,\n\t\t\t\t\t\tFOREIGN KEY (issue_id) REFERENCES ${TABLES.issues}(id) ON DELETE CASCADE\n\t\t\t\t\t)`,\n      },\n      {\n        sql: `CREATE TABLE IF NOT EXISTS ${TABLES.labels} (\n\t\t\t\t\t\tid INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\t\t\tname TEXT NOT NULL UNIQUE,\n\t\t\t\t\t\tcolor TEXT NOT NULL CHECK (length(color) = 6 AND color NOT GLOB '*[^0-9A-Fa-f]*'),\n\t\t\t\t\t\tcreated_at INTEGER NOT NULL,\n\t\t\t\t\t\tupdated_at INTEGER NOT NULL\n\t\t\t\t\t)`,\n      },\n      {\n        sql: `CREATE TABLE IF NOT EXISTS ${TABLES.issueLabels} (\n\t\t\t\t\t\tissue_id INTEGER NOT NULL,\n\t\t\t\t\t\tlabel_id INTEGER NOT NULL,\n\t\t\t\t\t\tPRIMARY KEY (issue_id, label_id),\n\t\t\t\t\t\tFOREIGN KEY (issue_id) REFERENCES ${TABLES.issues}(id) ON DELETE CASCADE,\n\t\t\t\t\t\tFOREIGN KEY (label_id) REFERENCES ${TABLES.labels}(id) ON DELETE CASCADE\n\t\t\t\t\t)`,\n      },\n      {\n        sql: `CREATE TABLE IF NOT EXISTS ${TABLES.assignees} (\n\t\t\t\t\t\tissue_id INTEGER NOT NULL,\n\t\t\t\t\t\tuser_handle TEXT NOT NULL,\n\t\t\t\t\t\tPRIMARY KEY (issue_id, user_handle),\n\t\t\t\t\t\tFOREIGN KEY (issue_id) REFERENCES ${TABLES.issues}(id) ON DELETE CASCADE\n\t\t\t\t\t)`,\n      },\n      {\n        sql: `CREATE TABLE IF NOT EXISTS ${TABLES.blocks} (\n\t\t\t\t\t\tblocker_id INTEGER NOT NULL,\n\t\t\t\t\t\tblocked_id INTEGER NOT NULL,\n\t\t\t\t\t\tPRIMARY KEY (blocker_id, blocked_id),\n\t\t\t\t\t\tCHECK (blocker_id != blocked_id),\n\t\t\t\t\t\tFOREIGN KEY (blocker_id) REFERENCES ${TABLES.issues}(id) ON DELETE CASCADE,\n\t\t\t\t\t\tFOREIGN KEY (blocked_id) REFERENCES ${TABLES.issues}(id) ON DELETE CASCADE\n\t\t\t\t\t)`,\n      },\n      {\n        sql: `CREATE TABLE IF NOT EXISTS ${TABLES.events} (\n\t\t\t\t\t\tid INTEGER PRIMARY KEY AUTOINCREMENT,\n\t\t\t\t\t\tevent_type TEXT NOT NULL CHECK (event_type IN (\n\t\t\t\t\t\t\t'issue.created', 'issue.updated', 'issue.deleted',\n\t\t\t\t\t\t\t'comment.created', 'comment.updated', 'comment.deleted',\n\t\t\t\t\t\t\t'label.created', 'label.updated', 'label.deleted'\n\t\t\t\t\t\t)),\n\t\t\t\t\t\tentity_id INTEGER NOT NULL,\n\t\t\t\t\t\tactor TEXT NOT NULL,\n\t\t\t\t\t\tdata TEXT NOT NULL CHECK (json_valid(data)),\n\t\t\t\t\t\tevent_timestamp INTEGER NOT NULL\n\t\t\t\t\t)`,\n      },\n      `CREATE INDEX IF NOT EXISTS idx_${TABLES.issues}_status ON ${TABLES.issues}(status)`,\n      `CREATE INDEX IF NOT EXISTS idx_${TABLES.comments}_issue ON ${TABLES.comments}(issue_id)`,\n      `CREATE INDEX IF NOT EXISTS idx_${TABLES.assignees}_user ON ${TABLES.assignees}(user_handle)`,\n      `CREATE INDEX IF NOT EXISTS idx_${TABLES.blocks}_blocked ON ${TABLES.blocks}(blocked_id)`,\n      `CREATE INDEX IF NOT EXISTS idx_${TABLES.events}_entity ON ${TABLES.events}(event_type, entity_id, id)`,\n      {\n        sql: `CREATE TRIGGER IF NOT EXISTS issue_tracker_blocks_no_cycles\n            BEFORE INSERT ON ${TABLES.blocks}\n            BEGIN\n              SELECT CASE WHEN NEW.blocker_id = NEW.blocked_id OR EXISTS (\n                WITH RECURSIVE reachable(id) AS (\n                  SELECT blocked_id FROM ${TABLES.blocks} WHERE blocker_id = NEW.blocked_id\n                  UNION\n                  SELECT edge.blocked_id FROM ${TABLES.blocks} edge\n                  JOIN reachable ON edge.blocker_id = reachable.id\n                ) SELECT 1 FROM reachable WHERE id = NEW.blocker_id\n              ) THEN RAISE(ABORT, 'blocking relationship would create a cycle') END;\n            END`,\n      },\n      {\n        sql: `CREATE TRIGGER IF NOT EXISTS issue_tracker_events_no_update\n\t\t\t\t\t\tBEFORE UPDATE ON ${TABLES.events}\n\t\t\t\t\t\tBEGIN SELECT RAISE(ABORT, 'issue tracker events are append-only'); END`,\n      },\n      {\n        sql: `CREATE TRIGGER IF NOT EXISTS issue_tracker_events_no_delete\n\t\t\t\t\t\tBEFORE DELETE ON ${TABLES.events}\n\t\t\t\t\t\tBEGIN SELECT RAISE(ABORT, 'issue tracker events are append-only'); END`,\n      },\n    ];\n    if (labelsAreNew) {\n      const timestamp = now();\n      for (const label of DEFAULT_LABELS) {\n        statements.push(\n          {\n            sql:\n              `INSERT OR IGNORE INTO ${TABLES.labels} (name, color, created_at, updated_at) VALUES (?, ?, ?, ?)`,\n            args: [label.name, label.color, timestamp, timestamp],\n          },\n          {\n            sql:\n              `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n\t              SELECT 'label.created', label.id, 'system', json_object(\n\t                'id', label.id, 'name', label.name, 'color', label.color,\n\t                'created_at', label.created_at, 'updated_at', label.updated_at\n\t              ), ? FROM ${TABLES.labels} label\n\t              WHERE label.name = ? AND NOT EXISTS (\n\t                SELECT 1 FROM ${TABLES.events}\n\t                WHERE event_type = 'label.created' AND entity_id = label.id\n\t              )`,\n            args: [timestamp, label.name],\n          },\n        );\n      }\n    }\n    await atomicWrite(statements);\n  }\n\n  async function emitCreatedLabel(\n    name: string,\n    color: string,\n    actor: string,\n    timestamp: number,\n  ): Promise<number> {\n    const results = await atomicWrite([\n      {\n        sql:\n          `INSERT INTO ${TABLES.labels} (name, color, created_at, updated_at) VALUES (?, ?, ?, ?)`,\n        args: [name, color, timestamp, timestamp],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n\t\t\t\t\t\tSELECT 'label.created', id, ?, json_object(\n\t\t\t\t\t\t\t'id', id, 'name', name, 'color', color,\n\t\t\t\t\t\t\t'created_at', created_at, 'updated_at', updated_at\n\t\t\t\t\t\t), ? FROM ${TABLES.labels} WHERE id = last_insert_rowid()`,\n        args: [actor, timestamp],\n      },\n    ]);\n    return number(results[0].lastInsertRowid);\n  }\n\n  async function migrateLegacyRows(): Promise<void> {\n    const legacyIssues = \"issue_tracker_issues_legacy\";\n    if (!(await tableExists(legacyIssues))) return;\n    const issueRows = (await client.execute(`SELECT * FROM ${legacyIssues}`))\n      .rows;\n    const legacyComments = \"issue_tracker_comments_legacy\";\n    const commentRows = (await tableExists(legacyComments))\n      ? (await client.execute(`SELECT * FROM ${legacyComments}`)).rows\n      : [];\n    const timestamp = now();\n    const statements: Statement[] = [];\n\n    for (const row of issueRows) {\n      const id = number(row.id);\n      const status: IssueStatus = row.status === \"closed\" ? \"closed\" : \"open\";\n      const stateReason: StateReason = status === \"closed\" ? \"completed\" : null;\n      const createdAt = number(row.created_at);\n      const updatedAt = number(row.updated_at);\n      const snapshot = {\n        id,\n        title: String(row.title),\n        body: String(row.description ?? \"\"),\n        status,\n        state_reason: stateReason,\n        created_at: createdAt,\n        updated_at: updatedAt,\n      };\n      const actor = String(row.created_by ?? \"migration\");\n      statements.push(\n        {\n          sql: `INSERT OR IGNORE INTO ${TABLES.issues}\n\t\t\t\t\t\t(id, title, body, status, state_reason, created_at, updated_at)\n\t\t\t\t\t\tVALUES (?, ?, ?, ?, ?, ?, ?)`,\n          args: [\n            id,\n            snapshot.title,\n            snapshot.body,\n            status,\n            stateReason,\n            createdAt,\n            updatedAt,\n          ],\n        },\n        {\n          sql:\n            `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n\t\t\t\t\t\tSELECT 'issue.created', ?, ?, ?, ?\n\t\t\t\t\t\tWHERE NOT EXISTS (SELECT 1 FROM ${TABLES.events} WHERE event_type = 'issue.created' AND entity_id = ?)`,\n          args: [id, actor, JSON.stringify(snapshot), createdAt, id],\n        },\n      );\n\n      let legacyLabels: string[] = [];\n      try {\n        const parsed = JSON.parse(String(row.labels ?? \"[]\"));\n        if (Array.isArray(parsed)) {\n          legacyLabels = parsed.filter((item) => typeof item === \"string\");\n        }\n      } catch {\n        legacyLabels = [];\n      }\n      for (const name of legacyLabels) {\n        const color = DEFAULT_LABELS.find((label) =>\n          label.name === name\n        )?.color ??\n          \"8b949e\";\n        statements.push(\n          {\n            sql:\n              `INSERT OR IGNORE INTO ${TABLES.labels} (name, color, created_at, updated_at) VALUES (?, ?, ?, ?)`,\n            args: [name, color, timestamp, timestamp],\n          },\n          {\n            sql:\n              `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n\t\t\t\t\t\t\tSELECT 'label.created', id, 'migration', json_object(\n\t\t\t\t\t\t\t\t'id', id, 'name', name, 'color', color,\n\t\t\t\t\t\t\t\t'created_at', created_at, 'updated_at', updated_at\n\t\t\t\t\t\t\t), ? FROM ${TABLES.labels} label\n\t\t\t\t\t\t\tWHERE name = ? AND NOT EXISTS (\n\t\t\t\t\t\t\t\tSELECT 1 FROM ${TABLES.events} WHERE event_type = 'label.created' AND entity_id = label.id\n\t\t\t\t\t\t\t)`,\n            args: [timestamp, name],\n          },\n          {\n            sql:\n              `INSERT OR IGNORE INTO ${TABLES.issueLabels} (issue_id, label_id)\n\t\t\t\t\t\t\tSELECT ?, id FROM ${TABLES.labels} WHERE name = ?`,\n            args: [id, name],\n          },\n          {\n            sql:\n              `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n\t\t\t\t\t\t\tSELECT 'issue.updated', ?, ?, ?, ? WHERE NOT EXISTS (\n\t\t\t\t\t\t\t\tSELECT 1 FROM ${TABLES.events} WHERE event_type = 'issue.updated' AND entity_id = ? AND data = ?\n\t\t\t\t\t\t\t)`,\n            args: [\n              id,\n              actor,\n              JSON.stringify({ update_target: \"label\", from: null, to: name }),\n              updatedAt,\n              id,\n              JSON.stringify({ update_target: \"label\", from: null, to: name }),\n            ],\n          },\n        );\n      }\n\n      const assignee = typeof row.assignee === \"string\"\n        ? row.assignee.trim().replace(/^@/, \"\")\n        : \"\";\n      if (assignee) {\n        const data = JSON.stringify({\n          update_target: \"assignee\",\n          from: null,\n          to: assignee,\n        });\n        statements.push(\n          {\n            sql:\n              `INSERT OR IGNORE INTO ${TABLES.assignees} (issue_id, user_handle) VALUES (?, ?)`,\n            args: [id, assignee],\n          },\n          {\n            sql:\n              `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n\t\t\t\t\t\t\tSELECT 'issue.updated', ?, ?, ?, ? WHERE NOT EXISTS (\n\t\t\t\t\t\t\t\tSELECT 1 FROM ${TABLES.events} WHERE event_type = 'issue.updated' AND entity_id = ? AND data = ?\n\t\t\t\t\t\t\t)`,\n            args: [id, actor, data, updatedAt, id, data],\n          },\n        );\n      }\n    }\n\n    for (const row of commentRows) {\n      const id = number(row.id);\n      const issueId = number(row.issue_id);\n      const createdAt = number(row.created_at);\n      const snapshot = {\n        id,\n        issue_id: issueId,\n        body: String(row.body),\n        created_at: createdAt,\n        updated_at: createdAt,\n      };\n      statements.push(\n        {\n          sql: `INSERT OR IGNORE INTO ${TABLES.comments}\n\t\t\t\t\t\t(id, issue_id, body, created_at, updated_at) VALUES (?, ?, ?, ?, ?)`,\n          args: [id, issueId, snapshot.body, createdAt, createdAt],\n        },\n        {\n          sql:\n            `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n\t\t\t\t\t\tSELECT 'comment.created', ?, ?, ?, ? WHERE NOT EXISTS (\n\t\t\t\t\t\t\tSELECT 1 FROM ${TABLES.events} WHERE event_type = 'comment.created' AND entity_id = ?\n\t\t\t\t\t\t)`,\n          args: [\n            id,\n            String(row.author ?? \"migration\"),\n            JSON.stringify(snapshot),\n            createdAt,\n            id,\n          ],\n        },\n      );\n    }\n    statements.push(\n      `DROP TABLE IF EXISTS ${legacyComments}`,\n      `DROP TABLE ${legacyIssues}`,\n    );\n    await atomicWrite(statements);\n  }\n\n  async function initSchema(): Promise<void> {\n    await client.execute(\"PRAGMA foreign_keys = ON\");\n    if (!(await tableExists(TABLES.issues)) && (await tableExists(\"issues\"))) {\n      await client.execute(`ALTER TABLE issues RENAME TO ${TABLES.issues}`);\n    }\n    if (\n      !(await tableExists(TABLES.comments)) &&\n      (await tableExists(\"comments\"))\n    ) {\n      await client.execute(`ALTER TABLE comments RENAME TO ${TABLES.comments}`);\n    }\n\n    const columns = await tableColumns(TABLES.issues);\n    if (\n      columns.includes(\"description\") &&\n      !(await tableExists(\"issue_tracker_issues_legacy\"))\n    ) {\n      await client.execute(\n        `ALTER TABLE ${TABLES.issues} RENAME TO issue_tracker_issues_legacy`,\n      );\n      if (await tableExists(TABLES.comments)) {\n        await client.execute(\n          `ALTER TABLE ${TABLES.comments} RENAME TO issue_tracker_comments_legacy`,\n        );\n      }\n    }\n\n    if (\n      (await tableExists(\"issue_tracker_issues_legacy\")) &&\n      !(await tableExists(\"issue_tracker_comments_legacy\")) &&\n      (await tableColumns(TABLES.comments)).includes(\"author\")\n    ) {\n      await client.execute(\n        `ALTER TABLE ${TABLES.comments} RENAME TO issue_tracker_comments_legacy`,\n      );\n    }\n\n    await createFinalTables();\n    await migrateLegacyRows();\n  }\n\n  async function getBaseIssue(id: number) {\n    const result = await client.execute({\n      sql: `SELECT * FROM ${TABLES.issues} WHERE id = ?`,\n      args: [id],\n    });\n    const row = result.rows[0];\n    if (!row) return null;\n    return {\n      id: number(row.id),\n      title: String(row.title),\n      body: String(row.body),\n      status: row.status as IssueStatus,\n      state_reason: (row.state_reason ?? null) as StateReason,\n      created_at: number(row.created_at),\n      updated_at: number(row.updated_at),\n    };\n  }\n\n  async function getIssue(id: number): Promise<Issue | null> {\n    const issue = await getBaseIssue(id);\n    if (!issue) return null;\n    const [labelRows, assigneeRows, blockerRows, blocksRows, creatorRows] =\n      await Promise.all([\n        client.execute({\n          sql: `SELECT label.* FROM ${TABLES.labels} label\n\t\t\t\t\tJOIN ${TABLES.issueLabels} link ON link.label_id = label.id\n\t\t\t\t\tWHERE link.issue_id = ? ORDER BY label.name`,\n          args: [id],\n        }),\n        client.execute({\n          sql:\n            `SELECT user_handle FROM ${TABLES.assignees} WHERE issue_id = ? ORDER BY user_handle`,\n          args: [id],\n        }),\n        client.execute({\n          sql: `SELECT issue.id, issue.title, issue.status, issue.state_reason\n\t\t\t\t\tFROM ${TABLES.blocks} edge JOIN ${TABLES.issues} issue ON issue.id = edge.blocker_id\n\t\t\t\t\tWHERE edge.blocked_id = ? ORDER BY issue.id`,\n          args: [id],\n        }),\n        client.execute({\n          sql: `SELECT issue.id, issue.title, issue.status, issue.state_reason\n\t\t\t\t\tFROM ${TABLES.blocks} edge JOIN ${TABLES.issues} issue ON issue.id = edge.blocked_id\n\t\t\t\t\tWHERE edge.blocker_id = ? ORDER BY issue.id`,\n          args: [id],\n        }),\n        client.execute({\n          sql: `SELECT actor FROM ${TABLES.events}\n\t\t\t\t\tWHERE event_type = 'issue.created' AND entity_id = ? ORDER BY id LIMIT 1`,\n          args: [id],\n        }),\n      ]);\n    const labels: Label[] = labelRows.rows.map((row) => ({\n      id: number(row.id),\n      name: String(row.name),\n      color: String(row.color),\n      created_at: number(row.created_at),\n      updated_at: number(row.updated_at),\n    }));\n    const toReference = (row: Record<string, unknown>): IssueReference => ({\n      id: number(row.id),\n      title: String(row.title),\n      status: row.status as IssueStatus,\n      state_reason: (row.state_reason ?? null) as StateReason,\n    });\n    const blockers = blockerRows.rows.map(toReference);\n    return {\n      ...issue,\n      creator: creatorRows.rows[0] ? String(creatorRows.rows[0].actor) : null,\n      labels,\n      assignees: assigneeRows.rows.map((row) => String(row.user_handle)),\n      blockers,\n      blocks: blocksRows.rows.map(toReference),\n      blocked: blockers.some((blocker) => blocker.status === \"open\"),\n    };\n  }\n\n  async function listIssues(\n    opts: {\n      status?: IssueStatus;\n      label?: string;\n      assignee?: string;\n      search?: string;\n    } = {},\n  ): Promise<Issue[]> {\n    let sql = `SELECT issue.id FROM ${TABLES.issues} issue`;\n    const conditions: string[] = [];\n    const args: SqlValue[] = [];\n    if (opts.status) {\n      conditions.push(\"issue.status = ?\");\n      args.push(opts.status);\n    }\n    if (opts.label) {\n      conditions.push(\n        `EXISTS (SELECT 1 FROM ${TABLES.issueLabels} il JOIN ${TABLES.labels} l ON l.id = il.label_id WHERE il.issue_id = issue.id AND l.name = ?)`,\n      );\n      args.push(opts.label);\n    }\n    if (opts.assignee) {\n      conditions.push(\n        `EXISTS (SELECT 1 FROM ${TABLES.assignees} ia WHERE ia.issue_id = issue.id AND ia.user_handle = ?)`,\n      );\n      args.push(opts.assignee);\n    }\n    if (opts.search) {\n      conditions.push(\"(issue.title LIKE ? OR issue.body LIKE ?)\");\n      args.push(`%${opts.search}%`, `%${opts.search}%`);\n    }\n    if (conditions.length) sql += ` WHERE ${conditions.join(\" AND \")}`;\n    sql += \" ORDER BY issue.updated_at DESC, issue.id DESC\";\n    const result = await client.execute({ sql, args });\n    return (\n      await Promise.all(result.rows.map((row) => getIssue(number(row.id))))\n    ).filter((issue): issue is Issue => issue !== null);\n  }\n\n  async function createIssue(data: {\n    title: string;\n    body?: string;\n    actor: string;\n  }): Promise<number> {\n    const timestamp = now();\n    const results = await atomicWrite([\n      {\n        sql:\n          `INSERT INTO ${TABLES.issues} (title, body, status, state_reason, created_at, updated_at)\n\t\t\t\t\t\tVALUES (?, ?, 'open', NULL, ?, ?)`,\n        args: [data.title, data.body ?? \"\", timestamp, timestamp],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n\t\t\t\t\t\tSELECT 'issue.created', id, ?, json_object(\n\t\t\t\t\t\t\t'id', id, 'title', title, 'body', body, 'status', status,\n\t\t\t\t\t\t\t'state_reason', state_reason, 'created_at', created_at, 'updated_at', updated_at\n\t\t\t\t\t\t), ? FROM ${TABLES.issues} WHERE id = last_insert_rowid()`,\n        args: [data.actor, timestamp],\n      },\n    ]);\n    return number(results[0].lastInsertRowid);\n  }\n\n  async function updateIssue(\n    id: number,\n    data: Partial<{ title: string; body: string }>,\n    actor: string,\n  ): Promise<void> {\n    const existing = await getBaseIssue(id);\n    if (!existing) throw new HttpError(404, `Issue #${id} not found.`);\n    const changes = ([\"title\", \"body\"] as const)\n      .filter(\n        (field) => data[field] !== undefined && data[field] !== existing[field],\n      )\n      .map((field) => ({\n        field,\n        from: existing[field],\n        to: data[field] as string,\n      }));\n    if (!changes.length) return;\n    const timestamp = now();\n    const statements: Statement[] = [\n      {\n        sql: `UPDATE ${TABLES.issues} SET ${\n          changes\n            .map((change) => `${change.field} = ?`)\n            .join(\", \")\n        }, updated_at = ? WHERE id = ?`,\n        args: [...changes.map((change) => change.to), timestamp, id],\n      },\n      ...changes.map(\n        (change): Statement => ({\n          sql:\n            `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('issue.updated', ?, ?, ?, ?)`,\n          args: [\n            id,\n            actor,\n            JSON.stringify({\n              update_target: change.field,\n              from: change.from,\n              to: change.to,\n            }),\n            timestamp,\n          ],\n        }),\n      ),\n    ];\n    await atomicWrite(statements);\n  }\n\n  async function setLifecycle(\n    id: number,\n    actor: string,\n    status: IssueStatus,\n    stateReason: StateReason,\n  ): Promise<void> {\n    const existing = await getBaseIssue(id);\n    if (!existing) throw new HttpError(404, `Issue #${id} not found.`);\n    if (existing.status === status && existing.state_reason === stateReason) {\n      return;\n    }\n    const timestamp = now();\n    const statements: Statement[] = [\n      {\n        sql:\n          `UPDATE ${TABLES.issues} SET status = ?, state_reason = ?, updated_at = ? WHERE id = ?`,\n        args: [status, stateReason, timestamp, id],\n      },\n    ];\n    if (existing.status !== status) {\n      statements.push({\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('issue.updated', ?, ?, ?, ?)`,\n        args: [\n          id,\n          actor,\n          JSON.stringify({\n            update_target: \"status\",\n            from: existing.status,\n            to: status,\n          }),\n          timestamp,\n        ],\n      });\n    }\n    if (existing.state_reason !== stateReason) {\n      statements.push({\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('issue.updated', ?, ?, ?, ?)`,\n        args: [\n          id,\n          actor,\n          JSON.stringify({\n            update_target: \"state_reason\",\n            from: existing.state_reason,\n            to: stateReason,\n          }),\n          timestamp,\n        ],\n      });\n    }\n    await atomicWrite(statements);\n  }\n\n  async function closeIssue(\n    id: number,\n    actor: string,\n    reason: ClosedStateReason = \"completed\",\n  ) {\n    if (!CLOSED_STATE_REASONS.includes(reason)) {\n      throw new HttpError(400, \"Invalid close reason.\");\n    }\n    await setLifecycle(id, actor, \"closed\", reason);\n  }\n\n  async function reopenIssue(id: number, actor: string) {\n    await setLifecycle(id, actor, \"open\", \"reopened\");\n  }\n\n  async function deleteIssue(id: number, actor: string): Promise<void> {\n    if (!(await getBaseIssue(id))) {\n      throw new HttpError(404, `Issue #${id} not found.`);\n    }\n    const timestamp = now();\n    const statements: Statement[] = [\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n          SELECT 'issue.updated', ?, ?, json_object(\n            'update_target', 'label', 'from', label.name, 'to', NULL\n          ), ? FROM ${TABLES.issueLabels} link\n          JOIN ${TABLES.labels} label ON label.id = link.label_id\n          WHERE link.issue_id = ?`,\n        args: [id, actor, timestamp, id],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n          SELECT 'issue.updated', ?, ?, json_object(\n            'update_target', 'assignee', 'from', user_handle, 'to', NULL\n          ), ? FROM ${TABLES.assignees} WHERE issue_id = ?`,\n        args: [id, actor, timestamp, id],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n          SELECT 'issue.updated', ?, ?, json_object(\n            'update_target', 'blocks', 'from', blocked_id, 'to', NULL\n          ), ? FROM ${TABLES.blocks} WHERE blocker_id = ?`,\n        args: [id, actor, timestamp, id],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n          SELECT 'issue.updated', ?, ?, json_object(\n            'update_target', 'blocked_by', 'from', blocker_id, 'to', NULL\n          ), ? FROM ${TABLES.blocks} WHERE blocked_id = ?`,\n        args: [id, actor, timestamp, id],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n          SELECT 'comment.deleted', id, ?, json_object(\n            'id', id, 'issue_id', issue_id, 'body', body,\n            'created_at', created_at, 'updated_at', updated_at\n          ), ? FROM ${TABLES.comments} WHERE issue_id = ?`,\n        args: [actor, timestamp, id],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n          SELECT 'issue.deleted', id, ?, json_object(\n            'id', id, 'title', title, 'body', body, 'status', status,\n            'state_reason', state_reason, 'created_at', created_at, 'updated_at', updated_at\n          ), ? FROM ${TABLES.issues} WHERE id = ?`,\n        args: [actor, timestamp, id],\n      },\n      { sql: `DELETE FROM ${TABLES.issues} WHERE id = ?`, args: [id] },\n    ];\n    await atomicWrite(statements);\n  }\n\n  async function listLabels(): Promise<Label[]> {\n    const result = await client.execute(\n      `SELECT * FROM ${TABLES.labels} ORDER BY name`,\n    );\n    return result.rows.map((row) => ({\n      id: number(row.id),\n      name: String(row.name),\n      color: String(row.color),\n      created_at: number(row.created_at),\n      updated_at: number(row.updated_at),\n    }));\n  }\n\n  async function getLabel(id: number): Promise<Label | null> {\n    const result = await client.execute({\n      sql: `SELECT * FROM ${TABLES.labels} WHERE id = ?`,\n      args: [id],\n    });\n    const row = result.rows[0];\n    return row\n      ? {\n        id: number(row.id),\n        name: String(row.name),\n        color: String(row.color),\n        created_at: number(row.created_at),\n        updated_at: number(row.updated_at),\n      }\n      : null;\n  }\n\n  async function findLabelByName(name: string): Promise<Label | null> {\n    const result = await client.execute({\n      sql: `SELECT * FROM ${TABLES.labels} WHERE name = ?`,\n      args: [name],\n    });\n    const row = result.rows[0];\n    return row\n      ? {\n        id: number(row.id),\n        name: String(row.name),\n        color: String(row.color),\n        created_at: number(row.created_at),\n        updated_at: number(row.updated_at),\n      }\n      : null;\n  }\n\n  async function createLabel(data: {\n    name: string;\n    color: string;\n    actor: string;\n  }): Promise<number> {\n    const color = normalizeColor(data.color);\n    if (await findLabelByName(data.name)) {\n      throw new HttpError(409, `Label name \"${data.name}\" is already in use.`);\n    }\n    return await emitCreatedLabel(data.name, color, data.actor, now());\n  }\n\n  async function updateLabel(\n    id: number,\n    data: Partial<{ name: string; color: string }>,\n    actor: string,\n  ): Promise<void> {\n    const existing = await getLabel(id);\n    if (!existing) throw new HttpError(404, `Label #${id} not found.`);\n    if (data.color !== undefined) data.color = normalizeColor(data.color);\n    if (data.name !== undefined && data.name !== existing.name) {\n      const conflict = await findLabelByName(data.name);\n      if (conflict && conflict.id !== id) {\n        throw new HttpError(\n          409,\n          `Label name \"${data.name}\" is already in use.`,\n        );\n      }\n    }\n    const changes = ([\"name\", \"color\"] as const)\n      .filter(\n        (field) => data[field] !== undefined && data[field] !== existing[field],\n      )\n      .map((field) => ({\n        field,\n        from: existing[field],\n        to: data[field] as string,\n      }));\n    if (!changes.length) return;\n    const timestamp = now();\n    await atomicWrite([\n      {\n        sql: `UPDATE ${TABLES.labels} SET ${\n          changes\n            .map((change) => `${change.field} = ?`)\n            .join(\", \")\n        }, updated_at = ? WHERE id = ?`,\n        args: [...changes.map((change) => change.to), timestamp, id],\n      },\n      ...changes.map(\n        (change): Statement => ({\n          sql:\n            `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('label.updated', ?, ?, ?, ?)`,\n          args: [\n            id,\n            actor,\n            JSON.stringify({\n              update_target: change.field,\n              from: change.from,\n              to: change.to,\n            }),\n            timestamp,\n          ],\n        }),\n      ),\n    ]);\n  }\n\n  async function deleteLabel(id: number, actor: string): Promise<void> {\n    const label = await getLabel(id);\n    if (!label) throw new HttpError(404, `Label #${id} not found.`);\n    const links = await client.execute({\n      sql: `SELECT issue_id FROM ${TABLES.issueLabels} WHERE label_id = ?`,\n      args: [id],\n    });\n    const timestamp = now();\n    const statements: Statement[] = [\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('label.deleted', ?, ?, ?, ?)`,\n        args: [id, actor, JSON.stringify(labelSnapshot(label)), timestamp],\n      },\n    ];\n    for (const row of links.rows) {\n      const issueId = number(row.issue_id);\n      statements.push(\n        {\n          sql: `UPDATE ${TABLES.issues} SET updated_at = ? WHERE id = ?`,\n          args: [timestamp, issueId],\n        },\n        {\n          sql:\n            `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('issue.updated', ?, ?, ?, ?)`,\n          args: [\n            issueId,\n            actor,\n            JSON.stringify({\n              update_target: \"label\",\n              from: label.name,\n              to: null,\n            }),\n            timestamp,\n          ],\n        },\n      );\n    }\n    statements.push({\n      sql: `DELETE FROM ${TABLES.labels} WHERE id = ?`,\n      args: [id],\n    });\n    await atomicWrite(statements);\n  }\n\n  async function addLabel(\n    issueId: number,\n    labelId: number,\n    actor: string,\n  ): Promise<void> {\n    if (!(await getBaseIssue(issueId))) {\n      throw new HttpError(404, `Issue #${issueId} not found.`);\n    }\n    const label = await getLabel(labelId);\n    if (!label) throw new HttpError(404, `Label #${labelId} not found.`);\n    const existing = await client.execute({\n      sql:\n        `SELECT 1 FROM ${TABLES.issueLabels} WHERE issue_id = ? AND label_id = ?`,\n      args: [issueId, labelId],\n    });\n    if (existing.rows.length) return;\n    const timestamp = now();\n    await atomicWrite([\n      {\n        sql:\n          `INSERT INTO ${TABLES.issueLabels} (issue_id, label_id) VALUES (?, ?)`,\n        args: [issueId, labelId],\n      },\n      {\n        sql: `UPDATE ${TABLES.issues} SET updated_at = ? WHERE id = ?`,\n        args: [timestamp, issueId],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('issue.updated', ?, ?, ?, ?)`,\n        args: [\n          issueId,\n          actor,\n          JSON.stringify({\n            update_target: \"label\",\n            from: null,\n            to: label.name,\n          }),\n          timestamp,\n        ],\n      },\n    ]);\n  }\n\n  async function removeLabel(\n    issueId: number,\n    labelId: number,\n    actor: string,\n  ): Promise<void> {\n    if (!(await getBaseIssue(issueId))) {\n      throw new HttpError(404, `Issue #${issueId} not found.`);\n    }\n    const label = await getLabel(labelId);\n    if (!label) throw new HttpError(404, `Label #${labelId} not found.`);\n    const existing = await client.execute({\n      sql:\n        `SELECT 1 FROM ${TABLES.issueLabels} WHERE issue_id = ? AND label_id = ?`,\n      args: [issueId, labelId],\n    });\n    if (!existing.rows.length) return;\n    const timestamp = now();\n    await atomicWrite([\n      {\n        sql:\n          `DELETE FROM ${TABLES.issueLabels} WHERE issue_id = ? AND label_id = ?`,\n        args: [issueId, labelId],\n      },\n      {\n        sql: `UPDATE ${TABLES.issues} SET updated_at = ? WHERE id = ?`,\n        args: [timestamp, issueId],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('issue.updated', ?, ?, ?, ?)`,\n        args: [\n          issueId,\n          actor,\n          JSON.stringify({\n            update_target: \"label\",\n            from: label.name,\n            to: null,\n          }),\n          timestamp,\n        ],\n      },\n    ]);\n  }\n\n  async function addAssignee(\n    issueId: number,\n    handle: string,\n    actor: string,\n  ): Promise<void> {\n    if (!(await getBaseIssue(issueId))) {\n      throw new HttpError(404, `Issue #${issueId} not found.`);\n    }\n    const existing = await client.execute({\n      sql:\n        `SELECT 1 FROM ${TABLES.assignees} WHERE issue_id = ? AND user_handle = ?`,\n      args: [issueId, handle],\n    });\n    if (existing.rows.length) return;\n    const timestamp = now();\n    await atomicWrite([\n      {\n        sql:\n          `INSERT INTO ${TABLES.assignees} (issue_id, user_handle) VALUES (?, ?)`,\n        args: [issueId, handle],\n      },\n      {\n        sql: `UPDATE ${TABLES.issues} SET updated_at = ? WHERE id = ?`,\n        args: [timestamp, issueId],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('issue.updated', ?, ?, ?, ?)`,\n        args: [\n          issueId,\n          actor,\n          JSON.stringify({\n            update_target: \"assignee\",\n            from: null,\n            to: handle,\n          }),\n          timestamp,\n        ],\n      },\n    ]);\n  }\n\n  async function removeAssignee(\n    issueId: number,\n    handle: string,\n    actor: string,\n  ): Promise<void> {\n    if (!(await getBaseIssue(issueId))) {\n      throw new HttpError(404, `Issue #${issueId} not found.`);\n    }\n    const existing = await client.execute({\n      sql:\n        `SELECT 1 FROM ${TABLES.assignees} WHERE issue_id = ? AND user_handle = ?`,\n      args: [issueId, handle],\n    });\n    if (!existing.rows.length) return;\n    const timestamp = now();\n    await atomicWrite([\n      {\n        sql:\n          `DELETE FROM ${TABLES.assignees} WHERE issue_id = ? AND user_handle = ?`,\n        args: [issueId, handle],\n      },\n      {\n        sql: `UPDATE ${TABLES.issues} SET updated_at = ? WHERE id = ?`,\n        args: [timestamp, issueId],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('issue.updated', ?, ?, ?, ?)`,\n        args: [\n          issueId,\n          actor,\n          JSON.stringify({\n            update_target: \"assignee\",\n            from: handle,\n            to: null,\n          }),\n          timestamp,\n        ],\n      },\n    ]);\n  }\n\n  async function addBlock(\n    issueId: number,\n    otherIssueId: number,\n    direction: \"blocks\" | \"blocked_by\",\n    actor: string,\n  ): Promise<void> {\n    const blockerId = direction === \"blocks\" ? issueId : otherIssueId;\n    const blockedId = direction === \"blocks\" ? otherIssueId : issueId;\n    if (blockerId === blockedId) {\n      throw new HttpError(409, \"An issue cannot block itself.\");\n    }\n    if (!(await getBaseIssue(blockerId)) || !(await getBaseIssue(blockedId))) {\n      throw new HttpError(404, \"Issue not found.\");\n    }\n    const cycle = await client.execute({\n      sql: `WITH RECURSIVE reachable(id) AS (\n\t\t\t\tSELECT blocked_id FROM ${TABLES.blocks} WHERE blocker_id = ?\n\t\t\t\tUNION\n\t\t\t\tSELECT edge.blocked_id FROM ${TABLES.blocks} edge JOIN reachable ON edge.blocker_id = reachable.id\n\t\t\t) SELECT 1 FROM reachable WHERE id = ? LIMIT 1`,\n      args: [blockedId, blockerId],\n    });\n    if (cycle.rows.length) {\n      throw new HttpError(409, \"Blocking relationship would create a cycle.\");\n    }\n    const existing = await client.execute({\n      sql:\n        `SELECT 1 FROM ${TABLES.blocks} WHERE blocker_id = ? AND blocked_id = ?`,\n      args: [blockerId, blockedId],\n    });\n    if (existing.rows.length) return;\n    const timestamp = now();\n    await atomicWrite([\n      {\n        sql:\n          `INSERT INTO ${TABLES.blocks} (blocker_id, blocked_id) VALUES (?, ?)`,\n        args: [blockerId, blockedId],\n      },\n      {\n        sql: `UPDATE ${TABLES.issues} SET updated_at = ? WHERE id = ?`,\n        args: [timestamp, issueId],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('issue.updated', ?, ?, ?, ?)`,\n        args: [\n          issueId,\n          actor,\n          JSON.stringify({\n            update_target: direction,\n            from: null,\n            to: otherIssueId,\n          }),\n          timestamp,\n        ],\n      },\n    ]);\n  }\n\n  async function removeBlock(\n    issueId: number,\n    otherIssueId: number,\n    direction: \"blocks\" | \"blocked_by\",\n    actor: string,\n  ): Promise<void> {\n    const blockerId = direction === \"blocks\" ? issueId : otherIssueId;\n    const blockedId = direction === \"blocks\" ? otherIssueId : issueId;\n    if (!(await getBaseIssue(blockerId)) || !(await getBaseIssue(blockedId))) {\n      throw new HttpError(404, \"Issue not found.\");\n    }\n    const existing = await client.execute({\n      sql:\n        `SELECT 1 FROM ${TABLES.blocks} WHERE blocker_id = ? AND blocked_id = ?`,\n      args: [blockerId, blockedId],\n    });\n    if (!existing.rows.length) return;\n    const timestamp = now();\n    await atomicWrite([\n      {\n        sql:\n          `DELETE FROM ${TABLES.blocks} WHERE blocker_id = ? AND blocked_id = ?`,\n        args: [blockerId, blockedId],\n      },\n      {\n        sql: `UPDATE ${TABLES.issues} SET updated_at = ? WHERE id = ?`,\n        args: [timestamp, issueId],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('issue.updated', ?, ?, ?, ?)`,\n        args: [\n          issueId,\n          actor,\n          JSON.stringify({\n            update_target: direction,\n            from: otherIssueId,\n            to: null,\n          }),\n          timestamp,\n        ],\n      },\n    ]);\n  }\n\n  async function listComments(issueId: number): Promise<Comment[]> {\n    const result = await client.execute({\n      sql:\n        `SELECT comment.*, event.actor AS author FROM ${TABLES.comments} comment\n\t\t\t\tLEFT JOIN ${TABLES.events} event ON event.event_type = 'comment.created' AND event.entity_id = comment.id\n\t\t\t\tWHERE comment.issue_id = ? ORDER BY comment.created_at, comment.id`,\n      args: [issueId],\n    });\n    return result.rows.map((row) => ({\n      id: number(row.id),\n      issue_id: number(row.issue_id),\n      body: String(row.body),\n      created_at: number(row.created_at),\n      updated_at: number(row.updated_at),\n      author: row.author == null ? null : String(row.author),\n    }));\n  }\n\n  async function getComment(id: number): Promise<Comment | null> {\n    const result = await client.execute({\n      sql:\n        `SELECT comment.*, event.actor AS author FROM ${TABLES.comments} comment\n        LEFT JOIN ${TABLES.events} event ON event.event_type = 'comment.created' AND event.entity_id = comment.id\n        WHERE comment.id = ? ORDER BY event.id LIMIT 1`,\n      args: [id],\n    });\n    const row = result.rows[0];\n    return row\n      ? {\n        id: number(row.id),\n        issue_id: number(row.issue_id),\n        body: String(row.body),\n        created_at: number(row.created_at),\n        updated_at: number(row.updated_at),\n        author: row.author == null ? null : String(row.author),\n      }\n      : null;\n  }\n\n  async function createComment(data: {\n    issueId: number;\n    body: string;\n    actor: string;\n  }): Promise<number> {\n    if (!(await getBaseIssue(data.issueId))) {\n      throw new HttpError(404, `Issue #${data.issueId} not found.`);\n    }\n    const timestamp = now();\n    const results = await atomicWrite([\n      {\n        sql:\n          `INSERT INTO ${TABLES.comments} (issue_id, body, created_at, updated_at) VALUES (?, ?, ?, ?)`,\n        args: [data.issueId, data.body, timestamp, timestamp],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp)\n\t\t\t\t\t\tSELECT 'comment.created', id, ?, json_object('id', id, 'issue_id', issue_id, 'body', body, 'created_at', created_at, 'updated_at', updated_at), ?\n\t\t\t\t\t\tFROM ${TABLES.comments} WHERE id = last_insert_rowid()`,\n        args: [data.actor, timestamp],\n      },\n      {\n        sql: `UPDATE ${TABLES.issues} SET updated_at = ? WHERE id = ?`,\n        args: [timestamp, data.issueId],\n      },\n    ]);\n    return number(results[0].lastInsertRowid);\n  }\n\n  async function updateComment(\n    id: number,\n    body: string,\n    actor: string,\n  ): Promise<void> {\n    const result = await client.execute({\n      sql: `SELECT * FROM ${TABLES.comments} WHERE id = ?`,\n      args: [id],\n    });\n    const row = result.rows[0];\n    if (!row) throw new HttpError(404, `Comment #${id} not found.`);\n    if (String(row.body) === body) return;\n    const timestamp = now();\n    await atomicWrite([\n      {\n        sql:\n          `UPDATE ${TABLES.comments} SET body = ?, updated_at = ? WHERE id = ?`,\n        args: [body, timestamp, id],\n      },\n      {\n        sql: `UPDATE ${TABLES.issues} SET updated_at = ? WHERE id = ?`,\n        args: [timestamp, number(row.issue_id)],\n      },\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('comment.updated', ?, ?, ?, ?)`,\n        args: [\n          id,\n          actor,\n          JSON.stringify({\n            update_target: \"body\",\n            from: String(row.body),\n            to: body,\n          }),\n          timestamp,\n        ],\n      },\n    ]);\n  }\n\n  async function deleteComment(id: number, actor: string): Promise<void> {\n    const result = await client.execute({\n      sql: `SELECT * FROM ${TABLES.comments} WHERE id = ?`,\n      args: [id],\n    });\n    const row = result.rows[0];\n    if (!row) throw new HttpError(404, `Comment #${id} not found.`);\n    const comment = {\n      id: number(row.id),\n      issue_id: number(row.issue_id),\n      body: String(row.body),\n      created_at: number(row.created_at),\n      updated_at: number(row.updated_at),\n    };\n    const timestamp = now();\n    await atomicWrite([\n      {\n        sql:\n          `INSERT INTO ${TABLES.events} (event_type, entity_id, actor, data, event_timestamp) VALUES ('comment.deleted', ?, ?, ?, ?)`,\n        args: [id, actor, JSON.stringify(commentSnapshot(comment)), timestamp],\n      },\n      { sql: `DELETE FROM ${TABLES.comments} WHERE id = ?`, args: [id] },\n      {\n        sql: `UPDATE ${TABLES.issues} SET updated_at = ? WHERE id = ?`,\n        args: [timestamp, comment.issue_id],\n      },\n    ]);\n  }\n\n  async function listEvents(\n    opts: { entity?: \"issue\" | \"comment\" | \"label\"; entityId?: number } = {},\n  ): Promise<TrackerEvent[]> {\n    let sql = `SELECT * FROM ${TABLES.events}`;\n    const conditions: string[] = [];\n    const args: SqlValue[] = [];\n    if (opts.entity) {\n      conditions.push(\"event_type LIKE ?\");\n      args.push(`${opts.entity}.%`);\n    }\n    if (opts.entityId !== undefined) {\n      conditions.push(\"entity_id = ?\");\n      args.push(opts.entityId);\n    }\n    if (conditions.length) sql += ` WHERE ${conditions.join(\" AND \")}`;\n    sql += \" ORDER BY id\";\n    const result = await client.execute({ sql, args });\n    return result.rows.map((row) => ({\n      id: number(row.id),\n      event_type: row.event_type as EventType,\n      entity_id: number(row.entity_id),\n      actor: String(row.actor),\n      data: parseJson(row.data),\n      event_timestamp: number(row.event_timestamp),\n    }));\n  }\n\n  return {\n    initSchema,\n    listIssues,\n    getIssue,\n    createIssue,\n    updateIssue,\n    closeIssue,\n    reopenIssue,\n    deleteIssue,\n    listLabels,\n    getLabel,\n    createLabel,\n    updateLabel,\n    deleteLabel,\n    addLabel,\n    removeLabel,\n    addAssignee,\n    removeAssignee,\n    addBlock,\n    removeBlock,\n    listComments,\n    getComment,\n    createComment,\n    updateComment,\n    deleteComment,\n    listEvents,\n  };\n}\n\nexport type IssueStore = ReturnType<typeof createIssueStore>;\nexport const defaultIssueStore = createIssueStore(\n  sqlite as unknown as SqliteClient,\n);\n\nexport const initSchema = defaultIssueStore.initSchema;\nexport const listIssues = defaultIssueStore.listIssues;\nexport const getIssue = defaultIssueStore.getIssue;\nexport const createIssue = defaultIssueStore.createIssue;\nexport const updateIssue = defaultIssueStore.updateIssue;\nexport const closeIssue = defaultIssueStore.closeIssue;\nexport const reopenIssue = defaultIssueStore.reopenIssue;\nexport const deleteIssue = defaultIssueStore.deleteIssue;\nexport const listLabels = defaultIssueStore.listLabels;\nexport const getLabel = defaultIssueStore.getLabel;\nexport const createLabel = defaultIssueStore.createLabel;\nexport const updateLabel = defaultIssueStore.updateLabel;\nexport const deleteLabel = defaultIssueStore.deleteLabel;\nexport const addLabel = defaultIssueStore.addLabel;\nexport const removeLabel = defaultIssueStore.removeLabel;\nexport const addAssignee = defaultIssueStore.addAssignee;\nexport const removeAssignee = defaultIssueStore.removeAssignee;\nexport const addBlock = defaultIssueStore.addBlock;\nexport const removeBlock = defaultIssueStore.removeBlock;\nexport const listComments = defaultIssueStore.listComments;\nexport const getComment = defaultIssueStore.getComment;\nexport const createComment = defaultIssueStore.createComment;\nexport const updateComment = defaultIssueStore.updateComment;\nexport const deleteComment = defaultIssueStore.deleteComment;\nexport const listEvents = defaultIssueStore.listEvents;\n",[226],"7cff4590-9f8d-4f76-a485-70d576252995","components.tsx","bc7095f6-7b3c-11f1-9afb-1607ee4eb77e",267,["D",1784059508115],51,"/** @jsxImportSource npm:hono@4.6.14/jsx */\nimport type { FC } from \"npm:hono@4.6.14/jsx\";\nimport type { Comment, Issue, Label } from \"./db.ts\";\nimport { Layout } from \"./layout.tsx\";\nimport { T } from \"./theme.ts\";\nimport {\n  Banner,\n  Button,\n  Card,\n  FIELD,\n  LabelTag,\n  Select,\n  StatusBadge,\n} from \"./ui.tsx\";\n\n// Layout `active` tab map — every page component below sets this on its\n// <Layout active=\"...\"> call so the shared top bar highlights the right tab.\n// Each page belongs to exactly one surface, so the value is set locally\n// per component rather than derived from the route:\n//   \"issues\" -> IssueListPage, NewIssuePage, IssueDetailPage, EditIssuePage\n//   \"labels\" -> LabelsPage\n// Adding a new page? Set `active` on its <Layout> call and update this list.\nfunction date(timestamp: number) {\n  return new Date(timestamp).toLocaleString(\"en-US\", {\n    dateStyle: \"medium\",\n    timeStyle: \"short\",\n  });\n}\n\nfunction relativeTime(timestamp: number) {\n  const seconds = Math.max(0, Math.floor((Date.now() - timestamp) / 1000));\n  if (seconds < 60) return \"just now\";\n  const minutes = Math.floor(seconds / 60);\n  if (minutes < 60) return `${minutes}m ago`;\n  const hours = Math.floor(minutes / 60);\n  if (hours < 24) return `${hours}h ago`;\n  const days = Math.floor(hours / 24);\n  if (days < 7) return `${days}d ago`;\n  const weeks = Math.floor(days / 7);\n  if (weeks < 5) return `${weeks}w ago`;\n  const months = Math.floor(days / 30);\n  if (months < 12) return `${months}mo ago`;\n  return `${Math.floor(days / 365)}y ago`;\n}\n\nfunction queryWithStatus(query: string, status: \"open\" | \"closed\") {\n  const tokens = query.trim().split(/\\s+/).filter(Boolean);\n  let replaced = false;\n  const next = tokens.flatMap((token) => {\n    if (!/^status:/i.test(token)) return [token];\n    if (replaced) return [];\n    replaced = true;\n    return [`status:${status}`];\n  });\n  if (!replaced) next.unshift(`status:${status}`);\n  return next.join(\" \");\n}\n\nfunction listHref(base: string, query: string) {\n  return `${base}/?${new URLSearchParams({ q: query })}`;\n}\n\nexport const IssueListPage: FC<{\n  title: string;\n  user: string | null;\n  canCreate: boolean;\n  auth?: boolean;\n  login?: string | null;\n  base?: string;\n  issues: Array<Issue & { commentCount: number }>;\n  filters: {\n    query: string;\n    status: \"open\" | \"closed\";\n    openCount: number;\n    closedCount: number;\n  };\n}> = ({\n  title,\n  user,\n  canCreate,\n  auth = true,\n  login,\n  base = \"\",\n  issues,\n  filters,\n}) => (\n  <Layout\n    title={title}\n    user={user}\n    auth={auth}\n    login={login}\n    base={base}\n    active=\"issues\"\n  >\n    <div class=\"flex gap-2 mb-4\">\n      <form method=\"get\" action={`${base}/`} class=\"flex gap-2 flex-1\">\n        <input\n          type=\"search\"\n          name=\"q\"\n          value={filters.query}\n          placeholder=\"Search title and body, or use status:open…\"\n          class={`${FIELD} flex-1`}\n        />\n        <Button type=\"submit\" variant=\"ghost\">Search</Button>\n      </form>\n      {canCreate ? <Button href={`${base}/new`}>+ New Issue</Button> : null}\n    </div>\n    <Card class=\"p-0 overflow-hidden\">\n      <div class={`flex gap-4 items-center p-3 border-b border-[${T.border}]`}>\n        <a\n          href={listHref(base, queryWithStatus(filters.query, \"open\"))}\n          aria-current={filters.status === \"open\" ? \"page\" : undefined}\n          class={`inline-flex items-center gap-2 no-underline font-medium ${\n            filters.status === \"open\" ? `text-[${T.text}]` : `text-[${T.muted}]`\n          }`}\n        >\n          <span aria-hidden=\"true\">●</span>\n          Open\n          <span\n            class={`rounded-full px-2 py-0.5 text-xs bg-[${T.surface}]`}\n          >\n            {filters.openCount}\n          </span>\n        </a>\n        <a\n          href={listHref(base, queryWithStatus(filters.query, \"closed\"))}\n          aria-current={filters.status === \"closed\" ? \"page\" : undefined}\n          class={`inline-flex items-center gap-2 no-underline font-medium ${\n            filters.status === \"closed\"\n              ? `text-[${T.text}]`\n              : `text-[${T.muted}]`\n          }`}\n        >\n          <span aria-hidden=\"true\">○</span>\n          Closed\n          <span\n            class={`rounded-full px-2 py-0.5 text-xs bg-[${T.surface}]`}\n          >\n            {filters.closedCount}\n          </span>\n        </a>\n      </div>\n      {issues.length\n        ? (\n          <div>\n            {issues.map((issue) => (\n              <article\n                key={issue.id}\n                class={`flex gap-3 p-4 border-b border-[${T.border}] last:border-b-0`}\n              >\n                <span\n                  aria-label={issue.status === \"open\" ? \"Open\" : \"Closed\"}\n                  title={issue.status === \"open\" ? \"Open\" : \"Closed\"}\n                  class={`text-lg leading-5 ${\n                    issue.status === \"open\"\n                      ? \"text-green-400\"\n                      : `text-[${T.muted}]`\n                  }`}\n                >\n                  {issue.status === \"open\" ? \"●\" : \"○\"}\n                </span>\n                <div class=\"min-w-0 flex-1\">\n                  <div class=\"flex gap-2 items-center flex-wrap\">\n                    <a\n                      class={`font-semibold text-[${T.link}] no-underline hover:underline`}\n                      href={`${base}/issue/${issue.id}`}\n                    >\n                      {issue.title}\n                    </a>\n                    {issue.blocked\n                      ? (\n                        <span class=\"rounded-full border border-amber-400 text-amber-300 px-2 py-0.5 text-xs\">\n                          Blocked\n                        </span>\n                      )\n                      : null}\n                  </div>\n                  <div class={`text-xs text-[${T.muted}] mt-1`}>\n                    #{issue.id} · @{issue.creator ?? \"unknown\"} opened{\" \"}\n                    {relativeTime(issue.created_at)} · Updated{\" \"}\n                    {relativeTime(issue.updated_at)}\n                  </div>\n                  {issue.labels.length\n                    ? (\n                      <div class=\"mt-2\">\n                        {issue.labels.map((label) => (\n                          <LabelTag key={label.id} label={label} />\n                        ))}\n                      </div>\n                    )\n                    : null}\n                </div>\n                {issue.commentCount > 0\n                  ? (\n                    <span\n                      class={`text-xs text-[${T.muted}] whitespace-nowrap self-start`}\n                      aria-label={`${issue.commentCount} ${\n                        issue.commentCount === 1 ? \"comment\" : \"comments\"\n                      }`}\n                    >\n                      {issue.commentCount}{\" \"}\n                      {issue.commentCount === 1 ? \"comment\" : \"comments\"}\n                    </span>\n                  )\n                  : null}\n              </article>\n            ))}\n          </div>\n        )\n        : <p class={`p-4 text-[${T.muted}]`}>No issues found.</p>}\n    </Card>\n  </Layout>\n);\n\nexport const NewIssuePage: FC<{\n  title: string;\n  user: string | null;\n  labels: Label[];\n  auth?: boolean;\n  login?: string | null;\n  base?: string;\n  error?: string;\n}> = ({ title, user, labels, auth = true, login, base = \"\", error }) => (\n  <Layout\n    title={`${title} — New Issue`}\n    user={user}\n    auth={auth}\n    login={login}\n    base={base}\n    active=\"issues\"\n  >\n    <a href={`${base}/`} class={`text-[${T.muted}]`}>\n      ← all issues\n    </a>\n    <Card class=\"mt-3\">\n      <h2>Create Issue</h2>\n      {error ? <Banner kind=\"err\" msg={error} /> : null}\n      <form method=\"post\" action={`${base}/new`} class=\"grid gap-3\">\n        <input name=\"title\" placeholder=\"Title\" required class={FIELD} />\n        <textarea\n          name=\"body\"\n          placeholder=\"Describe the issue…\"\n          class={`${FIELD} min-h-[160px] py-3`}\n        />\n        <fieldset>\n          <legend class={`text-xs text-[${T.muted}]`}>Labels</legend>\n          <div class=\"flex gap-3 flex-wrap\">\n            {labels.map((label) => (\n              <label key={label.id}>\n                <input type=\"checkbox\" name=\"label_id\" value={label.id} />{\" \"}\n                <LabelTag label={label} />\n              </label>\n            ))}\n          </div>\n        </fieldset>\n        <label class={`text-xs text-[${T.muted}]`}>\n          Assignees (comma-separated)\n          <input\n            name=\"assignees\"\n            placeholder=\"alice, bob\"\n            class={`${FIELD} w-full mt-1`}\n          />\n        </label>\n        <div class=\"flex gap-2\">\n          <Button type=\"submit\">Create Issue</Button>\n          <Button href={`${base}/`} variant=\"ghost\">\n            Cancel\n          </Button>\n        </div>\n      </form>\n    </Card>\n  </Layout>\n);\n\nfunction CommentCard({\n  comment,\n  user,\n  canModerateComments,\n  base = \"\",\n}: {\n  comment: Comment;\n  user: string | null;\n  canModerateComments: boolean;\n  base?: string;\n}) {\n  const canManage = canModerateComments || user === comment.author;\n  return (\n    <div\n      class={`bg-[${T.surface}] border border-[${T.border}] rounded-lg p-3 mb-2`}\n    >\n      <div class={`text-xs text-[${T.muted}]`}>\n        @{comment.author ?? \"unknown\"} · {date(comment.created_at)}\n        {comment.updated_at !== comment.created_at ? \" · edited\" : \"\"}\n      </div>\n      <div class=\"whitespace-pre-wrap my-2\">{comment.body}</div>\n      {canManage\n        ? (\n          <details>\n            <summary class={`cursor-pointer text-xs text-[${T.link}]`}>\n              Edit comment\n            </summary>\n            <form\n              method=\"post\"\n              action={`${base}/comment/${comment.id}/edit`}\n              class=\"grid gap-2 mt-2\"\n            >\n              <textarea name=\"body\" class={`${FIELD} w-full min-h-[80px] py-2`}>\n                {comment.body}\n

