Merge remote-tracking branch 'upstream/master'

api/tangled/cbor_gen.go

···
 	}
 
 	cw := cbg.NewCborWriter(w)
-	fieldCount := 9
+	fieldCount := 10
 
 	if t.Body == nil {
 		fieldCount--
 	}
 
 	if t.Mentions == nil {
+		fieldCount--
+	}
+
+	if t.Patch == nil {
 		fieldCount--
 	}
 
···
 	}
 
 	// t.Patch (string) (string)
-	if len("patch") > 1000000 {
-		return xerrors.Errorf("Value in field \"patch\" was too long")
-	}
+	if t.Patch != nil {
 
-	if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("patch"))); err != nil {
-		return err
-	}
-	if _, err := cw.WriteString(string("patch")); err != nil {
-		return err
-	}
+		if len("patch") > 1000000 {
+			return xerrors.Errorf("Value in field \"patch\" was too long")
+		}
 
-	if len(t.Patch) > 1000000 {
-		return xerrors.Errorf("Value in field t.Patch was too long")
-	}
+		if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("patch"))); err != nil {
+			return err
+		}
+		if _, err := cw.WriteString(string("patch")); err != nil {
+			return err
+		}
+
+		if t.Patch == nil {
+			if _, err := cw.Write(cbg.CborNull); err != nil {
+				return err
+			}
+		} else {
+			if len(*t.Patch) > 1000000 {
+				return xerrors.Errorf("Value in field t.Patch was too long")
+			}
 
-	if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Patch))); err != nil {
-		return err
-	}
-	if _, err := cw.WriteString(string(t.Patch)); err != nil {
-		return err
+			if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(*t.Patch))); err != nil {
+				return err
+			}
+			if _, err := cw.WriteString(string(*t.Patch)); err != nil {
+				return err
+			}
+		}
 	}
 
 	// t.Title (string) (string)
···
 		return err
 	}
 
+	// t.PatchBlob (util.LexBlob) (struct)
+	if len("patchBlob") > 1000000 {
+		return xerrors.Errorf("Value in field \"patchBlob\" was too long")
+	}
+
+	if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("patchBlob"))); err != nil {
+		return err
+	}
+	if _, err := cw.WriteString(string("patchBlob")); err != nil {
+		return err
+	}
+
+	if err := t.PatchBlob.MarshalCBOR(cw); err != nil {
+		return err
+	}
+
 	// t.References ([]string) (slice)
 	if t.References != nil {
 
···
 		case "patch":
 
 			{
-				sval, err := cbg.ReadStringWithMax(cr, 1000000)
+				b, err := cr.ReadByte()
 				if err != nil {
 					return err
 				}
+				if b != cbg.CborNull[0] {
+					if err := cr.UnreadByte(); err != nil {
+						return err
+					}
 
-				t.Patch = string(sval)
+					sval, err := cbg.ReadStringWithMax(cr, 1000000)
+					if err != nil {
+						return err
+					}
+
+					t.Patch = (*string)(&sval)
+				}
 			}
 			// t.Title (string) (string)
 		case "title":
···
 				}
 
 				t.CreatedAt = string(sval)
+			}
+			// t.PatchBlob (util.LexBlob) (struct)
+		case "patchBlob":
+
+			{
+
+				b, err := cr.ReadByte()
+				if err != nil {
+					return err
+				}
+				if b != cbg.CborNull[0] {
+					if err := cr.UnreadByte(); err != nil {
+						return err
+					}
+					t.PatchBlob = new(util.LexBlob)
+					if err := t.PatchBlob.UnmarshalCBOR(cr); err != nil {
+						return xerrors.Errorf("unmarshaling t.PatchBlob pointer: %w", err)
+					}
+				}
+
 			}
 			// t.References ([]string) (slice)
 		case "references":

api/tangled/repopull.go

···
 } //
 // RECORDTYPE: RepoPull
 type RepoPull struct {
-	LexiconTypeID string           `json:"$type,const=sh.tangled.repo.pull" cborgen:"$type,const=sh.tangled.repo.pull"`
-	Body          *string          `json:"body,omitempty" cborgen:"body,omitempty"`
-	CreatedAt     string           `json:"createdAt" cborgen:"createdAt"`
-	Mentions      []string         `json:"mentions,omitempty" cborgen:"mentions,omitempty"`
-	Patch         string           `json:"patch" cborgen:"patch"`
-	References    []string         `json:"references,omitempty" cborgen:"references,omitempty"`
-	Source        *RepoPull_Source `json:"source,omitempty" cborgen:"source,omitempty"`
-	Target        *RepoPull_Target `json:"target" cborgen:"target"`
-	Title         string           `json:"title" cborgen:"title"`
+	LexiconTypeID string   `json:"$type,const=sh.tangled.repo.pull" cborgen:"$type,const=sh.tangled.repo.pull"`
+	Body          *string  `json:"body,omitempty" cborgen:"body,omitempty"`
+	CreatedAt     string   `json:"createdAt" cborgen:"createdAt"`
+	Mentions      []string `json:"mentions,omitempty" cborgen:"mentions,omitempty"`
+	// patch: (deprecated) use patchBlob instead
+	Patch *string `json:"patch,omitempty" cborgen:"patch,omitempty"`
+	// patchBlob: patch content
+	PatchBlob  *util.LexBlob    `json:"patchBlob" cborgen:"patchBlob"`
+	References []string         `json:"references,omitempty" cborgen:"references,omitempty"`
+	Source     *RepoPull_Source `json:"source,omitempty" cborgen:"source,omitempty"`
+	Target     *RepoPull_Target `json:"target" cborgen:"target"`
+	Title      string           `json:"title" cborgen:"title"`
 }
 
 // RepoPull_Source is a "source" in the sh.tangled.repo.pull schema.

appview/commitverify/verify.go

···
 import (
 	"log"
 
-	"github.com/go-git/go-git/v5/plumbing/object"
 	"tangled.org/core/appview/db"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/crypto"
···
 	return ""
 }
 
-func GetVerifiedObjectCommits(e db.Execer, emailToDid map[string]string, commits []*object.Commit) (VerifiedCommits, error) {
-	ndCommits := []types.NiceDiff{}
-	for _, commit := range commits {
-		ndCommits = append(ndCommits, ObjectCommitToNiceDiff(commit))
-	}
-	return GetVerifiedCommits(e, emailToDid, ndCommits)
-}
-
-func GetVerifiedCommits(e db.Execer, emailToDid map[string]string, ndCommits []types.NiceDiff) (VerifiedCommits, error) {
+func GetVerifiedCommits(e db.Execer, emailToDid map[string]string, ndCommits []types.Commit) (VerifiedCommits, error) {
 	vcs := VerifiedCommits{}
 
 	didPubkeyCache := make(map[string][]models.PublicKey)
 
 	for _, commit := range ndCommits {
-		c := commit.Commit
-
-		committerEmail := c.Committer.Email
+		committerEmail := commit.Committer.Email
 		if did, exists := emailToDid[committerEmail]; exists {
 			// check if we've already fetched public keys for this did
 			pubKeys, ok := didPubkeyCache[did]
···
 			}
 
 			// try to verify with any associated pubkeys
+			payload := commit.Payload()
+			signature := commit.PGPSignature
 			for _, pk := range pubKeys {
-				if _, ok := crypto.VerifyCommitSignature(pk.Key, commit); ok {
+				if _, ok := crypto.VerifySignature([]byte(pk.Key), []byte(signature), []byte(payload)); ok {
 
 					fp, err := crypto.SSHFingerprint(pk.Key)
 					if err != nil {
 						log.Println("error computing ssh fingerprint:", err)
 					}
 
-					vc := verifiedCommit{fingerprint: fp, hash: c.This}
+					vc := verifiedCommit{fingerprint: fp, hash: commit.This}
 					vcs[vc] = struct{}{}
 					break
 				}
···
 
 	return vcs, nil
 }
-
-// ObjectCommitToNiceDiff is a compatibility function to convert a
-// commit object into a NiceDiff structure.
-func ObjectCommitToNiceDiff(c *object.Commit) types.NiceDiff {
-	var niceDiff types.NiceDiff
-
-	// set commit information
-	niceDiff.Commit.Message = c.Message
-	niceDiff.Commit.Author = c.Author
-	niceDiff.Commit.This = c.Hash.String()
-	niceDiff.Commit.Committer = c.Committer
-	niceDiff.Commit.Tree = c.TreeHash.String()
-	niceDiff.Commit.PGPSignature = c.PGPSignature
-
-	changeId, ok := c.ExtraHeaders["change-id"]
-	if ok {
-		niceDiff.Commit.ChangedId = string(changeId)
-	}
-
-	// set parent hash if available
-	if len(c.ParentHashes) > 0 {
-		niceDiff.Commit.Parent = c.ParentHashes[0].String()
-	}
-
-	// XXX: Stats and Diff fields are typically populated
-	// after fetching the actual diff information, which isn't
-	// directly available in the commit object itself.
-
-	return niceDiff
-}

appview/db/artifact.go

···
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/ipfs/go-cid"
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 func AddArtifact(e Execer, artifact models.Artifact) error {
···
 	return err
 }
 
-func GetArtifact(e Execer, filters ...filter) ([]models.Artifact, error) {
+func GetArtifact(e Execer, filters ...orm.Filter) ([]models.Artifact, error) {
 	var artifacts []models.Artifact
 
 	var conditions []string
···
 	return artifacts, nil
 }
 
-func DeleteArtifact(e Execer, filters ...filter) error {
+func DeleteArtifact(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {

appview/db/collaborators.go

···
 	"time"
 
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 func AddCollaborator(e Execer, c models.Collaborator) error {
···
 	return err
 }
 
-func DeleteCollaborator(e Execer, filters ...filter) error {
+func DeleteCollaborator(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 		return nil, nil
 	}
 
-	return GetRepos(e, 0, FilterIn("at_uri", repoAts))
+	return GetRepos(e, 0, orm.FilterIn("at_uri", repoAts))
 }
 
-func GetCollaborators(e Execer, filters ...filter) ([]models.Collaborator, error) {
+func GetCollaborators(e Execer, filters ...orm.Filter) ([]models.Collaborator, error) {
 	var collaborators []models.Collaborator
 	var conditions []string
 	var args []any

appview/db/db.go

···
 import (
 	"context"
 	"database/sql"
-	"fmt"
 	"log/slog"
-	"reflect"
 	"strings"
 
 	_ "github.com/mattn/go-sqlite3"
 	"tangled.org/core/log"
+	"tangled.org/core/orm"
 )
 
 type DB struct {
···
 	}
 
 	// run migrations
-	runMigration(conn, logger, "add-description-to-repos", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-description-to-repos", func(tx *sql.Tx) error {
 		tx.Exec(`
 			alter table repos add column description text check (length(description) <= 200);
 		`)
 		return nil
 	})
 
-	runMigration(conn, logger, "add-rkey-to-pubkeys", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-rkey-to-pubkeys", func(tx *sql.Tx) error {
 		// add unconstrained column
 		_, err := tx.Exec(`
 			alter table public_keys
···
 		return nil
 	})
 
-	runMigration(conn, logger, "add-rkey-to-comments", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-rkey-to-comments", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			alter table comments drop column comment_at;
 			alter table comments add column rkey text;
···
 		return err
 	})
 
-	runMigration(conn, logger, "add-deleted-and-edited-to-issue-comments", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-deleted-and-edited-to-issue-comments", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			alter table comments add column deleted text; -- timestamp
 			alter table comments add column edited text; -- timestamp
···
 		return err
 	})
 
-	runMigration(conn, logger, "add-source-info-to-pulls-and-submissions", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-source-info-to-pulls-and-submissions", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			alter table pulls add column source_branch text;
 			alter table pulls add column source_repo_at text;
···
 		return err
 	})
 
-	runMigration(conn, logger, "add-source-to-repos", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-source-to-repos", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			alter table repos add column source text;
 		`)
···
 	//
 	// [0]: https://sqlite.org/pragma.html#pragma_foreign_keys
 	conn.ExecContext(ctx, "pragma foreign_keys = off;")
-	runMigration(conn, logger, "recreate-pulls-column-for-stacking-support", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "recreate-pulls-column-for-stacking-support", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			create table pulls_new (
 				-- identifiers
···
 	})
 	conn.ExecContext(ctx, "pragma foreign_keys = on;")
 
-	runMigration(conn, logger, "add-spindle-to-repos", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-spindle-to-repos", func(tx *sql.Tx) error {
 		tx.Exec(`
 			alter table repos add column spindle text;
 		`)
···
 	// drop all knot secrets, add unique constraint to knots
 	//
 	// knots will henceforth use service auth for signed requests
-	runMigration(conn, logger, "no-more-secrets", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "no-more-secrets", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			create table registrations_new (
 				id integer primary key autoincrement,
···
 	})
 
 	// recreate and add rkey + created columns with default constraint
-	runMigration(conn, logger, "rework-collaborators-table", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "rework-collaborators-table", func(tx *sql.Tx) error {
 		// create new table
 		// - repo_at instead of repo integer
 		// - rkey field
···
 		return err
 	})
 
-	runMigration(conn, logger, "add-rkey-to-issues", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-rkey-to-issues", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			alter table issues add column rkey text not null default '';
 
···
 	})
 
 	// repurpose the read-only column to "needs-upgrade"
-	runMigration(conn, logger, "rename-registrations-read-only-to-needs-upgrade", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "rename-registrations-read-only-to-needs-upgrade", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			alter table registrations rename column read_only to needs_upgrade;
 		`)
···
 	})
 
 	// require all knots to upgrade after the release of total xrpc
-	runMigration(conn, logger, "migrate-knots-to-total-xrpc", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "migrate-knots-to-total-xrpc", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			update registrations set needs_upgrade = 1;
 		`)
···
 	})
 
 	// require all knots to upgrade after the release of total xrpc
-	runMigration(conn, logger, "migrate-spindles-to-xrpc-owner", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "migrate-spindles-to-xrpc-owner", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			alter table spindles add column needs_upgrade integer not null default 0;
 		`)
···
 	//
 	// disable foreign-keys for the next migration
 	conn.ExecContext(ctx, "pragma foreign_keys = off;")
-	runMigration(conn, logger, "remove-issue-at-from-issues", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "remove-issue-at-from-issues", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			create table if not exists issues_new (
 				-- identifiers
···
 	// - new columns
 	//   * column "reply_to" which can be any other comment
 	//   * column "at-uri" which is a generated column
-	runMigration(conn, logger, "rework-issue-comments", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "rework-issue-comments", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			create table if not exists issue_comments (
 				-- identifiers
···
 	//
 	// disable foreign-keys for the next migration
 	conn.ExecContext(ctx, "pragma foreign_keys = off;")
-	runMigration(conn, logger, "add-at-uri-to-pulls", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-at-uri-to-pulls", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 		create table if not exists pulls_new (
 			-- identifiers
···
 	//
 	// disable foreign-keys for the next migration
 	conn.ExecContext(ctx, "pragma foreign_keys = off;")
-	runMigration(conn, logger, "remove-repo-at-pull-id-from-pull-submissions", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "remove-repo-at-pull-id-from-pull-submissions", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 		create table if not exists pull_submissions_new (
 			-- identifiers
···
 
 	// knots may report the combined patch for a comparison, we can store that on the appview side
 	// (but not on the pds record), because calculating the combined patch requires a git index
-	runMigration(conn, logger, "add-combined-column-submissions", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-combined-column-submissions", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			alter table pull_submissions add column combined text;
 		`)
 		return err
 	})
 
-	runMigration(conn, logger, "add-pronouns-profile", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-pronouns-profile", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			alter table profile add column pronouns text;
 		`)
 		return err
 	})
 
-	runMigration(conn, logger, "add-meta-column-repos", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-meta-column-repos", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			alter table repos add column website text;
 			alter table repos add column topics text;
···
 		return err
 	})
 
-	runMigration(conn, logger, "add-usermentioned-preference", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "add-usermentioned-preference", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			alter table notification_preferences add column user_mentioned integer not null default 1;
 		`)
···
 	})
 
 	// remove the foreign key constraints from stars.
-	runMigration(conn, logger, "generalize-stars-subject", func(tx *sql.Tx) error {
+	orm.RunMigration(conn, logger, "generalize-stars-subject", func(tx *sql.Tx) error {
 		_, err := tx.Exec(`
 			create table stars_new (
 				id integer primary key autoincrement,
···
 	}, nil
 }
 
-type migrationFn = func(*sql.Tx) error
-
-func runMigration(c *sql.Conn, logger *slog.Logger, name string, migrationFn migrationFn) error {
-	logger = logger.With("migration", name)
-
-	tx, err := c.BeginTx(context.Background(), nil)
-	if err != nil {
-		return err
-	}
-	defer tx.Rollback()
-
-	var exists bool
-	err = tx.QueryRow("select exists (select 1 from migrations where name = ?)", name).Scan(&exists)
-	if err != nil {
-		return err
-	}
-
-	if !exists {
-		// run migration
-		err = migrationFn(tx)
-		if err != nil {
-			logger.Error("failed to run migration", "err", err)
-			return err
-		}
-
-		// mark migration as complete
-		_, err = tx.Exec("insert into migrations (name) values (?)", name)
-		if err != nil {
-			logger.Error("failed to mark migration as complete", "err", err)
-			return err
-		}
-
-		// commit the transaction
-		if err := tx.Commit(); err != nil {
-			return err
-		}
-
-		logger.Info("migration applied successfully")
-	} else {
-		logger.Warn("skipped migration, already applied")
-	}
-
-	return nil
-}
-
 func (d *DB) Close() error {
 	return d.DB.Close()
 }
-
-type filter struct {
-	key string
-	arg any
-	cmp string
-}
-
-func newFilter(key, cmp string, arg any) filter {
-	return filter{
-		key: key,
-		arg: arg,
-		cmp: cmp,
-	}
-}
-
-func FilterEq(key string, arg any) filter      { return newFilter(key, "=", arg) }
-func FilterNotEq(key string, arg any) filter   { return newFilter(key, "<>", arg) }
-func FilterGte(key string, arg any) filter     { return newFilter(key, ">=", arg) }
-func FilterLte(key string, arg any) filter     { return newFilter(key, "<=", arg) }
-func FilterIs(key string, arg any) filter      { return newFilter(key, "is", arg) }
-func FilterIsNot(key string, arg any) filter   { return newFilter(key, "is not", arg) }
-func FilterIn(key string, arg any) filter      { return newFilter(key, "in", arg) }
-func FilterLike(key string, arg any) filter    { return newFilter(key, "like", arg) }
-func FilterNotLike(key string, arg any) filter { return newFilter(key, "not like", arg) }
-func FilterContains(key string, arg any) filter {
-	return newFilter(key, "like", fmt.Sprintf("%%%v%%", arg))
-}
-
-func (f filter) Condition() string {
-	rv := reflect.ValueOf(f.arg)
-	kind := rv.Kind()
-
-	// if we have `FilterIn(k, [1, 2, 3])`, compile it down to `k in (?, ?, ?)`
-	if (kind == reflect.Slice && rv.Type().Elem().Kind() != reflect.Uint8) || kind == reflect.Array {
-		if rv.Len() == 0 {
-			// always false
-			return "1 = 0"
-		}
-
-		placeholders := make([]string, rv.Len())
-		for i := range placeholders {
-			placeholders[i] = "?"
-		}
-
-		return fmt.Sprintf("%s %s (%s)", f.key, f.cmp, strings.Join(placeholders, ", "))
-	}
-
-	return fmt.Sprintf("%s %s ?", f.key, f.cmp)
-}
-
-func (f filter) Arg() []any {
-	rv := reflect.ValueOf(f.arg)
-	kind := rv.Kind()
-	if (kind == reflect.Slice && rv.Type().Elem().Kind() != reflect.Uint8) || kind == reflect.Array {
-		if rv.Len() == 0 {
-			return nil
-		}
-
-		out := make([]any, rv.Len())
-		for i := range rv.Len() {
-			out[i] = rv.Index(i).Interface()
-		}
-		return out
-	}
-
-	return []any{f.arg}
-}

appview/db/follow.go

···
 	"time"
 
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 func AddFollow(e Execer, follow *models.Follow) error {
···
 	return result, nil
 }
 