\n \n \n \n \n \n \n )\n : null}\n \n );\n}\n\nexport const IssueDetailPage: FC<{\n title: string;\n user: string | null;\n canManage: boolean;\n canDelete: boolean;\n canModerateComments: boolean;\n canComment?: boolean;\n auth?: boolean;\n login?: string | null;\n base?: string;\n issue: Issue;\n comments: Comment[];\n labels: Label[];\n}> = ({\n title,\n user,\n canManage,\n canDelete,\n canModerateComments,\n canComment,\n auth = true,\n login,\n base = \"\",\n issue,\n comments,\n labels,\n}) => (\n \n \n ← all issues\n \n \n

\n #{issue.id} {issue.title}\n

\n \n {issue.blocked ? Blocked : null}\n \n Opened by @{issue.creator ?? \"unknown\"}\n \n

\n {issue.labels.map((label) => )}\n

{issue.body}

\n Assignees:{\" \"}\n {issue.assignees.map((handle) => `@${handle}`).join(\", \") || \"none\"}\n

\n Blocked by: {issue.blockers.map((item) => (\n \n #{item.id}\n \n ))}\n {issue.blockers.length ? \"\" : \"none\"}\n

\n Blocks: {issue.blocks.map((item) => (\n \n #{item.id}\n \n ))}\n {issue.blocks.length ? \"\" : \"none\"}\n

\n {canManage\n ? (\n

\n \n {issue.status === \"open\"\n ? (\n \n \n \n \n )\n : (\n \n )}\n {canDelete\n ? (\n \n )\n : null}\n

\n )\n : null}\n \n {canManage\n ? (\n \n

Relationships

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n )\n : null}\n \n

Comments ({comments.length})

\n {comments.map((comment) => (\n \n ))}\n {(canComment ?? (user !== null || !auth))\n ? (\n \n \n);\n\nexport const EditIssuePage: FC<{\n title: string;\n user: string | null;\n issue: Issue;\n auth?: boolean;\n login?: string | null;\n base?: string;\n error?: string;\n}> = ({ title, user, issue, auth = true, login, base = \"\", error }) => (\n \n \n ← back\n \n \n {error ? : null}\n \n \n \n \n \n \n \n);\n\nexport const LabelsPage: FC<{\n title: string;\n user: string | null;\n labels: Label[];\n canManage: boolean;\n auth?: boolean;\n login?: string | null;\n base?: string;\n}> = ({ title, user, labels, canManage, auth = true, login, base = \"\" }) => (\n \n \n ← all issues\n \n \n

Labels

\n {labels.map((label) => (\n \n \n \n {canManage\n ? (\n <>\n \n Save\n \n \n Delete\n \n \n )\n : null}\n \n ))}\n {canManage\n ? (\n \n \n);\n",[234],"b3c589a6-6538-44a1-a2f5-86c110c2adfc",["D",1784059508131],8,[28],"1e82e220-8a49-47cd-a54b-6e1e78b6161a","app.tsx","fc916b18-7b48-11f1-b573-1607ee4eb77e",266,["D",1784059508103],16,"/** @jsxImportSource npm:hono@4.6.14/jsx */\nimport {\n type CallableIntegration,\n defineIntegration,\n type IntegrationContext,\n} from \"https://esm.town/v/nbbaier/integrations/mod.ts\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { type Context, Hono } from \"npm:hono@4.6.14\";\nimport { createApi } from \"./api.ts\";\nimport {\n EditIssuePage,\n IssueDetailPage,\n IssueListPage,\n LabelsPage,\n NewIssuePage,\n} from \"./components.tsx\";\nimport {\n CLOSED_STATE_REASONS,\n type ClosedStateReason,\n defaultIssueStore,\n type Issue,\n ISSUE_STATUSES,\n type IssueStatus,\n type IssueStore,\n} from \"./db.ts\";\nimport { Layout } from \"./layout.tsx\";\nimport { Banner } from \"./ui.tsx\";\n\nexport interface IssueTrackerOptions {\n maintainers?: string[];\n /** @deprecated Use maintainers. */\n owner?: string[];\n defaultRole?: \"contributor\" | \"viewer\";\n auth?: boolean;\n title?: string;\n apiKey?: string;\n}\n\ntype Role = \"viewer\" | \"contributor\" | \"maintainer\";\ntype Env = {\n Variables: {\n user: string;\n role: Role;\n /** Mount prefix for HTML links: \"\" standalone, ctx.prefix routed. */\n base: string;\n /** Whether login/logout UI makes sense for this request. */\n authUi: boolean;\n /** Origin-level login route supplied by the active auth surface. */\n login: string | null;\n };\n Bindings: IntegrationContext;\n};\n\n/** Routed mode iff the router passed an IntegrationContext as Hono env. */\nfunction routedCtx(c: Context): IntegrationContext | undefined {\n return typeof c.env?.prefix === \"string\" ? c.env : undefined;\n}\n\nfunction surfaceForPath(path: string): \"issues\" | \"labels\" {\n return path === \"/labels\" || path.startsWith(\"/labels/\")\n ? \"labels\"\n : \"issues\";\n}\n\nfunction runtimeVal() {\n try {\n return parseVal();\n } catch {\n return {\n username: \"local\",\n name: \"issue-tracker\",\n links: { self: { val: \"https://www.val.town/\" } },\n };\n }\n}\n\nfunction envApiKey(): string | undefined {\n try {\n return Deno.env.get(\"ISSUE_TRACKER_API_KEY\");\n } catch {\n return undefined; // no env permission — API writes stay disabled\n }\n}\n\nfunction handles(value: FormDataEntryValue | null): string[] {\n return String(value ?? \"\")\n .split(\",\")\n .map((handle) => handle.trim().replace(/^@/, \"\"))\n .filter(Boolean);\n}\n\ntype ParsedIssueQuery = {\n query: string;\n status: IssueStatus;\n assignee?: string;\n search?: string;\n label?: string;\n author?: string;\n blocked?: boolean;\n};\n\nfunction normalizeHandle(value: string) {\n return value.trim().replace(/^@/, \"\");\n}\n\nfunction parseIssueQuery(query: string): ParsedIssueQuery {\n const tokens = query.trim().split(/\\s+/).filter(Boolean);\n let status: IssueStatus = \"open\";\n let assignee: string | undefined;\n let label: string | undefined;\n let author: string | undefined;\n let blocked: boolean | undefined;\n const freeText: string[] = [];\n\n for (const token of tokens) {\n const separator = token.indexOf(\":\");\n if (separator < 1 || separator === token.length - 1) {\n freeText.push(token);\n continue;\n }\n const key = token.slice(0, separator).toLowerCase();\n const value = token.slice(separator + 1).trim();\n if (!value) {\n freeText.push(token);\n continue;\n }\n if (key === \"status\" && ISSUE_STATUSES.includes(value as IssueStatus)) {\n status = value as IssueStatus;\n } else if (key === \"assignee\") {\n assignee = normalizeHandle(value) || undefined;\n } else if (key === \"label\") {\n label = value;\n } else if (key === \"author\") {\n author = normalizeHandle(value) || undefined;\n } else if (key === \"is\" && value === \"blocked\") {\n blocked = true;\n } else if (key === \"is\" && value === \"unblocked\") {\n blocked = false;\n } else {\n freeText.push(token);\n }\n }\n\n return {\n query: query.trim(),\n status,\n assignee,\n label,\n author,\n blocked,\n search: freeText.join(\" \") || undefined,\n };\n}\n\nfunction issueQueryFrom(c: Context): ParsedIssueQuery {\n const q = c.req.query(\"q\");\n const query = q === undefined ? c.req.query(\"query\") : q;\n if (query !== undefined) return parseIssueQuery(query);\n\n const status = c.req.query(\"status\");\n const assignee = normalizeHandle(c.req.query(\"assignee\") ?? \"\");\n const search = c.req.query(\"search\")?.trim() || undefined;\n const effectiveStatus = ISSUE_STATUSES.includes(status as IssueStatus)\n ? status as IssueStatus\n : \"open\";\n const legacyQuery = [\n status && ISSUE_STATUSES.includes(status as IssueStatus)\n ? `status:${status}`\n : \"\",\n assignee ? `assignee:${assignee}` : \"\",\n search ?? \"\",\n ].filter(Boolean).join(\" \");\n return {\n query: legacyQuery,\n status: effectiveStatus,\n assignee: assignee || undefined,\n search,\n };\n}\n\nexport function issueTracker(\n options: IssueTrackerOptions = {},\n store: IssueStore = defaultIssueStore,\n): CallableIntegration {\n const val = runtimeVal();\n const auth = options.auth !== false;\n const title = options.title ?? `Issues · ${val.username}/${val.name}`;\n const maintainers = new Set([\n val.username,\n ...(options.maintainers ?? []),\n ...(options.owner ?? []),\n ]);\n const defaultRole: Role = options.defaultRole ?? \"contributor\";\n const apiKey = options.apiKey ?? envApiKey();\n const app = new Hono();\n app.onError((error, c) =>\n c.html(\n \n \n ,\n 409,\n )\n );\n app.route(\"/api\", createApi(apiKey, store));\n\n app.use(\"*\", async (c, next) => {\n await store.initSchema();\n const ctx = routedCtx(c);\n c.set(\"base\", ctx?.prefix ?? \"\");\n // Login/logout UI renders only where a working /auth/* exists. Routed: the\n // login-location signal (ctx.login) says where the router's login lives, or\n // null when it owns none (auth: false) — so an anonymous visitor reaching\n // this flagged tracker still gets a working \"log in\" link under a gated\n // router, and none under an ungated one. Standalone: the tracker's own\n // /auth/* exists exactly when auth is on.\n c.set(\"login\", ctx ? ctx.login : auth ? \"/auth/login\" : null);\n c.set(\"authUi\", c.get(\"login\") !== null);\n if (!auth) {\n c.set(\"user\", ctx?.user ?? \"anonymous\");\n c.set(\"role\", \"maintainer\");\n } else if (ctx) {\n // Routed: the router owns authentication. ctx.user is the verified\n // identity; null means the router runs ungated, so there is no way\n // to log in — those visitors are read-only viewers.\n if (ctx.user) {\n c.set(\"user\", ctx.user);\n c.set(\"role\", maintainers.has(ctx.user) ? \"maintainer\" : defaultRole);\n } else c.set(\"role\", \"viewer\");\n } else {\n const session = await getOAuthUserData(c.req.raw);\n if (session?.user) {\n const username = session.user.username ?? \"\";\n c.set(\"user\", username);\n c.set(\"role\", maintainers.has(username) ? \"maintainer\" : defaultRole);\n } else c.set(\"role\", \"viewer\");\n }\n await next();\n });\n\n async function forbidden(c: Context, message: string) {\n return await c.html(\n \n \n ,\n 403,\n );\n }\n\n async function contributor(c: Context): Promise {\n const role = c.get(\"role\") ?? \"viewer\";\n if (role !== \"viewer\") return c.get(\"user\") ?? \"anonymous\";\n // Anonymous standalone visitors can log in; everyone else (routed\n // viewers, logged-in viewers) has no role-changing move to offer.\n if (auth && !routedCtx(c) && !c.get(\"user\")) {\n return c.redirect(\"/auth/login\");\n }\n return await forbidden(\n c,\n \"You need contributor access to perform this action.\",\n );\n }\n\n async function maintainer(c: Context): Promise {\n const actor = await contributor(c);\n if (actor instanceof Response) return actor;\n return c.get(\"role\") === \"maintainer\"\n ? actor\n : await forbidden(c, \"Only a maintainer can perform this action.\");\n }\n\n async function manager(\n c: Context,\n issue: Issue,\n ): Promise {\n const actor = await contributor(c);\n if (actor instanceof Response) return actor;\n return c.get(\"role\") === \"maintainer\" || actor === issue.creator\n ? actor\n : await forbidden(\n c,\n \"Only the issue's creator or a maintainer can perform this action.\",\n );\n }\n\n async function issueFor(c: Context): Promise {\n const id = Number(c.req.param(\"id\"));\n if (!Number.isInteger(id)) return c.redirect(\"/\");\n const issue = await store.getIssue(id);\n return (\n issue ??\n c.html(\n \n \n ,\n 404,\n )\n );\n }\n\n app.get(\"/source\", (c) => c.redirect(val.links.self.val));\n\n app.get(\"/\", async (c) => {\n const filters = issueQueryFrom(c);\n const [statusIssues, countIssues] = await Promise.all([\n store.listIssues({\n status: filters.status,\n assignee: filters.assignee,\n search: filters.search,\n }),\n store.listIssues({\n assignee: filters.assignee,\n search: filters.search,\n }),\n ]);\n const matchesRouteFilters = (issue: Issue) =>\n (!filters.label ||\n issue.labels.some((label) => label.name === filters.label)) &&\n (!filters.author || issue.creator === filters.author) &&\n (filters.blocked === undefined || issue.blocked === filters.blocked);\n const issues = statusIssues.filter(matchesRouteFilters);\n const counts = countIssues.filter(matchesRouteFilters);\n const rows = await Promise.all(\n issues.map(async (issue) => ({\n ...issue,\n commentCount: (await store.listComments(issue.id)).length,\n })),\n );\n return c.html(\n issue.status === \"open\").length,\n closedCount: counts.filter((issue) =>\n issue.status === \"closed\"\n ).length,\n }}\n />,\n );\n });\n\n app.get(\"/new\", async (c) => {\n const actor = await contributor(c);\n if (actor instanceof Response) return actor;\n return c.html(\n ,\n );\n });\n\n app.post(\"/new\", async (c) => {\n const actor = await contributor(c);\n if (actor instanceof Response) return actor;\n const form = await c.req.formData();\n const issueTitle = String(form.get(\"title\") ?? \"\").trim();\n if (!issueTitle) {\n return c.html(\n ,\n 400,\n );\n }\n const id = await store.createIssue({\n title: issueTitle,\n body: String(form.get(\"body\") ?? \"\"),\n actor,\n });\n for (const value of form.getAll(\"label_id\")) {\n const labelId = Number(value);\n if (Number.isInteger(labelId)) await store.addLabel(id, labelId, actor);\n }\n for (const handle of handles(form.get(\"assignees\"))) {\n await store.addAssignee(id, handle, actor);\n }\n return c.redirect(`/issue/${id}`);\n });\n\n app.get(\"/issue/:id\", async (c) => {\n const issue = await issueFor(c);\n if (issue instanceof Response) return issue;\n const user = c.get(\"user\") ?? null;\n const canManage = c.get(\"role\") === \"maintainer\" ||\n (c.get(\"role\") === \"contributor\" && user === issue.creator);\n return c.html(\n ,\n );\n });\n\n app.get(\"/issue/:id/edit\", async (c) => {\n const issue = await issueFor(c);\n if (issue instanceof Response) return issue;\n const actor = await manager(c, issue);\n if (actor instanceof Response) return actor;\n return c.html(\n ,\n );\n });\n\n app.post(\"/issue/:id/edit\", async (c) => {\n const issue = await issueFor(c);\n if (issue instanceof Response) return issue;\n const actor = await manager(c, issue);\n if (actor instanceof Response) return actor;\n const form = await c.req.formData();\n const issueTitle = String(form.get(\"title\") ?? \"\").trim();\n if (!issueTitle) {\n return c.html(\n ,\n 400,\n );\n }\n await store.updateIssue(\n issue.id,\n {\n title: issueTitle,\n body: String(form.get(\"body\") ?? \"\"),\n },\n actor,\n );\n return c.redirect(`/issue/${issue.id}`);\n });\n\n app.post(\"/issue/:id/close\", async (c) => {\n const issue = await issueFor(c);\n if (issue instanceof Response) return issue;\n const actor = await manager(c, issue);\n if (actor instanceof Response) return actor;\n const reason = String(\n (await c.req.formData()).get(\"reason\") ?? \"completed\",\n );\n if (!CLOSED_STATE_REASONS.includes(reason as ClosedStateReason)) {\n throw new Error(\"Invalid close reason.\");\n }\n await store.closeIssue(issue.id, actor, reason as ClosedStateReason);\n return c.redirect(`/issue/${issue.id}`);\n });\n\n app.post(\"/issue/:id/reopen\", async (c) => {\n const issue = await issueFor(c);\n if (issue instanceof Response) return issue;\n const actor = await manager(c, issue);\n if (actor instanceof Response) return actor;\n await store.reopenIssue(issue.id, actor);\n return c.redirect(`/issue/${issue.id}`);\n });\n\n app.post(\"/issue/:id/label\", async (c) => {\n const issue = await issueFor(c);\n if (issue instanceof Response) return issue;\n const actor = await manager(c, issue);\n if (actor instanceof Response) return actor;\n const form = await c.req.formData();\n const labelId = Number(form.get(\"label_id\"));\n if (form.get(\"action\") === \"remove\") {\n await store.removeLabel(issue.id, labelId, actor);\n } else await store.addLabel(issue.id, labelId, actor);\n return c.redirect(`/issue/${issue.id}`);\n });\n\n app.post(\"/issue/:id/assignee\", async (c) => {\n const issue = await issueFor(c);\n if (issue instanceof Response) return issue;\n const actor = await manager(c, issue);\n if (actor instanceof Response) return actor;\n const form = await c.req.formData();\n const handle = String(form.get(\"handle\") ?? \"\")\n .trim()\n .replace(/^@/, \"\");\n if (handle) {\n if (form.get(\"action\") === \"remove\") {\n await store.removeAssignee(issue.id, handle, actor);\n } else await store.addAssignee(issue.id, handle, actor);\n }\n return c.redirect(`/issue/${issue.id}`);\n });\n\n app.post(\"/issue/:id/block\", async (c) => {\n const issue = await issueFor(c);\n if (issue instanceof Response) return issue;\n const actor = await manager(c, issue);\n if (actor instanceof Response) return actor;\n const form = await c.req.formData();\n const otherId = Number(form.get(\"other_id\"));\n const direction = form.get(\"direction\") === \"blocked_by\"\n ? \"blocked_by\"\n : \"blocks\";\n if (form.get(\"action\") === \"remove\") {\n await store.removeBlock(issue.id, otherId, direction, actor);\n } else await store.addBlock(issue.id, otherId, direction, actor);\n return c.redirect(`/issue/${issue.id}`);\n });\n\n app.post(\"/issue/:id/comment\", async (c) => {\n const issue = await issueFor(c);\n if (issue instanceof Response) return issue;\n const actor = await contributor(c);\n if (actor instanceof Response) return actor;\n const body = String((await c.req.formData()).get(\"body\") ?? \"\");\n if (body.trim()) {\n await store.createComment({ issueId: issue.id, body, actor });\n }\n return c.redirect(`/issue/${issue.id}`);\n });\n\n app.post(\"/comment/:commentId/edit\", async (c) => {\n const id = Number(c.req.param(\"commentId\"));\n const actor = await contributor(c);\n if (actor instanceof Response) return actor;\n const comment = await store.getComment(id);\n if (!comment) return c.redirect(\"/\");\n if (c.get(\"role\") !== \"maintainer\" && actor !== comment.author) {\n return await forbidden(\n c,\n \"Only the comment's author or a maintainer can perform this action.\",\n );\n }\n const body = String((await c.req.formData()).get(\"body\") ?? \"\");\n if (body.trim()) await store.updateComment(id, body, actor);\n return c.redirect(c.req.header(\"Referer\") ?? \"/\");\n });\n\n app.post(\"/comment/:commentId/delete\", async (c) => {\n const actor = await contributor(c);\n if (actor instanceof Response) return actor;\n const id = Number(c.req.param(\"commentId\"));\n const comment = await store.getComment(id);\n if (!comment) return c.redirect(\"/\");\n if (c.get(\"role\") !== \"maintainer\" && actor !== comment.author) {\n return await forbidden(\n c,\n \"Only the comment's author or a maintainer can perform this action.\",\n );\n }\n await store.deleteComment(id, actor);\n return c.redirect(c.req.header(\"Referer\") ?? \"/\");\n });\n\n app.post(\"/issue/:id/delete\", async (c) => {\n const actor = await maintainer(c);\n if (actor instanceof Response) return actor;\n await store.deleteIssue(Number(c.req.param(\"id\")), actor);\n return c.redirect(\"/\");\n });\n\n app.get(\"/labels\", async (c) =>\n c.html(\n ,\n ));\n app.post(\"/labels\", async (c) => {\n const actor = await maintainer(c);\n if (actor instanceof Response) return actor;\n const form = await c.req.formData();\n await store.createLabel({\n name: String(form.get(\"name\") ?? \"\").trim(),\n color: String(form.get(\"color\") ?? \"\")\n .trim()\n .replace(/^#/, \"\"),\n actor,\n });\n return c.redirect(\"/labels\");\n });\n app.post(\"/labels/:id\", async (c) => {\n const actor = await maintainer(c);\n if (actor instanceof Response) return actor;\n const id = Number(c.req.param(\"id\"));\n const form = await c.req.formData();\n if (form.get(\"action\") === \"delete\") await store.deleteLabel(id, actor);\n else {\n await store.updateLabel(\n id,\n {\n name: String(form.get(\"name\") ?? \"\").trim(),\n color: String(form.get(\"color\") ?? \"\")\n .trim()\n .replace(/^#/, \"\"),\n },\n actor,\n );\n }\n return c.redirect(\"/labels\");\n });\n\n // Standalone mode runs the tracker's own OAuth; routed mode receives the\n // router-verified identity via ctx and must not wrap OAuth again.\n const standalone = auth\n ? oauthMiddleware((req: Request) => app.fetch(req))\n : (req: Request) => app.fetch(req);\n return defineIntegration({\n name: \"Issue Tracker\",\n slug: \"issues\",\n description:\n \"Issues, labels, comments, and an agent JSON API on this val's SQLite.\",\n requiredEnv: apiKey ? undefined : [\"ISSUE_TRACKER_API_KEY\"],\n // Session-less flag: the tracker is safe for anonymous traffic — its viewer\n // role serves public reads and its own role model / bearer `/api` still draw\n // the fine line per-route. A gated router therefore passes session-less\n // requests through untouched (ctx.user: null) instead of walling them, and\n // bearer clients reach `/api` with Authorization intact. Inert standalone.\n sessionLess: true,\n handler: (req, ctx) => (ctx ? app.fetch(req, ctx) : standalone(req)),\n });\n}\n\nexport default issueTracker;\n",[246],"40eeb772-bdb0-439a-94a2-eb6f3c0b59c4","api_test.ts","2c47603c-7c0d-11f1-9ca3-1607ee4eb77e",222,["D",1784052698028],4,"import { assertEquals } from \"jsr:@std/assert@1.0.19\";\nimport { createApi } from \"./api.ts\";\nimport { createIssueStore } from \"./db.ts\";\nimport { createTestSqlite } from \"./test_sqlite.ts\";\n\nDeno.test(\"JSON API drives lifecycle, labels, assignees, blocks, and comments\", async () => {\n const store = createIssueStore(createTestSqlite());\n const api = createApi(\"secret\", store);\n const request = async (path: string, method = \"GET\", body?: unknown) => {\n const response = await api.request(path, {\n method,\n headers: body\n ? { Authorization: \"Bearer secret\", \"Content-Type\": \"application/json\" }\n : undefined,\n body: body ? JSON.stringify(body) : undefined,\n });\n return { status: response.status, json: await response.json() };\n };\n\n const labels = (await request(\"/labels\")).json as Array<{\n id: number;\n name: string;\n }>;\n const bugId = labels.find((label) => label.name === \"bug\")?.id ?? 0;\n const first = await request(\"/issues\", \"POST\", {\n title: \"First\",\n body: \" body\\n\",\n label_ids: [bugId],\n assignees: [\"alice\"],\n actor: \"owner\",\n });\n assertEquals(first.status, 201);\n assertEquals((first.json as { body: string }).body, \" body\\n\");\n assertEquals((first.json as { labels: unknown[] }).labels.length, 1);\n assertEquals((first.json as { assignees: string[] }).assignees, [\"alice\"]);\n const firstId = (first.json as { id: number }).id;\n const second = await request(\"/issues\", \"POST\", {\n title: \"Second\",\n actor: \"owner\",\n });\n const secondId = (second.json as { id: number }).id;\n\n const closed = await request(`/issues/${firstId}/close`, \"POST\", {\n reason: \"not_planned\",\n actor: \"owner\",\n });\n assertEquals(\n {\n status: (closed.json as { status: string }).status,\n state_reason: (closed.json as { state_reason: string }).state_reason,\n },\n { status: \"closed\", state_reason: \"not_planned\" },\n );\n const reopened = await request(`/issues/${firstId}/reopen`, \"POST\", {\n actor: \"owner\",\n });\n assertEquals(\n {\n status: (reopened.json as { status: string }).status,\n state_reason: (reopened.json as { state_reason: string }).state_reason,\n },\n { status: \"open\", state_reason: \"reopened\" },\n );\n assertEquals(\n (\n await request(`/issues/${firstId}/close`, \"POST\", {\n reason: \"typo\",\n actor: \"owner\",\n })\n ).status,\n 400,\n );\n\n await request(`/issues/${firstId}/labels`, \"POST\", {\n remove: [bugId],\n actor: \"owner\",\n });\n await request(`/issues/${firstId}/assignees`, \"POST\", {\n add: [\"bob\"],\n remove: [\"alice\"],\n actor: \"owner\",\n });\n await request(`/issues/${firstId}/blocks`, \"POST\", {\n add: [secondId],\n actor: \"owner\",\n });\n const comment = await request(`/issues/${firstId}/comments`, \"POST\", {\n body: \" note\\n\",\n actor: \"owner\",\n });\n assertEquals(comment.status, 201);\n const commentId = (comment.json as { id: number }).id;\n await request(`/comments/${commentId}`, \"PATCH\", {\n body: \" edited note\\n\",\n actor: \"owner\",\n });\n const fetched = await request(`/issues/${firstId}`);\n assertEquals((fetched.json as { labels: unknown[] }).labels, []);\n assertEquals((fetched.json as { assignees: string[] }).assignees, [\"bob\"]);\n assertEquals(\n (fetched.json as { blocks: Array<{ id: number }> }).blocks[0].id,\n secondId,\n );\n assertEquals(\n (fetched.json as { comments: Array<{ body: string }> }).comments[0].body,\n \" edited note\\n\",\n );\n await request(`/comments/${commentId}`, \"DELETE\", { actor: \"owner\" });\n assertEquals(\n ((await request(`/issues/${firstId}`)).json as { comments: unknown[] })\n .comments,\n [],\n );\n});\n\n/** Shared low-level request helper for the error/shape-focused tests below. */\nasync function call(\n api: ReturnType,\n path: string,\n method = \"GET\",\n body?: unknown,\n token?: string,\n) {\n const headers: Record = {};\n if (token !== undefined) headers.Authorization = `Bearer ${token}`;\n if (body !== undefined) headers[\"Content-Type\"] = \"application/json\";\n const response = await api.request(path, {\n method,\n headers: Object.keys(headers).length ? headers : undefined,\n body: body !== undefined ? JSON.stringify(body) : undefined,\n });\n return { status: response.status, json: await response.json() };\n}\n\nDeno.test(\"write routes require the configured bearer token\", async () => {\n const store = createIssueStore(createTestSqlite());\n const api = createApi(\"secret\", store);\n\n const missing = await call(api, \"/issues\", \"POST\", { title: \"x\" });\n assertEquals(missing.status, 401);\n assertEquals(\n (missing.json as { error: string }).error,\n \"Invalid or missing API key.\",\n );\n\n const wrong = await call(api, \"/issues\", \"POST\", { title: \"x\" }, \"nope\");\n assertEquals(wrong.status, 401);\n});\n\nDeno.test(\"write routes are disabled without a configured API key\", async () => {\n const store = createIssueStore(createTestSqlite());\n const api = createApi(undefined, store);\n\n const response = await call(api, \"/issues\", \"POST\", { title: \"x\" }, \"any\");\n assertEquals(response.status, 403);\n});\n\nDeno.test(\"malformed requests return 400 instead of being coerced or ignored\", async () => {\n const store = createIssueStore(createTestSqlite());\n const api = createApi(\"secret\", store);\n const authed = (path: string, method = \"GET\", body?: unknown) =>\n call(api, path, method, body, \"secret\");\n\n const created = await authed(\"/issues\", \"POST\", { title: \"Issue\" });\n const issueId = (created.json as { id: number }).id;\n\n assertEquals((await call(api, \"/issues/not-a-number\")).status, 400);\n assertEquals((await call(api, \"/issues?status=bogus\")).status, 400);\n assertEquals(\n (await authed(`/issues/${issueId}/close`, \"POST\", { reason: \"bogus\" }))\n .status,\n 400,\n );\n assertEquals(\n (await authed(\"/labels\", \"POST\", { name: \"x\", color: \"not-hex\" })).status,\n 400,\n );\n assertEquals(\n (await authed(\"/issues\", \"POST\", { title: \"x\", label_ids: [\"1\"] })).status,\n 400,\n );\n assertEquals(\n (await authed(\"/issues\", \"POST\", { title: \"x\", label_ids: [-1] })).status,\n 400,\n );\n assertEquals(\n (await authed(\"/issues\", \"POST\", { title: \"x\", assignees: [\"\"] })).status,\n 400,\n );\n assertEquals(\n (await authed(`/issues/${issueId}/labels`, \"POST\", { add: [\"oops\"] }))\n .status,\n 400,\n );\n assertEquals(\n (await authed(`/issues/${issueId}/assignees`, \"POST\", { add: [1] })).status,\n 400,\n );\n assertEquals(\n (await authed(`/issues/${issueId}/blocks`, \"POST\", { add: [0] })).status,\n 400,\n );\n});\n\nDeno.test(\"missing issues, comments, and labels return 404\", async () => {\n const store = createIssueStore(createTestSqlite());\n const api = createApi(\"secret\", store);\n const authed = (path: string, method = \"GET\", body?: unknown) =>\n call(api, path, method, body, \"secret\");\n\n assertEquals((await call(api, \"/issues/999999\")).status, 404);\n assertEquals(\n (await authed(\"/issues/999999\", \"PATCH\", { title: \"x\" })).status,\n 404,\n );\n assertEquals((await authed(\"/issues/999999\", \"DELETE\")).status, 404);\n assertEquals((await authed(\"/issues/999999/close\", \"POST\", {})).status, 404);\n assertEquals((await authed(\"/issues/999999/reopen\", \"POST\", {})).status, 404);\n assertEquals(\n (await authed(\"/issues/999999/labels\", \"POST\", { add: [1] })).status,\n 404,\n );\n assertEquals(\n (await authed(\"/issues/999999/assignees\", \"POST\", { add: [\"alice\"] }))\n .status,\n 404,\n );\n assertEquals(\n (await authed(\"/issues/999999/blocks\", \"POST\", { add: [1] })).status,\n 404,\n );\n assertEquals(\n (await authed(\"/issues/999999/comments\", \"POST\", { body: \"hi\" })).status,\n 404,\n );\n assertEquals((await call(api, \"/issues/999999/events\")).status, 404);\n\n assertEquals(\n (await authed(\"/comments/999999\", \"PATCH\", { body: \"x\" })).status,\n 404,\n );\n assertEquals((await authed(\"/comments/999999\", \"DELETE\")).status, 404);\n\n assertEquals(\n (await authed(\"/labels/999999\", \"PATCH\", { name: \"x\" })).status,\n 404,\n );\n assertEquals((await authed(\"/labels/999999\", \"DELETE\")).status, 404);\n\n const badLabel = await authed(\"/issues\", \"POST\", {\n title: \"Has bad label\",\n label_ids: [999999],\n });\n assertEquals(badLabel.status, 404);\n\n const issue = await authed(\"/issues\", \"POST\", { title: \"Real issue\" });\n const issueId = (issue.json as { id: number }).id;\n assertEquals(\n (await authed(`/issues/${issueId}/labels`, \"POST\", { add: [999999] }))\n .status,\n 404,\n );\n});\n\nDeno.test(\"blocking cycles and duplicate label names return 409\", async () => {\n const store = createIssueStore(createTestSqlite());\n const api = createApi(\"secret\", store);\n const authed = (path: string, method = \"GET\", body?: unknown) =>\n call(api, path, method, body, \"secret\");\n\n const a = (\n (await authed(\"/issues\", \"POST\", { title: \"A\" })).json as { id: number }\n ).id;\n const b = (\n (await authed(\"/issues\", \"POST\", { title: \"B\" })).json as { id: number }\n ).id;\n assertEquals(\n (await authed(`/issues/${a}/blocks`, \"POST\", { add: [a] })).status,\n 409,\n );\n await authed(`/issues/${a}/blocks`, \"POST\", { add: [b] });\n assertEquals(\n (await authed(`/issues/${b}/blocks`, \"POST\", { add: [a] })).status,\n 409,\n );\n\n assertEquals(\n (await authed(\"/labels\", \"POST\", { name: \"bug\", color: \"abcdef\" })).status,\n 409,\n );\n await authed(\"/labels\", \"POST\", { name: \"unique-label\", color: \"abcdef\" });\n const labels = (await call(api, \"/labels\")).json as Array<{\n id: number;\n name: string;\n }>;\n const existing = labels.find((label) => label.name === \"bug\");\n const toRename = labels.find((label) => label.name === \"unique-label\");\n assertEquals(\n (\n await authed(`/labels/${toRename?.id}`, \"PATCH\", {\n name: existing?.name,\n })\n ).status,\n 409,\n );\n});\n\nDeno.test(\"Issue, Comment, Label, and Event responses match the documented shape\", async () => {\n const store = createIssueStore(createTestSqlite());\n const api = createApi(\"secret\", store);\n const authed = (path: string, method = \"GET\", body?: unknown) =>\n call(api, path, method, body, \"secret\");\n\n const labels = (await call(api, \"/labels\")).json as Array<\n Record\n >;\n assertEquals(Object.keys(labels[0]).sort(), [\n \"color\",\n \"created_at\",\n \"id\",\n \"name\",\n \"updated_at\",\n ]);\n\n const created = await authed(\"/issues\", \"POST\", {\n title: \"Shape check\",\n assignees: [\"alice\"],\n });\n const issue = created.json as Record;\n assertEquals(Object.keys(issue).sort(), [\n \"assignees\",\n \"blocked\",\n \"blockers\",\n \"blocks\",\n \"body\",\n \"created_at\",\n \"creator\",\n \"id\",\n \"labels\",\n \"state_reason\",\n \"status\",\n \"title\",\n \"updated_at\",\n ]);\n const issueId = issue.id as number;\n\n const comment = await authed(`/issues/${issueId}/comments`, \"POST\", {\n body: \"note\",\n actor: \"alice\",\n });\n assertEquals(Object.keys(comment.json as object).sort(), [\n \"author\",\n \"body\",\n \"created_at\",\n \"id\",\n \"issue_id\",\n \"updated_at\",\n ]);\n\n const events = await call(api, `/issues/${issueId}/events`);\n const event = (events.json as Record[])[0];\n assertEquals(Object.keys(event).sort(), [\n \"actor\",\n \"data\",\n \"entity_id\",\n \"event_timestamp\",\n \"event_type\",\n \"id\",\n ]);\n\n const fetched = await call(api, `/issues/${issueId}`);\n assertEquals(Object.keys(fetched.json as object).includes(\"comments\"), true);\n});\n",[254],"77df7542-7411-4e97-8d94-6872d674925c","api.ts","4e80ef48-7be4-11f1-9a45-1607ee4eb77e",226,["D",1784052698195],"/**\n * Agent-facing JSON API. Reads are public; writes require the configured\n * bearer token. Actors are Val Town handles carried only by event records.\n */\nimport { type Context, Hono } from \"npm:hono@4.6.14\";\nimport {\n CLOSED_STATE_REASONS,\n type ClosedStateReason,\n defaultIssueStore,\n HttpError,\n ISSUE_STATUSES,\n type IssueStatus,\n type IssueStore,\n} from \"./db.ts\";\n\n// biome-ignore lint/suspicious/noExplicitAny: request JSON is validated field by field\ntype Body = Record;\ntype ApiEnv = { Variables: { actor: string; body: Body } };\n\nfunction stringField(body: Body, key: string): string | undefined {\n return typeof body[key] === \"string\" ? body[key].trim() : undefined;\n}\n\nfunction rawStringField(body: Body, key: string): string | undefined {\n return typeof body[key] === \"string\" ? body[key] : undefined;\n}\n\nfunction idParam(value: string): number | null {\n const id = Number(value);\n return Number.isInteger(id) && id > 0 ? id : null;\n}\n\n/**\n * Strict, all-or-nothing validation for an optional ID-array field: an\n * absent field is an empty operation; a present field must be entirely\n * positive integers or the whole request is rejected with `400`.\n */\nfunction idArrayField(c: Context, key: string): number[] | Response {\n const value = c.get(\"body\")[key];\n if (value === undefined) return [];\n const valid = Array.isArray(value) &&\n value.every(\n (item: unknown) =>\n typeof item === \"number\" && Number.isInteger(item) && item > 0,\n );\n if (!valid) {\n return c.json(\n { error: `${key} must be an array of positive integers.` },\n 400,\n );\n }\n return value as number[];\n}\n\n/**\n * Strict, all-or-nothing validation for an optional handle-array field: an\n * absent field is an empty operation; a present field must be entirely\n * non-empty strings or the whole request is rejected with `400`.\n */\nfunction handlesField(c: Context, key: string): string[] | Response {\n const value = c.get(\"body\")[key];\n if (value === undefined) return [];\n const valid = Array.isArray(value) &&\n value.every(\n (item: unknown) =>\n typeof item === \"string\" && item.trim().replace(/^@/, \"\").length > 0,\n );\n if (!valid) {\n return c.json(\n { error: `${key} must be an array of non-empty strings.` },\n 400,\n );\n }\n return (value as string[]).map((item) => item.trim().replace(/^@/, \"\"));\n}\n\nexport function createApi(\n apiKey: string | undefined,\n store: IssueStore = defaultIssueStore,\n) {\n const api = new Hono();\n\n api.onError((error, c) => {\n if (error instanceof HttpError) {\n return c.json({ error: error.message }, error.status);\n }\n console.error(error);\n return c.json({ error: \"Internal server error.\" }, 500);\n });\n api.use(\"*\", async (_c, next) => {\n await store.initSchema();\n await next();\n });\n api.use(\"*\", async (c, next) => {\n if (c.req.method === \"GET\") return await next();\n if (!apiKey) {\n return c.json(\n {\n error: \"API writes are disabled: ISSUE_TRACKER_API_KEY is not set.\",\n },\n 403,\n );\n }\n const token = (c.req.header(\"Authorization\") ?? \"\").replace(\n /^Bearer\\s+/i,\n \"\",\n );\n if (token !