-func GetFollows(e Execer, limit int, filters ...filter) ([]models.Follow, error) {
+func GetFollows(e Execer, limit int, filters ...orm.Filter) ([]models.Follow, error) {
 	var follows []models.Follow
 
 	var conditions []string
···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var follow models.Follow
 		var followedAt string
···
 }
 
 func GetFollowers(e Execer, did string) ([]models.Follow, error) {
-	return GetFollows(e, 0, FilterEq("subject_did", did))
+	return GetFollows(e, 0, orm.FilterEq("subject_did", did))
 }
 
 func GetFollowing(e Execer, did string) ([]models.Follow, error) {
-	return GetFollows(e, 0, FilterEq("user_did", did))
+	return GetFollows(e, 0, orm.FilterEq("user_did", did))
 }
 
 func getFollowStatuses(e Execer, userDid string, subjectDids []string) (map[string]models.FollowStatus, error) {

appview/db/issues.go

···
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/pagination"
+	"tangled.org/core/orm"
 )
 
 func PutIssue(tx *sql.Tx, issue *models.Issue) error {
···
 
 	issues, err := GetIssues(
 		tx,
-		FilterEq("did", issue.Did),
-		FilterEq("rkey", issue.Rkey),
+		orm.FilterEq("did", issue.Did),
+		orm.FilterEq("rkey", issue.Rkey),
 	)
 	switch {
 	case err != nil:
···
 	return nil
 }
 
-func GetIssuesPaginated(e Execer, page pagination.Page, filters ...filter) ([]models.Issue, error) {
+func GetIssuesPaginated(e Execer, page pagination.Page, filters ...orm.Filter) ([]models.Issue, error) {
 	issueMap := make(map[string]*models.Issue) // at-uri -> issue
 
 	var conditions []string
···
 		whereClause = " where " + strings.Join(conditions, " and ")
 	}
 
-	pLower := FilterGte("row_num", page.Offset+1)
-	pUpper := FilterLte("row_num", page.Offset+page.Limit)
+	pLower := orm.FilterGte("row_num", page.Offset+1)
+	pUpper := orm.FilterLte("row_num", page.Offset+page.Limit)
 
 	pageClause := ""
 	if page.Limit > 0 {
···
 		repoAts = append(repoAts, string(issue.RepoAt))
 	}
 
-	repos, err := GetRepos(e, 0, FilterIn("at_uri", repoAts))
+	repos, err := GetRepos(e, 0, orm.FilterIn("at_uri", repoAts))
 	if err != nil {
 		return nil, fmt.Errorf("failed to build repo mappings: %w", err)
 	}
···
 	// collect comments
 	issueAts := slices.Collect(maps.Keys(issueMap))
 
-	comments, err := GetIssueComments(e, FilterIn("issue_at", issueAts))
+	comments, err := GetIssueComments(e, orm.FilterIn("issue_at", issueAts))
 	if err != nil {
 		return nil, fmt.Errorf("failed to query comments: %w", err)
 	}
···
 	}
 
 	// collect allLabels for each issue
-	allLabels, err := GetLabels(e, FilterIn("subject", issueAts))
+	allLabels, err := GetLabels(e, orm.FilterIn("subject", issueAts))
 	if err != nil {
 		return nil, fmt.Errorf("failed to query labels: %w", err)
 	}
···
 	}
 
 	// collect references for each issue
-	allReferencs, err := GetReferencesAll(e, FilterIn("from_at", issueAts))
+	allReferencs, err := GetReferencesAll(e, orm.FilterIn("from_at", issueAts))
 	if err != nil {
 		return nil, fmt.Errorf("failed to query reference_links: %w", err)
 	}
···
 	issues, err := GetIssuesPaginated(
 		e,
 		pagination.Page{},
-		FilterEq("repo_at", repoAt),
-		FilterEq("issue_id", issueId),
+		orm.FilterEq("repo_at", repoAt),
+		orm.FilterEq("issue_id", issueId),
 	)
 	if err != nil {
 		return nil, err
···
 	return &issues[0], nil
 }
 
-func GetIssues(e Execer, filters ...filter) ([]models.Issue, error) {
+func GetIssues(e Execer, filters ...orm.Filter) ([]models.Issue, error) {
 	return GetIssuesPaginated(e, pagination.Page{}, filters...)
 }
 
···
 func GetIssueIDs(e Execer, opts models.IssueSearchOptions) ([]int64, error) {
 	var ids []int64
 
-	var filters []filter
+	var filters []orm.Filter
 	openValue := 0
 	if opts.IsOpen {
 		openValue = 1
 	}
-	filters = append(filters, FilterEq("open", openValue))
+	filters = append(filters, orm.FilterEq("open", openValue))
 	if opts.RepoAt != "" {
-		filters = append(filters, FilterEq("repo_at", opts.RepoAt))
+		filters = append(filters, orm.FilterEq("repo_at", opts.RepoAt))
 	}
 
 	var conditions []string
···
 	return id, nil
 }
 
-func DeleteIssueComments(e Execer, filters ...filter) error {
+func DeleteIssueComments(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	return err
 }
 
-func GetIssueComments(e Execer, filters ...filter) ([]models.IssueComment, error) {
+func GetIssueComments(e Execer, filters ...orm.Filter) ([]models.IssueComment, error) {
 	commentMap := make(map[string]*models.IssueComment)
 
 	var conditions []string
···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
 
 	for rows.Next() {
 		var comment models.IssueComment
···
 
 	// collect references for each comments
 	commentAts := slices.Collect(maps.Keys(commentMap))
-	allReferencs, err := GetReferencesAll(e, FilterIn("from_at", commentAts))
+	allReferencs, err := GetReferencesAll(e, orm.FilterIn("from_at", commentAts))
 	if err != nil {
 		return nil, fmt.Errorf("failed to query reference_links: %w", err)
 	}
···
 	return nil
 }
 
-func CloseIssues(e Execer, filters ...filter) error {
+func CloseIssues(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	return err
 }
 
-func ReopenIssues(e Execer, filters ...filter) error {
+func ReopenIssues(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {

appview/db/label.go

···
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 // no updating type for now
···
 	return id, nil
 }
 
-func DeleteLabelDefinition(e Execer, filters ...filter) error {
+func DeleteLabelDefinition(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	return err
 }
 
-func GetLabelDefinitions(e Execer, filters ...filter) ([]models.LabelDefinition, error) {
+func GetLabelDefinitions(e Execer, filters ...orm.Filter) ([]models.LabelDefinition, error) {
 	var labelDefinitions []models.LabelDefinition
 	var conditions []string
 	var args []any
···
 }
 
 // helper to get exactly one label def
-func GetLabelDefinition(e Execer, filters ...filter) (*models.LabelDefinition, error) {
+func GetLabelDefinition(e Execer, filters ...orm.Filter) (*models.LabelDefinition, error) {
 	labels, err := GetLabelDefinitions(e, filters...)
 	if err != nil {
 		return nil, err
···
 	return id, nil
 }
 
-func GetLabelOps(e Execer, filters ...filter) ([]models.LabelOp, error) {
+func GetLabelOps(e Execer, filters ...orm.Filter) ([]models.LabelOp, error) {
 	var labelOps []models.LabelOp
 	var conditions []string
 	var args []any
···
 }
 
 // get labels for a given list of subject URIs
-func GetLabels(e Execer, filters ...filter) (map[syntax.ATURI]models.LabelState, error) {
+func GetLabels(e Execer, filters ...orm.Filter) (map[syntax.ATURI]models.LabelState, error) {
 	ops, err := GetLabelOps(e, filters...)
 	if err != nil {
 		return nil, err
···
 	}
 	labelAts := slices.Collect(maps.Keys(labelAtSet))
 
-	actx, err := NewLabelApplicationCtx(e, FilterIn("at_uri", labelAts))
+	actx, err := NewLabelApplicationCtx(e, orm.FilterIn("at_uri", labelAts))
 	if err != nil {
 		return nil, err
 	}
···
 	return results, nil
 }
 
-func NewLabelApplicationCtx(e Execer, filters ...filter) (*models.LabelApplicationCtx, error) {
+func NewLabelApplicationCtx(e Execer, filters ...orm.Filter) (*models.LabelApplicationCtx, error) {
 	labels, err := GetLabelDefinitions(e, filters...)
 	if err != nil {
 		return nil, err

appview/db/language.go

···
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
-func GetRepoLanguages(e Execer, filters ...filter) ([]models.RepoLanguage, error) {
+func GetRepoLanguages(e Execer, filters ...orm.Filter) ([]models.RepoLanguage, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 		whereClause,
 	)
 	rows, err := e.Query(query, args...)
-
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute query: %w ", err)
 	}
+	defer rows.Close()
 
 	var langs []models.RepoLanguage
 	for rows.Next() {
···
 	return nil
 }
 
-func DeleteRepoLanguages(e Execer, filters ...filter) error {
+func DeleteRepoLanguages(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 func UpdateRepoLanguages(tx *sql.Tx, repoAt syntax.ATURI, ref string, langs []models.RepoLanguage) error {
 	err := DeleteRepoLanguages(
 		tx,
-		FilterEq("repo_at", repoAt),
-		FilterEq("ref", ref),
+		orm.FilterEq("repo_at", repoAt),
+		orm.FilterEq("ref", ref),
 	)
 	if err != nil {
 		return fmt.Errorf("failed to delete existing languages: %w", err)

appview/db/notifications.go

···
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/pagination"
+	"tangled.org/core/orm"
 )
 
 func CreateNotification(e Execer, notification *models.Notification) error {
···
 }
 
 // GetNotificationsPaginated retrieves notifications with filters and pagination
-func GetNotificationsPaginated(e Execer, page pagination.Page, filters ...filter) ([]*models.Notification, error) {
+func GetNotificationsPaginated(e Execer, page pagination.Page, filters ...orm.Filter) ([]*models.Notification, error) {
 	var conditions []string
 	var args []any
 
···
 }
 
 // GetNotificationsWithEntities retrieves notifications with their related entities
-func GetNotificationsWithEntities(e Execer, page pagination.Page, filters ...filter) ([]*models.NotificationWithEntity, error) {
+func GetNotificationsWithEntities(e Execer, page pagination.Page, filters ...orm.Filter) ([]*models.NotificationWithEntity, error) {
 	var conditions []string
 	var args []any
 
···
 }
 
 // GetNotifications retrieves notifications with filters
-func GetNotifications(e Execer, filters ...filter) ([]*models.Notification, error) {
+func GetNotifications(e Execer, filters ...orm.Filter) ([]*models.Notification, error) {
 	return GetNotificationsPaginated(e, pagination.FirstPage(), filters...)
 }
 
-func CountNotifications(e Execer, filters ...filter) (int64, error) {
+func CountNotifications(e Execer, filters ...orm.Filter) (int64, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 }
 
 func MarkNotificationRead(e Execer, notificationID int64, userDID string) error {
-	idFilter := FilterEq("id", notificationID)
-	recipientFilter := FilterEq("recipient_did", userDID)
+	idFilter := orm.FilterEq("id", notificationID)
+	recipientFilter := orm.FilterEq("recipient_did", userDID)
 
 	query := fmt.Sprintf(`
 		UPDATE notifications
···
 }
 
 func MarkAllNotificationsRead(e Execer, userDID string) error {
-	recipientFilter := FilterEq("recipient_did", userDID)
-	readFilter := FilterEq("read", 0)
+	recipientFilter := orm.FilterEq("recipient_did", userDID)
+	readFilter := orm.FilterEq("read", 0)
 
 	query := fmt.Sprintf(`
 		UPDATE notifications
···
 }
 
 func DeleteNotification(e Execer, notificationID int64, userDID string) error {
-	idFilter := FilterEq("id", notificationID)
-	recipientFilter := FilterEq("recipient_did", userDID)
+	idFilter := orm.FilterEq("id", notificationID)
+	recipientFilter := orm.FilterEq("recipient_did", userDID)
 
 	query := fmt.Sprintf(`
 		DELETE FROM notifications
···
 }
 
 func GetNotificationPreference(e Execer, userDid string) (*models.NotificationPreferences, error) {
-	prefs, err := GetNotificationPreferences(e, FilterEq("user_did", userDid))
+	prefs, err := GetNotificationPreferences(e, orm.FilterEq("user_did", userDid))
 	if err != nil {
 		return nil, err
 	}
···
 	return p, nil
 }
 
-func GetNotificationPreferences(e Execer, filters ...filter) (map[syntax.DID]*models.NotificationPreferences, error) {
+func GetNotificationPreferences(e Execer, filters ...orm.Filter) (map[syntax.DID]*models.NotificationPreferences, error) {
 	prefsMap := make(map[syntax.DID]*models.NotificationPreferences)
 
 	var conditions []string
···
 
 func (d *DB) ClearOldNotifications(ctx context.Context, olderThan time.Duration) error {
 	cutoff := time.Now().Add(-olderThan)
-	createdFilter := FilterLte("created", cutoff)
+	createdFilter := orm.FilterLte("created", cutoff)
 
 	query := fmt.Sprintf(`
 		DELETE FROM notifications

appview/db/pipeline.go

···
 	"time"
 
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
-func GetPipelines(e Execer, filters ...filter) ([]models.Pipeline, error) {
+func GetPipelines(e Execer, filters ...orm.Filter) ([]models.Pipeline, error) {
 	var pipelines []models.Pipeline
 
 	var conditions []string
···
 
 // this is a mega query, but the most useful one:
 // get N pipelines, for each one get the latest status of its N workflows
-func GetPipelineStatuses(e Execer, limit int, filters ...filter) ([]models.Pipeline, error) {
+func GetPipelineStatuses(e Execer, limit int, filters ...orm.Filter) ([]models.Pipeline, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
-		filter.key = "p." + filter.key // the table is aliased in the query to `p`
+		filter.Key = "p." + filter.Key // the table is aliased in the query to `p`
 		conditions = append(conditions, filter.Condition())
 		args = append(args, filter.Arg()...)
 	}
···
 	conditions = nil
 	args = nil
 	for _, p := range pipelines {
-		knotFilter := FilterEq("pipeline_knot", p.Knot)
-		rkeyFilter := FilterEq("pipeline_rkey", p.Rkey)
+		knotFilter := orm.FilterEq("pipeline_knot", p.Knot)
+		rkeyFilter := orm.FilterEq("pipeline_rkey", p.Rkey)
 		conditions = append(conditions, fmt.Sprintf("(%s and %s)", knotFilter.Condition(), rkeyFilter.Condition()))
 		args = append(args, p.Knot)
 		args = append(args, p.Rkey)

appview/db/profile.go

···
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 const TimeframeMonths = 7
···
 	timeline := models.ProfileTimeline{
 		ByMonth: make([]models.ByMonth, TimeframeMonths),
 	}
-	currentMonth := time.Now().Month()
+	now := time.Now()
 	timeframe := fmt.Sprintf("-%d months", TimeframeMonths)
 
 	pulls, err := GetPullsByOwnerDid(e, forDid, timeframe)
···
 
 	// group pulls by month
 	for _, pull := range pulls {
-		pullMonth := pull.Created.Month()
+		monthsAgo := monthsBetween(pull.Created, now)
 
-		if currentMonth-pullMonth >= TimeframeMonths {
+		if monthsAgo >= TimeframeMonths {
 			// shouldn't happen; but times are weird
 			continue
 		}
 
-		idx := currentMonth - pullMonth
+		idx := monthsAgo
 		items := &timeline.ByMonth[idx].PullEvents.Items
 
 		*items = append(*items, &pull)
···
 
 	issues, err := GetIssues(
 		e,
-		FilterEq("did", forDid),
-		FilterGte("created", time.Now().AddDate(0, -TimeframeMonths, 0)),
+		orm.FilterEq("did", forDid),
+		orm.FilterGte("created", time.Now().AddDate(0, -TimeframeMonths, 0)),
 	)
 	if err != nil {
 		return nil, fmt.Errorf("error getting issues by owner did: %w", err)
 	}
 
 	for _, issue := range issues {
-		issueMonth := issue.Created.Month()
+		monthsAgo := monthsBetween(issue.Created, now)
 
-		if currentMonth-issueMonth >= TimeframeMonths {
+		if monthsAgo >= TimeframeMonths {
 			// shouldn't happen; but times are weird
 			continue
 		}
 
-		idx := currentMonth - issueMonth
+		idx := monthsAgo
 		items := &timeline.ByMonth[idx].IssueEvents.Items
 
 		*items = append(*items, &issue)
 	}
 
-	repos, err := GetRepos(e, 0, FilterEq("did", forDid))
+	repos, err := GetRepos(e, 0, orm.FilterEq("did", forDid))
 	if err != nil {
 		return nil, fmt.Errorf("error getting all repos by did: %w", err)
 	}
···
 		if repo.Source != "" {
 			sourceRepo, err = GetRepoByAtUri(e, repo.Source)
 			if err != nil {
-				return nil, err
+				// the source repo was not found, skip this bit
+				log.Println("profile", "err", err)
 			}
 		}
 
-		repoMonth := repo.Created.Month()
+		monthsAgo := monthsBetween(repo.Created, now)
 
-		if currentMonth-repoMonth >= TimeframeMonths {
+		if monthsAgo >= TimeframeMonths {
 			// shouldn't happen; but times are weird
 			continue
 		}
 
-		idx := currentMonth - repoMonth
+		idx := monthsAgo
 
 		items := &timeline.ByMonth[idx].RepoEvents
 		*items = append(*items, models.RepoEvent{
···
 	return &timeline, nil
 }
 
+func monthsBetween(from, to time.Time) int {
+	years := to.Year() - from.Year()
+	months := int(to.Month() - from.Month())
+	return years*12 + months
+}
+
 func UpsertProfile(tx *sql.Tx, profile *models.Profile) error {
 	defer tx.Rollback()
 
···
 	return tx.Commit()
 }
 
-func GetProfiles(e Execer, filters ...filter) (map[string]*models.Profile, error) {
+func GetProfiles(e Execer, filters ...orm.Filter) (map[string]*models.Profile, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
 
 	profileMap := make(map[string]*models.Profile)
 	for rows.Next() {
···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
+
 	idxs := make(map[string]int)
 	for did := range profileMap {
 		idxs[did] = 0
···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
+
 	idxs = make(map[string]int)
 	for did := range profileMap {
 		idxs[did] = 0
···
 	}
 
 	// ensure all pinned repos are either own repos or collaborating repos
-	repos, err := GetRepos(e, 0, FilterEq("did", profile.Did))
+	repos, err := GetRepos(e, 0, orm.FilterEq("did", profile.Did))
 	if err != nil {
 		log.Printf("getting repos for %s: %s", profile.Did, err)
 	}

appview/db/pulls.go

···
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 func NewPull(tx *sql.Tx, pull *models.Pull) error {
···
 	return pullId - 1, err
 }
 
-func GetPullsWithLimit(e Execer, limit int, filters ...filter) ([]*models.Pull, error) {
+func GetPullsWithLimit(e Execer, limit int, filters ...orm.Filter) ([]*models.Pull, error) {
 	pulls := make(map[syntax.ATURI]*models.Pull)
 
 	var conditions []string
···
 	for _, p := range pulls {
 		pullAts = append(pullAts, p.AtUri())
 	}
-	submissionsMap, err := GetPullSubmissions(e, FilterIn("pull_at", pullAts))
+	submissionsMap, err := GetPullSubmissions(e, orm.FilterIn("pull_at", pullAts))
 	if err != nil {
 		return nil, fmt.Errorf("failed to get submissions: %w", err)
 	}
···
 	}
 
 	// collect allLabels for each issue
-	allLabels, err := GetLabels(e, FilterIn("subject", pullAts))
+	allLabels, err := GetLabels(e, orm.FilterIn("subject", pullAts))
 	if err != nil {
 		return nil, fmt.Errorf("failed to query labels: %w", err)
 	}
···
 			sourceAts = append(sourceAts, *p.PullSource.RepoAt)
 		}
 	}
-	sourceRepos, err := GetRepos(e, 0, FilterIn("at_uri", sourceAts))
+	sourceRepos, err := GetRepos(e, 0, orm.FilterIn("at_uri", sourceAts))
 	if err != nil && !errors.Is(err, sql.ErrNoRows) {
 		return nil, fmt.Errorf("failed to get source repos: %w", err)
 	}
···
 		}
 	}
 
-	allReferences, err := GetReferencesAll(e, FilterIn("from_at", pullAts))
+	allReferences, err := GetReferencesAll(e, orm.FilterIn("from_at", pullAts))
 	if err != nil {
 		return nil, fmt.Errorf("failed to query reference_links: %w", err)
 	}
···
 	return orderedByPullId, nil
 }
 
-func GetPulls(e Execer, filters ...filter) ([]*models.Pull, error) {
+func GetPulls(e Execer, filters ...orm.Filter) ([]*models.Pull, error) {
 	return GetPullsWithLimit(e, 0, filters...)
 }
 
 func GetPullIDs(e Execer, opts models.PullSearchOptions) ([]int64, error) {
 	var ids []int64
 