== apiKey) {\n return c.json({ error: \"Invalid or missing API key.\" }, 401);\n }\n const body: Body = await c.req.json().catch(() => ({}));\n c.set(\"body\", body);\n c.set(\"actor\", stringField(body, \"actor\") || \"agent\");\n await next();\n });\n\n api.get(\"/issues\", async (c) => {\n const status = c.req.query(\"status\");\n if (\n status !== undefined &&\n !ISSUE_STATUSES.includes(status as IssueStatus)\n ) {\n return c.json(\n { error: `status must be one of ${ISSUE_STATUSES.join(\", \")}.` },\n 400,\n );\n }\n return c.json(\n await store.listIssues({\n status: status as IssueStatus | undefined,\n label: c.req.query(\"label\") || undefined,\n assignee: c.req.query(\"assignee\")?.replace(/^@/, \"\") || undefined,\n search: c.req.query(\"search\") || undefined,\n }),\n );\n });\n\n api.post(\"/issues\", async (c) => {\n const body = c.get(\"body\");\n const title = stringField(body, \"title\");\n if (!title) return c.json({ error: \"title is required.\" }, 400);\n const labelIds = idArrayField(c, \"label_ids\");\n if (labelIds instanceof Response) return labelIds;\n const assignees = handlesField(c, \"assignees\");\n if (assignees instanceof Response) return assignees;\n for (const labelId of labelIds) {\n if (!(await store.getLabel(labelId))) {\n return c.json({ error: `Label #${labelId} not found.` }, 404);\n }\n }\n const id = await store.createIssue({\n title,\n body: rawStringField(body, \"body\") ?? \"\",\n actor: c.get(\"actor\"),\n });\n for (const labelId of labelIds) {\n await store.addLabel(id, labelId, c.get(\"actor\"));\n }\n for (const handle of assignees) {\n await store.addAssignee(id, handle, c.get(\"actor\"));\n }\n return c.json(await store.getIssue(id), 201);\n });\n\n api.get(\"/issues/:id\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n const issue = await store.getIssue(id);\n if (!issue) return c.json({ error: `Issue #${id} not found.` }, 404);\n return c.json({ ...issue, comments: await store.listComments(id) });\n });\n\n api.patch(\"/issues/:id\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getIssue(id))) {\n return c.json({ error: `Issue #${id} not found.` }, 404);\n }\n const body = c.get(\"body\");\n await store.updateIssue(\n id,\n {\n ...(stringField(body, \"title\") !== undefined\n ? { title: stringField(body, \"title\") }\n : {}),\n ...(rawStringField(body, \"body\") !== undefined\n ? { body: rawStringField(body, \"body\") }\n : {}),\n },\n c.get(\"actor\"),\n );\n return c.json(await store.getIssue(id));\n });\n\n api.delete(\"/issues/:id\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getIssue(id))) {\n return c.json({ error: `Issue #${id} not found.` }, 404);\n }\n await store.deleteIssue(id, c.get(\"actor\"));\n return c.json({ deleted: id });\n });\n\n api.post(\"/issues/:id/close\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getIssue(id))) {\n return c.json({ error: `Issue #${id} not found.` }, 404);\n }\n const body = c.get(\"body\");\n if (\n body.reason !== undefined &&\n !CLOSED_STATE_REASONS.includes(body.reason)\n ) {\n return c.json({ error: \"invalid close reason\" }, 400);\n }\n const reason: ClosedStateReason = body.reason ?? \"completed\";\n const comment = rawStringField(body, \"comment\");\n if (comment?.trim()) {\n await store.createComment({\n issueId: id,\n body: comment,\n actor: c.get(\"actor\"),\n });\n }\n await store.closeIssue(id, c.get(\"actor\"), reason);\n return c.json(await store.getIssue(id));\n });\n\n api.post(\"/issues/:id/reopen\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getIssue(id))) {\n return c.json({ error: `Issue #${id} not found.` }, 404);\n }\n await store.reopenIssue(id, c.get(\"actor\"));\n return c.json(await store.getIssue(id));\n });\n\n api.post(\"/issues/:id/labels\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getIssue(id))) {\n return c.json({ error: `Issue #${id} not found.` }, 404);\n }\n const remove = idArrayField(c, \"remove\");\n if (remove instanceof Response) return remove;\n const add = idArrayField(c, \"add\");\n if (add instanceof Response) return add;\n for (const labelId of remove) {\n await store.removeLabel(id, labelId, c.get(\"actor\"));\n }\n for (const labelId of add) {\n await store.addLabel(id, labelId, c.get(\"actor\"));\n }\n return c.json(await store.getIssue(id));\n });\n\n api.post(\"/issues/:id/assignees\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getIssue(id))) {\n return c.json({ error: `Issue #${id} not found.` }, 404);\n }\n const remove = handlesField(c, \"remove\");\n if (remove instanceof Response) return remove;\n const add = handlesField(c, \"add\");\n if (add instanceof Response) return add;\n for (const handle of remove) {\n await store.removeAssignee(id, handle, c.get(\"actor\"));\n }\n for (const handle of add) {\n await store.addAssignee(id, handle, c.get(\"actor\"));\n }\n return c.json(await store.getIssue(id));\n });\n\n for (\n const [path, direction] of [\n [\"blocks\", \"blocks\"],\n [\"blocked-by\", \"blocked_by\"],\n ] as const\n ) {\n api.post(`/issues/:id/${path}`, async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getIssue(id))) {\n return c.json({ error: `Issue #${id} not found.` }, 404);\n }\n const remove = idArrayField(c, \"remove\");\n if (remove instanceof Response) return remove;\n const add = idArrayField(c, \"add\");\n if (add instanceof Response) return add;\n for (const otherId of remove) {\n await store.removeBlock(id, otherId, direction, c.get(\"actor\"));\n }\n for (const otherId of add) {\n await store.addBlock(id, otherId, direction, c.get(\"actor\"));\n }\n return c.json(await store.getIssue(id));\n });\n }\n\n api.post(\"/issues/:id/comments\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getIssue(id))) {\n return c.json({ error: `Issue #${id} not found.` }, 404);\n }\n const body = rawStringField(c.get(\"body\"), \"body\");\n if (!body?.trim()) return c.json({ error: \"body is required.\" }, 400);\n const commentId = await store.createComment({\n issueId: id,\n body,\n actor: c.get(\"actor\"),\n });\n return c.json(\n (await store.listComments(id)).find(\n (comment) => comment.id === commentId,\n ),\n 201,\n );\n });\n\n api.patch(\"/comments/:id\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getComment(id))) {\n return c.json({ error: `Comment #${id} not found.` }, 404);\n }\n const body = rawStringField(c.get(\"body\"), \"body\");\n if (!body?.trim()) return c.json({ error: \"body is required.\" }, 400);\n await store.updateComment(id, body, c.get(\"actor\"));\n return c.json({ updated: id });\n });\n\n api.delete(\"/comments/:id\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getComment(id))) {\n return c.json({ error: `Comment #${id} not found.` }, 404);\n }\n await store.deleteComment(id, c.get(\"actor\"));\n return c.json({ deleted: id });\n });\n\n api.get(\"/issues/:id/events\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getIssue(id))) {\n return c.json({ error: `Issue #${id} not found.` }, 404);\n }\n return c.json(await store.listEvents({ entity: \"issue\", entityId: id }));\n });\n\n api.get(\"/labels\", async (c) => c.json(await store.listLabels()));\n api.post(\"/labels\", async (c) => {\n const body = c.get(\"body\");\n const name = stringField(body, \"name\");\n const color = stringField(body, \"color\");\n if (!name || !color) {\n return c.json({ error: \"name and color are required.\" }, 400);\n }\n const id = await store.createLabel({\n name,\n color: color.replace(/^#/, \"\"),\n actor: c.get(\"actor\"),\n });\n return c.json(await store.getLabel(id), 201);\n });\n api.patch(\"/labels/:id\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getLabel(id))) {\n return c.json({ error: `Label #${id} not found.` }, 404);\n }\n const body = c.get(\"body\");\n await store.updateLabel(\n id,\n {\n ...(stringField(body, \"name\") !== undefined\n ? { name: stringField(body, \"name\") }\n : {}),\n ...(stringField(body, \"color\") !== undefined\n ? { color: stringField(body, \"color\")?.replace(/^#/, \"\") }\n : {}),\n },\n c.get(\"actor\"),\n );\n return c.json(await store.getLabel(id));\n });\n api.delete(\"/labels/:id\", async (c) => {\n const id = idParam(c.req.param(\"id\"));\n if (!id) return c.json({ error: \"invalid id\" }, 400);\n if (!(await store.getLabel(id))) {\n return c.json({ error: `Label #${id} not found.` }, 404);\n }\n await store.deleteLabel(id, c.get(\"actor\"));\n return c.json({ deleted: id });\n });\n\n return api;\n}\n",[262],"4feb55a4-64fd-4f70-985c-26e3143fb3be","README.md","dae70d12-7b3c-11f1-b278-1607ee4eb77e",227,["D",1784052698291],20,"# val-issue-tracker\n\nA lightweight GitHub-flavoured issue tracker for Val Town's scoped SQLite\n(`std/sqlite/main.ts`) — issues, labels, assignees, blocking edges, comments,\nand a bearer-authenticated JSON API. A drop-in Hono app: imports execute against\nthe host val's database, and all tables use the `issue_tracker_*` prefix.\n\nIt is an [`integrations`](https://esm.town/v/nbbaier/integrations/mod.ts)\ncontract integration, so `issueTracker()` returns a **callable Integration**:\nthe same value works both as a standalone HTTP val and mounted under a router\nalongside other integrations.\n\n## Standalone: this val's own tracker\n\n`main.ts` mounts the tracker for **this** val's scoped database — the tracker\n_is_ the val's HTTP export and runs its own OAuth. Visit the val's endpoint and\nlog in.\n\nScoped SQLite is bound to whichever val's runtime is **executing** the code, not\nto where the source lives. So importing the tracker into another val makes it\nread and write **that** val's database automatically — no tokens, no registry:\n\n```ts\nimport { issueTracker } from \"https://esm.town/v/nbbaier/val-issue-tracker/mod.ts\";\n\nexport default issueTracker({\n maintainers: [\"afriend\"],\n apiKey: Deno.env.get(\"ISSUE_TRACKER_API_KEY\"),\n});\n```\n\nThe running val's owner is always a maintainer. Public reads, Val Town OAuth,\nand the visible `/source` redirect remain built in.\n\n## Routed: mounted alongside other integrations\n\nRegister it with a `createRouter` and it mounts under `/issues/`, sharing one\nOAuth gate with every other integration:\n\n```ts\nimport { createRouter } from \"https://esm.town/v/nbbaier/integrations/mod.ts\";\nimport { issueTracker } from \"https://esm.town/v/nbbaier/val-issue-tracker/mod.ts\";\n\nexport default createRouter({\n integrations: [issueTracker({})],\n});\n```\n\nThe router owns **authentication**; the tracker's role model remains its own\n**authorization** layer, resolved from the router-provided user. A null user —\nthe ungated router's anonymous visitor — becomes a read-only viewer rather than\nbeing redirected to a login that doesn't exist. The bearer-token JSON API keeps\nits own gate, which stacks behind the router's when the router has one.\n\n### Options\n\n| Option | Meaning |\n| ------------- | --------------------------------------------------------------------- |\n| `maintainers` | Additional Val Town handles with maintainer access |\n| `owner` | Deprecated alias for `maintainers` |\n| `defaultRole` | `contributor` (default) or `viewer` for other logged-in users |\n| `auth` | Val Town OAuth when `true` (default); fully open tracker when `false` |\n| `title` | Header and browser title |\n| `apiKey` | Bearer token for JSON writes; defaults to `ISSUE_TRACKER_API_KEY` |\n\nWith auth enabled, viewers can read; contributors can create/comment and manage\nissues they created; maintainers can manage all issues, labels, and deletions.\n\n### Requirement when `auth` is on\n\nThe OAuth gate — this val's own when standalone, the router's when routed —\nneeds an `OAUTH_STATE_ENCRYPTION_KEY` env var (any random 32-byte hex string) to\nencrypt session cookies. Generate one with `openssl rand -hex 32`. The\nintegration declares it as `requiredEnv`, so a router's directory page badges it\nwhen unset.\n\n## Data model\n\n- Issues have `title`, markdown-text `body`, `open`/`closed` status, and an\n auto-managed `state_reason`.\n- Labels are curated name/colour entities and are applied through a join table.\n- Assignees are a set of Val Town handles.\n- Blocking edges form a strict DAG; `blocked` is derived from open blockers.\n- Comments are editable entities.\n- An append-only events table is the sole provenance/history source. Live\n entities retain current state and timestamps only; relationship rows are bare\n tuples.\n- Fresh installs seed `bug`, `enhancement`, `documentation`, `question`, and\n `duplicate` exactly once.\n\nSchema initialization is idempotent and runs on requests. It also migrates the\nold tracker schema: `description → body`, priority removal,\n`in_progress → open`, JSON labels and single assignee lifted into joins, and\nsynthetic creation events.\n\n## JSON API\n\nReads under `/api` are public. Writes require `Authorization: Bearer `.\nThe main operations are:\n\n| Method and path | Purpose |\n| ---------------------------------- | ----------------------------------------------------- |\n| `GET/POST /api/issues` | List/filter or create issues |\n| `GET/PATCH/DELETE /api/issues/:id` | Read, edit, or hard-delete an issue |\n| `POST /api/issues/:id/close` | Close with `completed`, `not_planned`, or `duplicate` |\n| `POST /api/issues/:id/reopen` | Reopen |\n| `POST /api/issues/:id/labels` | Apply/remove label IDs |\n| `POST /api/issues/:id/assignees` | Assign/unassign handles |\n| `POST /api/issues/:id/blocks` | Add/remove issues this issue blocks |\n| `POST /api/issues/:id/blocked-by` | Add/remove blockers |\n| `POST /api/issues/:id/comments` | Comment |\n| `PATCH/DELETE /api/comments/:id` | Edit/delete a comment |\n| `GET/POST /api/labels` | List/create labels |\n| `PATCH/DELETE /api/labels/:id` | Edit/delete a label |\n\nReads are public; writes are `401` without a valid bearer token and `403` if no\ntoken is configured at all. Requests are validated strictly: malformed IDs,\nfilters, or collection fields (`label_ids`, `add`/`remove`, `assignees`) return\n`400`; a missing issue, comment, or label returns `404`; a blocking cycle or\nduplicate label name returns `409`. Errors are always `{\"error\": \"...\"}`. See\n[docs/issue-tracker-valtown.md](./docs/issue-tracker-valtown.md) for the exact\nrequest and response shapes, the event-data grammar, and the full status-code\ntable.\n\n## Development\n\nBiome (tab-indented, per `biome.json`) is the canonical formatter — not\n`deno fmt`. Local Val Town and Claude Code state (`.vt/`, `.claude/`) is\nexcluded from formatting and lint checks.\n\n```bash\ndeno task fmt # biome check . --write (format + apply safe fixes)\ndeno task lint # deno lint\ndeno task typecheck # deno check across source and test files\ndeno task test # deno test\ndeno task check # runs all four in sequence\n```\n\nThe focused test suite uses Deno's SQLite-compatible in-memory driver; it never\nwrites a database file.\n\n## Files\n\n- `db.ts` — schema, migration, domain operations, and default Val Town store.\n- `api.ts` — bearer-authenticated Hono JSON API.\n- `app.tsx` — OAuth/permissions and HTML form routes.\n- `components.tsx`, `ui.tsx`, `layout.tsx` — server-rendered Hono TSX.\n- `mod.ts` — reusable public entry point.\n- `main.ts` — this val's own consumer.\n",[269],"c34cfc02-9b11-4180-af9f-fc65ffdf536f","CONTEXT.md","eee9abe2-7bf2-11f1-803f-1607ee4eb77e",221,["D",1784052698014],"# Context — Val Issue Tracker\n\nA GitHub-flavored issue tracker, designed as a **drop-in library**: it is\nimported into any Val Town project and uses that host val's scoped SQLite\ndatabase. Table names are prefixed (`issue_tracker_*`) to avoid colliding with\nthe host's tables.\n\nIt mounts two ways: **standalone** (`export default issueTracker({...})` as a\nval's HTTP export, running its own OAuth) or **routed** (registered with an\n[integrations](https://www.val.town/x/nbbaier/integrations/code/) router, which\nowns authentication and passes the verified user and mount prefix as an\n`IntegrationContext`). The factory returns a callable Integration that serves\nboth; in routed mode the role model is fed by `ctx.user`, and a null `ctx.user`\n(ungated router) yields a read-only viewer.\n\n## Glossary\n\n### Issue\n\nThe core unit of work. Has a title, a markdown **body** (renamed from\n`description` to match Comment and GitHub — one word, \"body\", for \"the markdown\nprose of this thing\"), a status, and metadata (creator, timestamps). Modeled\nafter a GitHub issue.\n\n### Body\n\nThe markdown prose of an Issue or a Comment. Stored as plain `TEXT`; \"it is\nmarkdown\" is a rendering contract, not a storage concern (see docs/backlog.md).\n\n### Status\n\nAn issue's lifecycle state. Exactly two values: **`open`** and **`closed`**.\nThere is no `in_progress` (removed). This mirrors GitHub, where \"not planned\" is\n_not_ a third state — see State Reason.\n\n### State Reason\n\nA nullable qualifier explaining _why_ an issue holds its current status,\nmirroring GitHub's `state_reason`. Values: `completed`, `not_planned`,\n`duplicate` (pair with `closed`), `reopened` (pairs with `open`), or `null`.\nThis is what distinguishes \"closed because done\" from \"closed because\nabandoned\". It is **auto-managed**, never set freely: creating leaves it `null`;\nclosing sets the chosen reason (`completed` default); reopening forces\n`reopened` (which distinguishes a reopened issue from a never-closed one). Valid\npairings — `open` with `null`/`reopened`, `closed` with\n`completed`/`not_planned`/`duplicate` — are guarded by a SQLite `CHECK`\nconstraint.\n\n### User (identity)\n\nAny actor — creator, comment author, assignee — is a **Val Town user**. There is\nno local users table; anyone who can make changes is logged in via Val Town\nauth. Identity is carried as the Val Town **handle** (username), not a stable id\n— renames are rare and human-readable handles need no lookup. Handles should\neventually render as links to the user's Val Town profile (see docs/backlog.md).\n\n### Assignee\n\nThe Val Town user(s) responsible for an issue. Multi-valued (a set), not single\n— an issue may have zero or more assignees. An assignee is _not_ an entity, just\na link between an issue and an existing Val Town user, stored as a bare join\ntuple (`issue_tracker_issue_assignees(issue_id, user_handle)`). Who assigned\nwhom, and when, lives in the events log — not on the row.\n\n### Comment\n\nA markdown note attached to an issue. An entity — editable, and keeps\n`created_at` + `updated_at` columns. Who authored/edited it is _not_ a column;\nthe actor is derived from the events log (the old `author` column is gone). See\nADR 0003 and ADR 0004.\n\n### Entity vs Link\n\nAn **entity** (Issue, Comment, Label) is user-authored and editable. It keeps\n`created_at` + `updated_at` as denormalized columns (needed for hot-path listing\nand \"last activity\" sorting); the **actor** behind each create/update (`*_by`)\nis _not_ stored — it is derived from the events log. A **link** (the assignee\nand block join rows) is a **bare relationship tuple** — `(issue_id, label_id)`,\n`(issue_id,\nuser_handle)`, `(blocker_id, blocked_id)` — with no audit columns at\nall; its full provenance lives in events. See ADR 0003 (amended) and ADR 0004.\n\n### Label\n\nA reusable, curated tag — a first-class entity with a unique `name` and a\n`color`, living in `issue_tracker_labels`. Applied to issues via a join\n(`issue_tracker_issue_labels`); applying means picking an existing label, not\ntyping free-form text. Deleting a label is allowed even when in use — the join\nrows cascade away and the tagged issues simply lose that label. A default set\n(`bug`, `enhancement`, `documentation`, `question`, `duplicate`) is seeded\n**once, when the labels table is first created** — never re-seeded, so user\ndeletions survive (see ADR 0001).\n\n### Blocking relationship\n\nA directed dependency between two issues in the same tracker: \"A blocks B\" means\nB depends on A. Stored as one directed edge in\n`issue_tracker_issue_blocks(blocker_id,\nblocked_id)`; \"blocks\" and \"blocked by\"\nare the same edge read from opposite ends. The block graph is a strict DAG:\n**any** edge that would create a cycle is rejected — self-edges, direct\nreciprocals (A↔B), and longer loops (A→B→C→A) alike. This is stricter than\nGitHub (which permits longer cycles) and is enforced with a reachability check\non insert (see ADR 0002).\n\n### Touch (updated_at)\n\nMutating an issue's associations — adding/removing a label, an assignee, or a\nblock edge, or adding a comment — updates that issue's `updated_at`, exactly as\nediting the issue itself does. `updated_at` reflects \"last activity on this\nissue\", not just edits to its own columns.\n\n### Blocked (derived)\n\nAn issue is _blocked_ iff at least one of its blockers is still `open`. This is\nnever stored — it is computed from the edges and the blockers' status, so\nclosing a blocker automatically unblocks its dependents. Blocked-ness is\ninformational: it does **not** prevent an issue from being closed.\n\n### Event\n\nAn append-only record of one change, in a single polymorphic table\n(`issue_tracker_events`): `id`, `event_type`, `entity_id`, `actor`, `data`,\n`event_timestamp`. `event_type` is `.` where entity ∈ {issue,\ncomment, label} and verb ∈ {created, updated, deleted}. The events log is the\n**source of truth for provenance and history**; live tables hold only current\nstate. Grammar:\n\n- **Boundary events snapshot full state.** `*.created` → the entity's full\n initial state; `*.deleted` → its full final state (so a hard-deleted row\n leaves a complete tombstone).\n- **`*.updated` carries a field delta:** `{ update_target, from, to }`.\n Associations are modelled as `issue.updated` with `update_target` ∈ {label,\n assignee, blocks, blocked_by} and `from`/`to` using **`null ↔ value`** (null→X\n = added, X→null = removed). A block edge writes **one** event, on the acting\n issue.\n\nOne event per changed field: closing an issue emits two events (`status` and\n`state_reason`), sharing one actor and timestamp. See ADR 0004.\n\n### Actor\n\nThe Val Town handle that performed a change, stored on each event. This is the\nonly place actor/provenance lives — entities and links do not carry `*_by`\ncolumns.\n\n## Removed / rejected\n\n- **Priority** — removed entirely. Faithful to GitHub, which has no first-class\n priority field (labels/Projects only).\n- **`in_progress` status** — removed; existing rows migrate to `open`.\n",[277],"97a698fa-af29-4782-923e-6567950652da","CLAUDE.md","eec4ed34-7bf2-11f1-9665-1607ee4eb77e",182,["D",1783653143490],"\n\n# Agent instructions — val-issue-tracker\n\n## Agent skills\n\n### Issue tracker\n\nLocal markdown under `docs/issues//` — issues/PRDs as files, no\nexternal PRs. See `docs/agents/issue-tracker.md`.\n\n### Triage labels\n\nFive canonical roles, default strings (`needs-triage`, `needs-info`,\n`ready-for-agent`, `ready-for-human`, `wontfix`). See\n`docs/agents/triage-labels.md`.\n\n### Domain docs\n\nSingle-context — root `CONTEXT.md` + `docs/adr/` (0001–0004). See\n`docs/agents/domain.md`.\n",[284],"2962acd1-da54-4800-a90a-07becc787602","AGENTS.md","eeb653e6-7bf2-11f1-9665-1607ee4eb77e",177,["D",1783653143220],[291],"054476e7-04a7-4b95-9e68-3276cca56df3",".vtignore","0a9d3ac6-7b43-11f1-a110-1607ee4eb77e",23,["D",1783566329616],".git\n.vscode\n.cursor\n.claude\n.DS_Store\nnode_modules\nvendor",[297],"bc026218-6b7e-4cdc-a0ed-1e2a98ae1732","wireframes","b2fea024-7fb7-11f1-b27c-1607ee4eb77e",236,["D",1784056238376],"directory",[304],"a4f232e2-8ab1-4a5e-9634-5b86a0a15abd","docs","4e6ce2e6-7be4-11f1-9a45-1607ee4eb77e",128,["D",1783635592340],[311],"pulls","branches","forks","envVars",{"_323":63,"_325":63},"connections",{"_323":63,"_324":63},"count","unfilledCount","emptyCount",{"_43":310,"_32":311,"_30":312,"_155":-5,"_41":42,"_40":313,"_157":59,"_38":693,"_13":63,"_33":308,"_35":-5,"_24":25,"_161":-5,"_381":694,"_27":695},{"_43":688,"_32":663,"_30":657,"_155":312,"_41":42,"_40":689,"_157":59,"_38":690,"_13":63,"_33":308,"_35":-5,"_24":25,"_161":-5,"_381":691,"_27":692},{"_43":680,"_32":681,"_30":682,"_155":657,"_41":42,"_40":683,"_157":59,"_38":684,"_13":207,"_33":20,"_35":685,"_24":25,"_161":-5,"_381":686,"_27":687},{"_43":672,"_32":673,"_30":674,"_155":657,"_41":42,"_40":675,"_157":59,"_38":676,"_13":207,"_33":20,"_35":677,"_24":25,"_161":-5,"_381":678,"_27":679},{"_43":664,"_32":665,"_30":666,"_155":657,"_41":42,"_40":667,"_157":59,"_38":668,"_13":207,"_33":20,"_35":669,"_24":25,"_161":-5,"_381":670,"_27":671},{"_43":654,"_32":655,"_30":656,"_155":657,"_41":42,"_40":658,"_157":59,"_38":659,"_13":207,"_33":20,"_35":660,"_24":25,"_161":-5,"_381":661,"_27":662},{"_43":649,"_32":632,"_30":626,"_155":312,"_41":42,"_40":650,"_157":59,"_38":651,"_13":63,"_33":308,"_35":-5,"_24":25,"_161":-5,"_381":652,"_27":653},{"_43":641,"_32":642,"_30":643,"_155":626,"_41":42,"_40":644,"_157":59,"_38":645,"_13":207,"_33":20,"_35":646,"_24":25,"_161":-5,"_381":647,"_27":648},{"_43":633,"_32":634,"_30":635,"_155":626,"_41":42,"_40":636,"_157":25,"_38":637,"_13":207,"_33":20,"_35":638,"_24":25,"_161":-5,"_381":639,"_27":640},{"_43":623,"_32":624,"_30":625,"_155":626,"_41":42,"_40":627,"_157":59,"_38":628,"_13":207,"_33":20,"_35":629,"_24":25,"_161":-5,"_381":630,"_27":631},{"_43":618,"_32":518,"_30":537,"_155":312,"_41":42,"_40":619,"_157":59,"_38":620,"_13":63,"_33":308,"_35":-5,"_24":25,"_161":-5,"_381":621,"_27":622},{"_43":613,"_32":550,"_30":544,"_155":537,"_41":42,"_40":614,"_157":59,"_38":615,"_13":63,"_33":308,"_35":-5,"_24":25,"_161":-5,"_381":616,"_27":617},{"_43":608,"_32":518,"_30":554,"_155":544,"_41":42,"_40":609,"_157":59,"_38":610,"_13":63,"_33":308,"_35":-5,"_24":25,"_161":-5,"_381":611,"_27":612},{"_43":600,"_32":601,"_30":602,"_155":554,"_41":42,"_40":603,"_157":59,"_38":604,"_13":497,"_33":20,"_35":605,"_24":25,"_161":-5,"_381":606,"_27":607},{"_43":592,"_32":593,"_30":594,"_155":554,"_41":42,"_40":595,"_157":25,"_38":596,"_13":207,"_33":20,"_35":597,"_24":25,"_161":-5,"_381":598,"_27":599},{"_43":584,"_32":585,"_30":586,"_155":554,"_41":42,"_40":587,"_157":25,"_38":588,"_13":63,"_33":20,"_35":589,"_24":25,"_161":-5,"_381":590,"_27":591},{"_43":576,"_32":577,"_30":578,"_155":554,"_41":42,"_40":579,"_157":25,"_38":580,"_13":63,"_33":20,"_35":581,"_24":25,"_161":-5,"_381":582,"_27":583},{"_43":568,"_32":569,"_30":570,"_155":554,"_41":42,"_40":571,"_157":25,"_38":572,"_13":63,"_33":20,"_35":573,"_24":25,"_161":-5,"_381":574,"_27":575},{"_43":560,"_32":561,"_30":562,"_155":554,"_41":42,"_40":563,"_157":25,"_38":564,"_13":63,"_33":20,"_35":565,"_24":25,"_161":-5,"_381":566,"_27":567},{"_43":551,"_32":552,"_30":553,"_155":554,"_41":42,"_40":555,"_157":25,"_38":556,"_13":63,"_33":20,"_35":557,"_24":25,"_161":-5,"_381":558,"_27":559},{"_43":542,"_32":529,"_30":543,"_155":544,"_41":42,"_40":545,"_157":25,"_38":546,"_13":63,"_33":20,"_35":547,"_24":25,"_161":-5,"_381":548,"_27":549},{"_43":536,"_32":519,"_30":512,"_155":537,"_41":42,"_40":538,"_157":59,"_38":539,"_13":63,"_33":308,"_35":-5,"_24":25,"_161":-5,"_381":540,"_27":541},{"_43":528,"_32":529,"_30":530,"_155":512,"_41":42,"_40":531,"_157":25,"_38":532,"_13":175,"_33":20,"_35":533,"_24":25,"_161":-5,"_381":534,"_27":535},{"_43":520,"_32":521,"_30":522,"_155":512,"_41":42,"_40":523,"_157":25,"_38":524,"_13":63,"_33":20,"_35":525,"_24":25,"_161":-5,"_381":526,"_27":527},{"_43":509,"_32":510,"_30":511,"_155":512,"_41":42,"_40":513,"_157":25,"_38":514,"_13":175,"_33":20,"_35":515,"_24":25,"_161":-5,"_381":516,"_27":517},{"_43":501,"_32":502,"_30":503,"_155":312,"_41":42,"_40":504,"_157":25,"_38":505,"_13":207,"_33":20,"_35":506,"_24":25,"_161":-5,"_381":507,"_27":508},{"_43":492,"_32":493,"_30":494,"_155":312,"_41":42,"_40":495,"_157":59,"_38":496,"_13":497,"_33":20,"_35":498,"_24":25,"_161":-5,"_381":499,"_27":500},{"_43":303,"_32":304,"_30":305,"_155":-5,"_41":42,"_40":306,"_157":59,"_38":489,"_13":63,"_33":308,"_35":-5,"_24":25,"_161":-5,"_381":490,"_27":491},{"_43":481,"_32":482,"_30":483,"_155":305,"_41":42,"_40":484,"_157":59,"_38":485,"_13":63,"_33":20,"_35":486,"_24":25,"_161":-5,"_381":487,"_27":488},{"_43":473,"_32":474,"_30":475,"_155":305,"_41":42,"_40":476,"_157":59,"_38":477,"_13":63,"_33":20,"_35":478,"_24":25,"_161":-5,"_381":479,"_27":480},{"_43":465,"_32":466,"_30":467,"_155":305,"_41":42,"_40":468,"_157":59,"_38":469,"_13":63,"_33":20,"_35":470,"_24":25,"_161":-5,"_381":471,"_27":472},{"_43":457,"_32":458,"_30":459,"_155":305,"_41":42,"_40":460,"_157":59,"_38":461,"_13":63,"_33":20,"_35":462,"_24":25,"_161":-5,"_381":463,"_27":464},{"_43":449,"_32":450,"_30":451,"_155":305,"_41":42,"_40":452,"_157":59,"_38":453,"_13":63,"_33":20,"_35":454,"_24":25,"_161":-5,"_381":455,"_27":456},{"_43":441,"_32":442,"_30":443,"_155":305,"_41":42,"_40":444,"_157":59,"_38":445,"_13":63,"_33":20,"_35":446,"_24":25,"_161":-5,"_381":447,"_27":448},{"_43":296,"_32":297,"_30":298,"_155":-5,"_41":42,"_40":299,"_157":59,"_38":438,"_13":63,"_33":20,"_35":301,"_24":25,"_161":-5,"_381":439,"_27":440},{"_43":290,"_32":291,"_30":292,"_155":-5,"_41":42,"_40":293,"_157":25,"_38":435,"_13":207,"_33":20,"_35":288,"_24":25,"_161":-5,"_381":436,"_27":437},{"_43":283,"_32":284,"_30":285,"_155":-5,"_41":42,"_40":286,"_157":25,"_38":432,"_13":207,"_33":20,"_35":288,"_24":25,"_161":-5,"_381":433,"_27":434},{"_43":276,"_32":277,"_30":278,"_155":-5,"_41":42,"_40":279,"_157":59,"_38":429,"_13":258,"_33":20,"_35":281,"_24":25,"_161":-5,"_381":430,"_27":431},{"_43":268,"_32":269,"_30":270,"_155":-5,"_41":42,"_40":271,"_157":25,"_38":426,"_13":273,"_33":20,"_35":274,"_24":25,"_161":-5,"_381":427,"_27":428},{"_43":261,"_32":262,"_30":263,"_155":-5,"_41":42,"_40":264,"_157":25,"_38":423,"_13":258,"_33":34,"_35":266,"_24":25,"_161":-5,"_381":424,"_27":425},{"_43":253,"_32":254,"_30":255,"_155":-5,"_41":42,"_40":256,"_157":25,"_38":420,"_13":258,"_33":34,"_35":259,"_24":25,"_161":-5,"_381":421,"_27":422},{"_43":245,"_32":246,"_30":247,"_155":-5,"_41":42,"_40":248,"_157":25,"_38":417,"_13":250,"_33":34,"_35":251,"_24":25,"_161":-5,"_381":418,"_27":419},{"_43":241,"_32":28,"_30":31,"_155":-5,"_41":42,"_40":14,"_157":25,"_38":414,"_13":243,"_33":34,"_35":37,"_24":25,"_161":-5,"_381":415,"_27":416},{"_43":233,"_32":234,"_30":235,"_155":-5,"_41":42,"_40":236,"_157":25,"_38":411,"_13":238,"_33":34,"_35":239,"_24":25,"_161":-5,"_381":412,"_27":413},{"_43":225,"_32":226,"_30":227,"_155":-5,"_41":42,"_40":228,"_157":25,"_38":408,"_13":230,"_33":34,"_35":231,"_24":25,"_161":-5,"_381":409,"_27":410},{"_43":218,"_32":219,"_30":220,"_155":-5,"_41":42,"_40":221,"_157":25,"_38":405,"_13":175,"_33":34,"_35":223,"_24":25,"_161":-5,"_381":406,"_27":407},{"_43":210,"_32":211,"_30":212,"_155":-5,"_41":42,"_40":213,"_157":25,"_38":402,"_13":215,"_33":20,"_35":216,"_24":25,"_161":-5,"_381":403,"_27":404},{"_43":202,"_32":203,"_30":204,"_155":-5,"_41":42,"_40":205,"_157":25,"_38":399,"_13":207,"_33":34,"_35":208,"_24":25,"_161":-5,"_381":400,"_27":401},{"_43":194,"_32":195,"_30":196,"_155":-5,"_41":42,"_40":197,"_157":25,"_38":396,"_13":199,"_33":34,"_35":200,"_24":25,"_161":-5,"_381":397,"_27":398},{"_43":186,"_32":187,"_30":57,"_155":-5,"_41":42,"_40":188,"_157":59,"_38":393,"_13":190,"_33":191,"_35":192,"_24":25,"_161":-5,"_381":394,"_27":395},{"_43":178,"_32":179,"_30":180,"_155":-5,"_41":42,"_40":181,"_157":59,"_38":390,"_13":183,"_33":34,"_35":184,"_24":25,"_161":-5,"_381":391,"_27":392},{"_43":170,"_32":171,"_30":172,"_155":-5,"_41":42,"_40":173,"_157":59,"_38":387,"_13":175,"_33":34,"_35":176,"_24":25,"_161":-5,"_381":388,"_27":389},{"_43":163,"_32":164,"_30":165,"_155":-5,"_41":42,"_40":166,"_157":25,"_38":384,"_13":63,"_33":34,"_35":168,"_24":25,"_161":-5,"_381":385,"_27":386},{"_43":152,"_32":153,"_30":154,"_155":-5,"_41":42,"_40":156,"_157":25,"_38":380,"_13":159,"_33":34,"_35":160,"_24":25,"_161":-5,"_381":382,"_27":383},["D",1784057420955],"children",[],[153],["D",1784057421314],[],[164],["D",1784052697980],[],[171],["D",1784052697990],[],[179],["D",1783790091112],[],[187],["D",1784058461137],[],[195],["D",1784052698514],[],[203],["D",1784057421224],[],[211],["D",1784052698200],[],[219],["D",1784052698661],[],[226],["D",1784059508115],[],[234],["D",1784059508131],[],[28],["D",1784059508103],[],[246],["D",1784052698028],[],[254],["D",1784052698195],[],[262],["D",1784052698291],[],[269],["D",1784052698014],[],[277],["D",1783653143490],[],[284],["D",1783653143220],[],[291],["D",1783566329616],[],[297],"6c4a9c2a-8804-40f2-9c5c-deea119c0a23","labels.svg","b3741c28-7fb7-11f1-9bc9-1607ee4eb77e",243,["D",1784056239115],"\n",[],[304,442],"e9830a9d-e7b2-4b16-b16b-8a007dbf731b","issue-new.svg","b36ba9f8-7fb7-11f1-a948-1607ee4eb77e",242,["D",1784056238912],"\n",[],[304,450],"81255732-c8ff-4f6e-8146-c9ce067cb307","issue-list.svg","b394ccf2-7fb7-11f1-85b9-1607ee4eb77e",246,["D",1784056239000],"\n",[],[304,458],"0e66acac-c582-4829-842b-7464ae32d5e1","issue-detail.svg","b356bfca-7fb7-11f1-9bc9-1607ee4eb77e",240,["D",1784056238922],"\n",[],[304,466],"d0ad359b-cd1b-4c0e-b265-518735b96af0","index.html","b34c3e2e-7fb7-11f1-85b9-1607ee4eb77e",239,["D",1784056238895],"\n\n\n \n \n \n Val Issue Tracker — wireframe review\n \n \n \n

\n \n val-issue-tracker · Wireframes
\n Jump to a screen\n \n \n

\n\n

Flow

\n ⤳Flow diagram\n\n

Screens

\n 1Issue list\n 2Issue detail\n 3New issue\n 4Labels\n\n

Open questions

\n ?For reviewer\n \n \n\n

val-issue-tracker · Wireframes

Val Issue Tracker — app design

Low-fi structure pass over the tracker's four pages (edit issue mirrors the create form),\n restyled after the GitHub Issues interface per review: a slim top bar (Issues · Labels) on\n every screen, token search + stacked rows on the list, a metadata sidebar with per-section\n gears on detail, and a Write/Preview editor on create. Red dashed marks are the annotation\n layer, not proposed UI.

\n 5 wireframes\n Desktop 1280×800\n Lo-fi · monochrome\n Click any wireframe to zoom\n

\n\n \n

Flow

Screen flow

\n Solid arrows are navigation; labelled arrows note the trigger. Every mutating action\n on the detail page (close, reopen, label, assign, block, comment) POSTs and redirects back to the same page.

flow.svg1280×640

\n $\"Screen$ \n

\n\n \n

Screen 1 · Home

1.Issue list · `/`

\n GitHub-style landing page: slim top bar, a token search bar with the New issue\n button, and a list panel with Open/Closed tabs and stacked issue rows sorted by last activity.

\n issue-list.svg1280×800 · desktop

\n $\"Issue$ \n

Annotations

1 — Slim top bar replaces the sidebar: Issues and Labels tabs (active underlined), avatar and handle on the right. One shared Layout component across all screens; embeds compactly in host vals. Personal views (assigned/created by me) stay deferred.
2 — Token search bar replacing the separate filter fields: parse status: / assignee: tokens plus free text into the existing listIssues filters.
3 — Open/Closed tabs with count pills, replacing both the metric tiles and the status dropdown. Fits the strict two-state model.
4 — Label chips under each title carry the triage signal (ready-for-agent etc.) without a dedicated column.
5 — \"Blocked\" pill sits in the meta line before the issue number, as in GitHub.

\n Why this changes: adopts the GitHub list anatomy from review feedback.\n Stacked rows give titles a full line, make labels visible for triage scanning, and the\n token search collapses three filter controls into one input.

\n \n \n

\n\n \n

Screen 2 · Core

2.Issue detail · `/issue/:id`

\n GitHub-style detail under the shared top bar: title with number and edit pencil, a filled\n Open pill, the issue body as the first comment card, then the thread and composer; management\n lives in a right sidebar of hairline-divided sections, each with a gear.

\n issue-detail.svg1280×800 · desktop

\n $\"Issue$ \n

Annotations

1 — Filled Open pill (with state icon) plus outlined Blocked pill; the pencil beside the title goes to /issue/:id/edit.
2 — The body renders as the first comment card, with an Owner/role badge and \"edited\" provenance drawn from the events log.
3 — Sidebar sections (Assignees, Labels, Relationships, Delete) each with a gear that reveals the add/remove controls, instead of always-visible forms.
4 — \"Close issue\" with a reason chooser sits in the composer footer, GitHub-style: completed (default), not planned, duplicate. Reopen swaps in when closed.
5 — Relationships shows both edge directions with each blocker's open/closed state; adding an edge is rejected if it would create a cycle.

\n Why this changes: matches the GitHub issue view from review feedback.\n Reading and managing separate cleanly, and gear-reveals keep the sidebar quiet until you\n need to change something. Note the gear interaction needs a little client-side JS (or\n <details> disclosure) in an app that is currently zero-JS forms.

\n \n \n

\n\n \n

Screen 3 · Create

3.New issue · `/new`

\n GitHub-style \"Create new issue\": title and a Write/Preview markdown editor in the main\n column, assignees and labels in the right sidebar. The edit page (/issue/:id/edit)\n mirrors this with only title + body.

\n issue-new.svg1280×800 · desktop

\n $\"New$ \n

Annotations

1 — Write/Preview tabs on the description editor. Preview is marked roadmap: it activates once markdown rendering lands, and until then only Write shows.
2 — Assignees and labels move to a sidebar with gear-pickers; labels stay a curated set (picking, never typing). Handles remain unvalidated, noted in the sidebar.
3 — \"Create more\" checkbox for batch entry: on submit, redirect back to /new instead of the new issue.

\n Why this changes: matches the GitHub create screen from review feedback.\n The main column stays focused on writing; metadata moves out of the critical path.