-	var filters []filter
-	filters = append(filters, FilterEq("state", opts.State))
+	var filters []orm.Filter
+	filters = append(filters, orm.FilterEq("state", opts.State))
 	if opts.RepoAt != "" {
-		filters = append(filters, FilterEq("repo_at", opts.RepoAt))
+		filters = append(filters, orm.FilterEq("repo_at", opts.RepoAt))
 	}
 
 	var conditions []string
···
 }
 
 func GetPull(e Execer, repoAt syntax.ATURI, pullId int) (*models.Pull, error) {
-	pulls, err := GetPullsWithLimit(e, 1, FilterEq("repo_at", repoAt), FilterEq("pull_id", pullId))
+	pulls, err := GetPullsWithLimit(e, 1, orm.FilterEq("repo_at", repoAt), orm.FilterEq("pull_id", pullId))
 	if err != nil {
 		return nil, err
 	}
···
 }
 
 // mapping from pull -> pull submissions
-func GetPullSubmissions(e Execer, filters ...filter) (map[syntax.ATURI][]*models.PullSubmission, error) {
+func GetPullSubmissions(e Execer, filters ...orm.Filter) (map[syntax.ATURI][]*models.PullSubmission, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 
 	// Get comments for all submissions using GetPullComments
 	submissionIds := slices.Collect(maps.Keys(submissionMap))
-	comments, err := GetPullComments(e, FilterIn("submission_id", submissionIds))
+	comments, err := GetPullComments(e, orm.FilterIn("submission_id", submissionIds))
 	if err != nil {
 		return nil, fmt.Errorf("failed to get pull comments: %w", err)
 	}
···
 	return m, nil
 }
 
-func GetPullComments(e Execer, filters ...filter) ([]models.PullComment, error) {
+func GetPullComments(e Execer, filters ...orm.Filter) ([]models.PullComment, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 
 	// collect references for each comments
 	commentAts := slices.Collect(maps.Keys(commentMap))
-	allReferencs, err := GetReferencesAll(e, FilterIn("from_at", commentAts))
+	allReferencs, err := GetReferencesAll(e, orm.FilterIn("from_at", commentAts))
 	if err != nil {
 		return nil, fmt.Errorf("failed to query reference_links: %w", err)
 	}
···
 	return err
 }
 
-func SetPullParentChangeId(e Execer, parentChangeId string, filters ...filter) error {
+func SetPullParentChangeId(e Execer, parentChangeId string, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 
···
 
 // Only used when stacking to update contents in the event of a rebase (the interdiff should be empty).
 // otherwise submissions are immutable
-func UpdatePull(e Execer, newPatch, sourceRev string, filters ...filter) error {
+func UpdatePull(e Execer, newPatch, sourceRev string, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 
···
 func GetStack(e Execer, stackId string) (models.Stack, error) {
 	unorderedPulls, err := GetPulls(
 		e,
-		FilterEq("stack_id", stackId),
-		FilterNotEq("state", models.PullDeleted),
+		orm.FilterEq("stack_id", stackId),
+		orm.FilterNotEq("state", models.PullDeleted),
 	)
 	if err != nil {
 		return nil, err
···
 func GetAbandonedPulls(e Execer, stackId string) ([]*models.Pull, error) {
 	pulls, err := GetPulls(
 		e,
-		FilterEq("stack_id", stackId),
-		FilterEq("state", models.PullDeleted),
+		orm.FilterEq("stack_id", stackId),
+		orm.FilterEq("state", models.PullDeleted),
 	)
 	if err != nil {
 		return nil, err

appview/db/punchcard.go

···
 	"time"
 
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 // this adds to the existing count
···
 	return err
 }
 
-func MakePunchcard(e Execer, filters ...filter) (*models.Punchcard, error) {
+func MakePunchcard(e Execer, filters ...orm.Filter) (*models.Punchcard, error) {
 	punchcard := &models.Punchcard{}
 	now := time.Now()
 	startOfYear := time.Date(now.Year(), 1, 1, 0, 0, 0, 0, time.UTC)
···
 			punch.Count = int(count.Int64)
 		}
 
-		punchcard.Punches[punch.Date.YearDay()] = punch
+		punchcard.Punches[punch.Date.YearDay()-1] = punch
 		punchcard.Total += punch.Count
 	}
 

appview/db/reference.go

···
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 // ValidateReferenceLinks resolves refLinks to Issue/PR/IssueComment/PullComment ATURIs.
···
 	return err
 }
 
-func GetReferencesAll(e Execer, filters ...filter) (map[syntax.ATURI][]syntax.ATURI, error) {
+func GetReferencesAll(e Execer, filters ...orm.Filter) (map[syntax.ATURI][]syntax.ATURI, error) {
 	var (
 		conditions []string
 		args       []any
···
 	if len(aturis) == 0 {
 		return nil, nil
 	}
-	filter := FilterIn("c.at_uri", aturis)
+	filter := orm.FilterIn("c.at_uri", aturis)
 	rows, err := e.Query(
 		fmt.Sprintf(
 			`select r.did, r.name, i.issue_id, c.id, i.title, i.open
···
 	if len(aturis) == 0 {
 		return nil, nil
 	}
-	filter := FilterIn("c.comment_at", aturis)
+	filter := orm.FilterIn("c.comment_at", aturis)
 	rows, err := e.Query(
 		fmt.Sprintf(
 			`select r.did, r.name, p.pull_id, c.id, p.title, p.state

appview/db/registration.go

···
 	"time"
 
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
-func GetRegistrations(e Execer, filters ...filter) ([]models.Registration, error) {
+func GetRegistrations(e Execer, filters ...orm.Filter) ([]models.Registration, error) {
 	var registrations []models.Registration
 
 	var conditions []string
···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
 
 	for rows.Next() {
 		var createdAt string
···
 	return registrations, nil
 }
 
-func MarkRegistered(e Execer, filters ...filter) error {
+func MarkRegistered(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	return err
 }
 
-func DeleteKnot(e Execer, filters ...filter) error {
+func DeleteKnot(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {

appview/db/repos.go

···
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
-func GetRepos(e Execer, limit int, filters ...filter) ([]models.Repo, error) {
+func GetRepos(e Execer, limit int, filters ...orm.Filter) ([]models.Repo, error) {
 	repoMap := make(map[syntax.ATURI]*models.Repo)
 
 	var conditions []string
···
 		limitClause,
 	)
 	rows, err := e.Query(repoQuery, args...)
-
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute repo query: %w ", err)
 	}
+	defer rows.Close()
 
 	for rows.Next() {
 		var repo models.Repo
···
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute labels query: %w ", err)
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var repoat, labelat string
 		if err := rows.Scan(&repoat, &labelat); err != nil {
···
 			from repo_languages
 			where repo_at in (%s)
 			and is_default_ref = 1
+			and language <> ''
 		)
 		where rn = 1
 		`,
···
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute lang query: %w ", err)
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var repoat, lang string
 		if err := rows.Scan(&repoat, &lang); err != nil {
···
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute star-count query: %w ", err)
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var repoat string
 		var count int
···
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute issue-count query: %w ", err)
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var repoat string
 		var open, closed int
···
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute pulls-count query: %w ", err)
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var repoat string
 		var open, merged, closed, deleted int
···
 }
 
 // helper to get exactly one repo
-func GetRepo(e Execer, filters ...filter) (*models.Repo, error) {
+func GetRepo(e Execer, filters ...orm.Filter) (*models.Repo, error) {
 	repos, err := GetRepos(e, 0, filters...)
 	if err != nil {
 		return nil, err
···
 	return &repos[0], nil
 }
 
-func CountRepos(e Execer, filters ...filter) (int64, error) {
+func CountRepos(e Execer, filters ...orm.Filter) (int64, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	return err
 }
 
-func UnsubscribeLabel(e Execer, filters ...filter) error {
+func UnsubscribeLabel(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	return err
 }
 
-func GetRepoLabels(e Execer, filters ...filter) ([]models.RepoLabel, error) {
+func GetRepoLabels(e Execer, filters ...orm.Filter) ([]models.RepoLabel, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {

appview/db/spindle.go

···
 	"time"
 
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
-func GetSpindles(e Execer, filters ...filter) ([]models.Spindle, error) {
+func GetSpindles(e Execer, filters ...orm.Filter) ([]models.Spindle, error) {
 	var spindles []models.Spindle
 
 	var conditions []string
···
 	return err
 }
 
-func VerifySpindle(e Execer, filters ...filter) (int64, error) {
+func VerifySpindle(e Execer, filters ...orm.Filter) (int64, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	return res.RowsAffected()
 }
 
-func DeleteSpindle(e Execer, filters ...filter) error {
+func DeleteSpindle(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	return err
 }
 
-func RemoveSpindleMember(e Execer, filters ...filter) error {
+func RemoveSpindleMember(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	return err
 }
 
-func GetSpindleMembers(e Execer, filters ...filter) ([]models.SpindleMember, error) {
+func GetSpindleMembers(e Execer, filters ...orm.Filter) ([]models.SpindleMember, error) {
 	var members []models.SpindleMember
 
 	var conditions []string

appview/db/star.go

···
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 func AddStar(e Execer, star *models.Star) error {
···
 
 // GetRepoStars return a list of stars each holding target repository.
 // If there isn't known repo with starred at-uri, those stars will be ignored.
-func GetRepoStars(e Execer, limit int, filters ...filter) ([]models.RepoStar, error) {
+func GetRepoStars(e Execer, limit int, filters ...orm.Filter) ([]models.RepoStar, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
 
 	starMap := make(map[string][]models.Star)
 	for rows.Next() {
···
 		return nil, nil
 	}
 
-	repos, err := GetRepos(e, 0, FilterIn("at_uri", args))
+	repos, err := GetRepos(e, 0, orm.FilterIn("at_uri", args))
 	if err != nil {
 		return nil, err
 	}
···
 	return repoStars, nil
 }
 
-func CountStars(e Execer, filters ...filter) (int64, error) {
+func CountStars(e Execer, filters ...orm.Filter) (int64, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	}
 
 	// get full repo data
-	repos, err := GetRepos(e, 0, FilterIn("at_uri", repoUris))
+	repos, err := GetRepos(e, 0, orm.FilterIn("at_uri", repoUris))
 	if err != nil {
 		return nil, err
 	}

appview/db/strings.go

···
 	"time"
 
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 func AddString(e Execer, s models.String) error {
···
 	return err
 }
 
-func GetStrings(e Execer, limit int, filters ...filter) ([]models.String, error) {
+func GetStrings(e Execer, limit int, filters ...orm.Filter) ([]models.String, error) {
 	var all []models.String
 
 	var conditions []string
···
 	return all, nil
 }
 
-func CountStrings(e Execer, filters ...filter) (int64, error) {
+func CountStrings(e Execer, filters ...orm.Filter) (int64, error) {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {
···
 	return count, nil
 }
 
-func DeleteString(e Execer, filters ...filter) error {
+func DeleteString(e Execer, filters ...orm.Filter) error {
 	var conditions []string
 	var args []any
 	for _, filter := range filters {

appview/db/timeline.go

···
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 // TODO: this gathers heterogenous events from different sources and aggregates
···
 }
 
 func getTimelineRepos(e Execer, limit int, loggedInUserDid string, userIsFollowing []string) ([]models.TimelineEvent, error) {
-	filters := make([]filter, 0)
+	filters := make([]orm.Filter, 0)
 	if userIsFollowing != nil {
-		filters = append(filters, FilterIn("did", userIsFollowing))
+		filters = append(filters, orm.FilterIn("did", userIsFollowing))
 	}
 
 	repos, err := GetRepos(e, limit, filters...)
···
 
 	var origRepos []models.Repo
 	if args != nil {
-		origRepos, err = GetRepos(e, 0, FilterIn("at_uri", args))
+		origRepos, err = GetRepos(e, 0, orm.FilterIn("at_uri", args))
 	}
 	if err != nil {
 		return nil, err
···
 }
 
 func getTimelineStars(e Execer, limit int, loggedInUserDid string, userIsFollowing []string) ([]models.TimelineEvent, error) {
-	filters := make([]filter, 0)
+	filters := make([]orm.Filter, 0)
 	if userIsFollowing != nil {
-		filters = append(filters, FilterIn("did", userIsFollowing))
+		filters = append(filters, orm.FilterIn("did", userIsFollowing))
 	}
 
 	stars, err := GetRepoStars(e, limit, filters...)
···
 }
 
 func getTimelineFollows(e Execer, limit int, loggedInUserDid string, userIsFollowing []string) ([]models.TimelineEvent, error) {
-	filters := make([]filter, 0)
+	filters := make([]orm.Filter, 0)
 	if userIsFollowing != nil {
-		filters = append(filters, FilterIn("user_did", userIsFollowing))
+		filters = append(filters, orm.FilterIn("user_did", userIsFollowing))
 	}
 
 	follows, err := GetFollows(e, limit, filters...)
···
 		return nil, nil
 	}
 
-	profiles, err := GetProfiles(e, FilterIn("did", subjects))
+	profiles, err := GetProfiles(e, orm.FilterIn("did", subjects))
 	if err != nil {
 		return nil, err
 	}

appview/ingester.go

···
 	"tangled.org/core/appview/serververify"
 	"tangled.org/core/appview/validator"
 	"tangled.org/core/idresolver"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 )
 
···
 
 		err = db.AddArtifact(i.Db, artifact)
 	case jmodels.CommitOperationDelete:
-		err = db.DeleteArtifact(i.Db, db.FilterEq("did", did), db.FilterEq("rkey", e.Commit.RKey))
+		err = db.DeleteArtifact(i.Db, orm.FilterEq("did", did), orm.FilterEq("rkey", e.Commit.RKey))
 	}
 
 	if err != nil {
···
 
 		err = db.UpsertProfile(tx, &profile)
 	case jmodels.CommitOperationDelete:
-		err = db.DeleteArtifact(i.Db, db.FilterEq("did", did), db.FilterEq("rkey", e.Commit.RKey))
+		err = db.DeleteArtifact(i.Db, orm.FilterEq("did", did), orm.FilterEq("rkey", e.Commit.RKey))
 	}
 
 	if err != nil {
···
 		// get record from db first
 		members, err := db.GetSpindleMembers(
 			ddb,
-			db.FilterEq("did", did),
-			db.FilterEq("rkey", rkey),
+			orm.FilterEq("did", did),
+			orm.FilterEq("rkey", rkey),
 		)
 		if err != nil || len(members) != 1 {
 			return fmt.Errorf("failed to get member: %w, len(members) = %d", err, len(members))
···
 		// remove record by rkey && update enforcer
 		if err = db.RemoveSpindleMember(
 			tx,
-			db.FilterEq("did", did),
-			db.FilterEq("rkey", rkey),
+			orm.FilterEq("did", did),
+			orm.FilterEq("rkey", rkey),
 		); err != nil {
 			return fmt.Errorf("failed to remove from db: %w", err)
 		}
···
 		// get record from db first
 		spindles, err := db.GetSpindles(
 			ddb,
-			db.FilterEq("owner", did),
-			db.FilterEq("instance", instance),
+			orm.FilterEq("owner", did),
+			orm.FilterEq("instance", instance),
 		)
 		if err != nil || len(spindles) != 1 {
 			return fmt.Errorf("failed to get spindles: %w, len(spindles) = %d", err, len(spindles))
···
 		// remove spindle members first
 		err = db.RemoveSpindleMember(
 			tx,
-			db.FilterEq("owner", did),
-			db.FilterEq("instance", instance),
+			orm.FilterEq("owner", did),
+			orm.FilterEq("instance", instance),
 		)
 		if err != nil {
 			return err
···
 
 		err = db.DeleteSpindle(
 			tx,
-			db.FilterEq("owner", did),
-			db.FilterEq("instance", instance),
+			orm.FilterEq("owner", did),
+			orm.FilterEq("instance", instance),
 		)
 		if err != nil {
 			return err
···
 	case jmodels.CommitOperationDelete:
 		if err := db.DeleteString(
 			ddb,
-			db.FilterEq("did", did),
-			db.FilterEq("rkey", rkey),
+			orm.FilterEq("did", did),
+			orm.FilterEq("rkey", rkey),
 		); err != nil {
 			l.Error("failed to delete", "err", err)
 			return fmt.Errorf("failed to delete string record: %w", err)
···
 		// get record from db first
 		registrations, err := db.GetRegistrations(
 			ddb,
-			db.FilterEq("domain", domain),
-			db.FilterEq("did", did),
+			orm.FilterEq("domain", domain),
+			orm.FilterEq("did", did),
 		)
 		if err != nil {
 			return fmt.Errorf("failed to get registration: %w", err)
···
 
 		err = db.DeleteKnot(
 			tx,
-			db.FilterEq("did", did),
-			db.FilterEq("domain", domain),
+			orm.FilterEq("did", did),
+			orm.FilterEq("domain", domain),
 		)
 		if err != nil {
 			return err
···
 	case jmodels.CommitOperationDelete:
 		if err := db.DeleteIssueComments(
 			ddb,
-			db.FilterEq("did", did),
-			db.FilterEq("rkey", rkey),
+			orm.FilterEq("did", did),
+			orm.FilterEq("rkey", rkey),
 		); err != nil {
 			return fmt.Errorf("failed to delete issue comment record: %w", err)
 		}
···
 	case jmodels.CommitOperationDelete:
 		if err := db.DeleteLabelDefinition(
 			ddb,
-			db.FilterEq("did", did),
-			db.FilterEq("rkey", rkey),
+			orm.FilterEq("did", did),
+			orm.FilterEq("rkey", rkey),
 		); err != nil {
 			return fmt.Errorf("failed to delete labeldef record: %w", err)
 		}
···
 		var repo *models.Repo
 		switch collection {
 		case tangled.RepoIssueNSID:
-			i, err := db.GetIssues(ddb, db.FilterEq("at_uri", subject))
+			i, err := db.GetIssues(ddb, orm.FilterEq("at_uri", subject))
 			if err != nil || len(i) != 1 {
 				return fmt.Errorf("failed to find subject: %w || subject count %d", err, len(i))
 			}
···
 			return fmt.Errorf("unsupport label subject: %s", collection)
 		}
 
-		actx, err := db.NewLabelApplicationCtx(ddb, db.FilterIn("at_uri", repo.Labels))
+		actx, err := db.NewLabelApplicationCtx(ddb, orm.FilterIn("at_uri", repo.Labels))
 		if err != nil {
 			return fmt.Errorf("failed to build label application ctx: %w", err)
 		}

appview/issues/issues.go

···
 	"tangled.org/core/appview/config"
 	"tangled.org/core/appview/db"
 	issues_indexer "tangled.org/core/appview/indexer/issues"
+	"tangled.org/core/appview/mentions"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/notify"
 	"tangled.org/core/appview/oauth"
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/pages/repoinfo"
 	"tangled.org/core/appview/pagination"
-	"tangled.org/core/appview/refresolver"
 	"tangled.org/core/appview/reporesolver"
 	"tangled.org/core/appview/validator"
 	"tangled.org/core/idresolver"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 	"tangled.org/core/tid"
 )
 
 type Issues struct {
-	oauth        *oauth.OAuth
-	repoResolver *reporesolver.RepoResolver
-	enforcer     *rbac.Enforcer
-	pages        *pages.Pages
-	idResolver   *idresolver.Resolver
-	refResolver  *refresolver.Resolver
-	db           *db.DB
-	config       *config.Config
-	notifier     notify.Notifier
-	logger       *slog.Logger
-	validator    *validator.Validator
-	indexer      *issues_indexer.Indexer
+	oauth            *oauth.OAuth
+	repoResolver     *reporesolver.RepoResolver
+	enforcer         *rbac.Enforcer
+	pages            *pages.Pages
+	idResolver       *idresolver.Resolver
+	mentionsResolver *mentions.Resolver
+	db               *db.DB
+	config           *config.Config
+	notifier         notify.Notifier
+	logger           *slog.Logger
+	validator        *validator.Validator
+	indexer          *issues_indexer.Indexer
 }
 
 func New(
···
 	enforcer *rbac.Enforcer,
 	pages *pages.Pages,
 	idResolver *idresolver.Resolver,
-	refResolver *refresolver.Resolver,
+	mentionsResolver *mentions.Resolver,
 	db *db.DB,
 	config *config.Config,
 	notifier notify.Notifier,
···
 	logger *slog.Logger,
 ) *Issues {
 	return &Issues{
-		oauth:        oauth,
-		repoResolver: repoResolver,
-		enforcer:     enforcer,
-		pages:        pages,
-		idResolver:   idResolver,
-		refResolver:  refResolver,
-		db:           db,
-		config:       config,
-		notifier:     notifier,
-		logger:       logger,
-		validator:    validator,
-		indexer:      indexer,
+		oauth:            oauth,
+		repoResolver:     repoResolver,
+		enforcer:         enforcer,
+		pages:            pages,
+		idResolver:       idResolver,
+		mentionsResolver: mentionsResolver,
+		db:               db,
+		config:           config,
+		notifier:         notifier,
+		logger:           logger,
+		validator:        validator,
+		indexer:          indexer,
 	}
 }
 