\n \n \n

\n\n \n

Screen 4 · Admin

4.Labels · `/labels`

\n GitHub-style label management, shown with the inline create row expanded: New label\n reveals a form above the list (preview chip, name, color + swatch), and the panel lists one row\n per label with chip, hex color, open-issue count, and an overflow menu. Viewers see the list read-only.

\n labels.svg1280×800 · desktop

\n $\"Labels$ \n

Annotations

1 — Label creation, answered inline: \"New label\" (maintainer-only) expands this create row with a live preview chip, name input, and color input with swatch. It maps directly onto the existing POST /labels (name + color). Descriptions dropped per review.
2 — Open-issue count per label (one join query); clicking it filters the issue list to that label.
3 — Overflow menu holds edit (in-place row) and delete, gated to maintainers.

\n Why this changes: matches the GitHub labels screen from review feedback.\n Creation stays on this page rather than a separate screen, and the count makes delete's\n cascade visible before the click.

\n \n \n

\n\n \n

For reviewer

Open questions

JavaScript budget: The app is currently zero-JS server-rendered forms. Gear-pickers, token search highlighting, and Write/Preview tabs all want some client-side behavior. How much JS is acceptable, or should these degrade to <details> disclosures and plain form posts?
Token search: Parse status:/assignee: tokens server-side into the existing filters, or keep separate query params and just style one input?
Mobile: The tracker is server-rendered and embeddable; do we need dedicated 375px wireframes, or is a single responsive column acceptable?

\n\n

\n Wireframes follow the wireframe skill house style: black on white, 1.5pt strokes, 8px grid, type sizes 12/14/20/28. Red dashed annotations are the call-out layer only and not part of the proposed UI.\n

\n \n\n \n\n \n \n\n",[],[304,474],"0624324c-15a1-4656-b4f5-0e2e312f15c2","flow.svg","b35d6c26-7fb7-11f1-851e-1607ee4eb77e",241,["D",1784056238995],"\n",[],[304,482],["D",1784056238376],[354,355,356,357,358,359],[304],"a7d6b8dd-1925-4e52-8b1a-7519e5abc73e","issue-tracker-valtown.md","4e874dca-7be4-11f1-973a-1607ee4eb77e",199,["D",1783711960586],2,"# Issue tracker: val-issue-tracker (JSON API)\n\nUse the tracker's JSON API for agent and script operations; do not scrape HTML.\n\n**Tracker URL**: `` (for example `https://username-myval.web.val.run`)\n\n**Auth**: reads are public. Writes require\n`Authorization: Bearer `. Each write may include `actor`,\na Val Town handle; omitted actors default to `agent`. Actor provenance is stored\nonly in the append-only events log.\n\n## Response shapes\n\nEvery response is JSON. Successful responses are either a single object, an\narray, or a small acknowledgement object (`{\"deleted\": id}` /\n`{\"updated\": id}`); error responses always have the shape:\n\n```json\n{ \"error\": \"human-readable message\" }\n```\n\n### Label\n\n```ts\n{\n id: number;\n name: string;\n color: string; // six lowercase hex characters, no leading \"#\"\n created_at: number; // ms since epoch\n updated_at: number;\n}\n```\n\n### IssueReference\n\nThe compact shape used inside `blockers` and `blocks`.\n\n```ts\n{\n id: number;\n title: string;\n status: \"open\" | \"closed\";\n state_reason: \"completed\" | \"not_planned\" | \"duplicate\" | \"reopened\" | null;\n}\n```\n\n### Issue\n\n```ts\n{\n id: number;\n title: string;\n body: string; // markdown, verbatim (not trimmed)\n status: \"open\" | \"closed\";\n state_reason: \"completed\" | \"not_planned\" | \"duplicate\" | \"reopened\" | null;\n created_at: number;\n updated_at: number; // last activity: own edits, comments, or association changes\n creator: string | null; // Val Town handle, derived from the issue's creation event\n labels: Label[];\n assignees: string[]; // Val Town handles, no \"@\" prefix\n blockers: IssueReference[];\n blocks: IssueReference[];\n blocked: boolean; // true iff at least one blocker is still \"open\"\n}\n```\n\n`GET /api/issues/:id` returns an `Issue` plus a `comments` field\n(`comments: Comment[]`); no other endpoint includes `comments`.\n\n### Comment\n\n```ts\n{\n id: number;\n issue_id: number;\n body: string; // markdown, verbatim\n created_at: number;\n updated_at: number;\n author: string | null; // Val Town handle, derived from the comment's creation event\n}\n```\n\n### Event\n\n```ts\n{\n id: number;\n event_type:\n | \"issue.created\" | \"issue.updated\" | \"issue.deleted\"\n | \"comment.created\" | \"comment.updated\" | \"comment.deleted\"\n | \"label.created\" | \"label.updated\" | \"label.deleted\";\n entity_id: number; // the issue/comment/label id the event is about\n actor: string;\n data: unknown; // grammar below\n event_timestamp: number;\n}\n```\n\n`GET /api/issues/:id/events` returns `Event[]` in append order.\n\n## Event data grammar\n\nEvents are the source of truth for provenance and history; live tables hold only\ncurrent state.\n\n- **Boundary events (`*.created`, `*.deleted`) snapshot full state.** The `data`\n field is the entity's complete state at that moment — a hard-deleted row\n leaves a full tombstone:\n - `issue.created` / `issue.deleted` data:\n `{id, title, body, status, state_reason, created_at, updated_at}`\n - `comment.created` / `comment.deleted` data:\n `{id, issue_id, body, created_at, updated_at}` (no `author` — that is always\n derived from the surrounding event, never stored in the payload)\n - `label.created` / `label.deleted` data:\n `{id, name, color, created_at, updated_at}`\n- **`*.updated` events carry a single field delta:**\n `{update_target, from, to}`.\n - For `issue.updated`, `update_target` is one of `title`, `body`, `status`,\n `state_reason`, `label`, `assignee`, `blocks`, `blocked_by`. Associations\n (`label`, `assignee`, `blocks`, `blocked_by`) use **`null ↔ value`**\n (`from: null` = added, `to: null` = removed). A block edge writes exactly\n one event, on the acting issue (the one named in the endpoint path).\n - For `comment.updated`, `update_target` is `\"body\"`.\n - For `label.updated`, `update_target` is `\"name\"` or `\"color\"`.\n - One event per changed field: closing an issue with a new reason emits two\n `issue.updated` events (`status` and `state_reason`), sharing one actor and\n timestamp.\n\n## Status codes\n\n| Status | Meaning |\n| ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `200` | Read succeeded, or a mutation applied and the endpoint returns the resulting state. |\n| `201` | An issue, comment, or label was created. |\n| `400` | The request is malformed: invalid `:id`, invalid `status` filter, invalid close `reason`, invalid label `color`, a missing required scalar field (`title`; `name`/`color`; comment `body`), or a collection field (`label_ids`, `add`, `remove`, `assignees`) that isn't shaped as required — see below. |\n| `401` | A write was attempted with a missing or incorrect bearer token. |\n| `403` | A write was attempted but `ISSUE_TRACKER_API_KEY` isn't configured, so writes are disabled entirely. |\n| `404` | The issue, comment, or label named by `:id` — or referenced by an ID inside `label_ids`/`add`/`remove` — does not exist. |\n| `409` | The write conflicts with an existing invariant: a blocking edge would create a cycle (including a self-edge), or a label `name` collides with an existing label. |\n\n## Strict collection validation\n\n`label_ids`, and the `add`/`remove` fields on the labels and blocks/blocked-by\nendpoints, are validated as a whole, not filtered element by element:\n\n- **Absent** — treated as an empty operation (no IDs added or removed).\n- **Present** — must be an array where every element is a positive integer\n (`Number.isInteger(x) && x > 0`). Any other shape (not an array, a\n non-integer, zero, a negative number, a string, etc.) rejects the entire\n request with `400`; nothing is applied.\n- Each ID that passes shape validation must still reference an existing label or\n issue, or the request fails with `404`.\n\n`assignees`, and the `add`/`remove` fields on the assignees endpoint, follow the\nsame absent-is-empty / present-is-all-or-nothing rule, but for handles:\n\n- **Present** — must be an array of non-empty strings after trimming and\n stripping a leading `@`. Any other shape rejects the request with `400`.\n- Handles are not entities (no lookup table), so there is no `404` for an\n unrecognized assignee — any well-shaped handle is accepted.\n\n## Endpoints\n\n| Method and path | Body / query | Success |\n| --------------------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |\n| `GET /api/issues` | `?status=open\\|closed&label=&assignee=&search=` | `200` `Issue[]`. `400` if `status` is present and not `open`/`closed`. |\n| `POST /api/issues` | `{title, body?, label_ids?: number[], assignees?: string[], actor?}` | `201` `Issue`. `400` missing `title` or malformed `label_ids`/`assignees`. `404` if a `label_ids` entry doesn't exist. |\n| `GET /api/issues/:id` | — | `200` `Issue & {comments: Comment[]}`. `400` invalid id. `404` missing issue. |\n| `PATCH /api/issues/:id` | `{title?, body?, actor?}` | `200` updated `Issue`. `400` invalid id. `404` missing issue. |\n| `DELETE /api/issues/:id` | `{actor?}` | `200` `{deleted: id}`. `400` invalid id. `404` missing issue. |\n| `POST /api/issues/:id/close` | `{reason?: \"completed\" \\| \"not_planned\" \\| \"duplicate\", comment?, actor?}` | `200` updated `Issue`; reason defaults to `completed`. `400` invalid id/reason. `404` missing issue. |\n| `POST /api/issues/:id/reopen` | `{actor?}` | `200` updated `Issue` with `state_reason: \"reopened\"`. `400` invalid id. `404` missing issue. |\n| `POST /api/issues/:id/labels` | `{add?: number[], remove?: number[], actor?}` | `200` updated `Issue`. `400` invalid id or malformed `add`/`remove`. `404` missing issue or a missing label id. |\n| `POST /api/issues/:id/assignees` | `{add?: string[], remove?: string[], actor?}` | `200` updated `Issue`. `400` invalid id or malformed `add`/`remove`. `404` missing issue. |\n| `POST /api/issues/:id/blocks` | `{add?: number[], remove?: number[], actor?}` | `200` updated `Issue`. `400` invalid id or malformed `add`/`remove`. `404` missing issue or referenced issue id. `409` cycle or self-edge. |\n| `POST /api/issues/:id/blocked-by` | `{add?: number[], remove?: number[], actor?}` | Same as `/blocks`, opposite edge direction. |\n| `POST /api/issues/:id/comments` | `{body, actor?}` | `201` `Comment`. `400` invalid id or missing `body`. `404` missing issue. |\n| `PATCH /api/comments/:id` | `{body, actor?}` | `200` `{updated: id}`. `400` invalid id or missing `body`. `404` missing comment. |\n| `DELETE /api/comments/:id` | `{actor?}` | `200` `{deleted: id}`. `400` invalid id. `404` missing comment. |\n| `GET /api/issues/:id/events` | — | `200` `Event[]` in append order. `400` invalid id. `404` missing issue. |\n| `GET /api/labels` | — | `200` `Label[]`. |\n| `POST /api/labels` | `{name, color, actor?}` | `201` `Label` (`color` is hex, with or without `#`). `400` missing `name`/`color` or invalid `color`. `409` `name` already in use. |\n| `PATCH /api/labels/:id` | `{name?, color?, actor?}` | `200` updated `Label`. `400` invalid id or `color`. `404` missing label. `409` renaming to an in-use `name`. |\n| `DELETE /api/labels/:id` | `{actor?}` | `200` `{deleted: id}`. `400` invalid id. `404` missing label. |\n\nAll write routes additionally return `401` for a missing/incorrect bearer token,\nand `403` if `ISSUE_TRACKER_API_KEY` is unset — checked before any body or id\nvalidation.\n\n## Triage labels\n\nLabels are curated entities, not free-text arrays. Before applying workflow\nlabels such as `needs-triage`, create each one once with `POST /api/labels`,\nretain its ID, then send that ID to the issue-label endpoint. The product's\nfresh-install defaults are `bug`, `enhancement`, `documentation`, `question`,\nand `duplicate`.\n\n## curl examples\n\n```bash\nTRACKER=https://your-handle-your-val.web.val.run\nKEY=...\n\n# Discover label IDs\ncurl -s \"$TRACKER/api/labels\"\n\n# Create with curated labels and multiple assignees\ncurl -s -X POST \"$TRACKER/api/issues\" \\\n -H \"Authorization: Bearer $KEY\" -H \"Content-Type: application/json\" \\\n -d '{\"title\":\"Fix flaky test\",\"body\":\"Observed in CI\",\"label_ids\":[1],\"assignees\":[\"alice\"],\"actor\":\"alice\"}'\n\n# Close as deliberately not planned\ncurl -s -X POST \"$TRACKER/api/issues/12/close\" \\\n -H \"Authorization: Bearer $KEY\" -H \"Content-Type: application/json\" \\\n -d '{\"reason\":\"not_planned\",\"comment\":\"Superseded by #15.\",\"actor\":\"alice\"}'\n\n# Reopen\ncurl -s -X POST \"$TRACKER/api/issues/12/reopen\" \\\n -H \"Authorization: Bearer $KEY\" -H \"Content-Type: application/json\" \\\n -d '{\"actor\":\"alice\"}'\n\n# Declare that #12 blocks #15\ncurl -s -X POST \"$TRACKER/api/issues/12/blocks\" \\\n -H \"Authorization: Bearer $KEY\" -H \"Content-Type: application/json\" \\\n -d '{\"add\":[15],\"actor\":\"alice\"}'\n```\n",[],[311,493],"209f927c-480f-4f66-8f57-ecc131f50714","backlog.md","eea1bf8a-7bf2-11f1-975e-1607ee4eb77e",173,["D",1783653142692],"# Backlog — deferred wants\n\nThings wanted eventually, not now. Not commitments; parking lot.\n\n- **Clickable user handles.** Wherever a user handle is displayed (creator,\n comment author, assignee), render it as a link to that user's Val Town\n profile. Purely a rendering concern — the data model just stores the handle.\n (See [[User]] in CONTEXT.md.)\n- **Markdown rendering.** Issue bodies and comment bodies are stored as\n markdown; rendering them to HTML is a later concern.\n",[],[311,502],"0f39a161-6c79-4dab-9fbc-d3a2a3ec0bc0","tickets.md","eeb0130a-7bf2-11f1-8022-1607ee4eb77e","ee67d8e2-7bf2-11f1-b0f6-1607ee4eb77e",175,["D",1783653142898],"# Tickets: Richer data model for val-issue-tracker\n\nTracer-bullet tickets implementing the richer data model. Source spec:\n`docs/issues/richer-data-model/PRD.md`. Governed by `CONTEXT.md` + ADRs\n0001–0004.\n\nAll tickets are `ready-for-agent` — agent-grabbable by construction.\n\n## Implementation checklist\n\n- [x] Ticket 1 — core schema reshape and issue lifecycle\n- [x] Ticket 2 — append-only events and lifecycle provenance\n- [x] Ticket 3 — labels, assignees, blocking, comments, events, and touch rules\n- [x] Ticket 4 — idempotent old-schema migration\n- [x] Ticket 5 — final JSON API convention, consumer cleanup, and verification\n\nWork the **frontier**: any ticket whose blockers are all done. Order here is\ndependency order (blockers first): 1 → 2 → 3 → then 4 and 5 in parallel.\n\n> Migration caveat: tickets 1–3 are correct against _fresh_ databases. The ~3\n> existing deployments are only safe to run once ticket 4 (migration) lands,\n> since `initSchema` runs against live data every request. Deploy the set at the\n> end.\n\n## 1. Core schema reshape + issue lifecycle\n\nStatus: ready-for-agent\n\n**What to build:** Fresh-install issue schema on the new model — priority\nremoved entirely; `status` collapses to `open`/`closed`; a nullable\n`state_reason` (`completed`/`not_planned`/`duplicate`/`reopened`) guarded by a\n`CHECK` constraint against status; the issue body field renamed from\n`description` to `body`. The create / close / reopen operations auto-manage\n`state_reason` (create → null; close → chosen reason, default `completed`;\nreopen → `reopened`). The JSON API and HTML UI are reconciled to the new `Issue`\nshape, and the schema knowledge those two consumers currently duplicate\n(status/priority constants, label parse/serialize) is pulled into the\ndata-access layer as a prefactor so later tickets change one place. No migration\nof existing data in this ticket. _Demoable: create an issue, close it as\nnot_planned, reopen it — through both the API and the UI._\n\n**Blocked by:** None — can start immediately.\n\n## 2. Events log foundation + issue lifecycle events\n\nStatus: ready-for-agent\n\n**What to build:** The single append-only events table (`id`, `event_type`,\n`entity_id`, `actor`, `data`, `event_timestamp`) and the emit helper, wired into\nthe issue lifecycle from ticket 1. `*.created` and `*.deleted` carry full state\nsnapshots; `*.updated` carries `{ update_target, from, to }`. One event per\nchanged field, so closing emits two events (`status` and `state_reason`) sharing\nan actor and timestamp. _Demoable: close an issue and observe two events with\nthe acting handle and correct payloads._\n\n**Blocked by:** 1\n\n## 3. Associations: labels + assignees + blocking\n\nStatus: ready-for-agent\n\n**What to build:** All three issue relationships, end-to-end (schema +\noperations + API\n\n- UI + events + touch rule):\n\n* **Labels** — a curated Label entity (`name`, `color`), applied via a bare\n issue↔label join; a default set (`bug`, `enhancement`, `documentation`,\n `question`, `duplicate`) seeded exactly once at table creation and never\n re-seeded; apply/remove; label rename/recolour/delete (deleting an in-use\n label cascades its join rows away).\n* **Assignees** — a set of Val Town users via a bare issue↔handle join;\n add/remove; an \"assigned to me\" query.\n* **Blocking** — a directed `blocker → blocked` edge stored once; insert\n rejected if the target can already reach the source (strict DAG — self,\n reciprocal, and longer cycles all refused); remove; \"blocked\" derived (blocked\n while any blocker is still open) and never stored, and never gating close.\n\nEvery mutation emits its events — label ops as `label.*` plus `issue.updated`\nwith `update_target: label` using `null ↔ value`; assignee and block changes as\n`issue.updated` with `update_target` ∈ {assignee, blocks, blocked_by},\n`null ↔ value`; a block edge writes one event on the acting issue. Every\nassociation change also touches the parent issue's `updated_at`.\n\n_(Largest ticket — if it overflows a single context window at execution time,\nsplit back into labels / assignees / blocking, each blocked by 1 and 2.)_\n\n**Blocked by:** 1, 2\n\n## 4. Migration for existing deployments\n\nStatus: ready-for-agent\n\n**What to build:** One idempotent migration routine (living in the schema-init\npath, safe to run every request) that brings the ~3 existing deployments onto\nthe final schema: remap any `in_progress` issue to `open`; drop priority; expose\nthe old `description` as `body`; lift each existing JSON `labels` array into the\nLabel entities and issue↔label join (creating labels as needed); move any\nexisting single `assignee` into the assignee join; and backfill a synthetic\n`*.created` event (and any required state) for existing rows so no entity is\nleft without provenance. Running it twice is a no-op.\n\n**Blocked by:** 1, 2, 3\n\n## 5. Rewrite JSON API convention doc + final cleanup\n\nStatus: ready-for-agent\n\n**What to build:** Rewrite `docs/issue-tracker-valtown.md` to the new schema and\nendpoint surface (no priority, two statuses, `state_reason` on close/reopen, and\nthe label / assignee / block operations), replacing the outdated convention it\ndocuments today. Remove any remaining old-schema constants or dead code paths in\nthe consumers. Done last so the doc describes the final API exactly once.\n\n**Blocked by:** 3\n",[],[311,518,519,510],"issues","richer-data-model","1da2fc19-c168-4db0-ace9-4a383b4d3b42","certification.md","1d471d5a-7c96-11f1-a281-1607ee4eb77e",195,["D",1783711960231],"# Certification: richer-data-model remediation pass\n\nDate: 2026-07-10 Verdict: **certified complete** (independent recertification\naudit)\n\nAfter the five implementation tickets in `tickets.md` landed, a remediation pass\nran as five one-shot agent prompts (formerly in `agent-prompts/`, deleted after\nthis certification). What each fixed:\n\n1. **SQLite transaction contract** — `db.ts` drives every multi-statement write\n through `client.transaction(\"write\")` with explicit commit/rollback, never\n top-level `batch()`. The resolved adapter\n (`npm:@tursodatabase/serverless@1.2.3/compat`) was read at source and its\n top-level `batch()` confirmed broken for this purpose: it ignores the mode\n argument and drops bound args. Proven by tests: a batch-throwing client,\n forced mid-transaction failure rollback, and entity-ID (not event-ID) return\n values.\n2. **Comment UI** — the comment edit control is a `