···
 
 	labelDefs, err := db.GetLabelDefinitions(
 		rp.db,
-		db.FilterIn("at_uri", f.Labels),
-		db.FilterContains("scope", tangled.RepoIssueNSID),
+		orm.FilterIn("at_uri", f.Labels),
+		orm.FilterContains("scope", tangled.RepoIssueNSID),
 	)
 	if err != nil {
 		l.Error("failed to fetch labels", "err", err)
···
 		newIssue := issue
 		newIssue.Title = r.FormValue("title")
 		newIssue.Body = r.FormValue("body")
-		newIssue.Mentions, newIssue.References = rp.refResolver.Resolve(r.Context(), newIssue.Body)
+		newIssue.Mentions, newIssue.References = rp.mentionsResolver.Resolve(r.Context(), newIssue.Body)
 
 		if err := rp.validator.ValidateIssue(newIssue); err != nil {
 			l.Error("validation error", "err", err)
···
 	if isIssueOwner || isRepoOwner || isCollaborator {
 		err = db.CloseIssues(
 			rp.db,
-			db.FilterEq("id", issue.Id),
+			orm.FilterEq("id", issue.Id),
 		)
 		if err != nil {
 			l.Error("failed to close issue", "err", err)
···
 	if isCollaborator || isRepoOwner || isIssueOwner {
 		err := db.ReopenIssues(
 			rp.db,
-			db.FilterEq("id", issue.Id),
+			orm.FilterEq("id", issue.Id),
 		)
 		if err != nil {
 			l.Error("failed to reopen issue", "err", err)
···
 		replyTo = &replyToUri
 	}
 
-	mentions, references := rp.refResolver.Resolve(r.Context(), body)
+	mentions, references := rp.mentionsResolver.Resolve(r.Context(), body)
 
 	comment := models.IssueComment{
 		Did:        user.Did,
···
 	commentId := chi.URLParam(r, "commentId")
 	comments, err := db.GetIssueComments(
 		rp.db,
-		db.FilterEq("id", commentId),
+		orm.FilterEq("id", commentId),
 	)
 	if err != nil {
 		l.Error("failed to fetch comment", "id", commentId)
···
 	commentId := chi.URLParam(r, "commentId")
 	comments, err := db.GetIssueComments(
 		rp.db,
-		db.FilterEq("id", commentId),
+		orm.FilterEq("id", commentId),
 	)
 	if err != nil {
 		l.Error("failed to fetch comment", "id", commentId)
···
 		newComment := comment
 		newComment.Body = newBody
 		newComment.Edited = &now
-		newComment.Mentions, newComment.References = rp.refResolver.Resolve(r.Context(), newBody)
+		newComment.Mentions, newComment.References = rp.mentionsResolver.Resolve(r.Context(), newBody)
 
 		record := newComment.AsRecord()
 
···
 	commentId := chi.URLParam(r, "commentId")
 	comments, err := db.GetIssueComments(
 		rp.db,
-		db.FilterEq("id", commentId),
+		orm.FilterEq("id", commentId),
 	)
 	if err != nil {
 		l.Error("failed to fetch comment", "id", commentId)
···
 	commentId := chi.URLParam(r, "commentId")
 	comments, err := db.GetIssueComments(
 		rp.db,
-		db.FilterEq("id", commentId),
+		orm.FilterEq("id", commentId),
 	)
 	if err != nil {
 		l.Error("failed to fetch comment", "id", commentId)
···
 	commentId := chi.URLParam(r, "commentId")
 	comments, err := db.GetIssueComments(
 		rp.db,
-		db.FilterEq("id", commentId),
+		orm.FilterEq("id", commentId),
 	)
 	if err != nil {
 		l.Error("failed to fetch comment", "id", commentId)
···
 
 	// optimistic deletion
 	deleted := time.Now()
-	err = db.DeleteIssueComments(rp.db, db.FilterEq("id", comment.Id))
+	err = db.DeleteIssueComments(rp.db, orm.FilterEq("id", comment.Id))
 	if err != nil {
 		l.Error("failed to delete comment", "err", err)
 		rp.pages.Notice(w, fmt.Sprintf("comment-%s-status", commentId), "failed to delete comment")
···
 
 		issues, err = db.GetIssues(
 			rp.db,
-			db.FilterIn("id", res.Hits),
+			orm.FilterIn("id", res.Hits),
 		)
 		if err != nil {
 			l.Error("failed to get issues", "err", err)
···
 		issues, err = db.GetIssuesPaginated(
 			rp.db,
 			page,
-			db.FilterEq("repo_at", f.RepoAt()),
-			db.FilterEq("open", openInt),
+			orm.FilterEq("repo_at", f.RepoAt()),
+			orm.FilterEq("open", openInt),
 		)
 		if err != nil {
 			l.Error("failed to get issues", "err", err)
···
 
 	labelDefs, err := db.GetLabelDefinitions(
 		rp.db,
-		db.FilterIn("at_uri", f.Labels),
-		db.FilterContains("scope", tangled.RepoIssueNSID),
+		orm.FilterIn("at_uri", f.Labels),
+		orm.FilterContains("scope", tangled.RepoIssueNSID),
 	)
 	if err != nil {
 		l.Error("failed to fetch labels", "err", err)
···
 		})
 	case http.MethodPost:
 		body := r.FormValue("body")
-		mentions, references := rp.refResolver.Resolve(r.Context(), body)
+		mentions, references := rp.mentionsResolver.Resolve(r.Context(), body)
 
 		issue := &models.Issue{
 			RepoAt:     f.RepoAt(),

appview/issues/opengraph.go

···
 	dollyX := dollyBounds.Min.X + (dollyBounds.Dx() / 2) - (dollySize / 2)
 	dollyY := statsY + iconBaselineOffset - dollySize/2 + 25
 	dollyColor := color.RGBA{180, 180, 180, 255} // light gray
-	err = dollyArea.DrawDollySilhouette(dollyX, dollyY, dollySize, dollyColor)
+	err = dollyArea.DrawDolly(dollyX, dollyY, dollySize, dollyColor)
 	if err != nil {
-		log.Printf("dolly silhouette not available (this is ok): %v", err)
+		log.Printf("dolly not available (this is ok): %v", err)
 	}
 
 	// Draw "opened by @author" and date at the bottom with more spacing

appview/knots/knots.go

···
 	"tangled.org/core/appview/xrpcclient"
 	"tangled.org/core/eventconsumer"
 	"tangled.org/core/idresolver"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 	"tangled.org/core/tid"
 
···
 	user := k.OAuth.GetUser(r)
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		db.FilterEq("did", user.Did),
+		orm.FilterEq("did", user.Did),
 	)
 	if err != nil {
 		k.Logger.Error("failed to fetch knot registrations", "err", err)
···
 
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("domain", domain),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("domain", domain),
 	)
 	if err != nil {
 		l.Error("failed to get registrations", "err", err)
···
 	repos, err := db.GetRepos(
 		k.Db,
 		0,
-		db.FilterEq("knot", domain),
+		orm.FilterEq("knot", domain),
 	)
 	if err != nil {
 		l.Error("failed to get knot repos", "err", err)
···
 	// get record from db first
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("domain", domain),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("domain", domain),
 	)
 	if err != nil {
 		l.Error("failed to get registration", "err", err)
···
 
 	err = db.DeleteKnot(
 		tx,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("domain", domain),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("domain", domain),
 	)
 	if err != nil {
 		l.Error("failed to delete registration", "err", err)
···
 	// get record from db first
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("domain", domain),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("domain", domain),
 	)
 	if err != nil {
 		l.Error("failed to get registration", "err", err)
···
 	// Get updated registration to show
 	registrations, err = db.GetRegistrations(
 		k.Db,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("domain", domain),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("domain", domain),
 	)
 	if err != nil {
 		l.Error("failed to get registration", "err", err)
···
 
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("domain", domain),
-		db.FilterIsNot("registered", "null"),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("domain", domain),
+		orm.FilterIsNot("registered", "null"),
 	)
 	if err != nil {
 		l.Error("failed to get registration", "err", err)
···
 
 	registrations, err := db.GetRegistrations(
 		k.Db,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("domain", domain),
-		db.FilterIsNot("registered", "null"),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("domain", domain),
+		orm.FilterIsNot("registered", "null"),
 	)
 	if err != nil {
 		l.Error("failed to get registration", "err", err)
···
 	memberId, err := k.IdResolver.ResolveIdent(r.Context(), member)
 	if err != nil {
 		l.Error("failed to resolve member identity to handle", "err", err)
-		k.Pages.Notice(w, noticeId, "Failed to remove member, identity resolution failed.")
-		return
-	}
-	if memberId.Handle.IsInvalidHandle() {
-		l.Error("failed to resolve member identity to handle")
 		k.Pages.Notice(w, noticeId, "Failed to remove member, identity resolution failed.")
 		return
 	}

appview/labels/labels.go

···
 	"tangled.org/core/appview/oauth"
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/validator"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 	"tangled.org/core/tid"
 
···
 	repoAt := r.Form.Get("repo")
 	subjectUri := r.Form.Get("subject")
 
-	repo, err := db.GetRepo(l.db, db.FilterEq("at_uri", repoAt))
+	repo, err := db.GetRepo(l.db, orm.FilterEq("at_uri", repoAt))
 	if err != nil {
 		fail("Failed to get repository.", err)
 		return
 	}
 
 	// find all the labels that this repo subscribes to
-	repoLabels, err := db.GetRepoLabels(l.db, db.FilterEq("repo_at", repoAt))
+	repoLabels, err := db.GetRepoLabels(l.db, orm.FilterEq("repo_at", repoAt))
 	if err != nil {
 		fail("Failed to get labels for this repository.", err)
 		return
···
 		labelAts = append(labelAts, rl.LabelAt.String())
 	}
 
-	actx, err := db.NewLabelApplicationCtx(l.db, db.FilterIn("at_uri", labelAts))
+	actx, err := db.NewLabelApplicationCtx(l.db, orm.FilterIn("at_uri", labelAts))
 	if err != nil {
 		fail("Invalid form data.", err)
 		return
 	}
 
 	// calculate the start state by applying already known labels
-	existingOps, err := db.GetLabelOps(l.db, db.FilterEq("subject", subjectUri))
+	existingOps, err := db.GetLabelOps(l.db, orm.FilterEq("subject", subjectUri))
 	if err != nil {
 		fail("Invalid form data.", err)
 		return

appview/middleware/middleware.go

···
 	"tangled.org/core/appview/pagination"
 	"tangled.org/core/appview/reporesolver"
 	"tangled.org/core/idresolver"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 )
 
···
 
 			repo, err := db.GetRepo(
 				mw.db,
-				db.FilterEq("did", id.DID.String()),
-				db.FilterEq("name", repoName),
+				orm.FilterEq("did", id.DID.String()),
+				orm.FilterEq("name", repoName),
 			)
 			if err != nil {
 				log.Println("failed to resolve repo", "err", err)
+				w.WriteHeader(http.StatusNotFound)
 				mw.pages.ErrorKnot404(w)
 				return
 			}
···
 			f, err := mw.repoResolver.Resolve(r)
 			if err != nil {
 				log.Println("failed to fully resolve repo", err)
+				w.WriteHeader(http.StatusNotFound)
 				mw.pages.ErrorKnot404(w)
 				return
 			}
···
 		f, err := mw.repoResolver.Resolve(r)
 		if err != nil {
 			log.Println("failed to fully resolve repo", err)
+			w.WriteHeader(http.StatusNotFound)
 			mw.pages.ErrorKnot404(w)
 			return
 		}
···
 			f, err := mw.repoResolver.Resolve(r)
 			if err != nil {
 				log.Println("failed to fully resolve repo", err)
+				w.WriteHeader(http.StatusNotFound)
 				mw.pages.ErrorKnot404(w)
 				return
 			}

appview/models/pull.go

···
 	Repo   *Repo
 }
 
+// NOTE: This method does not include patch blob in returned atproto record
 func (p Pull) AsRecord() tangled.RepoPull {
 	var source *tangled.RepoPull_Source
 	if p.PullSource != nil {
···
 			Repo:   p.RepoAt.String(),
 			Branch: p.TargetBranch,
 		},
-		Patch:  p.LatestPatch(),
 		Source: source,
 	}
 	return record

appview/notifications/notifications.go

···
 	"tangled.org/core/appview/oauth"
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/pagination"
+	"tangled.org/core/orm"
 )
 
 type Notifications struct {
···
 
 	total, err := db.CountNotifications(
 		n.db,
-		db.FilterEq("recipient_did", user.Did),
+		orm.FilterEq("recipient_did", user.Did),
 	)
 	if err != nil {
 		l.Error("failed to get total notifications", "err", err)
···
 	notifications, err := db.GetNotificationsWithEntities(
 		n.db,
 		page,
-		db.FilterEq("recipient_did", user.Did),
+		orm.FilterEq("recipient_did", user.Did),
 	)
 	if err != nil {
 		l.Error("failed to get notifications", "err", err)
···
 
 	count, err := db.CountNotifications(
 		n.db,
-		db.FilterEq("recipient_did", user.Did),
-		db.FilterEq("read", 0),
+		orm.FilterEq("recipient_did", user.Did),
+		orm.FilterEq("read", 0),
 	)
 	if err != nil {
 		http.Error(w, "Failed to get unread count", http.StatusInternalServerError)

appview/notify/db/db.go

···
 import (
 	"context"
 	"log"
-	"maps"
 	"slices"
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
···
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/notify"
 	"tangled.org/core/idresolver"
+	"tangled.org/core/orm"
+	"tangled.org/core/sets"
 )
 
 const (
-	maxMentions = 5
+	maxMentions = 8
 )
 
 type databaseNotifier struct {
···
 		return
 	}
 	var err error
-	repo, err := db.GetRepo(n.db, db.FilterEq("at_uri", string(star.RepoAt)))
+	repo, err := db.GetRepo(n.db, orm.FilterEq("at_uri", string(star.RepoAt)))
 	if err != nil {
 		log.Printf("NewStar: failed to get repos: %v", err)
 		return
 	}
 
 	actorDid := syntax.DID(star.Did)
-	recipients := []syntax.DID{syntax.DID(repo.Did)}
+	recipients := sets.Singleton(syntax.DID(repo.Did))
 	eventType := models.NotificationTypeRepoStarred
 	entityType := "repo"
 	entityId := star.RepoAt.String()
···
 }
 
 func (n *databaseNotifier) NewIssue(ctx context.Context, issue *models.Issue, mentions []syntax.DID) {
-
-	// build the recipients list
-	// - owner of the repo
-	// - collaborators in the repo
-	var recipients []syntax.DID
-	recipients = append(recipients, syntax.DID(issue.Repo.Did))
-	collaborators, err := db.GetCollaborators(n.db, db.FilterEq("repo_at", issue.Repo.RepoAt()))
+	collaborators, err := db.GetCollaborators(n.db, orm.FilterEq("repo_at", issue.Repo.RepoAt()))
 	if err != nil {
 		log.Printf("failed to fetch collaborators: %v", err)
 		return
 	}
+
+	// build the recipients list
+	// - owner of the repo
+	// - collaborators in the repo
+	// - remove users already mentioned
+	recipients := sets.Singleton(syntax.DID(issue.Repo.Did))
 	for _, c := range collaborators {
-		recipients = append(recipients, c.SubjectDid)
+		recipients.Insert(c.SubjectDid)
+	}
+	for _, m := range mentions {
+		recipients.Remove(m)
 	}
 
 	actorDid := syntax.DID(issue.Did)
···
 	)
 	n.notifyEvent(
 		actorDid,
-		mentions,
+		sets.Collect(slices.Values(mentions)),
 		models.NotificationTypeUserMentioned,
 		entityType,
 		entityId,
···
 }
 
 func (n *databaseNotifier) NewIssueComment(ctx context.Context, comment *models.IssueComment, mentions []syntax.DID) {
-	issues, err := db.GetIssues(n.db, db.FilterEq("at_uri", comment.IssueAt))
+	issues, err := db.GetIssues(n.db, orm.FilterEq("at_uri", comment.IssueAt))
 	if err != nil {
 		log.Printf("NewIssueComment: failed to get issues: %v", err)
 		return
···
 	}
 	issue := issues[0]
 
-	var recipients []syntax.DID
-	recipients = append(recipients, syntax.DID(issue.Repo.Did))
+	// built the recipients list:
+	// - the owner of the repo
+	// - | if the comment is a reply -> everybody on that thread
+	//   | if the comment is a top level -> just the issue owner
+	// - remove mentioned users from the recipients list
+	recipients := sets.Singleton(syntax.DID(issue.Repo.Did))
 
 	if comment.IsReply() {
 		// if this comment is a reply, then notify everybody in that thread
 		parentAtUri := *comment.ReplyTo
-		allThreads := issue.CommentList()
 
 		// find the parent thread, and add all DIDs from here to the recipient list
-		for _, t := range allThreads {
+		for _, t := range issue.CommentList() {
 			if t.Self.AtUri().String() == parentAtUri {
-				recipients = append(recipients, t.Participants()...)
+				for _, p := range t.Participants() {
+					recipients.Insert(p)
+				}
 			}
 		}
 	} else {
 		// not a reply, notify just the issue author
-		recipients = append(recipients, syntax.DID(issue.Did))
+		recipients.Insert(syntax.DID(issue.Did))
+	}
+
+	for _, m := range mentions {
+		recipients.Remove(m)
 	}
 
 	actorDid := syntax.DID(comment.Did)
···
 	)
 	n.notifyEvent(
 		actorDid,
-		mentions,
+		sets.Collect(slices.Values(mentions)),
 		models.NotificationTypeUserMentioned,
 		entityType,
 		entityId,
···
 
 func (n *databaseNotifier) NewFollow(ctx context.Context, follow *models.Follow) {
 	actorDid := syntax.DID(follow.UserDid)
-	recipients := []syntax.DID{syntax.DID(follow.SubjectDid)}
+	recipients := sets.Singleton(syntax.DID(follow.SubjectDid))
 	eventType := models.NotificationTypeFollowed
 	entityType := "follow"
 	entityId := follow.UserDid
···
 }
 
 func (n *databaseNotifier) NewPull(ctx context.Context, pull *models.Pull) {
-	repo, err := db.GetRepo(n.db, db.FilterEq("at_uri", string(pull.RepoAt)))
+	repo, err := db.GetRepo(n.db, orm.FilterEq("at_uri", string(pull.RepoAt)))
 	if err != nil {
 		log.Printf("NewPull: failed to get repos: %v", err)
 		return
 	}
-
-	// build the recipients list
-	// - owner of the repo
-	// - collaborators in the repo
-	var recipients []syntax.DID
-	recipients = append(recipients, syntax.DID(repo.Did))
-	collaborators, err := db.GetCollaborators(n.db, db.FilterEq("repo_at", repo.RepoAt()))
+	collaborators, err := db.GetCollaborators(n.db, orm.FilterEq("repo_at", repo.RepoAt()))
 	if err != nil {
 		log.Printf("failed to fetch collaborators: %v", err)
 		return
 	}
+
+	// build the recipients list
+	// - owner of the repo
+	// - collaborators in the repo
+	recipients := sets.Singleton(syntax.DID(repo.Did))
 	for _, c := range collaborators {
-		recipients = append(recipients, c.SubjectDid)
+		recipients.Insert(c.SubjectDid)
 	}
 
 	actorDid := syntax.DID(pull.OwnerDid)
···
 		return
 	}
 
-	repo, err := db.GetRepo(n.db, db.FilterEq("at_uri", comment.RepoAt))
+	repo, err := db.GetRepo(n.db, orm.FilterEq("at_uri", comment.RepoAt))
 	if err != nil {
 		log.Printf("NewPullComment: failed to get repos: %v", err)
 		return
···
 	// build up the recipients list:
 	// - repo owner
 	// - all pull participants
-	var recipients []syntax.DID
-	recipients = append(recipients, syntax.DID(repo.Did))
+	// - remove those already mentioned
+	recipients := sets.Singleton(syntax.DID(repo.Did))
 	for _, p := range pull.Participants() {
-		recipients = append(recipients, syntax.DID(p))
+		recipients.Insert(syntax.DID(p))
+	}
+	for _, m := range mentions {
+		recipients.Remove(m)
 	}
 
 	actorDid := syntax.DID(comment.OwnerDid)
···
 	)
 	n.notifyEvent(
 		actorDid,
-		mentions,
+		sets.Collect(slices.Values(mentions)),
 		models.NotificationTypeUserMentioned,
 		entityType,
 		entityId,
···
 }
 
 func (n *databaseNotifier) NewIssueState(ctx context.Context, actor syntax.DID, issue *models.Issue) {
-	// build up the recipients list:
-	// - repo owner
-	// - repo collaborators
-	// - all issue participants
-	var recipients []syntax.DID
-	recipients = append(recipients, syntax.DID(issue.Repo.Did))
-	collaborators, err := db.GetCollaborators(n.db, db.FilterEq("repo_at", issue.Repo.RepoAt()))
+	collaborators, err := db.GetCollaborators(n.db, orm.FilterEq("repo_at", issue.Repo.RepoAt()))
 	if err != nil {
 		log.Printf("failed to fetch collaborators: %v", err)
 		return
 	}
+
+	// build up the recipients list:
+	// - repo owner
+	// - repo collaborators
+	// - all issue participants
+	recipients := sets.Singleton(syntax.DID(issue.Repo.Did))
 	for _, c := range collaborators {
-		recipients = append(recipients, c.SubjectDid)
+		recipients.Insert(c.SubjectDid)
 	}
 	for _, p := range issue.Participants() {
-		recipients = append(recipients, syntax.DID(p))
+		recipients.Insert(syntax.DID(p))
 	}
 
 	entityType := "pull"
···
 
 func (n *databaseNotifier) NewPullState(ctx context.Context, actor syntax.DID, pull *models.Pull) {
 	// Get repo details
-	repo, err := db.GetRepo(n.db, db.FilterEq("at_uri", string(pull.RepoAt)))
+	repo, err := db.GetRepo(n.db, orm.FilterEq("at_uri", string(pull.RepoAt)))
 	if err != nil {
 		log.Printf("NewPullState: failed to get repos: %v", err)
 		return
 	}
 