` that round-trips\n   multiline markdown through the real Hono form routes; bodies render as\n   escaped JSX text with `whitespace-pre-wrap` (no HTML rendering). Control\n   visibility fixed via a maintainer-only `canModerateComments` prop on\n   `IssueDetailPage`: maintainers and the comment author see edit/delete\n   controls; a non-author issue creator does not. Server-side checks remain the\n   enforcement layer and the UI mirrors them exactly.\n3. **API/docs parity** — strict all-or-nothing validation for collection fields\n   (`label_ids`/`add`/`remove`/`assignees`: absent = empty operation,\n   present-but-malformed = 400); 400 for an invalid `status` filter; 404\n   existence guards on every mutation route; a small typed `HttpError`\n   (400/404/409) in `db.ts` replacing the old map-everything-to-409 handler;\n   `docs/issue-tracker-valtown.md` rewritten with complete response shapes, the\n   event-data grammar, the `{\"error\": \"...\"}` convention, a status-code table,\n   and exact per-route responses matching `api.ts` route-by-route.\n4. **Check policy** — Biome (tab-indented) is the canonical formatter, not\n   `deno fmt`; `.vt/` and `.claude/` excluded via `biome.json` `files.includes`;\n   canonical commands are the `deno.json` tasks `fmt` / `lint` / `typecheck` /\n   `test` / `check` (aggregate), documented in `README.md` and all passing.\n5. **Recertification** — independent audit rebuilt the requirement matrix for\n   all five tickets against the PRD, re-ran all checks (21/21 tests), compared\n   every API route against the convention doc (18 route/status combinations),\n   and repeated the stale-schema scan: no live use of priority, `in_progress`,\n   `description`, JSON-label storage, single-assignee storage, `*_by` columns,\n   or a stored comment `author` column (`Comment.author` is derived from\n   `comment.created` events via JOIN, per ADR 0003/0004). The only old- schema\n   references are the migration reader in `db.ts` and legacy-fixture SQL in\n   `db_test.ts`, by design.\n\n## Caveats\n\n- Nothing was deployed. The adapter-contract proof is static (reading the\n  resolved dependency's source), not a live round-trip against Val Town's scoped\n  SQLite. Live proof requires deploying and exercising one transactional write.\n- Known cosmetic quirk, out of scope: the HTML app's `onError` in `app.tsx`\n  renders every thrown error as a banner with HTTP status 409, including 404\n  `HttpError`s from the store. HTML routes check existence before mutating, so\n  it rarely triggers.\n",[],[311,518,519,521],"85c72af1-cc92-4979-a7a5-bac2e38e7689","PRD.md","eebd1596-7bf2-11f1-ab8e-1607ee4eb77e",174,["D",1783653142818],"# Spec: Richer data model for val-issue-tracker\n\nStatus: ready-for-agent\n\n> Synthesised from a grilling + domain-modeling session. Vocabulary follows\n> `CONTEXT.md`; decisions are governed by ADRs 0001–0004. This is a breaking\n> schema change to the tracker's own data model, plus the migration to get the\n> ~3 existing deployments onto it.\n\n## Problem Statement\n\nThe tracker's current data model carries fields the maintainer doesn't use and\ncan't represent the relationships they actually want. Priority is dead weight.\nStatus has a middle `in_progress` state that isn't wanted, yet there's no way to\nsay _why_ something was closed (done vs. abandoned). Labels are a JSON-array\nstring matched with `LIKE`, so they can't have colour, be renamed in one place,\nor be queried cleanly. There's no way to express that one issue blocks another.\nThere is no history: once a label is removed or an assignee dropped, the fact\nthat it was ever there is gone, and there's no record of who changed what. The\nmaintainer wants a GitHub-flavoured model that captures these relationships and\na full audit trail.\n\n## Solution\n\nReshape the tracker's schema to mirror GitHub's issue model where it earns its\nkeep, and add first-class structure for the things the maintainer actually uses:\n\n- Drop priority entirely and collapse status to `open` / `closed`, with a\n  nullable `state_reason` (`completed` / `not_planned` / `duplicate` /\n  `reopened`) carrying the nuance — so \"closed as done\" and \"closed as not\n  planned\" are distinguishable.\n- Promote labels from a JSON string to curated **Label** entities (name +\n  colour), applied to issues through a join, seeded with a small default set on\n  first install.\n- Make assignees a _set_ of Val Town users via a join, instead of a single\n  string.\n- Add directed **blocking relationships** between issues, kept as a strict DAG,\n  with \"blocked\" derived (an issue is blocked while any blocker is still open).\n- Record every change in a single append-only **events** log — the source of\n  truth for provenance (\"who did what, when\") and full state history, from which\n  auditability is derived. Live tables hold only current state.\n- Treat issue and comment bodies as markdown (a rendering contract; no storage\n  change).\n\nIdentity throughout is the Val Town handle — there is no local users table.\n\n## User Stories\n\n1. As a maintainer, I want priority removed from issues, so that the model\n   reflects that I never triage by priority.\n2. As a maintainer, I want status to be exactly `open` or `closed`, so that\n   there is no unwanted intermediate state to maintain.\n3. As a maintainer, I want to close an issue as `completed`, so that I can\n   record that the work was actually done.\n4. As a maintainer, I want to close an issue as `not_planned`, so that I can\n   record that I abandoned it rather than finished it.\n5. As a maintainer, I want to close an issue as `duplicate`, so that I can\n   record that it was already tracked elsewhere.\n6. As a maintainer, I want reopening an issue to mark its reason as `reopened`,\n   so that a reopened issue is distinguishable from one that was never closed.\n7. As a maintainer, I want the system to refuse an incoherent status/reason pair\n   (e.g. open + completed), so that the data can never represent an impossible\n   state.\n8. As a maintainer, I want `state_reason` to be set automatically by the\n   close/reopen/create actions, so that I can't forget to keep it consistent\n   with status.\n9. As a maintainer, I want labels to be real entities with names and colours, so\n   that I can see and manage a consistent taxonomy.\n10. As a maintainer, I want to apply an existing label to an issue by picking\n    it, so that typos can't spawn phantom labels.\n11. As a maintainer, I want to remove a label from an issue, so that the tag set\n    stays accurate.\n12. As a maintainer, I want a fresh install to come with a default set of labels\n    (`bug`, `enhancement`, `documentation`, `question`, `duplicate`), so that\n    the tracker is usable immediately.\n13. As a maintainer, I want labels I delete to stay deleted across restarts, so\n    that the default set doesn't resurrect itself on the next request.\n14. As a maintainer, I want to delete a label that is currently applied to\n    issues, so that retiring a tag just removes it everywhere.\n15. As a maintainer, I want to rename or recolour a label in one place, so that\n    every issue carrying it updates at once.\n16. As a maintainer, I want an issue to have zero or more assignees, so that\n    more than one Val Town user can own it.\n17. As a maintainer, I want to add and remove assignees on an issue, so that\n    ownership can change over time.\n18. As a maintainer, I want to ask \"what is assigned to me?\", so that I can find\n    my work without scanning every issue.\n19. As a maintainer, I want to declare that one issue blocks another, so that I\n    can express dependencies.\n20. As a maintainer, I want to view an issue's blockers and the issues it\n    blocks, so that I understand its dependency context from either direction.\n21. As a maintainer, I want an issue to show as blocked while any of its\n    blockers is still open, so that blocked-ness is always accurate without my\n    maintaining a flag.\n22. As a maintainer, I want closing a blocker to automatically unblock its\n    dependents, so that the state stays correct for free.\n23. As a maintainer, I want to still be able to close a blocked issue, so that\n    being blocked is informational and never traps me.\n24. As a maintainer, I want the system to reject an issue blocking itself, so\n    that nonsensical edges can't exist.\n25. As a maintainer, I want the system to reject any edge that would create a\n    cycle (direct or longer), so that the dependency graph stays a coherent DAG.\n26. As a maintainer, I want to remove a blocking relationship, so that I can\n    correct a dependency I no longer want.\n27. As a maintainer, I want issue and comment bodies treated as markdown, so\n    that formatting is preserved for later rendering.\n28. As a maintainer, I want to edit an issue's title and body, so that I can\n    correct or refine it after creation.\n29. As a maintainer, I want to edit a comment, so that I can fix mistakes in my\n    notes.\n30. As a maintainer, I want to delete a comment, so that I can remove notes that\n    no longer belong.\n31. As an auditor, I want every create, update, and delete recorded as an event\n    with the actor and timestamp, so that I can reconstruct who changed what and\n    when.\n32. As an auditor, I want each field change recorded with its before and after\n    value, so that I can see the full history of an issue's state.\n33. As an auditor, I want label applications, assignments, and block edges\n    recorded as events, so that removals are visible even though the\n    current-state row is gone.\n34. As an auditor, I want a deleted entity's final state captured in its\n    deletion event, so that a hard delete still leaves a complete record of what\n    was lost.\n35. As an auditor, I want a created entity's initial state captured in its\n    creation event, so that history can be replayed forward from a\n    self-contained starting point.\n36. As an auditor, I want to reconstruct an entity's state at any past point, so\n    that I can answer \"what did this look like last week?\".\n37. As a host-val developer, I want the tracker to keep using prefixed table\n    names in my scoped database, so that it never collides with my own tables.\n38. As a host-val developer, I want a friendly sequential issue number, so that\n    I can refer to issues as `#N` without an extra opaque id.\n39. As an existing deployment owner, I want my current issues migrated onto the\n    new schema, so that I lose no data when upgrading.\n40. As an existing deployment owner, I want any `in_progress` issue moved to\n    `open` during migration, so that no issue is stranded in a removed state.\n41. As an existing deployment owner, I want my current JSON labels lifted into\n    the new label and join tables, so that existing tags survive the change.\n42. As an existing deployment owner, I want existing rows to get a synthetic\n    creation event on migration, so that no entity is left with no provenance.\n43. As an agent, I want the JSON API to reflect the new schema (no priority, two\n    statuses, `state_reason`, label/assignee/block operations), so that\n    non-interactive callers drive the new model correctly.\n44. As an agent, I want the API convention doc updated to the new schema, so\n    that I'm not working from the outdated contract.\n45. As a maintainer, I want any change to an issue's labels, assignees, blocks,\n    or comments to bump the issue's `updated_at`, so that \"last activity\"\n    sorting reflects all activity, not just edits to the issue's own fields.\n\n## Implementation Decisions\n\n**Modules.** The single seam of change is the data-access layer (`db.ts`):\ntypes, schema creation/migration, and all query functions. The Hono JSON API and\nthe HTML UI are consumers that will be updated to match — both currently\nduplicate schema knowledge (status/priority constants, label parse/serialize)\nthat must be reconciled to the new model. The library's public entry point and\ntable-prefixing convention are unchanged.\n\n**Removed fields.** Priority is removed entirely (column, type, filters,\ncreate/update paths) — faithful to GitHub, which has no first-class priority.\nThe `in_progress` status is removed.\n\n**Status + state_reason.** `status` is `open` | `closed`. A nullable\n`state_reason` holds `completed` / `not_planned` / `duplicate` (with `closed`)\nor `reopened` (with `open`), or `null`. It is auto-managed: create → `null`;\nclose → chosen reason (`completed` default); reopen → `reopened`. A `CHECK`\nconstraint enforces the valid pairings so an incoherent row is impossible. (ADR\ncontext: mirrors GitHub; \"not planned\" is not a third state.)\n\n**Body.** The issue's `description` is renamed to `body` so Issue and Comment\nshare one term, matching GitHub. Bodies remain `TEXT`; markdown is a rendering\ncontract, not a storage change.\n\n**Labels (ADR 0001).** A **Label** is a curated entity: `id`, unique `name`,\n`color`. Applied via an issue↔label join (bare tuple), cascade-deleting both\nsides; deleting an in-use label is allowed and simply removes the join rows. A\ndefault set (`bug`, `enhancement`, `documentation`, `question`, `duplicate`) is\nseeded **exactly once, at the moment the labels table is first created**, never\nre-seeded — so user deletions survive. Labels are editable (rename/recolour in\none place).\n\n**Assignees.** Multi-valued set of Val Town users, stored as a bare\nissue↔user-handle join tuple. No local users table; identity is the handle.\nSupports \"assigned to me\" queries in both directions.\n\n**Blocking (ADR 0002).** A directed edge `blocker → blocked`, stored once with a\nunique pair constraint and cascade on issue delete. \"Blocks\" and \"blocked by\"\nare the same edge read from opposite ends. The graph is a **strict DAG**: on\ninsert, reject if the target can already reach the source (reachability check\nvia recursive query), which covers self-edges, direct reciprocals, and longer\ncycles alike — deliberately stricter than GitHub. \"Blocked\" is **derived, never\nstored**: an issue is blocked iff any blocker is still `open`; blocked-ness is\ninformational and does not prevent closing.\n\n**Audit + provenance (ADR 0003 as amended, ADR 0004).** Entities (Issue,\nComment, Label) keep only `created_at` + `updated_at` columns (for hot-path\nlisting / \"last activity\" sorting). There are **no `*_by` columns anywhere**;\nactor/provenance lives solely in the events log. Link rows carry no audit\ncolumns. Every entity is editable, including comments (the old comment `author`\ncolumn is gone; the author is derived from the `comment.created` event).\n\n**Events log (ADR 0004).** One append-only, polymorphic table with roughly this\nshape:\n\n| column            | meaning                                                                                 |\n| ----------------- | --------------------------------------------------------------------------------------- |\n| `id`              | ordering key                                                                            |\n| `event_type`      | `<entity>.<verb>`, entity ∈ {issue, comment, label}, verb ∈ {created, updated, deleted} |\n| `entity_id`       | id of the affected entity                                                               |\n| `actor`           | Val Town handle that performed the change                                               |\n| `data`            | JSON payload (shape depends on verb)                                                    |\n| `event_timestamp` | when it happened                                                                        |\n\nGrammar — _boundary events snapshot, updates carry deltas_:\n\n- `*.created` → full initial-state snapshot.\n- `*.deleted` → full final-state snapshot (entities are hard-deleted; the event\n  is the tombstone — soft-delete was considered and rejected).\n- `*.updated` → `{ update_target, from, to }`.\n- Associations (label apply/remove, assign/unassign, block add/remove) are\n  modelled as `issue.updated` events with `update_target` ∈ {`label`,\n  `assignee`, `blocks`, `blocked_by`} and `from`/`to` using **`null ↔ value`**\n  (null→X = added, X→null = removed). No separate verb or link entity type.\n- One event per changed field: closing emits two events (`status` and\n  `state_reason`) sharing one actor and timestamp; a \"closed as not planned\"\n  timeline line is a read-time grouping by (actor, timestamp).\n- A block edge writes **one** event, on the acting issue; the reverse \"blocked\n  by\" view is derived by querying events whose `to` references the issue.\n\n**Identity / numbering.** Issues keep the autoincrement `id` as their friendly\n`#N` — no separate opaque id, since a single scoped database per host makes `id`\na clean per-tracker counter and there are no PRs competing for the sequence.\n\n**Touch rule.** Mutating an issue's labels, assignees, block edges, or comments\nbumps that issue's `updated_at` (in addition to emitting an event).\n\n**Migration.** This is a breaking change against ~3 existing deployments (this\nval + two test vals). Migration must: rename `description` → `body`; drop\n`priority`; remap any `in_progress` issue to `open`; lift each existing JSON\n`labels` array into the new label entities (creating labels as needed) and\nissue↔label join rows; move any existing single `assignee` into the assignee\njoin; and backfill a synthetic `*.created` event (and any needed state) for\nexisting rows so nothing is left provenance-less. Migration runs within the\nexisting idempotent schema-init path and must be safe to run repeatedly.\n\n**API + docs.** The JSON API is updated to the new model: no `priority`, two\nstatuses, `state_reason` on close/reopen, and label / assignee / block\noperations. The convention doc `docs/issue-tracker-valtown.md` is rewritten to\nthe new schema (it currently documents the old one) as part of this work.\n\n## Testing Decisions\n\n**Seam.** A single new seam: the exported functions of the data-access layer\n(`db.ts`). There is no existing test suite, so this is the first — no prior art\nto mirror; establish the pattern here. Tests run against a scoped SQLite\ndatabase and exercise the exported functions directly, with no HTTP or UI in the\nloop.\n\n**What makes a good test here.** Assert _external behaviour_ of the data layer —\nthe observable outcomes of calling its functions — not internal implementation\n(not specific SQL, indexes, or private helpers). A good test states a domain\nrule and checks it holds.\n\n**Behaviours to cover:**\n\n- Status/reason: create leaves reason null; each close reason sets status closed\n  with the right reason; reopen sets `reopened`; the `CHECK` constraint rejects\n  an incoherent pair.\n- Labels: default set seeded on first creation; deletions survive a re-init\n  (seed-once); applying/removing labels; deleting an in-use label removes its\n  join rows.\n- Assignees: add/remove; \"assigned to me\" returns the right issues.\n- Blocking: self-edge rejected; direct reciprocal rejected; longer cycle\n  rejected; a valid edge accepted; \"blocked\" derived from open blockers; closing\n  a blocker unblocks dependents; a blocked issue can still be closed.\n- Events: create/update/delete emit events with correct type, actor, and payload\n  grammar (created/deleted snapshots, update deltas, association `null ↔ value`,\n  one-event-per- field on close, single event on block add); deleted-entity\n  snapshot is complete.\n- Touch: association and comment changes bump the parent issue's `updated_at`.\n- Migration: from a seeded old-schema database, `in_progress` → `open`, JSON\n  labels lifted into tables, `description` readable as `body`, and existing rows\n  gain creation events; running migration twice is a no-op.\n\n## Out of Scope\n\n- Rendering markdown to HTML, and rendering the events log as a UI activity\n  timeline (data supports both; presentation is deferred — see\n  `docs/backlog.md`).\n- Turning user handles into clickable profile links (backlog).\n- Reintroducing priority or an `in_progress` state in any form.\n- A local users table or any identity beyond the Val Town handle.\n- Soft delete / restore (explicitly rejected in favour of hard delete +\n  tombstone event).\n- Retention or pruning of the append-only events log.\n- Topological \"what should I work on next\" ordering (the strict DAG keeps the\n  door open for it later, but it is not built here).\n- Black-box tests at the HTTP/API layer (single `db.ts` seam only, by decision).\n\n## Further Notes\n\n- Governing decisions live in ADRs 0001–0004 and the glossary in `CONTEXT.md`;\n  use that vocabulary in issue titles, tests, and code.\n- Deferred wants are tracked in `docs/backlog.md`.\n- The stale `docs/issue-tracker-valtown.md` is intentionally left untouched\n  until this work rewrites it, so nothing points agents at the new schema before\n  it exists.\n",[],[311,518,519,529],"09a12ef3-b79f-45bc-b0d7-6c7e712da8e8","ee584d8c-7bf2-11f1-8d5b-1607ee4eb77e",138,["D",1783641873720],[348,349,350],[311,518,519],"03816fa8-dc6c-4678-be10-d32d70f490ee","b3ab7362-7fb7-11f1-8f98-1607ee4eb77e","b3107e7a-7fb7-11f1-b594-1607ee4eb77e",248,["D",1784056239133],"# PRD: GitHub-style UI refactor\n\nStatus: ready-for-agent\n\nWireframes for every screen live in `wireframes/` (browsable viewer at\n`wireframes/index.html`). They are the visual reference for this spec; the red\ndashed marks in them are annotations, not UI.\n\n## Problem Statement\n\nThe tracker's current UI is a functional but ad-hoc set of server-rendered\npages: the issue list is a dense table with no labels visible, filtering is a\nrow of separate form fields, issue management is a long single column of\nalways-visible forms stacked under the body, and label management looks nothing\nlike the rest of the app. For a user who lives in GitHub Issues, none of it\nmatches the mental model they already have, and the triage signal (labels like\n`ready-for-agent`) is invisible exactly where triage happens: the list.\n\n## Solution\n\nRestyle all pages after the GitHub Issues interface while keeping the existing\nroutes, role model, storage, and API untouched. A slim shared top bar (Issues ·\nLabels · current user) replaces per-page navigation. The issue list becomes a\ntoken search bar plus a panel of stacked rows with Open/Closed tabs, label\nchips, and a Blocked pill. The issue detail page becomes a two-column layout:\nthe body as the first comment card and the thread on the left, management\n(assignees, labels, relationships, delete) in a right sidebar of gear-revealed\nsections, with close-with-reason in the composer footer. Label management gains\na search input and an inline expanding create row. Issue creation gets a focused\ntitle + description column with metadata pickers in a sidebar. Everything stays\nserver-rendered and works without client-side JavaScript, using progressive\ndisclosure (`<details>`) and plain form posts.\n\n## User Stories\n\n1. As a user on any page, I want a consistent top bar with Issues and Labels\n   tabs and my handle/avatar, so that I always know where I am and can move\n   between the two surfaces in one click.\n2. As a visitor in standalone mode, I want the top bar to show a log in link\n   when I am signed out (and log out when signed in), so that the existing auth\n   affordances survive the redesign.\n3. As a user browsing issues, I want Open and Closed tabs with count pills at\n   the top of the list panel, so that I can switch lifecycle views and see\n   volumes at a glance.\n4. As a user browsing issues, I want each issue as a stacked row (state icon,\n   bold title, meta line, label chips), so that I can scan titles and triage\n   labels without opening anything.\n5. As a triager, I want label chips visible under each issue title in the list,\n   so that I can spot `ready-for-agent` vs `ready-for-human` work without\n   opening each issue.\n6. As a user browsing issues, I want a Blocked pill in a row's meta line when at\n   least one blocker is still open, so that I can skip work that cannot proceed.\n7. As a user browsing issues, I want each row's meta line to show number,\n   author, opened time, and last-updated time, so that I can judge freshness the\n   same way I do on GitHub.\n8. As a user browsing issues, I want rows sorted by last activity, so that the\n   most recently touched issues surface first.\n9. As a user browsing issues, I want a comment count on rows that have comments,\n   so that I can see where discussion is happening.\n10. As a user filtering issues, I want a single search bar that accepts\n    `status:` and `assignee:` tokens plus free text, so that one input replaces\n    the old row of separate filter fields.\n11. As a user filtering issues, I want free text in the search bar matched\n    against issue titles and bodies, so that I can find issues by content.\n12. As a contributor, I want a New issue button next to the search bar, so that\n    creating an issue is one click from the list.\n13. As a viewer (read-only role), I want the New issue button hidden, so that\n    the UI never offers actions I cannot perform.\n14. As a contributor creating an issue, I want a focused page with a required\n    title field and a description editor, so that writing is the primary\n    activity.\n15. As a contributor creating an issue, I want assignees and labels in a sidebar\n    with disclosure pickers over the curated label set, so that metadata never\n    interrupts the writing flow.\n16. As a contributor creating an issue, I want an \"assign yourself\" shortcut in\n    the Assignees section, so that self-assignment is one click.\n17. As a contributor creating an issue, I want a Create more checkbox that\n    returns me to a fresh form after submitting, so that I can enter several\n    issues in a row.\n18. As a contributor creating an issue, I want submitting without a title to\n    re-render the form with an error and my input preserved, so that I do not\n    lose work.\n19. As a user reading an issue, I want the title with the issue number, a filled\n    Open (or Closed) pill, and a Blocked pill when applicable, so that state is\n    legible at the top.\n20. As a user reading an issue, I want the body rendered as the first comment\n    card with author, opened time, an edited marker, and a role badge, so that\n    provenance reads like GitHub.\n21. As a user reading an issue, I want comments as cards with author and time,\n    so that the thread is easy to follow.\n22. As a user reading a closed issue, I want the close reason visible\n    (completed, not planned, duplicate), so that I know why it was closed.\n23. As a user reading a reopened issue, I want the reopened state visible, so\n    that I can distinguish it from a never-closed issue.\n24. As a commenter, I want a composer at the end of the thread with a Comment\n    button, so that replying is immediate.\n25. As a viewer, I want the composer replaced by a read-only notice, so that the\n    page degrades honestly for my role.\n26. As an issue manager (creator or maintainer), I want Close issue with a\n    reason chooser in the composer footer, so that closing with the right state\n    reason is part of the natural flow.\n27. As an issue manager, I want Reopen offered in the same spot when the issue\n    is closed, so that the lifecycle actions live in one place.\n28. As an issue manager, I want a sidebar with Assignees, Labels, and\n    Relationships sections that stay quiet until I open their controls, so that\n    reading is undisturbed by forms.\n29. As an issue manager, I want each sidebar section's controls revealed by a\n    disclosure (gear), so that add/remove actions are available without\n    permanent clutter.\n30. As an issue manager, I want to add and remove labels via a picker over the\n    curated set, so that labeling is choosing, never typing.\n31. As an issue manager, I want to add and remove assignees by Val Town handle,\n    so that responsibility stays visible.\n32. As an issue manager, I want the Relationships section to show both\n    directions (blocked by / blocks) with each blocker's open/closed state, so\n    that I understand the dependency picture.\n33. As an issue manager, I want adding a blocking edge that would create a cycle\n    to fail with a clear error, so that the DAG guarantee is surfaced, not\n    silent.\n34. As a comment author (or maintainer), I want edit and delete on my comments\n    via each card's overflow, so that moderation matches GitHub.\n35. As a maintainer, I want Delete issue in the sidebar clearly separated and\n    marked maintainer-only, so that the destructive action is hard to hit by\n    accident.\n36. As a user with no manage rights, I want the sidebar management controls\n    absent entirely, so that role boundaries render as absences, not errors.\n37. As an issue manager, I want a pencil next to the title leading to the edit\n    page, so that fixing a title or body is one click.\n38. As a user of the labels page, I want a search input over labels, so that I\n    can find a label as the set grows.\n39. As a user of the labels page, I want rows showing chip, hex color, and\n    open-issue count, so that I can see each label's look and usage.\n40. As a maintainer, I want New label to expand an inline create row (preview\n    chip, name, color with swatch), so that creation happens in place rather\n    than on another page.\n41. As a maintainer, I want edit and delete behind each label row's overflow\n    menu, so that management is available but not shouting.\n42. As a maintainer, I want the open-issue count visible before deleting a\n    label, so that the cascade (label vanishing from issues) is a visible\n    consequence.\n43. As a host-val owner mounting the tracker in routed mode, I want the compact\n    top bar to be the only chrome, so that the tracker embeds politely under my\n    router's own UI.\n44. As a keyboard or assistive-tech user, I want all interactions to be links,\n    forms, and native disclosures, so that the UI works without JavaScript and\n    with standard semantics.\n45. As a future user, I want a Preview tab slot in the editors that activates\n    when markdown rendering lands, so that the layout will not shift when the\n    roadmap catches up.\n46. As a triager, I want a `label:` search token (and a Labels dropdown that\n    injects it), so that I can narrow the list to a specific triage label like\n    `ready-for-agent`.\n47. As a user filtering issues, I want an `author:` search token (and an Author\n    dropdown), so that I can see issues opened by a given handle.\n48. As a user filtering issues, I want `is:blocked` / `is:unblocked` tokens (and\n    a Blocked/Unblocked dropdown), so that I can focus on work that can or\n    cannot proceed.\n49. As a user filtering issues, I want the Open/Closed tabs and every dropdown\n    to edit tokens in the one search query rather than replace it, so that\n    filters compose instead of clobbering each other.\n\n## Implementation Decisions\n\n- **No behavior-layer changes.** Routes, the store interface, the JSON API, the\n  database schema, and the role model (viewer / contributor / maintainer,\n  standalone vs routed, the auth-UI signal) all stay exactly as they are. This\n  is a presentation refactor of the page components and layout.\n- **Shared top bar in the layout component.** 64px bar rendered on every page:\n  Issues and Labels tabs with an active underline, current user handle and\n  avatar on the right, and the existing login/logout affordance when the auth UI\n  is enabled. All page-local back links and duplicate New issue buttons are\n  removed in favor of the bar.\n- **Zero-JS-first, progressive disclosure.** Every interaction must work as\n  plain links and form posts. Gear-revealed sidebar sections, the inline label\n  create row, overflow menus, and pickers are `<details>`/`<summary>`\n  disclosures. No client-side framework; if a sprinkle of JS is ever added it\n  must be an enhancement, not a requirement.\n- **Token search, parsed server-side.** The list's single search input submits\n  one query parameter. The server parses `status:<open|closed>`,\n  `assignee:<handle>`, `label:<name>`, `author:<handle>`, and\n  `is:blocked`/`is:unblocked` tokens out of it, in any order. `status` and\n  `assignee` feed the existing list-issues filters; `label`, `author`, and\n  blocked-ness are applied in-route over the returned issues (no store-interface\n  change — `blocked` stays a derived property). The remainder, and any\n  unrecognized token, become the free-text search. Old\n  `status`/`assignee`/`search` query parameters keep working.\n- **Token-injecting filter dropdowns.** The list header carries Author, Labels,\n  and Blocked/Unblocked dropdowns built as `<details>` disclosures; choosing an\n  entry adds or replaces the matching token (`author:`, `label:`,\n  `is:blocked`/`is:unblocked`) in the query and submits. They are conveniences\n  over the search bar, which stays the single source of truth; zero-JS via\n  native disclosures and form posts.\n- **Open/Closed tabs replace the metric tiles and the status dropdown.** Counts\n  render as pills on the tabs. The tabs are links that rewrite the `status:`\n  token in the current query, preserving every other token; the active tab\n  reflects the effective status filter (default: open).\n- **Stacked list rows replace the table.** Row anatomy: state icon, bold title\n  (linking to the detail page), optional Blocked pill, meta line (number,\n  author, opened relative time, updated relative time), label chips, and a\n  right-aligned comment count when nonzero. Blocked remains a derived property\n  (an open blocker exists), never stored.\n- **Detail page is two-column.** Main column: the issue body as the first\n  comment card (author, opened time, edited marker, a role badge when the author\n  is a maintainer), then comment cards, then the composer. Sidebar: Assignees,\n  Labels, Relationships, and Delete sections separated by hairlines, each\n  section's mutation controls inside a disclosure and rendered only for users\n  allowed to use them (manage rights for issue associations; maintainer for\n  delete). Relationships lists both edge directions with each related issue's\n  status; the existing cycle-rejection error surfaces through the existing error\n  banner.\n- **Lifecycle actions live in the composer footer.** Close issue with a reason\n  chooser (completed default, not planned, duplicate) next to the Comment\n  button; Reopen replaces it when the issue is closed. These call the existing\n  close/reopen routes.\n- **Create/edit pages.** Create: required title, description textarea in a\n  Write-tab editor frame with a visible but inert Preview slot (activates when\n  markdown rendering ships), sidebar sections for assignees (including\n  assign-yourself) and label picking, footer with Create, Cancel, and a Create\n  more checkbox that redirects back to the create form instead of the new issue.\n  Edit mirrors create with title + body only. Assignee handles remain\n  unvalidated; the form notes this.\n- **Labels page.** Heading with maintainer-only New label button that expands an\n  inline create row (live-preview chip, name, color with swatch) posting to the\n  existing create-label route; a search input filtering labels by name\n  (server-side, query parameter); rows of chip, hex color, open-issue count, and\n  an overflow disclosure containing edit-in-place and delete. Label deletion\n  behavior is unchanged (cascade off issues; defaults seeded once per ADR 0001 —\n  the page never re-seeds).\n- **Open-issue count per label** is computed with a join at render time; no\n  schema change.\n- **Monochrome-agnostic styling.** The wireframes are lo-fi; the implementation\n  keeps the app's existing styling approach and dark palette, mapping wireframe\n  structure (not colors) onto it. Label chips continue to use each label's\n  stored color.\n\n## Testing Decisions\n\n- **Single seam: the HTTP handler.** All tests drive the app through the tracker\n  factory called with an in-memory store, exactly as the existing form-driven\n  test does: build a request, call the returned handler, assert on status,\n  redirect location, and markers in the rendered HTML.\n- **Good tests assert external behavior, not markup internals.** Assert that the\n  open/closed counts render, that a blocked issue's list row contains the\n  Blocked marker, that a viewer's page omits the New issue and composer\n  affordances, that token search narrows results, that Create more redirects\n  back to the form — not that a specific class name or element nesting is\n  present. String markers should be user-visible text or stable landmarks.\n- **Prior art:** the existing end-to-end form test (`app_test` — HTML forms\n  drive create, lifecycle, labels, assignees, blocks, and comments) is the\n  model: in-memory SQLite via the test store factory, `auth: false`, form posts,\n  HTML assertions. New tests extend this file's style; role-gating tests can\n  construct routed contexts the same way existing routed tests do.\n- **The JSON API tests are untouched** — the API surface does not change.\n\n## Out of Scope\n\n- **Markdown rendering** and therefore Preview activation; the Preview tab ships\n  visibly inert (roadmap).\n- **Personal views** (assigned to me, created by me, recent activity) — deferred\n  until there is real multi-user traffic.\n- **Sort menus** and any other header dropdowns beyond Author, Labels, and\n  Blocked/Unblocked (which now ship — see Implementation Decisions); sort stays\n  fixed at last activity.\n- **Label descriptions** — explicitly decided against; no schema change.\n- **Mobile-specific layouts** — the pages remain simple enough to degrade, but\n  no dedicated responsive pass in this effort.\n- **Pagination**, file attachments, notifications, milestones, projects, and any\n  other GitHub feature without an existing backend.\n- **API or schema changes of any kind.**\n\n## Further Notes\n\n- Visual reference: `wireframes/issue-list.svg`, `wireframes/issue-detail.svg`,\n  `wireframes/issue-new.svg`, `wireframes/labels.svg`, flow overview in\n  `wireframes/flow.svg`, all browsable via `wireframes/index.html`.\n- The wireframes were iterated against GitHub Issues screenshots supplied during\n  the design session; decisions recorded there and folded in here: top bar over\n  sidebar nav, no label descriptions, personal views deferred, Preview marked\n  roadmap.\n- Relative-time formatting (\"3d ago\") appears throughout the wireframes; the\n  current UI shows absolute dates. Treat relative times as the target, but this\n  is a presentation detail, not a contract.\n- If disclosure-based pickers prove awkward for multi-select labeling in\n  practice, the fallback is the current always-visible form for that one\n  section; keep the section anatomy either way.\n",[],[311,518,550,529],"github-style-ui","bd25824a-46f8-4203-963a-29d26806be4f","07-labels-page.md","b3803c74-7fb7-11f1-bc45-1607ee4eb77e","b3318a70-7fb7-11f1-bc45-1607ee4eb77e",244,["D",1784056239217],"# 07 — Labels page\n\n**What to build:** The labels page becomes GitHub-like. A search input filters\nlabels by name server-side via a query parameter. Each label renders as a row\nshowing its chip, hex color, and open-issue count (computed with a join at\nrender time — no schema change). A maintainer-only New label button expands an\ninline create row with a live-preview chip, a name field, and a color field with\na swatch, posting to the existing create-label route. Each row has an overflow\ndisclosure containing edit-in-place and delete; the visible open-issue count\nmakes the delete cascade (the label vanishing from that many issues) a visible\nconsequence. Label deletion behavior is unchanged.\n\n**Blocked by:** 01\n\n**Status:** ready-for-agent\n\n- [ ] A search input filters the label list by name (server-side)\n- [ ] Each row shows the label chip, its hex color, and its open-issue count\n- [ ] A maintainer sees New label, which expands an inline create row with a\n      live-preview chip, name, and color-with-swatch, and creating a label works\n      via the existing route\n- [ ] Edit-in-place and delete live behind each row's overflow disclosure\n- [ ] A non-maintainer sees the list and counts but no create/edit/delete\n      controls\n- [ ] No route, store, API, or schema change\n",[],[311,518,550,518,552],"0fcbbc12-aa9b-4dce-9da5-e476d50c9fc4","06-create-and-edit-pages.md","b3c28c8c-7fb7-11f1-b19c-1607ee4eb77e",250,["D",1784056239622],"# 06 — Create & edit pages\n\n**What to build:** The create page becomes a focused writing column: a required\ntitle field and a description textarea inside a Write-tab editor frame with a\nvisible but inert Preview tab slot (activates when markdown rendering ships). A\nsidebar holds an Assignees section with an assign-yourself shortcut and a Labels\npicker over the curated set. The footer has Create, Cancel, and a Create more\ncheckbox that returns to a fresh create form after submitting instead of the new\nissue. Submitting without a title re-renders the form with an error and\npreserves the entered input. The edit page mirrors this layout with title and\nbody only. Assignee handles remain unvalidated, and the form notes this.\n\n**Blocked by:** 01\n\n**Status:** ready-for-agent\n\n- [ ] Create shows a required title, a description editor with a Write tab and\n      an inert Preview slot, and a sidebar with Assignees (incl.\n      assign-yourself) and a label picker\n- [ ] Submitting with a title creates the issue with the chosen labels and\n      assignees\n- [ ] Submitting without a title re-renders the form with an error and the\n      previously entered body/metadata preserved\n- [ ] The Create more checkbox redirects back to a fresh create form instead of\n      the new issue\n- [ ] Edit mirrors the layout with title + body and saves via the existing route\n- [ ] No route, store, API, or schema change\n",[],[311,518,550,518,561],"fa1168b7-b722-4dbb-bf5b-59bbaaec031b","05-issue-detail-management-sidebar.md","b3cc82c8-7fb7-11f1-99dd-1607ee4eb77e",251,["D",1784056239394],"# 05 — Issue detail: gear-revealed management sidebar\n\n**What to build:** The detail page's right column gains a management sidebar\nwith Assignees, Labels, and Relationships sections separated by hairlines, each\nsection's add/remove controls tucked inside a gear `<details>` disclosure so\nreading stays undisturbed. Labels are added/removed via a picker over the\ncurated set; assignees added/removed by Val Town handle; Relationships lists\nboth directions (blocked by / blocks) with each related issue's open/closed\nstate, and an edge that would create a cycle fails through the existing error\nbanner. Each comment card gains an overflow disclosure with edit and delete for\nits author (or a maintainer). A maintainer-only Delete issue sits clearly\nseparated at the bottom. For users without manage rights the sidebar controls\nare absent entirely, and delete is absent for non-maintainers.\n\n**Blocked by:** 04\n\n**Status:** ready-for-agent\n\n- [ ] Managers see Assignees, Labels, and Relationships sections whose controls\n      are revealed by a disclosure\n- [ ] Labels can be added/removed via a picker over the curated set; assignees\n      added/removed by handle\n- [ ] Relationships shows both blocked-by and blocks with each related issue's\n      state; a cycle-creating edge surfaces the existing error via the banner\n- [ ] A comment's author or a maintainer can edit and delete it from the card's\n      overflow\n- [ ] Delete issue appears only for maintainers and is visually separated;\n      non-managers see no sidebar controls at all (no errors)\n- [ ] No route, store, API, or schema change\n",[],[311,518,550,518,569],"22f54fea-60d3-4192-a45c-7ddf6e7882b5","04-issue-detail-reading-shell.md","b38c5cca-7fb7-11f1-9940-1607ee4eb77e",245,["D",1784056239307],"# 04 — Issue detail: reading shell + lifecycle composer footer\n\n**What to build:** The issue detail page becomes a two-column reading surface.\nThe header shows the title with its number, a filled Open (or Closed) pill, a\nBlocked pill when an open blocker exists, and a pencil linking to the edit page.\nThe body renders as the first comment card — author, opened relative time, an\nedited marker when edited, and a role badge when the author is a maintainer —\nfollowed by the comment thread as cards (each with author and time; a closed\nissue shows its close reason, a reopened issue shows the reopened state). The\nthread ends in a composer whose footer carries the lifecycle action: Close issue\nwith a reason chooser (completed default, not planned, duplicate) for an open\nissue, or Reopen for a closed one, beside the Comment button. Viewers get a\nread-only notice instead of the composer.\n\n**Blocked by:** 01\n\n**Status:** ready-for-agent\n\n- [ ] The header shows title + number, a filled Open/Closed pill, a Blocked pill\n      when applicable, and an edit pencil\n- [ ] The body appears as the first comment card with author, opened time, an\n      edited marker when edited, and a maintainer badge when applicable\n- [ ] Comments render as cards; a closed issue shows its close reason and a\n      reopened issue shows the reopened state\n- [ ] A manager sees Close-with-reason (open) or Reopen (closed) in the composer\n      footer, and closing/reopening still works via the existing routes\n- [ ] A viewer sees a read-only notice and no composer\n- [ ] No route, store, API, or schema change\n",[],[311,518,550,518,577],"3b76ef34-0ddb-4216-b312-de5459d556a0","03-filter-dropdowns.md","b3dadfc6-7fb7-11f1-add4-1607ee4eb77e",252,["D",1784056239456],"# 03 — Token-injecting filter dropdowns\n\n**What to build:** The list header gains three dropdowns — Author, Labels, and\nBlocked/Unblocked — each a native `<details>` disclosure listing its choices\n(author handles drawn from existing issues, the curated label set, and\nblocked/unblocked). Choosing an entry adds or replaces the matching token\n(`author:`, `label:`, `is:blocked`/`is:unblocked`) in the current query and\nsubmits, so the search bar stays the single source of truth. Everything works\nwith no client JavaScript.\n\n**Blocked by:** 02\n\n**Status:** ready-for-agent\n\n- [ ] The list header shows Author, Labels, and Blocked/Unblocked disclosures\n- [ ] Choosing a label adds `label:<name>` to the query and filters the list\n      accordingly\n- [ ] Choosing an author adds `author:<handle>`; choosing Blocked/Unblocked adds\n      `is:blocked`/`is:unblocked`\n- [ ] Selecting a value when its token already exists replaces it rather than\n      duplicating it\n- [ ] The dropdowns operate without JavaScript (native disclosure + form post)\n- [ ] No route, store, API, or schema change\n",[],[311,518,550,518,585],"3e37697d-be1e-4cbb-be09-71946a4c0260","02-issue-list-search-tabs-rows.md","b3bb38ba-7fb7-11f1-9b8e-1607ee4eb77e",269,["D",1784059508125],"# 02 — Issue list: query language, Open/Closed tabs, stacked rows\n\n**What to build:** The issue list becomes a GitHub-style search-and-scan\nsurface. A single search box submits one query; the server parses `status:`,\n`assignee:`, `label:`, `author:`, and `is:blocked`/`is:unblocked` tokens in any\norder. `status` and `assignee` feed the existing list filters; `label`,\n`author`, and blocked-ness are applied in-route over the returned issues (no\nstore-interface change — `blocked` stays a derived property). Leftover text, and\nany unrecognized token, become the free-text search across title and body. Open\nand Closed tabs sit above the list with count pills; clicking a tab rewrites\nonly the `status:` token and preserves the rest of the query. Each issue renders\nas a stacked row: state icon, bold linked title, a Blocked pill when an open\nblocker exists, a meta line (number, author, opened relative time, updated\nrelative time), label chips, and a right-aligned comment count when nonzero. A\nNew issue button sits by the search box for non-viewers and is hidden for\nviewers. Old `status`/`assignee`/`search` URLs keep working.\n\n**Blocked by:** 01\n\n**Status:** resolved\n\n- [x] `status:closed` in any position (alongside other tokens) narrows to closed\n      issues; free text narrows by title/body\n- [x] `label:<name>` and `author:<handle>` narrow the list;\n      `is:blocked`/`is:unblocked` narrow by derived blocked-ness\n- [x] Open and Closed tabs show correct counts, and clicking one preserves the\n      other tokens in the query\n- [x] A blocked issue's row shows the Blocked marker; rows show number, author,\n      relative opened/updated times, label chips, and a comment count when\n      comments exist\n- [x] Viewers see no New issue button; contributors and maintainers do\n- [x] Old `?status=`/`?assignee=`/`?search=` URLs produce the same results as\n      before\n- [x] No route, store, API, or schema change\n\n## Comments\n\n- Implemented server-side token parsing for the `q` query, with legacy query\n  parameters retained, route-level label/author/blocked filtering, activity\n  counts, and stacked issue rows.\n- Validation passed: `deno task check` (format, lint, typecheck, and full test\n  suite).\n",[],[311,518,550,518,593],"d9c2f100-36ac-439b-82aa-78d0fafb7213","01-shared-top-bar.md","b3a02c82-7fb7-11f1-9b8e-1607ee4eb77e",268,["D",1784059508142],"# 01 — Shared top bar in the layout\n\n**What to build:** On every page, a slim shared top bar replaces per-page\nnavigation. It shows two tabs — Issues and Labels — with the current surface\nactive, the signed-in user's handle and avatar on the right, and the existing\nauth affordance: a log in link when signed out (wherever a login location\nexists), log out when signed in, and neither when the tracker is mounted under\nan ungated router. In routed mode the bar is the only chrome the tracker adds.\nPer-page back links and duplicate New issue / Labels buttons come out in favor\nof the bar as each page is restyled.\n\n**Blocked by:** None — can start immediately.\n\n**Status:** resolved\n\n- [x] Every page renders the top bar with Issues and Labels tabs linking to\n      their surfaces\n- [x] The tab for the current surface is visibly active\n- [x] Signed out with an available login: the bar shows a log in link; signed\n      in: it shows the user handle and a log out control\n- [x] Under an ungated routed mount, the bar shows neither log in nor log out\n- [x] Internal links respect the mount prefix in routed mode and are prefix-free\n      standalone\n- [x] No route, store, API, or schema change; existing tests still pass\n\n## Comments\n\n- Verified the shared top bar implementation in `layout.tsx`, its active-surface\n  wiring across all page components and error pages, and routed prefix/auth\n  behavior in `app.tsx` and `app_test.tsx`.\n- Validation passed: `deno task check` (format, lint, typecheck, and 26 tests).\n",[],[311,518,550,518,601],"f9ae41d9-43f3-4d72-ac25-e5ff303e87ef",238,["D",1784056238688],[339,340,341,342,343,344,345],[311,518,550,518],"2acc39c9-ac03-40d5-a465-a4e0762786f6",237,["D",1784056238504],[338,346],[311,518,550],"087701f2-85c7-4143-bf9c-c982c16aabc3",137,["D",1783641873603],[337,347],[311,518],"333d9aaa-e7b2-4eb4-b3d6-a187292833b3","triage-labels.md","ee979b04-7bf2-11f1-ab8e-1607ee4eb77e","ee3720da-7bf2-11f1-8964-1607ee4eb77e",170,["D",1783653142340],"# Triage Labels\n\nThe skills speak in terms of five canonical triage roles. This file maps those\nroles to the actual label strings used in this repo's issue tracker.\n\n| Label in mattpocock/skills | Label in our tracker | Meaning                                  |\n| -------------------------- | -------------------- | ---------------------------------------- |\n| `needs-triage`             | `needs-triage`       | Maintainer needs to evaluate this issue  |\n| `needs-info`               | `needs-info`         | Waiting on reporter for more information |\n| `ready-for-agent`          | `ready-for-agent`    | Fully specified, ready for an AFK agent  |\n| `ready-for-human`          | `ready-for-human`    | Requires human implementation            |\n| `wontfix`                  | `wontfix`            | Will not be actioned                     |\n\nWhen a skill mentions a role (e.g. \"apply the AFK-ready triage label\"), use the\ncorresponding label string from this table.\n\n> Note: these five are the **skills' workflow** labels applied to `docs/issues/`\n> tickets. They are a different axis from the issue-tracker _product's_ labels\n> (`bug`, `enhancement`, `documentation`, `question`, `duplicate`) defined in\n> `CONTEXT.md`. Don't conflate the two.\n\nEdit the right-hand column to match whatever vocabulary you actually use.\n",[],[311,632,624],"agents","82f10ed3-774a-43fd-9359-15b8c0e73a99","issue-tracker.md","eea668c8-7bf2-11f1-8b8f-1607ee4eb77e",171,["D",1783653142513],"# Issue tracker: Local Markdown\n\nIssues and PRDs for this repo live as markdown files in `docs/issues/`.\n\n## Conventions\n\n- One feature per directory: `docs/issues/<feature-slug>/`\n- The PRD is `docs/issues/<feature-slug>/PRD.md`\n- Implementation issues are `docs/issues/<feature-slug>/issues/<NN>-<slug>.md`,\n  numbered from `01`\n- Triage state is recorded as a `Status:` line near the top of each issue file\n  (see `triage-labels.md` for the role strings)\n- Comments and conversation history append to the bottom of the file under a\n  `## Comments` heading\n\n## When a skill says \"publish to the issue tracker\"\n\nCreate a new file under `docs/issues/<feature-slug>/` (creating the directory if\nneeded).\n\n## When a skill says \"fetch the relevant ticket\"\n\nRead the file at the referenced path. The user will normally pass the path or\nthe issue number directly.\n\n## Wayfinding operations\n\nUsed by `/wayfinder`. The **map** is a file with one **child** file per ticket.\n\n- **Map**: `docs/issues/<effort>/map.md` — the Notes / Decisions-so-far / Fog\n  body.\n- **Child ticket**: `docs/issues/<effort>/issues/NN-<slug>.md`, numbered from\n  `01`, with the question in the body. A `Type:` line records the ticket type\n  (`research`/`prototype`/`grilling`/`task`); a `Status:` line records\n  `claimed`/`resolved`.\n- **Blocking**: a `Blocked by: NN, NN` line near the top. A ticket is unblocked\n  when every file it lists is `resolved`.\n- **Frontier**: scan `docs/issues/<effort>/issues/` for files that are open,\n  unblocked, and unclaimed; first by number wins.\n- **Claim**: set `Status: claimed` and save before any work.\n- **Resolve**: append the answer under an `## Answer` heading, set\n  `Status: resolved`, then append a context pointer (gist + link) to the map's\n  Decisions-so-far in `map.md`.\n",[],[311,632,634],"761446ff-c75d-4331-83d4-ae4f43707105","domain.md","ee8a62a4-7bf2-11f1-9482-1607ee4eb77e",169,["D",1783653142230],"# Domain Docs\n\nHow the engineering skills should consume this repo's domain documentation when\nexploring the codebase.\n\n## Before exploring, read these\n\n- **`CONTEXT.md`** at the repo root, or\n- **`CONTEXT-MAP.md`** at the repo root if it exists — it points at one\n  `CONTEXT.md` per context. Read each one relevant to the topic.\n- **`docs/adr/`** — read ADRs that touch the area you're about to work in. In\n  multi-context repos, also check `src/<context>/docs/adr/` for context-scoped\n  decisions.\n\nIf any of these files don't exist, **proceed silently**. Don't flag their\nabsence; don't suggest creating them upfront. The `/domain-modeling` skill\n(reached via `/grill-with-docs` and `/improve-codebase-architecture`) creates\nthem lazily when terms or decisions actually get resolved.\n\n## File structure\n\nThis repo is **single-context**: one root `CONTEXT.md` + `docs/adr/`.\n\n```\n/\n├── CONTEXT.md\n├── docs/adr/\n│   ├── 0001-seed-default-labels-once.md\n│   ├── 0002-blocking-graph-integrity.md\n│   ├── 0003-audit-columns-and-editability.md\n│   └── 0004-append-only-events-log.md\n└── ...\n```\n\n(For reference, a multi-context repo would instead have a `CONTEXT-MAP.md` at\nthe root pointing at per-context `CONTEXT.md` files under `src/<context>/`, each\nwith its own `docs/adr/`.)\n\n## Use the glossary's vocabulary\n\nWhen your output names a domain concept (in an issue title, a refactor proposal,\na hypothesis, a test name), use the term as defined in `CONTEXT.md`. Don't drift\nto synonyms the glossary explicitly avoids.\n\nIf the concept you need isn't in the glossary yet, that's a signal — either\nyou're inventing language the project doesn't use (reconsider) or there's a real\ngap (note it for `/domain-modeling`).\n\n## Flag ADR conflicts\n\nIf your output contradicts an existing ADR, surface it explicitly rather than\nsilently overriding:\n\n> _Contradicts ADR-0002 (blocking graph is a strict DAG) — but worth reopening\n> because…_\n",[],[311,632,642],"8a26a61d-d596-4a29-9050-a96215f95442",136,["D",1783641873401],[333,334,335],[311,632],"31c02dd3-aedd-4960-bc34-e9b9c5426093","0004-append-only-events-log.md","ee7eb5c6-7bf2-11f1-8930-1607ee4eb77e","ee2551f2-7bf2-11f1-a4f1-1607ee4eb77e",168,["D",1783653142026],"# 0004 — Single append-only events log as source of truth for history\n\n## Status\n\nAccepted\n\n## Context\n\nAudit columns (ADR 0003) record only the _last_ writer of a row — they cannot\nanswer \"what happened to this issue over time,\" and crucially cannot recover\ninformation that a mutation _removed_ (a label unapplied, an assignee dropped, a\nblock edge deleted). We want both an audit trail and full state history, and\noptionally a GitHub-style activity timeline later.\n\n## Decision\n\nAdd one append-only, polymorphic table:\n\n```\nissue_tracker_events(\n  id              INTEGER PK,\n  event_type      TEXT,      -- \"<entity>.<verb>\"\n  entity_id       INTEGER,   -- id of the issue/comment/label\n  actor           TEXT,      -- Val Town handle who did it\n  data            TEXT,      -- JSON, shape depends on verb\n  event_timestamp INTEGER\n)\n```\n\n- **Entities**: `issue`, `comment`, `label`. **Verbs**: `created`, `updated`,\n  `deleted`.\n- **Grammar** — _boundary events snapshot, updates carry deltas_:\n  - `*.created` → full initial-state snapshot in `data`.\n  - `*.deleted` → full final-state snapshot in `data` (entities are\n    **hard-deleted**; the event is the tombstone — see ADR 0003 amendment /\n    soft-delete rejected).\n  - `*.updated` → `{ update_target, from, to }`.\n- **Associations have no entity type of their own.** Applying/removing a label,\n  assigning/unassigning a user, and adding/removing a block edge are modelled as\n  `issue.updated` events with `update_target` ∈ {`label`, `assignee`, `blocks`,\n  `blocked_by`} and `from`/`to` using **`null ↔ value`** (null→X = added, X→null\n  = removed). This reuses the scalar-edit grammar; no new verb, no link entity\n  type.\n- **One event per changed field.** Closing emits two events (`status`\n  open→closed and `state_reason` null→reason) sharing one\n  `actor`/`event_timestamp`; reopen likewise. Rendering \"closed as not planned\"\n  as a single timeline line is a read-time grouping by (actor, timestamp).\n- **Block edges write one event, on the acting issue** (ADR 0002 / Q17); the\n  reverse \"blocked by\" view is derived by querying events whose `to` references\n  the issue.\n\n## Consequences\n\n- The log is the single source of truth for provenance and history; live tables\n  hold only current state. Every entity create/update/delete and every\n  association change **must** emit an event, or provenance is lost.\n- Full state at any past time is reconstructable: start from the `created`\n  snapshot, replay `updated` deltas forward.\n- Removals are captured (the whole point) — a `label_removed`-style fact\n  survives as an `issue.updated` with `to: null`, and deleted entities leave a\n  snapshot tombstone.\n- Whether the log is surfaced in the UI (activity timeline) is deferred; the\n  data supports it either way. Auditability is derived, not a stored view.\n- The table grows unboundedly (append-only); pruning/retention is a future\n  concern.\n",[],[311,663,655],"adr","26aa1419-2852-4924-b2b1-f3eb9e4adc9e","0003-audit-columns-and-editability.md","ee76ee18-7bf2-11f1-8022-1607ee4eb77e",166,["D",1783653141647],"# 0003 — Audit columns and universal editability\n\n## Status\n\nAccepted — **partially superseded by ADR 0004** (see amendment at end). The\n_editability_ decision stands in full; the `*_by` columns and the link\ncreation-pair were removed once the events log (ADR 0004) became the source of\ntruth for provenance.\n\n## Context\n\nWe want to know who created and last changed every piece of user-authored data,\nand we want a uniform convention rather than ad-hoc timestamps per table. Today\nit is inconsistent: issues have `created_by`/`created_at`/`updated_at` but no\n`updated_by`; comments have only `author` + `created_at` and no edit operation\nat all.\n\n## Decision\n\nTwo rules, applied across the whole schema:\n\n1. **Entities carry all four audit columns**: `created_at`, `created_by`,\n   `updated_at`, `updated_by`. Entities are the things a user authors and can\n   later change — **Issue**, **Comment**, **Label**. Consequently, _every entity\n   is editable_ (there is an update operation for each), including comments.\n   `created_by`/`updated_by` hold Val Town handles.\n\n2. **Join / link rows carry only the creation pair**: `created_at` +\n   `created_by` (surfaced with intent-revealing names, e.g.\n   `assigned_at`/`assigned_by` on assignees, `linked_at`/`linked_by` on block\n   edges). Links are immutable — a user _adds_ or _removes_ them, never _edits_\n   one — so `updated_at`/`updated_by` would be meaningless.\n\nNaming: the Comment's `author` column is renamed **`created_by`** so the\nconvention is uniform (the author _is_ the creator).\n\n## Consequences\n\n- Comment editing becomes a real, supported operation (mirrors GitHub).\n- Every table's provenance is queryable in a uniform way; no per-table special\n  cases.\n- `updated_at` combines with the \"touch\" rule (see CONTEXT.md): association\n  changes bump the parent issue's `updated_at` too.\n- Slightly more columns and write-path bookkeeping everywhere — accepted for the\n  auditability and uniformity it buys.\n\n## Amendment (superseded in part by ADR 0004)\n\nOnce the append-only events log (ADR 0004) was adopted, it became the source of\ntruth for _who_ did _what_ and _when_. That makes the `*_by` columns redundant —\nactor is derivable as the latest event for an entity. We therefore revised this\ndecision:\n\n- **Entities keep only `created_at` + `updated_at`** as denormalized columns —\n  they drive hot-path listing and \"last activity\" sorting, which would otherwise\n  require a `MAX(event_timestamp)` aggregate over the log on every render.\n- **`created_by` / `updated_by` columns are dropped.** The actor is derived from\n  the events log, which is already loaded on the only screen that needs it (an\n  entity's detail/timeline view).\n- **Link rows carry no audit columns at all** — assignees and block edges become\n  bare relationship tuples; their provenance lives entirely in events.\n\nWhat stands unchanged from the original decision: **every entity (Issue,\nComment, Label) is editable**, including comments, and the Comment's old\n`author` column is gone (its creator is derived from the `comment.created`\nevent).\n",[],[311,663,665],"bf1eb092-9651-471a-b7da-df0287561a70","0002-blocking-graph-integrity.md","eedbe340-7bf2-11f1-a9f4-1607ee4eb77e",183,["D",1783653141615],"# 0002 — Blocking graph is a strict DAG (reject all cycles)\n\n## Status\n\nAccepted\n\n## Context\n\nIssues can block each other, forming a directed graph stored as edges in\n`issue_tracker_issue_blocks(blocker_id, blocked_id)` (edge direction: blocker →\nblocked). Such a graph can contain degenerate or cyclic edges:\n\n- **Self-edge** — A blocks A.\n- **Direct reciprocal** — A blocks B and B blocks A.\n- **Longer cycle** — A blocks B, B blocks C, C blocks A.\n\nGitHub, empirically, rejects self-edges and direct reciprocals but _allows_\nlonger cycles like A→B→C→A (verified against its GraphQL `blockedBy`/`blocking`\nAPI). We deliberately do **not** follow GitHub here.\n\n## Decision\n\nEnforce a strict DAG — reject **any** edge that would create a cycle. All three\ncases above collapse into one rule, checked on insert of edge\n`blocker → blocked`:\n\n> Reject if `blocked` can already reach `blocker` by following block-edges —\n> i.e. a path `blocked → … → blocker` already exists (a self-edge is the\n> degenerate `blocked == blocker` case).\n\nImplemented as a reachability query (SQLite `WITH RECURSIVE`) run in the\ndatabase on each insert. `UNIQUE(blocker_id, blocked_id)` additionally prevents\nduplicate edges.\n\n## Rationale\n\nA cycle in a dependency graph is logically incoherent: a loop of issues that can\nnever be satisfied in dependency order. Keeping the graph a strict DAG also\npreserves the option to add topological \"what's workable now\" ordering later\nwithout retrofitting cycle detection.\n\n## Consequences\n\n- Every edge insert pays for one reachability traversal. For a\n  personal/small-team tracker's graph size this is negligible, and it runs\n  entirely in SQLite.\n- The block graph is guaranteed acyclic, so downstream features may safely\n  assume a topological order exists.\n- This is stricter than GitHub; anyone porting expectations from GitHub should\n  know that A→B→C→A is refused here.\n",[],[311,663,673],"610774cf-6c90-4bf8-91cb-2b82abfa3ecc","0001-seed-default-labels-once.md","ee84afa8-7bf2-11f1-8022-1607ee4eb77e",167,["D",1783653141936],"# 0001 — Seed default labels once, at table creation only\n\n## Status\n\nAccepted\n\n## Context\n\nThe tracker is a drop-in library: `initSchema()` is idempotent and runs on\n**every request** to guarantee the host val's tables exist. We also want to ship\na curated set of default labels (`bug`, `enhancement`, `documentation`,\n`question`, `duplicate`), and labels are user-deletable.\n\nThese two facts collide. If defaults are inserted \"when missing\" inside the\nper-request `initSchema()`, then any default a user deliberately deletes will\nreappear on the very next request — deletion would be impossible for default\nlabels.\n\n## Decision\n\nSeed the default labels **exactly once, in the branch that creates the\n`issue_tracker_labels` table** (i.e. only when it did not previously exist).\nOnce the table exists, `initSchema()` never touches label _rows_ again. After\ncreation the label set belongs entirely to the user: deletes and edits are\npermanent.\n\n## Consequences\n\n- Default labels behave like a starting kit, not enforced state — users can\n  prune or rename any of them and the changes stick.\n- The \"table was just created\" signal must be detected explicitly (e.g. check\n  existence before `CREATE TABLE`, or seed only when a freshly created table is\n  empty on first creation), since `CREATE TABLE IF NOT EXISTS` alone doesn't\n  tell us whether it already had data.\n- A host that wants the defaults back after deleting them must re-add them\n  manually; there is intentionally no auto-heal.\n",[],[311,663,681],"12a719bc-c079-4db1-bbdb-e6251ba56110",135,["D",1783641873285],[328,329,330,331],[311,663],["D",1783635592340],[327,332,336,351,352],[311],["D",1783563523910],["D",1789525245864],{"_100":99,"_107":103},{"_100":99,"_101":-5,"_102":103,"_18":55,"_104":105,"_106":25},{"_13":89,"_32":90,"_43":42,"_91":44,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":45,"_98":99},"ctx",{"_82":-5,"_127":734,"_735":736,"_737":738,"_739":25,"_740":25,"_741":25,"_742":59,"_743":-5,"_744":-7,"_745":-7,"_746":63,"_747":25,"_748":25,"_749":-5,"_750":25,"_751":25,"_752":25,"_753":-5},"ENV",{"_705":706,"_707":708,"_709":90,"_710":711,"_712":713,"_714":715,"_716":717,"_718":719,"_720":721,"_722":723,"_724":725,"_726":727,"_728":729,"_730":731,"_732":733},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]
</article></body></html>

\n #{issue.id} {issue.title}\n

Relationships

Comments ({comments.length})

Labels

Flow

Screens

Open questions

Screen flow

1.Issue list · /

Annotations

2.Issue detail · /issue/:id

Annotations

3.New issue · /new

Annotations

4.Labels · /labels

Annotations

Open questions

1.Issue list · `/`

2.Issue detail · `/issue/:id`

3.New issue · `/new`

4.Labels · `/labels`

Diff · v270