-	// build up the recipients list:
-	// - repo owner
-	// - all pull participants
-	var recipients []syntax.DID
-	recipients = append(recipients, syntax.DID(repo.Did))
-	collaborators, err := db.GetCollaborators(n.db, db.FilterEq("repo_at", repo.RepoAt()))
+	collaborators, err := db.GetCollaborators(n.db, orm.FilterEq("repo_at", repo.RepoAt()))
 	if err != nil {
 		log.Printf("failed to fetch collaborators: %v", err)
 		return
 	}
+
+	// build up the recipients list:
+	// - repo owner
+	// - all pull participants
+	recipients := sets.Singleton(syntax.DID(repo.Did))
 	for _, c := range collaborators {
-		recipients = append(recipients, c.SubjectDid)
+		recipients.Insert(c.SubjectDid)
 	}
 	for _, p := range pull.Participants() {
-		recipients = append(recipients, syntax.DID(p))
+		recipients.Insert(syntax.DID(p))
 	}
 
 	entityType := "pull"
···
 
 func (n *databaseNotifier) notifyEvent(
 	actorDid syntax.DID,
-	recipients []syntax.DID,
+	recipients sets.Set[syntax.DID],
 	eventType models.NotificationType,
 	entityType string,
 	entityId string,
···
 	issueId *int64,
 	pullId *int64,
 ) {
-	if eventType == models.NotificationTypeUserMentioned && len(recipients) > maxMentions {
-		recipients = recipients[:maxMentions]
+	// if the user is attempting to mention >maxMentions users, this is probably spam, do not mention anybody
+	if eventType == models.NotificationTypeUserMentioned && recipients.Len() > maxMentions {
+		return
 	}
-	recipientSet := make(map[syntax.DID]struct{})
-	for _, did := range recipients {
-		// everybody except actor themselves
-		if did != actorDid {
-			recipientSet[did] = struct{}{}
-		}
-	}
+
+	recipients.Remove(actorDid)
 
 	prefMap, err := db.GetNotificationPreferences(
 		n.db,
-		db.FilterIn("user_did", slices.Collect(maps.Keys(recipientSet))),
+		orm.FilterIn("user_did", slices.Collect(recipients.All())),
 	)
 	if err != nil {
 		// failed to get prefs for users
···
 	defer tx.Rollback()
 
 	// filter based on preferences
-	for recipientDid := range recipientSet {
+	for recipientDid := range recipients.All() {
 		prefs, ok := prefMap[recipientDid]
 		if !ok {
 			prefs = models.DefaultNotificationPreferences(recipientDid)

appview/notify/merged_notifier.go

···
 			v.Call(in)
 		}(n)
 	}
-	wg.Wait()
 }
 
 func (m *mergedNotifier) NewRepo(ctx context.Context, repo *models.Repo) {

appview/oauth/handler.go

···
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/appview/db"
 	"tangled.org/core/consts"
+	"tangled.org/core/orm"
 	"tangled.org/core/tid"
 )
 
···
 	// and create an sh.tangled.spindle.member record with that
 	spindleMembers, err := db.GetSpindleMembers(
 		o.Db,
-		db.FilterEq("instance", "spindle.tangled.sh"),
-		db.FilterEq("subject", did),
+		orm.FilterEq("instance", "spindle.tangled.sh"),
+		orm.FilterEq("subject", did),
 	)
 	if err != nil {
 		l.Error("failed to get spindle members", "err", err)

appview/ogcard/card.go

···
 	return nil
 }
 
-func (c *Card) DrawDollySilhouette(x, y, size int, iconColor color.Color) error {
+func (c *Card) DrawDolly(x, y, size int, iconColor color.Color) error {
 	tpl, err := template.New("dolly").
-		ParseFS(pages.Files, "templates/fragments/dolly/silhouette.html")
+		ParseFS(pages.Files, "templates/fragments/dolly/logo.html")
 	if err != nil {
-		return fmt.Errorf("failed to read dolly silhouette template: %w", err)
+		return fmt.Errorf("failed to read dolly template: %w", err)
 	}
 
 	var svgData bytes.Buffer
-	if err = tpl.ExecuteTemplate(&svgData, "fragments/dolly/silhouette", nil); err != nil {
-		return fmt.Errorf("failed to execute dolly silhouette template: %w", err)
+	if err = tpl.ExecuteTemplate(&svgData, "fragments/dolly/logo", nil); err != nil {
+		return fmt.Errorf("failed to execute dolly template: %w", err)
 	}
 
 	icon, err := BuildSVGIconFromData(svgData.Bytes(), iconColor)
···
 
 	// Handle SVG separately
 	if contentType == "image/svg+xml" || strings.HasSuffix(url, ".svg") {
-		return c.convertSVGToPNG(bodyBytes)
+		return convertSVGToPNG(bodyBytes)
 	}
 
 	// Support content types are in-sync with the allowed custom avatar file types
···
 }
 
 // convertSVGToPNG converts SVG data to a PNG image
-func (c *Card) convertSVGToPNG(svgData []byte) (image.Image, bool) {
+func convertSVGToPNG(svgData []byte) (image.Image, bool) {
 	// Parse the SVG
 	icon, err := oksvg.ReadIconStream(bytes.NewReader(svgData))
 	if err != nil {
···
 	draw.CatmullRom.Scale(scaledImg, scaledImg.Bounds(), img, srcBounds, draw.Src, nil)
 
 	// Draw the image with circular clipping
-	for cy := 0; cy < size; cy++ {
-		for cx := 0; cx < size; cx++ {
+	for cy := range size {
+		for cx := range size {
 			// Calculate distance from center
 			dx := float64(cx - center)
 			dy := float64(cy - center)

appview/pages/funcmap.go

···
 	"github.com/dustin/go-humanize"
 	"github.com/go-enry/go-enry/v2"
 	"github.com/yuin/goldmark"
+	emoji "github.com/yuin/goldmark-emoji"
 	"tangled.org/core/appview/filetree"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/pages/markup"
···
 			}
 			return pairs, nil
 		},
-		"append": func(s []string, values ...string) []string {
+		"append": func(s []any, values ...any) []any {
 			s = append(s, values...)
 			return s
 		},
···
 		},
 		"description": func(text string) template.HTML {
 			p.rctx.RendererType = markup.RendererTypeDefault
-			htmlString := p.rctx.RenderMarkdownWith(text, goldmark.New())
+			htmlString := p.rctx.RenderMarkdownWith(text, goldmark.New(
+				goldmark.WithExtensions(
+					emoji.Emoji,
+				),
+			))
 			sanitized := p.rctx.SanitizeDescription(htmlString)
 			return template.HTML(sanitized)
 		},

appview/pages/markup/extension/atlink.go

···
 	return KindAt
 }
 
-var atRegexp = regexp.MustCompile(`(^|\s|\()(@)([a-zA-Z0-9.-]+)(\b)`)
+var atRegexp = regexp.MustCompile(`(^|\s|\()(@)([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\b)`)
+var markdownLinkRegexp = regexp.MustCompile(`(?ms)\[.*\]\(.*\)`)
 
 type atParser struct{}
 
···
 	if m == nil {
 		return nil
 	}
+
+	// Check for all links in the markdown to see if the handle found is inside one
+	linksIndexes := markdownLinkRegexp.FindAllIndex(block.Source(), -1)
+	for _, linkMatch := range linksIndexes {
+		if linkMatch[0] < segment.Start && segment.Start < linkMatch[1] {
+			return nil
+		}
+	}
+
 	atSegment := text.NewSegment(segment.Start, segment.Start+m[1])
 	block.Advance(m[1])
 	node := &AtNode{}
···
 
 func (r *atHtmlRenderer) renderAt(w util.BufWriter, source []byte, n ast.Node, entering bool) (ast.WalkStatus, error) {
 	if entering {
-		w.WriteString(`<a href="/@`)
+		w.WriteString(`<a href="/`)
 		w.WriteString(n.(*AtNode).Handle)
-		w.WriteString(`" class="mention font-bold">`)
+		w.WriteString(`" class="mention">`)
 	} else {
 		w.WriteString("</a>")
 	}

appview/pages/markup/markdown.go

···
 
 	chromahtml "github.com/alecthomas/chroma/v2/formatters/html"
 	"github.com/alecthomas/chroma/v2/styles"
-	treeblood "github.com/wyatt915/goldmark-treeblood"
 	"github.com/yuin/goldmark"
+	"github.com/yuin/goldmark-emoji"
 	highlighting "github.com/yuin/goldmark-highlighting/v2"
 	"github.com/yuin/goldmark/ast"
 	"github.com/yuin/goldmark/extension"
···
 			extension.NewFootnote(
 				extension.WithFootnoteIDPrefix([]byte("footnote")),
 			),
-			treeblood.MathML(),
 			callout.CalloutExtention,
 			textension.AtExt,
+			emoji.Emoji,
 		),
 		goldmark.WithParserOptions(
 			parser.WithAutoHeadingID(),

appview/pages/markup/markdown_test.go

···
+package markup
+
+import (
+	"bytes"
+	"testing"
+)
+
+func TestAtExtension_Rendering(t *testing.T) {
+	tests := []struct {
+		name     string
+		markdown string
+		expected string
+	}{
+		{
+			name:     "renders simple at mention",
+			markdown: "Hello @user.tngl.sh!",
+			expected: `<p>Hello <a href="/user.tngl.sh" class="mention">@user.tngl.sh</a>!</p>`,
+		},
+		{
+			name:     "renders multiple at mentions",
+			markdown: "Hi @alice.tngl.sh and @bob.example.com",
+			expected: `<p>Hi <a href="/alice.tngl.sh" class="mention">@alice.tngl.sh</a> and <a href="/bob.example.com" class="mention">@bob.example.com</a></p>`,
+		},
+		{
+			name:     "renders at mention in parentheses",
+			markdown: "Check this out (@user.tngl.sh)",
+			expected: `<p>Check this out (<a href="/user.tngl.sh" class="mention">@user.tngl.sh</a>)</p>`,
+		},
+		{
+			name:     "does not render email",
+			markdown: "Contact me at [e-mail]",
+			expected: `<p>Contact me at <a href="mailto:[e-mail]">[e-mail]</a></p>`,
+		},
+		{
+			name:     "renders at mention with hyphen",
+			markdown: "Follow @user-name.tngl.sh",
+			expected: `<p>Follow <a href="/user-name.tngl.sh" class="mention">@user-name.tngl.sh</a></p>`,
+		},
+		{
+			name:     "renders at mention with numbers",
+			markdown: "@user123.test456.social",
+			expected: `<p><a href="/user123.test456.social" class="mention">@user123.test456.social</a></p>`,
+		},
+		{
+			name:     "at mention at start of line",
+			markdown: "@user.tngl.sh is cool",
+			expected: `<p><a href="/user.tngl.sh" class="mention">@user.tngl.sh</a> is cool</p>`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			md := NewMarkdown()
+
+			var buf bytes.Buffer
+			if err := md.Convert([]byte(tt.markdown), &buf); err != nil {
+				t.Fatalf("failed to convert markdown: %v", err)
+			}
+
+			result := buf.String()
+			if result != tt.expected+"\n" {
+				t.Errorf("expected:\n%s\ngot:\n%s", tt.expected, result)
+			}
+		})
+	}
+}
+
+func TestAtExtension_WithOtherMarkdown(t *testing.T) {
+	tests := []struct {
+		name     string
+		markdown string
+		contains string
+	}{
+		{
+			name:     "at mention with bold",
+			markdown: "**Hello @user.tngl.sh**",
+			contains: `<strong>Hello <a href="/user.tngl.sh" class="mention">@user.tngl.sh</a></strong>`,
+		},
+		{
+			name:     "at mention with italic",
+			markdown: "*Check @user.tngl.sh*",
+			contains: `<em>Check <a href="/user.tngl.sh" class="mention">@user.tngl.sh</a></em>`,
+		},
+		{
+			name:     "at mention in list",
+			markdown: "- Item 1\n- @user.tngl.sh\n- Item 3",
+			contains: `<a href="/user.tngl.sh" class="mention">@user.tngl.sh</a>`,
+		},
+		{
+			name:     "at mention in link",
+			markdown: "[@regnault.dev](https://regnault.dev)",
+			contains: `<a href="https://regnault.dev">@regnault.dev</a>`,
+		},
+		{
+			name:     "at mention in link again",
+			markdown: "[check out @regnault.dev](https://regnault.dev)",
+			contains: `<a href="https://regnault.dev">check out @regnault.dev</a>`,
+		},
+		{
+			name:     "at mention in link again, multiline",
+			markdown: "[\ncheck out @regnault.dev](https://regnault.dev)",
+			contains: "<a href=\"https://regnault.dev\">\ncheck out @regnault.dev</a>",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			md := NewMarkdown()
+
+			var buf bytes.Buffer
+			if err := md.Convert([]byte(tt.markdown), &buf); err != nil {
+				t.Fatalf("failed to convert markdown: %v", err)
+			}
+
+			result := buf.String()
+			if !bytes.Contains([]byte(result), []byte(tt.contains)) {
+				t.Errorf("expected output to contain:\n%s\ngot:\n%s", tt.contains, result)
+			}
+		})
+	}
+}

appview/pages/pages.go

···
 	"github.com/bluesky-social/indigo/atproto/identity"
 	"github.com/bluesky-social/indigo/atproto/syntax"
 	"github.com/go-git/go-git/v5/plumbing"
-	"github.com/go-git/go-git/v5/plumbing/object"
 )
 
 //go:embed templates/* static legal
···
 	return tpl.ExecuteTemplate(w, "layouts/base", params)
 }
 
+type DollyParams struct {
+	Classes   string
+	FillColor string
+}
+
+func (p *Pages) Dolly(w io.Writer, params DollyParams) error {
+	return p.executePlain("fragments/dolly/logo", w, params)
+}
+
 func (p *Pages) Favicon(w io.Writer) error {
-	return p.executePlain("fragments/dolly/silhouette", w, nil)
+	return p.Dolly(w, DollyParams{
+		Classes: "text-black dark:text-white",
+	})
 }
 
 type LoginParams struct {
···
 }
 
 func (p *Pages) StarBtnFragment(w io.Writer, params StarBtnFragmentParams) error {
-	return p.executePlain("fragments/starBtn", w, params)
+	return p.executePlain("fragments/starBtn-oob", w, params)
 }
 
 type RepoIndexParams struct {
···
 	RepoInfo      repoinfo.RepoInfo
 	Active        string
 	TagMap        map[string][]string
-	CommitsTrunc  []*object.Commit
+	CommitsTrunc  []types.Commit
 	TagsTrunc     []*types.TagReference
 	BranchesTrunc []types.Branch
 	// ForkInfo           *types.ForkInfo

appview/pages/templates/banner.html

···
     <div class="mx-6">
       These services may not be fully accessible until upgraded.
       <a class="underline text-red-800 dark:text-red-200"
-        href="https://tangled.org/@tangled.org/core/tree/master/docs/migrations.md">
+        href="https://docs.tangled.org/migrating-knots-spindles.html#migrating-knots-spindles">
         Click to read the upgrade guide</a>.
     </div>
   </details>

appview/pages/templates/brand/brand.html

···
 <div class="grid grid-cols-10">
   <header class="col-span-full md:col-span-10 px-6 py-2 mb-4">
     <h1 class="text-2xl font-bold dark:text-white mb-1">Brand</h1>
-    <p class="text-gray-600 dark:text-gray-400 mb-1">
+    <p class="text-gray-500 dark:text-gray-300 mb-1">
     Assets and guidelines for using Tangled's logo and brand elements.
     </p>
   </header>
···
 
       <!-- Introduction Section -->
       <section>
-        <p class="text-gray-600 dark:text-gray-400 mb-2">
+        <p class="text-gray-500 dark:text-gray-300 mb-2">
         Tangled's logo and mascot is <strong>Dolly</strong>, the first ever <em>cloned</em> mammal. Please
         follow the below guidelines when using Dolly and the logotype.
         </p>
-        <p class="text-gray-600 dark:text-gray-400 mb-2">
+        <p class="text-gray-500 dark:text-gray-300 mb-2">
         All assets are served as SVGs, and can be downloaded by right-clicking and clicking "Save image as".
         </p>
       </section>
···
         </div>
         <div class="order-1 lg:order-2">
           <h2 class="text-xl font-semibold dark:text-white mb-3">Black logotype</h2>
-          <p class="text-gray-600 dark:text-gray-400 mb-4">For use on light-colored backgrounds.</p>
+          <p class="text-gray-500 dark:text-gray-300 mb-4">For use on light-colored backgrounds.</p>
           <p class="text-gray-700 dark:text-gray-300">
           This is the preferred version of the logotype, featuring dark text and elements, ideal for light
           backgrounds and designs.
···
         </div>
         <div class="order-1 lg:order-2">
           <h2 class="text-xl font-semibold dark:text-white mb-3">White logotype</h2>
-          <p class="text-gray-600 dark:text-gray-400 mb-4">For use on dark-colored backgrounds.</p>
+          <p class="text-gray-500 dark:text-gray-300 mb-4">For use on dark-colored backgrounds.</p>
           <p class="text-gray-700 dark:text-gray-300">
             This version features white text and elements, ideal for dark backgrounds
             and inverted designs.
···
         </div>
         <div class="order-1 lg:order-2">
           <h2 class="text-xl font-semibold dark:text-white mb-3">Mark only</h2>
-          <p class="text-gray-600 dark:text-gray-400 mb-4">
+          <p class="text-gray-500 dark:text-gray-300 mb-4">
             When a smaller 1:1 logo or icon is needed, Dolly's face may be used on its own.
           </p>
           <p class="text-gray-700 dark:text-gray-300 mb-4">
···
         </div>
         <div class="order-1 lg:order-2">
           <h2 class="text-xl font-semibold dark:text-white mb-3">Colored backgrounds</h2>
-          <p class="text-gray-600 dark:text-gray-400 mb-4">
+          <p class="text-gray-500 dark:text-gray-300 mb-4">
             White logo mark on colored backgrounds.
           </p>
           <p class="text-gray-700 dark:text-gray-300 mb-4">
···
         </div>
         <div class="order-1 lg:order-2">
           <h2 class="text-xl font-semibold dark:text-white mb-3">Lighter backgrounds</h2>
-          <p class="text-gray-600 dark:text-gray-400 mb-4">
+          <p class="text-gray-500 dark:text-gray-300 mb-4">
             Dark logo mark on lighter, pastel backgrounds.
           </p>
           <p class="text-gray-700 dark:text-gray-300 mb-4">
···
         </div>
         <div class="order-1 lg:order-2">
           <h2 class="text-xl font-semibold dark:text-white mb-3">Recoloring</h2>
-          <p class="text-gray-600 dark:text-gray-400 mb-4">
+          <p class="text-gray-500 dark:text-gray-300 mb-4">
             Custom coloring of the logotype is permitted.
           </p>
           <p class="text-gray-700 dark:text-gray-300 mb-4">
···
           </p>
           <p class="text-gray-700 dark:text-gray-300 text-sm">
             <strong>Example:</strong> Gray/sand colored logotype on a light yellow/tan background.
-          </p>
-        </div>
-      </section>
-
-      <!-- Silhouette Section -->
-      <section class="grid grid-cols-1 lg:grid-cols-2 gap-8 items-center">
-        <div class="order-2 lg:order-1">
-          <div class="border border-gray-200 dark:border-gray-700 p-8 sm:p-16 bg-gray-50 dark:bg-gray-100 rounded">
-            <img src="https://assets.tangled.network/tangled_dolly_silhouette.svg"
-                 alt="Dolly silhouette"
-                 class="w-full max-w-32 mx-auto" />
-          </div>
-        </div>
-        <div class="order-1 lg:order-2">
-          <h2 class="text-xl font-semibold dark:text-white mb-3">Dolly silhouette</h2>
-          <p class="text-gray-600 dark:text-gray-400 mb-4">A minimalist version of Dolly.</p>
-          <p class="text-gray-700 dark:text-gray-300">
-            The silhouette can be used where a subtle brand presence is needed,
-            or as a background element. Works on any background color with proper contrast.
-            For example, we use this as the site's favicon.
           </p>
         </div>
       </section>

appview/pages/templates/fragments/dolly/logo.html

···
   <svg
      version="1.1"
      id="svg1"
-     class="{{ . }}"
+     class="{{ .Classes }}"
      width="25"
      height="25"
      viewBox="0 0 25 25"
···
      xmlns:svg="http://www.w3.org/2000/svg"
      xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
      xmlns:cc="http://creativecommons.org/ns#">
+    <style>
+      .dolly {
+        color: #000000;
+      }
+
+      @media (prefers-color-scheme: dark) {
+        .dolly {
+          color: #ffffff;
+        }
+      }
+    </style>
     <sodipodi:namedview
        id="namedview1"
        pagecolor="#ffffff"
···
        id="g1"
        transform="translate(-0.42924038,-0.87777209)">
       <path
-         fill="currentColor"
+         class="dolly"
+         fill="{{ or .FillColor "currentColor" }}"
          style="stroke-width:0.111183;"
          d="m 16.775491,24.987061 c -0.78517,-0.0064 -1.384202,-0.234614 -2.033994,-0.631295 -0.931792,-0.490188 -1.643475,-1.31368 -2.152014,-2.221647 C 11.781409,23.136647 10.701392,23.744942 9.4922931,24.0886 8.9774725,24.238111 8.0757679,24.389777 6.5811304,23.84827 4.4270703,23.124679 2.8580086,20.883331 3.0363279,18.599583 3.0037061,17.652919 3.3488675,16.723769 3.8381157,15.925061 2.5329485,15.224503 1.4686756,14.048584 1.0611184,12.606459 0.81344502,11.816973 0.82385989,10.966486 0.91519098,10.154906 1.2422711,8.2387903 2.6795811,6.5725716 4.5299585,5.9732484 5.2685364,4.290122 6.8802592,3.0349975 8.706276,2.7794663 c 1.2124148,-0.1688264 2.46744,0.084987 3.52811,0.7011837 1.545426,-1.7139736 4.237779,-2.2205077 6.293579,-1.1676231 1.568222,0.7488935 2.689625,2.3113526 2.961888,4.0151464 1.492195,0.5977882 2.749007,1.8168898 3.242225,3.3644951 0.329805,0.9581836 0.340709,2.0135956 0.127128,2.9974286 -0.381606,1.535184 -1.465322,2.842146 -2.868035,3.556463 0.0034,0.273204 0.901506,2.243045 0.751284,3.729647 -0.03281,1.858525 -1.211631,3.619894 -2.846433,4.475452 -0.953967,0.556812 -2.084452,0.546309 -3.120531,0.535398 z m -4.470079,-5.349839 c 1.322246,-0.147248 2.189053,-1.300106 2.862307,-2.338363 0.318287,-0.472954 0.561404,-1.002348 0.803,-1.505815 0.313265,0.287151 0.578698,0.828085 1.074141,0.956909 0.521892,0.162542 1.133743,0.03052 1.45325,-0.443554 0.611414,-1.140449 0.31004,-2.516537 -0.04602,-3.698347 C 18.232844,11.92927 17.945151,11.232927 17.397785,10.751793 17.514522,9.9283111 17.026575,9.0919791 16.332883,8.6609491 15.741721,9.1323278 14.842258,9.1294949 14.271975,8.6252369 13.178927,9.7400102 12.177239,9.7029996 11.209704,8.8195135 10.992255,8.6209543 10.577326,10.031484 9.1211947,9.2324497 8.2846288,9.9333947 7.6359672,10.607693 7.0611981,11.578553 6.5026891,12.62523 5.9177873,13.554793 5.867393,14.69141 c -0.024234,0.66432 0.4948601,1.360337 1.1982269,1.306329 0.702996,0.06277 1.1815208,-0.629091 1.7138087,-0.916491 0.079382,0.927141 0.1688108,1.923227 0.4821259,2.828358 0.3596254,1.171275 1.6262605,1.915695 2.8251855,1.745211 0.08481,-0.0066 0.218672,-0.01769 0.218672,-0.0176 z m 0.686342,-3.497495 c -0.643126,-0.394168 -0.33365,-1.249599 -0.359402,-1.870938 0.064,-0.749774 0.115321,-1.538054 0.452402,-2.221125 0.356724,-0.487008 1.226721,-0.299139 1.265134,0.325689 -0.02558,0.628509 -0.314101,1.25416 -0.279646,1.9057 -0.07482,0.544043 0.05418,1.155133 -0.186476,1.652391 -0.197455,0.275121 -0.599638,0.355105 -0.892012,0.208283 z m -2.808766,-0.358124 c -0.605767,-0.328664 -0.4133176,-1.155655 -0.5083256,-1.73063 0.078762,-0.66567 0.013203,-1.510085 0.5705316,-1.976886 0.545037,-0.380109 1.286917,0.270803 1.029164,0.868384 -0.274913,0.755214 -0.09475,1.580345 -0.08893,2.34609 -0.104009,0.451702 -0.587146,0.691508 -1.002445,0.493042 z"
          id="path4"

appview/pages/templates/fragments/dolly/silhouette.html

···
-{{ define "fragments/dolly/silhouette" }}
-<svg
-   version="1.1"
-   id="svg1"
-   width="25"
-   height="25"
-   viewBox="0 0 25 25"
-   sodipodi:docname="tangled_dolly_face_only_black_on_trans.svg"
-   inkscape:export-filename="tangled_dolly_silhouette_black_on_trans.svg"
-   inkscape:export-xdpi="96"
-   inkscape:export-ydpi="96"
-   inkscape:version="1.4 (e7c3feb100, 2024-10-09)"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:cc="http://creativecommons.org/ns#">
-   <style>
-     .dolly {
-       color: #000000;
-     }
-
-     @media (prefers-color-scheme: dark) {
-       .dolly {
-         color: #ffffff;
-       }
-     }
-   </style>
-  <sodipodi:namedview
-     id="namedview1"
-     pagecolor="#ffffff"
-     bordercolor="#000000"
-     borderopacity="0.25"
-     inkscape:showpageshadow="2"
-     inkscape:pageopacity="0.0"
-     inkscape:pagecheckerboard="true"
-     inkscape:deskcolor="#d5d5d5"
-     inkscape:zoom="64"
-     inkscape:cx="4.96875"
-     inkscape:cy="13.429688"
-     inkscape:window-width="3840"
-     inkscape:window-height="2160"
-     inkscape:window-x="0"
-     inkscape:window-y="0"
-     inkscape:window-maximized="0"
-     inkscape:current-layer="g1"
-     borderlayer="true">
-    <inkscape:page
-       x="0"
-       y="0"
-       width="25"
-       height="25"
-       id="page2"
-       margin="0"
-       bleed="0" />
-  </sodipodi:namedview>
-  <g
-     inkscape:groupmode="layer"
-     inkscape:label="Image"
-     id="g1"
-     transform="translate(-0.42924038,-0.87777209)">
-    <path
-       class="dolly"
-       fill="currentColor"
-       style="stroke-width:0.111183"
-       d="m 16.775491,24.987061 c -0.78517,-0.0064 -1.384202,-0.234614 -2.033994,-0.631295 -0.931792,-0.490188 -1.643475,-1.31368 -2.152014,-2.221647 C 11.781409,23.136647 10.701392,23.744942 9.4922931,24.0886 8.9774725,24.238111 8.0757679,24.389777 6.5811304,23.84827 4.4270703,23.124679 2.8580086,20.883331 3.0363279,18.599583 3.0037061,17.652919 3.3488675,16.723769 3.8381157,15.925061 2.5329485,15.224503 1.4686756,14.048584 1.0611184,12.606459 0.81344502,11.816973 0.82385989,10.966486 0.91519098,10.154906 1.2422711,8.2387903 2.6795811,6.5725716 4.5299585,5.9732484 5.2685364,4.290122 6.8802592,3.0349975 8.706276,2.7794663 c 1.2124148,-0.1688264 2.46744,0.084987 3.52811,0.7011837 1.545426,-1.7139736 4.237779,-2.2205077 6.293579,-1.1676231 1.568222,0.7488935 2.689625,2.3113526 2.961888,4.0151464 1.492195,0.5977882 2.749007,1.8168898 3.242225,3.3644951 0.329805,0.9581836 0.340709,2.0135956 0.127128,2.9974286 -0.381606,1.535184 -1.465322,2.842146 -2.868035,3.556463 0.0034,0.273204 0.901506,2.243045 0.751284,3.729647 -0.03281,1.858525 -1.211631,3.619894 -2.846433,4.475452 -0.953967,0.556812 -2.084452,0.546309 -3.120531,0.535398 z m -4.470079,-5.349839 c 1.322246,-0.147248 2.189053,-1.300106 2.862307,-2.338363 0.318287,-0.472954 0.561404,-1.002348 0.803,-1.505815 0.313265,0.287151 0.578698,0.828085 1.074141,0.956909 0.521892,0.162542 1.133743,0.03052 1.45325,-0.443554 0.611414,-1.140449 0.31004,-2.516537 -0.04602,-3.698347 C 18.232844,11.92927 17.945151,11.232927 17.397785,10.751793 17.514522,9.9283111 17.026575,9.0919791 16.332883,8.6609491 15.741721,9.1323278 14.842258,9.1294949 14.271975,8.6252369 13.178927,9.7400102 12.177239,9.7029996 11.209704,8.8195135 10.992255,8.6209543 10.577326,10.031484 9.1211947,9.2324497 8.2846288,9.9333947 7.6359672,10.607693 7.0611981,11.578553 6.5026891,12.62523 5.9177873,13.554793 5.867393,14.69141 c -0.024234,0.66432 0.4948601,1.360337 1.1982269,1.306329 0.702996,0.06277 1.1815208,-0.629091 1.7138087,-0.916491 0.079382,0.927141 0.1688108,1.923227 0.4821259,2.828358 0.3596254,1.171275 1.6262605,1.915695 2.8251855,1.745211 0.08481,-0.0066 0.218672,-0.01769 0.218672,-0.0176 z"
-       id="path7"
-       sodipodi:nodetypes="sccccccccccccccccccsscccccccccscccccccsc" />
-  </g>
-  <metadata
-     id="metadata1">
-    <rdf:RDF>
-      <cc:Work
-         rdf:about="">
-        <cc:license
-           rdf:resource="http://creativecommons.org/licenses/by/4.0/" />
-      </cc:Work>
-      <cc:License
-         rdf:about="http://creativecommons.org/licenses/by/4.0/">
-        <cc:permits
-           rdf:resource="http://creativecommons.org/ns#Reproduction" />
-        <cc:permits
-           rdf:resource="http://creativecommons.org/ns#Distribution" />
-        <cc:requires
-           rdf:resource="http://creativecommons.org/ns#Notice" />
-        <cc:requires
-           rdf:resource="http://creativecommons.org/ns#Attribution" />
-        <cc:permits
-           rdf:resource="http://creativecommons.org/ns#DerivativeWorks" />
-      </cc:License>
-    </rdf:RDF>
-  </metadata>
-</svg>
-{{ end }}

appview/pages/templates/fragments/logotype.html

···
 {{ define "fragments/logotype" }}
   <span class="flex items-center gap-2">
-    {{ template "fragments/dolly/logo" "size-16 text-black dark:text-white" }}
+    {{ template "fragments/dolly/logo" (dict "Classes" "size-16 text-black dark:text-white") }}
     <span class="font-bold text-4xl not-italic">tangled</span>
     <span class="font-normal not-italic text-xs rounded bg-gray-100 dark:bg-gray-700 px-1">
       alpha

appview/pages/templates/fragments/logotypeSmall.html

···
 {{ define "fragments/logotypeSmall" }}
   <span class="flex items-center gap-2">
-    {{ template "fragments/dolly/logo" "size-8 text-black dark:text-white" }}
+    {{ template "fragments/dolly/logo" (dict "Classes" "size-8 text-black dark:text-white")}}
     <span class="font-bold text-xl not-italic">tangled</span>
     <span class="font-normal not-italic text-xs rounded bg-gray-100 dark:bg-gray-700 px-1">
       alpha

appview/pages/templates/fragments/starBtn-oob.html

···
+{{ define "fragments/starBtn-oob" }}
+  <div hx-swap-oob='outerHTML:#starBtn[data-star-subject-at="{{ .SubjectAt }}"]'>
+    {{ template "fragments/starBtn" . }}
+  </div>
+{{ end }}

appview/pages/templates/fragments/starBtn.html

···
 {{ define "fragments/starBtn" }}
+    {{/* NOTE: this fragment is always replaced with hx-swap-oob */}}
     <button
         id="starBtn"
         class="btn disabled:opacity-50 disabled:cursor-not-allowed flex gap-2 items-center group"
···
         {{ end }}
 
         hx-trigger="click"
-        hx-target="this"
-        hx-swap="outerHTML"
-        hx-swap-oob='outerHTML:#starBtn[data-star-subject-at="{{ .SubjectAt }}"]'
         hx-disabled-elt="#starBtn"
     >
         {{ if .IsStarred }}

appview/pages/templates/fragments/tinyAvatarList.html

···
+{{ define "fragments/tinyAvatarList" }}
+  {{ $all := .all }}
+  {{ $classes := .classes }}
+  {{ $ps := take $all 5 }}
+  <div class="inline-flex items-center -space-x-3">
+    {{ $c := "z-50 z-40 z-30 z-20 z-10" }}
+    {{ range $i, $p := $ps }}
+      <img
+          src="{{ tinyAvatar . }}"
+          alt=""
+          class="rounded-full size-8 mr-1 border-2 border-gray-100 dark:border-gray-900 z-{{sub 5 $i}}0 {{ $classes }}"
+      />
+    {{ end }}
+
+    {{ if gt (len $all) 5 }}
+      <span class="pl-4 text-gray-500 dark:text-gray-400 text-sm">
+        +{{ sub (len $all) 5 }}
+      </span>
+    {{ end }}
+  </div>
+{{ end }}
+

appview/pages/templates/knots/index.html

···
 {{ define "docsButton" }}
 <a
 class="btn flex items-center gap-2"
-href="https://tangled.org/@tangled.org/core/blob/master/docs/spindle/hosting.md">
+href="https://docs.tangled.org/knot-self-hosting-guide.html#knot-self-hosting-guide">
 {{ i "book" "size-4" }}
 docs
 </a>

appview/pages/templates/layouts/base.html

···
             <script defer src="/static/htmx-ext-ws.min.js"></script>
             <script defer src="/static/actor-typeahead.js" type="module"></script>
 
+            <link rel="icon" href="/static/logos/dolly.ico" sizes="48x48"/>
+            <link rel="icon" href="/static/logos/dolly.svg" sizes="any" type="image/svg+xml"/>
+            <link rel="apple-touch-icon" href="/static/logos/dolly.png"/>
+
             <!-- preconnect to image cdn -->
             <link rel="preconnect" href="https://avatar.tangled.sh" />
             <link rel="preconnect" href="https://camo.tangled.sh" />

appview/pages/templates/layouts/fragments/footer.html

···
           <div class="flex flex-col gap-1">
             <div class="{{ $headerStyle }}">resources</div>
             <a href="https://blog.tangled.org" class="{{ $linkStyle }}" target="_blank" rel="noopener noreferrer">{{ i "book-open" $iconStyle }} blog</a>
-            <a href="https://tangled.org/@tangled.org/core/tree/master/docs" class="{{ $linkStyle }}">{{ i "book" $iconStyle }} docs</a>
+            <a href="https://docs.tangled.org" class="{{ $linkStyle }}">{{ i "book" $iconStyle }} docs</a>
             <a href="https://tangled.org/@tangled.org/core" class="{{ $linkStyle }}">{{ i "code" $iconStyle }} source</a>
             <a href="https://tangled.org/brand" class="{{ $linkStyle }}">{{ i "paintbrush" $iconStyle }} brand</a>
           </div>
···
           <div class="flex flex-col gap-1">
             <div class="{{ $headerStyle }}">resources</div>
             <a href="https://blog.tangled.org" class="{{ $linkStyle }}" target="_blank" rel="noopener noreferrer">{{ i "book-open" $iconStyle }} blog</a>
-            <a href="https://tangled.org/@tangled.org/core/tree/master/docs" class="{{ $linkStyle }}">{{ i "book" $iconStyle }} docs</a>
+            <a href="https://docs.tangled.org" class="{{ $linkStyle }}">{{ i "book" $iconStyle }} docs</a>
             <a href="https://tangled.org/@tangled.org/core" class="{{ $linkStyle }}">{{ i "code" $iconStyle }} source</a>
             <a href="https://tangled.org/brand" class="{{ $linkStyle }}">{{ i "paintbrush" $iconStyle }} brand</a>
           </div>

appview/pages/templates/layouts/fragments/topbar.html

···
         <div class="flex justify-between p-0 items-center">
             <div id="left-items">
               <a href="/" hx-boost="true" class="text-2xl no-underline hover:no-underline flex items-center gap-2">
-                {{ template "fragments/dolly/logo" "size-8 text-black dark:text-white" }}
-                <span class="font-bold text-xl not-italic hidden md:inline">tangled</span>
-                <span class="font-normal not-italic text-xs rounded bg-gray-100 dark:bg-gray-700 px-1 hidden md:inline">
-                  alpha
-                </span>
+                {{ template "fragments/logotypeSmall" }}
               </a>
             </div>
 

appview/pages/templates/repo/commit.html

···
   </div>
 
   <div class="flex flex-wrap items-center space-x-2">
-      <p class="flex flex-wrap items-center gap-2 text-sm text-gray-500 dark:text-gray-300">
-          {{ $did := index $.EmailToDid $commit.Author.Email }}
-
-          {{ if $did }}
-            {{ template "user/fragments/picHandleLink" $did }}
-          {{ else }}
-            <a href="mailto:{{ $commit.Author.Email }}" class="no-underline hover:underline text-gray-500 dark:text-gray-300">{{ $commit.Author.Name }}</a>
-          {{ end }}
+      <p class="flex flex-wrap items-center gap-1 text-sm text-gray-500 dark:text-gray-300">
+          {{ template "attribution" . }}
 
           <span class="px-1 select-none before:content-['\00B7']"></span>
-          {{ template "repo/fragments/time" $commit.Author.When }}
+            {{ template "repo/fragments/time" $commit.Committer.When }}
           <span class="px-1 select-none before:content-['\00B7']"></span>
 
           <a href="/{{ $repo }}/commit/{{ $commit.This }}" class="no-underline hover:underline text-gray-500 dark:text-gray-300">{{ slice $commit.This 0 8 }}</a>
···
 
 </section>
 {{end}}
+
+{{ define "attribution" }}
+  {{ $commit := .Diff.Commit }}
+  {{ $showCommitter := true }}
+  {{ if eq $commit.Author.Email $commit.Committer.Email }}
+    {{ $showCommitter = false }}
+  {{ end }}
+
+  {{ if $showCommitter }}
+    authored by {{ template "attributedUser" (list $commit.Author.Email $commit.Author.Name $.EmailToDid) }}
+    {{ range $commit.CoAuthors }} 
+      {{ template "attributedUser" (list .Email .Name $.EmailToDid) }}
+    {{ end }}
+    and committed by  {{ template "attributedUser" (list $commit.Committer.Email $commit.Committer.Name $.EmailToDid) }}
+  {{ else }}
+    {{ template "attributedUser" (list $commit.Author.Email $commit.Author.Name $.EmailToDid )}}
+  {{ end }}
+{{ end }}
+
+{{ define "attributedUser" }}
+  {{ $email := index . 0 }}
+  {{ $name := index . 1 }}
+  {{ $map := index . 2 }}
+  {{ $did := index $map $email }}
+
+  {{ if $did }}
+    {{ template "user/fragments/picHandleLink" $did }}
+  {{ else }}
+    <a href="mailto:{{ $email }}" class="no-underline hover:underline text-gray-500 dark:text-gray-300">{{ $name }}</a>
+  {{ end }}
+{{ end }}
 
 {{ define "topbarLayout" }}
   <header class="col-span-full" style="z-index: 20;">

appview/pages/templates/repo/empty.html

···
     {{ else if (and .LoggedInUser (eq .LoggedInUser.Did .RepoInfo.OwnerDid)) }}
       {{ $knot := .RepoInfo.Knot }}
       {{ if eq $knot "knot1.tangled.sh" }}
-          {{ $knot = "tangled.sh" }}
+          {{ $knot = "tangled.org" }}
       {{ end }}
       <div class="w-full flex place-content-center">
         <div class="py-6 w-fit flex flex-col gap-4">

appview/pages/templates/repo/fragments/backlinks.html

···
           <div class="flex gap-2 items-center">
             {{ if .State.IsClosed }}
               <span class="text-gray-500 dark:text-gray-400">
-                {{ i "ban" "w-4 h-4" }}
+                {{ i "ban" "size-3" }}
               </span>
             {{ else if eq .Kind.String "issues" }}
               <span class="text-green-600 dark:text-green-500">
-                {{ i "circle-dot" "w-4 h-4" }}
+                {{ i "circle-dot" "size-3" }}
               </span>
             {{ else if .State.IsOpen }}
               <span class="text-green-600 dark:text-green-500">
-                {{ i "git-pull-request" "w-4 h-4" }}
+                {{ i "git-pull-request" "size-3" }}
               </span>
             {{ else if .State.IsMerged }}
               <span class="text-purple-600 dark:text-purple-500">
-                {{ i "git-merge" "w-4 h-4" }}
+                {{ i "git-merge" "size-3" }}
               </span>
             {{ else }}
               <span class="text-gray-600 dark:text-gray-300">
-                {{ i "git-pull-request-closed" "w-4 h-4" }}
+                {{ i "git-pull-request-closed" "size-3" }}
               </span>
             {{ end }}
-            <a href="{{ . }}"><span class="text-gray-500 dark:text-gray-400">#{{ .SubjectId }}</span> {{ .Title }}</a>
+            <a href="{{ . }}" class="line-clamp-1 text-sm"><span class="text-gray-500 dark:text-gray-400">#{{ .SubjectId }}</span> {{ .Title }}</a>
           </div>
           {{ if not (eq $.RepoInfo.FullName $repoUrl) }}
           <div>

appview/pages/templates/repo/fragments/diff.html

···
     {{ else }}
     {{ range $idx, $hunk := $diff }}
       {{ with $hunk }}
-        <details open id="file-{{ .Name.New }}" class="group border border-gray-200 dark:border-gray-700 w-full mx-auto rounded bg-white dark:bg-gray-800 drop-shadow-sm" tabindex="{{ add $idx 1 }}">
+        <details open id="file-{{ .Id }}" class="group border border-gray-200 dark:border-gray-700 w-full mx-auto rounded bg-white dark:bg-gray-800 drop-shadow-sm" tabindex="{{ add $idx 1 }}">
           <summary class="list-none cursor-pointer sticky top-0">
             <div id="diff-file-header" class="rounded cursor-pointer bg-white dark:bg-gray-800 flex justify-between">
               <div id="left-side-items" class="p-2 flex gap-2 items-center overflow-x-auto">

appview/pages/templates/repo/fragments/participants.html

···
       <span class="font-bold text-gray-500 dark:text-gray-400 capitalize">Participants</span>
       <span class="bg-gray-200 dark:bg-gray-700 rounded py-1/2 px-1 ml-1">{{ len $all }}</span>
     </div>
-    <div class="flex items-center -space-x-3 mt-2">
-      {{ $c := "z-50 z-40 z-30 z-20 z-10" }}
-      {{ range $i, $p := $ps }}
-        <img
-            src="{{ tinyAvatar . }}"
-            alt=""
-            class="rounded-full h-8 w-8 mr-1 border-2 border-gray-100 dark:border-gray-900 z-{{sub 5 $i}}0"
-        />
-      {{ end }}
-
-      {{ if gt (len $all) 5 }}
-        <span class="pl-4 text-gray-500 dark:text-gray-400 text-sm">
-          +{{ sub (len $all) 5 }}
-        </span>
-      {{ end }}
-    </div>
+    {{ template "fragments/tinyAvatarList" (dict "all" $all "classes" "w-8 h-8") }}
   </div>
 {{ end }}

appview/pages/templates/repo/fragments/splitDiff.html

···
 {{- $lineNrStyle := "min-w-[3.5rem] flex-shrink-0 select-none text-right bg-white dark:bg-gray-800" -}}
 {{- $linkStyle := "text-gray-400 dark:text-gray-500 hover:underline" -}}
 {{- $lineNrSepStyle := "pr-2 border-r border-gray-200 dark:border-gray-700" -}}
-{{- $containerStyle := "flex min-w-full items-center target:border target:rounded-sm target:border-yellow-200 target:dark:border-yellow-700 scroll-mt-20" -}}
+{{- $containerStyle := "inline-flex w-full items-center target:border target:rounded-sm target:border-yellow-200 target:dark:border-yellow-700 scroll-mt-20" -}}
 {{- $emptyStyle := "bg-gray-200/30 dark:bg-gray-700/30" -}}
 {{- $addStyle := "bg-green-100 dark:bg-green-800/30 text-green-700 dark:text-green-400" -}}
 {{- $delStyle := "bg-red-100 dark:bg-red-800/30 text-red-700 dark:text-red-400 " -}}
 {{- $ctxStyle := "bg-white dark:bg-gray-800 text-gray-500 dark:text-gray-400" -}}
 {{- $opStyle := "w-5 flex-shrink-0 select-none text-center" -}}
 <div class="grid grid-cols-2 divide-x divide-gray-200 dark:divide-gray-700">
-<pre class="overflow-x-auto col-span-1"><div class="overflow-x-auto"><div class="min-w-full inline-block">{{- range .TextFragments -}}<div class="bg-gray-100 dark:bg-gray-700 text-gray-500 dark:text-gray-400 select-none text-center">&middot;&middot;&middot;</div>
+<div class="overflow-x-auto col-span-1 font-mono leading-normal"><div class="overflow-x-auto"><div class="inline-flex flex-col min-w-full">{{- range .TextFragments -}}<span class="block bg-gray-100 dark:bg-gray-700 text-gray-500 dark:text-gray-400 select-none text-center">&middot;&middot;&middot;</span>
  {{- range .LeftLines -}}
    {{- if .IsEmpty -}}
-     <div class="{{ $emptyStyle }} {{ $containerStyle }}">
-       <div class="{{$lineNrStyle}} {{$lineNrSepStyle}}"><span aria-hidden="true" class="invisible">{{.LineNumber}}</span></div>
-       <div class="{{ $opStyle }}"><span aria-hidden="true" class="invisible">{{ .Op.String }}</span></div>
-       <div class="px-2 invisible" aria-hidden="true">{{ .Content }}</div>
-     </div>
+     <span class="{{ $emptyStyle }} {{ $containerStyle }}">
+       <span class="{{$lineNrStyle}} {{$lineNrSepStyle}}"><span aria-hidden="true" class="invisible">{{.LineNumber}}</span></span>
+       <span class="{{ $opStyle }}"><span aria-hidden="true" class="invisible">{{ .Op.String }}</span></span>
+       <span class="px-2 invisible" aria-hidden="true">{{ .Content }}</span>
+     </span>
    {{- else if eq .Op.String "-" -}}
-     <div class="{{ $delStyle }} {{ $containerStyle }}" id="{{$name}}-O{{.LineNumber}}">
-       <div class="{{ $lineNrStyle }} {{ $lineNrSepStyle }}"><a class="{{$linkStyle}}" href="#{{$name}}-O{{.LineNumber}}">{{ .LineNumber }}</a></div>
-       <div class="{{ $opStyle }}">{{ .Op.String }}</div>
-       <div class="px-2">{{ .Content }}</div>
-     </div>
+    <span class="{{ $delStyle }} {{ $containerStyle }}" id="{{$name}}-O{{.LineNumber}}">
+      <span class="{{ $lineNrStyle }} {{ $lineNrSepStyle }}"><a class="{{$linkStyle}}" href="#{{$name}}-O{{.LineNumber}}">{{ .LineNumber }}</a></span>
+      <span class="{{ $opStyle }}">{{ .Op.String }}</span>
+      <span class="px-2 whitespace-pre">{{ .Content }}</span>
+    </span>
    {{- else if eq .Op.String " " -}}
-     <div class="{{ $ctxStyle }} {{ $containerStyle }}" id="{{$name}}-O{{.LineNumber}}">
-       <div class="{{ $lineNrStyle }} {{ $lineNrSepStyle }}"><a class="{{$linkStyle}}" href="#{{$name}}-O{{.LineNumber}}">{{ .LineNumber }}</a></div>
-       <div class="{{ $opStyle }}">{{ .Op.String }}</div>
-       <div class="px-2">{{ .Content }}</div>
-     </div>
+    <span class="{{ $ctxStyle }} {{ $containerStyle }}" id="{{$name}}-O{{.LineNumber}}">
+      <span class="{{ $lineNrStyle }} {{ $lineNrSepStyle }}"><a class="{{$linkStyle}}" href="#{{$name}}-O{{.LineNumber}}">{{ .LineNumber }}</a></span>
+      <span class="{{ $opStyle }}">{{ .Op.String }}</span>
+      <span class="px-2 whitespace-pre">{{ .Content }}</span>
+    </span>
    {{- end -}}
  {{- end -}}
- {{- end -}}</div></div></pre>
+ {{- end -}}</div></div></div>
 
-<pre class="overflow-x-auto col-span-1"><div class="overflow-x-auto"><div class="min-w-full inline-block">{{- range .TextFragments -}}<div class="bg-gray-100 dark:bg-gray-700 text-gray-500 dark:text-gray-400 select-none text-center">&middot;&middot;&middot;</div>
+<div class="overflow-x-auto col-span-1 font-mono leading-normal"><div class="overflow-x-auto"><div class="inline-flex flex-col min-w-full">{{- range .TextFragments -}}<span class="block bg-gray-100 dark:bg-gray-700 text-gray-500 dark:text-gray-400 select-none text-center">&middot;&middot;&middot;</span>
  {{- range .RightLines -}}
    {{- if .IsEmpty -}}
-     <div class="{{ $emptyStyle }} {{ $containerStyle }}">
-       <div class="{{$lineNrStyle}} {{$lineNrSepStyle}}"><span aria-hidden="true" class="invisible">{{.LineNumber}}</span></div>
-       <div class="{{ $opStyle }}"><span aria-hidden="true" class="invisible">{{ .Op.String }}</span></div>
-       <div class="px-2 invisible" aria-hidden="true">{{ .Content }}</div>
-     </div>
+     <span class="{{ $emptyStyle }} {{ $containerStyle }}">
+       <span class="{{$lineNrStyle}} {{$lineNrSepStyle}}"><span aria-hidden="true" class="invisible">{{.LineNumber}}</span></span>
+       <span class="{{ $opStyle }}"><span aria-hidden="true" class="invisible">{{ .Op.String }}</span></span>
+       <span class="px-2 invisible" aria-hidden="true">{{ .Content }}</span>
+     </span>
    {{- else if eq .Op.String "+" -}}
-     <div class="{{ $addStyle }} {{ $containerStyle }}" id="{{$name}}-N{{.LineNumber}}">
-       <div class="{{$lineNrStyle}} {{$lineNrSepStyle}}"><a class="{{$linkStyle}}" href="#{{$name}}-N{{.LineNumber}}">{{ .LineNumber }}</a></div>
-       <div class="{{ $opStyle }}">{{ .Op.String }}</div>
-       <div class="px-2" >{{ .Content }}</div>
-     </div>
+     <span class="{{ $addStyle }} {{ $containerStyle }}" id="{{$name}}-N{{.LineNumber}}">
+       <span class="{{$lineNrStyle}} {{$lineNrSepStyle}}"><a class="{{$linkStyle}}" href="#{{$name}}-N{{.LineNumber}}">{{ .LineNumber }}</a></span>
+       <span class="{{ $opStyle }}">{{ .Op.String }}</span>
+       <span class="px-2 whitespace-pre">{{ .Content }}</span>
+     </span>
    {{- else if eq .Op.String " " -}}
-     <div class="{{ $ctxStyle }} {{ $containerStyle }}" id="{{$name}}-N{{.LineNumber}}">
-       <div class="{{$lineNrStyle}} {{$lineNrSepStyle}}"><a class="{{$linkStyle}}" href="#{{$name}}-N{{.LineNumber}}">{{ .LineNumber }}</a></div>
-       <div class="{{ $opStyle }}">{{ .Op.String }}</div>
-       <div class="px-2">{{ .Content }}</div>
-     </div>
+     <span class="{{ $ctxStyle }} {{ $containerStyle }}" id="{{$name}}-N{{.LineNumber}}">
+       <span class="{{$lineNrStyle}} {{$lineNrSepStyle}}"><a class="{{$linkStyle}}" href="#{{$name}}-N{{.LineNumber}}">{{ .LineNumber }}</a> </span>
+       <span class="{{ $opStyle }}">{{ .Op.String }}</span>
+       <span class="px-2 whitespace-pre">{{ .Content }}</span>
+     </span>
    {{- end -}}
  {{- end -}}
- {{- end -}}</div></div></pre>
+ {{- end -}}</div></div></div>
 </div>
 {{ end }}

appview/pages/templates/repo/fragments/unifiedDiff.html

···
 {{ define "repo/fragments/unifiedDiff" }}
 {{ $name := .Id }}
-<pre class="overflow-x-auto"><div class="overflow-x-auto"><div class="min-w-full inline-block">{{- range .TextFragments -}}<div class="bg-gray-100 dark:bg-gray-700 text-gray-500 dark:text-gray-400 select-none text-center">&middot;&middot;&middot;</div>
+<div class="overflow-x-auto font-mono leading-normal"><div class="overflow-x-auto"><div class="inline-flex flex-col min-w-full">{{- range .TextFragments -}}<span class="block bg-gray-100 dark:bg-gray-700 text-gray-500 dark:text-gray-400 select-none text-center">&middot;&middot;&middot;</span>
  {{- $oldStart := .OldPosition -}}
  {{- $newStart := .NewPosition -}}
  {{- $lineNrStyle := "min-w-[3.5rem] flex-shrink-0 select-none text-right bg-white dark:bg-gray-800 target:bg-yellow-200 target:dark:bg-yellow-600" -}}
  {{- $linkStyle := "text-gray-400 dark:text-gray-500 hover:underline" -}}
  {{- $lineNrSepStyle1 := "" -}}
  {{- $lineNrSepStyle2 := "pr-2 border-r border-gray-200 dark:border-gray-700" -}}
- {{- $containerStyle := "flex min-w-full items-center target:border target:rounded-sm target:border-yellow-200 target:dark:border-yellow-700 scroll-mt-20" -}}
+ {{- $containerStyle := "inline-flex w-full items-center target:border target:rounded-sm target:border-yellow-200 target:dark:border-yellow-700 scroll-mt-20" -}}
  {{- $addStyle := "bg-green-100 dark:bg-green-800/30 text-green-700 dark:text-green-400 " -}}
  {{- $delStyle := "bg-red-100 dark:bg-red-800/30 text-red-700 dark:text-red-400 " -}}
  {{- $ctxStyle := "bg-white dark:bg-gray-800 text-gray-500 dark:text-gray-400" -}}
  {{- $opStyle := "w-5 flex-shrink-0 select-none text-center" -}}
  {{- range .Lines -}}
    {{- if eq .Op.String "+" -}}
-     <div class="{{ $addStyle }} {{ $containerStyle }}" id="{{$name}}-N{{$newStart}}">
-       <div class="{{$lineNrStyle}} {{$lineNrSepStyle1}}"><span aria-hidden="true" class="invisible">{{$newStart}}</span></div>
-       <div class="{{$lineNrStyle}} {{$lineNrSepStyle2}}"><a class="{{$linkStyle}}" href="#{{$name}}-N{{$newStart}}">{{ $newStart }}</a></div>
-       <div class="{{ $opStyle }}">{{ .Op.String }}</div>
-       <div class="px-2">{{ .Line }}</div>
-     </div>
+     <span class="{{ $addStyle }} {{ $containerStyle }}" id="{{$name}}-N{{$newStart}}">
+       <span class="{{$lineNrStyle}} {{$lineNrSepStyle1}}"><span aria-hidden="true" class="invisible">{{$newStart}}</span></span>
+       <span class="{{$lineNrStyle}} {{$lineNrSepStyle2}}"><a class="{{$linkStyle}}" href="#{{$name}}-N{{$newStart}}">{{ $newStart }}</a></span>
+       <span class="{{ $opStyle }}">{{ .Op.String }}</span>
+       <span class="px-2 whitespace-pre">{{ .Line }}</span>
+     </span>
      {{- $newStart = add64 $newStart 1 -}}
    {{- end -}}
    {{- if eq .Op.String "-" -}}
-     <div class="{{ $delStyle }} {{ $containerStyle }}" id="{{$name}}-O{{$oldStart}}">
-       <div class="{{$lineNrStyle}} {{$lineNrSepStyle1}}"><a class="{{$linkStyle}}" href="#{{$name}}-O{{$oldStart}}">{{ $oldStart }}</a></div>
-       <div class="{{$lineNrStyle}} {{$lineNrSepStyle2}}"><span aria-hidden="true" class="invisible">{{$oldStart}}</span></div>
-       <div class="{{ $opStyle }}">{{ .Op.String }}</div>
-       <div class="px-2">{{ .Line }}</div>
-     </div>
+     <span class="{{ $delStyle }} {{ $containerStyle }}" id="{{$name}}-O{{$oldStart}}">
+       <span class="{{$lineNrStyle}} {{$lineNrSepStyle1}}"><a class="{{$linkStyle}}" href="#{{$name}}-O{{$oldStart}}">{{ $oldStart }}</a></span>
+       <span class="{{$lineNrStyle}} {{$lineNrSepStyle2}}"><span aria-hidden="true" class="invisible">{{$oldStart}}</span></span>
+       <span class="{{ $opStyle }}">{{ .Op.String }}</span>
+       <span class="px-2 whitespace-pre">{{ .Line }}</span>
+     </span>
      {{- $oldStart = add64 $oldStart 1 -}}
    {{- end -}}
    {{- if eq .Op.String " " -}}
-     <div class="{{ $ctxStyle }} {{ $containerStyle }}" id="{{$name}}-O{{$oldStart}}-N{{$newStart}}">
-       <div class="{{$lineNrStyle}} {{$lineNrSepStyle1}}"><a class="{{$linkStyle}}" href="#{{$name}}-O{{$oldStart}}-N{{$newStart}}">{{ $oldStart }}</a></div>
-       <div class="{{$lineNrStyle}} {{$lineNrSepStyle2}}"><a class="{{$linkStyle}}" href="#{{$name}}-O{{$oldStart}}-N{{$newStart}}">{{ $newStart }}</a></div>
-       <div class="{{ $opStyle }}">{{ .Op.String }}</div>
-       <div class="px-2">{{ .Line }}</div>
-     </div>
+     <span class="{{ $ctxStyle }} {{ $containerStyle }}" id="{{$name}}-O{{$oldStart}}-N{{$newStart}}">
+       <span class="{{$lineNrStyle}} {{$lineNrSepStyle1}}"><a class="{{$linkStyle}}" href="#{{$name}}-O{{$oldStart}}-N{{$newStart}}">{{ $oldStart }}</a></span>
+       <span class="{{$lineNrStyle}} {{$lineNrSepStyle2}}"><a class="{{$linkStyle}}" href="#{{$name}}-O{{$oldStart}}-N{{$newStart}}">{{ $newStart }}</a></span>
+       <span class="{{ $opStyle }}">{{ .Op.String }}</span>
+       <span class="px-2 whitespace-pre">{{ .Line }}</span>
+     </span>
      {{- $newStart = add64 $newStart 1 -}}
      {{- $oldStart = add64 $oldStart 1 -}}
    {{- end -}}
  {{- end -}}
- {{- end -}}</div></div></pre>
+ {{- end -}}</div></div></div>
 {{ end }}
-

appview/pages/templates/repo/index.html

···
         {{ end }}
         <div class="flex items-center justify-between pb-5">
           {{ block "branchSelector" . }}{{ end }}
-          <div class="flex md:hidden items-center gap-2">
+          <div class="flex md:hidden items-center gap-3">
             <a href="/{{ .RepoInfo.FullName }}/commits/{{ .Ref | urlquery }}" class="inline-flex items-center text-sm gap-1 font-bold">
               {{ i "git-commit-horizontal" "w-4" "h-4" }} {{ .TotalCommits }}
             </a>
···
       <div class="px-4 py-2 border-b border-gray-200 dark:border-gray-600 flex items-center gap-4 flex-wrap">
         {{ range $value := .Languages }}
         <div
-          class="flex flex-grow items-center gap-2 text-xs align-items-center justify-center"
+          class="flex items-center gap-2 text-xs align-items-center justify-center"
         >
           {{ template "repo/fragments/colorBall" (dict "color" (langColor $value.Name)) }}
           <div>{{ or $value.Name "Other" }}
···
 
 {{ define "branchSelector" }}
   <div class="flex gap-2 items-center justify-between w-full">
-    <div class="flex gap-2 items-center">
+    <div class="flex gap-2 items-stretch">
       <select
           onchange="window.location.href = '/{{ .RepoInfo.FullName }}/tree/' + encodeURIComponent(this.value)"
           class="p-1 border max-w-32 border-gray-200 bg-white dark:bg-gray-800 dark:text-white dark:border-gray-700"
···
         <span
           class="mx-1 before:content-['·'] before:select-none"
           ></span>
-        <span>
-          {{ $did := index $.EmailToDid .Author.Email }}
-          <a href="{{ if $did }}/{{ resolve $did }}{{ else }}mailto:{{ .Author.Email }}{{ end }}"
-            class="text-gray-500 dark:text-gray-400 no-underline hover:underline"
-            >{{ if $did }}{{ template "user/fragments/picHandleLink" $did }}{{ else }}{{ .Author.Name }}{{ end }}</a>
-        </span>
+        {{ template "attribution" (list . $.EmailToDid) }}
         <div class="inline-block px-1 select-none after:content-['·']"></div>
         {{ template "repo/fragments/time" .Committer.When }}
 
···
     {{ end }}
   </div>
 </div>
+{{ end }}
+
+{{ define "attribution" }}
+  {{ $commit := index . 0 }}
+  {{ $map := index . 1 }}
+  <span class="flex items-center">
+    {{ $author := index $map $commit.Author.Email }}
+    {{ $coauthors := $commit.CoAuthors }}
+    {{ $all := list }}
+
+    {{ if $author }}
+        {{ $all = append $all $author }}
+    {{ end }}
+    {{ range $coauthors }}
+      {{ $co := index $map .Email }}
+      {{ if $co }}
+        {{ $all = append $all $co }}
+      {{ end }}
+    {{ end }}
+
+    {{ template "fragments/tinyAvatarList" (dict "all" $all "classes" "size-6") }}
+    <a href="{{ if $author }}/{{ $author }}{{ else }}mailto:{{ $commit.Author.Email }}{{ end }}"
+       class="no-underline hover:underline">
+       {{ if $author }}{{ resolve $author }}{{ else }}{{ $commit.Author.Name }}{{ end }}
+       {{ if $coauthors }} +{{ length $coauthors }}{{ end }}
+    </a>
+  </span>
 {{ end }}
 
 {{ define "branchList" }}

appview/pages/templates/repo/log.html

···
     <div class="hidden md:flex md:flex-col divide-y divide-gray-200 dark:divide-gray-700">
       {{ $grid := "grid grid-cols-14 gap-4" }}
       <div class="{{ $grid }}">
-        <div class="py-2 text-sm text-left text-gray-700 dark:text-gray-300 uppercase font-bold col-span-2">Author</div>
+        <div class="py-2 text-sm text-left text-gray-700 dark:text-gray-300 uppercase font-bold col-span-3">Author</div>
         <div class="py-2 text-sm text-left text-gray-700 dark:text-gray-300 uppercase font-bold col-span-3">Commit</div>
         <div class="py-2 text-sm text-left text-gray-700 dark:text-gray-300 uppercase font-bold col-span-6">Message</div>
-        <div class="py-2 text-sm text-left text-gray-700 dark:text-gray-300 uppercase font-bold col-span-1"></div>
         <div class="py-2 text-sm text-left text-gray-700 dark:text-gray-300 uppercase font-bold col-span-2 justify-self-end">Date</div>
       </div>
       {{ range $index, $commit := .Commits }}
         {{ $messageParts := splitN $commit.Message "\n\n" 2 }}
         <div class="{{ $grid }} py-3">
-          <div class="align-top truncate col-span-2">
-              {{ $did := index $.EmailToDid $commit.Author.Email }}
-              {{ if $did }}
-                  {{ template "user/fragments/picHandleLink" $did }}
-              {{ else }}
-                  <a href="mailto:{{ $commit.Author.Email }}" class="text-gray-700 dark:text-gray-300 no-underline hover:underline">{{ $commit.Author.Name }}</a>
-              {{ end }}
+          <div class="align-top col-span-3">
+            {{ template "attribution" (list $commit $.EmailToDid) }}
           </div>
           <div class="align-top font-mono flex items-start col-span-3">
               {{ $verified := $.VerifiedCommits.IsVerified $commit.Hash.String }}
···
           <div class="align-top col-span-6">
             <div>
                 <a href="/{{ $.RepoInfo.FullName }}/commit/{{ $commit.Hash.String }}" class="dark:text-white no-underline hover:underline">{{ index $messageParts 0 }}</a>
+
                 {{ if gt (len $messageParts) 1 }}
                 <button class="py-1/2 px-1 bg-gray-200 hover:bg-gray-400 dark:bg-gray-700 dark:hover:bg-gray-600 rounded" hx-on:click="this.parentElement.nextElementSibling.classList.toggle('hidden')">{{ i "ellipsis" "w-3 h-3" }}</button>
                 {{ end }}
···
                     </span>
                   {{ end }}
                 {{ end }}
+
+                <!-- ci status -->
+                <span class="text-xs">
+                  {{ $pipeline := index $.Pipelines .Hash.String }}
+                  {{ if and $pipeline (gt (len $pipeline.Statuses) 0) }}
+                    {{ template "repo/pipelines/fragments/pipelineSymbolLong" (dict "Pipeline" $pipeline "RepoInfo" $.RepoInfo) }}
+                  {{ end }}
+                </span>
             </div>
 
             {{ if gt (len $messageParts) 1 }}
               <p class="hidden mt-1 text-sm text-gray-600 dark:text-gray-400">{{ nl2br (index $messageParts 1) }}</p>
             {{ end }}
-          </div>
-          <div class="align-top col-span-1">
-              <!-- ci status -->
-              {{ $pipeline := index $.Pipelines .Hash.String }}
-              {{ if and $pipeline (gt (len $pipeline.Statuses) 0) }}
-                {{ template "repo/pipelines/fragments/pipelineSymbolLong" (dict "Pipeline" $pipeline "RepoInfo" $.RepoInfo) }}
-              {{ end }}
           </div>
           <div class="align-top justify-self-end text-gray-500 dark:text-gray-400 col-span-2">{{ template "repo/fragments/shortTimeAgo" $commit.Committer.When }}</div>
         </div>
···
                         </a>
                     </span>
                     <span class="mx-2 before:content-['·'] before:select-none"></span>
-                    <span>
-                        {{ $did := index $.EmailToDid $commit.Author.Email }}
-                        <a href="{{ if $did }}/{{ $did }}{{ else }}mailto:{{ $commit.Author.Email }}{{ end }}"
-                           class="text-gray-500 dark:text-gray-400 no-underline hover:underline">
-                           {{ if $did }}{{ template "user/fragments/picHandleLink" $did }}{{ else }}{{ $commit.Author.Name }}{{ end }}
-                        </a>
-                    </span>
+                    {{ template "attribution" (list $commit $.EmailToDid) }}
                     <div class="inline-block px-1 select-none after:content-['·']"></div>
                     <span>{{ template "repo/fragments/shortTime" $commit.Committer.When }}</span>
 
···
     </div>
 </section>
 
+{{ end }}
+
+{{ define "attribution" }}
+  {{ $commit := index . 0 }}
+  {{ $map := index . 1 }}
+  <span class="flex items-center gap-1">
+    {{ $author := index $map $commit.Author.Email }}
+    {{ $coauthors := $commit.CoAuthors }}
+    {{ $all := list }}
+
+    {{ if $author }}
+        {{ $all = append $all $author }}
+    {{ end }}
+    {{ range $coauthors }}
+      {{ $co := index $map .Email }}
+      {{ if $co }}
+        {{ $all = append $all $co }}
+      {{ end }}
+    {{ end }}
+
+    {{ template "fragments/tinyAvatarList" (dict "all" $all "classes" "size-6") }}
+    <a href="{{ if $author }}/{{ $author }}{{ else }}mailto:{{ $commit.Author.Email }}{{ end }}"
+       class="no-underline hover:underline">
+       {{ if $author }}{{ resolve $author }}{{ else }}{{ $commit.Author.Name }}{{ end }}
+       {{ if $coauthors }} +{{ length $coauthors }}{{ end }}
+    </a>
+  </span>
 {{ end }}
 
 {{ define "repoAfter" }}

appview/pages/templates/repo/pipelines/pipelines.html

···
       </p>
       <p>
         <span class="{{ $bullet }}">2</span>Configure your CI/CD
-        <a href="https://tangled.org/@tangled.org/core/blob/master/docs/spindle/pipeline.md" class="underline">pipeline</a>.
+        <a href="https://docs.tangled.org/spindles.html#pipelines" class="underline">pipeline</a>.
       </p>
       <p><span class="{{ $bullet }}">3</span>Trigger a workflow with a push or a pull-request!</p>
     </div>

appview/pages/templates/repo/settings/pipelines.html

···
       <p class="text-gray-500 dark:text-gray-400">
         Choose a spindle to execute your workflows on. Only repository owners
         can configure spindles. Spindles can be selfhosted,
-        <a class="text-gray-500 dark:text-gray-400 underline" href="https://tangled.org/@tangled.org/core/blob/master/docs/spindle/hosting.md">
+        <a class="text-gray-500 dark:text-gray-400 underline" href="https://docs.tangled.org/spindles.html#self-hosting-guide">
           click to learn more.
         </a>
       </p>

appview/pages/templates/spindles/index.html

···
 {{ define "docsButton" }}
 <a
 class="btn flex items-center gap-2"
-href="https://tangled.org/@tangled.org/core/blob/master/docs/spindle/hosting.md">
+href="https://docs.tangled.org/spindles.html#self-hosting-guide">
 {{ i "book" "size-4" }}
 docs
 </a>

appview/pages/templates/strings/string.html

···
         <span class="select-none">/</span>
         <a href="/strings/{{ $ownerId }}/{{ .String.Rkey }}" class="font-bold">{{ .String.Filename }}</a>
       </div>
-      <div class="flex gap-2 text-base">
+      <div class="flex gap-2 items-stretch text-base">
         {{ if and .LoggedInUser (eq .LoggedInUser.Did .String.Did) }}
           <a class="btn flex items-center gap-2 no-underline hover:no-underline p-2 group"
              hx-boost="true"

appview/pages/templates/user/followers.html

···
               "FollowersCount" .FollowersCount
               "FollowingCount" .FollowingCount) }}
     {{ else }}
-        <p class="px-6 dark:text-white">This user does not have any followers yet.</p>
+        <div class="text-base text-gray-500 flex items-center justify-center italic p-12 border border-gray-200 dark:border-gray-700 rounded">
+          <span>This user does not have any followers yet.</span>
+        </div>
     {{ end }}
   </div>
 {{ end }}

appview/pages/templates/user/following.html

···
               "FollowersCount" .FollowersCount
               "FollowingCount" .FollowingCount) }}
     {{ else }}
-        <p class="px-6 dark:text-white">This user does not follow anyone yet.</p>
+        <div class="text-base text-gray-500 flex items-center justify-center italic p-12 border border-gray-200 dark:border-gray-700 rounded">
+          <span>This user does not follow anyone yet.</span>
+        </div>
     {{ end }}
   </div>
 {{ end }}

appview/pages/templates/user/fragments/followCard.html

···
       <img class="object-cover rounded-full p-2" src="{{ fullAvatar $userIdent }}" alt="{{ $userIdent }}" />
     </div>
 
-    <div class="flex flex-col md:flex-row md:items-center md:justify-between gap-2 w-full">
+    <div class="flex flex-col md:flex-row md:items-center md:justify-between gap-2 w-full min-w-0">
       <div class="flex-1 min-h-0 justify-around flex flex-col">
         <a href="/{{ $userIdent }}">
           <span class="font-bold dark:text-white overflow-hidden text-ellipsis whitespace-nowrap max-w-full">{{ $userIdent | truncateAt30 }}</span>
         </a>
         {{ with .Profile }}
-        <p class="text-sm pb-2 md:pb-2">{{.Description}}</p>
+        <p class="text-sm pb-2 md:pb-2 break-words">{{.Description}}</p>
         {{ end }}
         <div class="text-sm flex items-center gap-2 my-2 overflow-hidden text-ellipsis whitespace-nowrap max-w-full">
           <span class="flex-shrink-0">{{ i "users" "size-4" }}</span>

appview/pages/templates/user/overview.html

···
   <p class="text-sm font-bold px-2 pb-4 dark:text-white">ACTIVITY</p>
   <div class="flex flex-col gap-4 relative">
     {{ if .ProfileTimeline.IsEmpty }}
-      <p class="dark:text-white">This user does not have any activity yet.</p>
+      <div class="text-base text-gray-500 flex items-center justify-center italic p-12 border border-gray-200 dark:border-gray-700 rounded">
+        <span class="flex items-center gap-2">
+          This user does not have any activity yet.
+        </span>
+      </div>
     {{ end }}
 
     {{ with .ProfileTimeline }}
···
         {{ template "user/fragments/repoCard" (list $ . false) }}
       </div>
       {{ else }}
-        <p class="dark:text-white">This user does not have any pinned repos.</p>
+        <div class="text-base text-gray-500 flex items-center justify-center italic p-12 border border-gray-200 dark:border-gray-700 rounded">
+          <span class="flex items-center gap-2">
+            This user does not have any pinned repos.
+          </span>
+        </div>
       {{ end }}
     </div>
   </div>

appview/pages/templates/user/repos.html

···
          {{ template "user/fragments/repoCard" (list $ . false) }}
       </div>
     {{ else }}
-        <p class="px-6 dark:text-white">This user does not have any repos yet.</p>
+        <div class="text-base text-gray-500 flex items-center justify-center italic p-12 border border-gray-200 dark:border-gray-700 rounded">
+          <span>This user does not have any repos yet.</span>
+        </div>
     {{ end }}
   </div>
 {{ end }}

appview/pages/templates/user/signup.html

···
                     page to complete your registration.
                     </span>
                     <div class="w-full mt-4 text-center">
-                      <div class="cf-turnstile" data-sitekey="{{ .CloudflareSiteKey }}"></div>
+                      <div class="cf-turnstile" data-sitekey="{{ .CloudflareSiteKey }}" data-size="flexible"></div>
                     </div>
                     <button class="btn text-base w-full my-2 mt-6" type="submit" id="signup-button" tabindex="7" >
                       <span>join now</span>
                     </button>
+                    <p class="text-sm text-gray-500">
+                      Already have an AT Protocol account? <a href="/login" class="underline">Login to Tangled</a>.
+                    </p>
+
+                    <p id="signup-msg" class="error w-full"></p>
+                    <p class="text-sm text-gray-500 pt-4">
+                      By signing up, you agree to our <a href="/terms" class="underline">Terms of Service</a> and <a href="/privacy" class="underline">Privacy Policy</a>.
+                    </p>
                 </form>
-                <p class="text-sm text-gray-500">
-                  Already have an AT Protocol account? <a href="/login" class="underline">Login to Tangled</a>.
-                </p>
-
-                <p id="signup-msg" class="error w-full"></p>
             </main>
         </body>
     </html>

appview/pages/templates/user/starred.html

···
          {{ template "user/fragments/repoCard" (list $ . true) }}
       </div>
     {{ else }}
-        <p class="px-6 dark:text-white">This user does not have any starred repos yet.</p>
+        <div class="text-base text-gray-500 flex items-center justify-center italic p-12 border border-gray-200 dark:border-gray-700 rounded">
+          <span>This user does not have any starred repos yet.</span>
+        </div>
     {{ end }}
   </div>
 {{ end }}

appview/pages/templates/user/strings.html

···
         {{ template "singleString" (list $ .) }}
       </div>
     {{ else }}
-      <p class="px-6 dark:text-white">This user does not have any strings yet.</p>
+      <div class="text-base text-gray-500 flex items-center justify-center italic p-12 border border-gray-200 dark:border-gray-700 rounded">
+        <span>This user does not have any strings yet.</span>
+      </div>
     {{ end }}
   </div>
 {{ end }}

appview/pipelines/pipelines.go

···
 	"tangled.org/core/appview/reporesolver"
 	"tangled.org/core/eventconsumer"
 	"tangled.org/core/idresolver"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 	spindlemodel "tangled.org/core/spindle/models"
 
···
 	ps, err := db.GetPipelineStatuses(
 		p.db,
 		30,
-		db.FilterEq("repo_owner", f.Did),
-		db.FilterEq("repo_name", f.Name),
-		db.FilterEq("knot", f.Knot),
+		orm.FilterEq("repo_owner", f.Did),
+		orm.FilterEq("repo_name", f.Name),
+		orm.FilterEq("knot", f.Knot),
 	)
 	if err != nil {
 		l.Error("failed to query db", "err", err)
···
 	ps, err := db.GetPipelineStatuses(
 		p.db,
 		1,
-		db.FilterEq("repo_owner", f.Did),
-		db.FilterEq("repo_name", f.Name),
-		db.FilterEq("knot", f.Knot),
-		db.FilterEq("id", pipelineId),
+		orm.FilterEq("repo_owner", f.Did),
+		orm.FilterEq("repo_name", f.Name),
+		orm.FilterEq("knot", f.Knot),
+		orm.FilterEq("id", pipelineId),
 	)
 	if err != nil {
 		l.Error("failed to query db", "err", err)
···
 	ps, err := db.GetPipelineStatuses(
 		p.db,
 		1,
-		db.FilterEq("repo_owner", f.Did),
-		db.FilterEq("repo_name", f.Name),
-		db.FilterEq("knot", f.Knot),
-		db.FilterEq("id", pipelineId),
+		orm.FilterEq("repo_owner", f.Did),
+		orm.FilterEq("repo_name", f.Name),
+		orm.FilterEq("knot", f.Knot),
+		orm.FilterEq("id", pipelineId),
 	)
 	if err != nil || len(ps) != 1 {
 		l.Error("pipeline query failed", "err", err, "count", len(ps))

appview/pulls/opengraph.go

···
 	"tangled.org/core/appview/db"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/ogcard"
+	"tangled.org/core/orm"
 	"tangled.org/core/patchutil"
 	"tangled.org/core/types"
 )
···
 	dollyX := dollyBounds.Min.X + (dollyBounds.Dx() / 2) - (dollySize / 2)
 	dollyY := statsY + iconBaselineOffset - dollySize/2 + 25
 	dollyColor := color.RGBA{180, 180, 180, 255} // light gray
-	err = dollyArea.DrawDollySilhouette(dollyX, dollyY, dollySize, dollyColor)
+	err = dollyArea.DrawDolly(dollyX, dollyY, dollySize, dollyColor)
 	if err != nil {
 		log.Printf("dolly silhouette not available (this is ok): %v", err)
 	}
···
 	}
 
 	// Get comment count from database
-	comments, err := db.GetPullComments(s.db, db.FilterEq("pull_id", pull.ID))
+	comments, err := db.GetPullComments(s.db, orm.FilterEq("pull_id", pull.ID))
 	if err != nil {
 		log.Printf("failed to get pull comments: %v", err)
 	}

appview/pulls/pulls.go

···
 	"tangled.org/core/appview/config"
 	"tangled.org/core/appview/db"
 	pulls_indexer "tangled.org/core/appview/indexer/pulls"
+	"tangled.org/core/appview/mentions"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/notify"
 	"tangled.org/core/appview/oauth"
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/pages/markup"
 	"tangled.org/core/appview/pages/repoinfo"
-	"tangled.org/core/appview/refresolver"
 	"tangled.org/core/appview/reporesolver"
 	"tangled.org/core/appview/validator"
 	"tangled.org/core/appview/xrpcclient"
 	"tangled.org/core/idresolver"
+	"tangled.org/core/orm"
 	"tangled.org/core/patchutil"
 	"tangled.org/core/rbac"
 	"tangled.org/core/tid"
···
 )
 
 type Pulls struct {
-	oauth        *oauth.OAuth
-	repoResolver *reporesolver.RepoResolver
-	pages        *pages.Pages
-	idResolver   *idresolver.Resolver
-	refResolver  *refresolver.Resolver
-	db           *db.DB
-	config       *config.Config
-	notifier     notify.Notifier
-	enforcer     *rbac.Enforcer
-	logger       *slog.Logger
-	validator    *validator.Validator
-	indexer      *pulls_indexer.Indexer
+	oauth            *oauth.OAuth
+	repoResolver     *reporesolver.RepoResolver
+	pages            *pages.Pages
+	idResolver       *idresolver.Resolver
+	mentionsResolver *mentions.Resolver
+	db               *db.DB
+	config           *config.Config
+	notifier         notify.Notifier
+	enforcer         *rbac.Enforcer
+	logger           *slog.Logger
+	validator        *validator.Validator
+	indexer          *pulls_indexer.Indexer
 }
 
 func New(
···
 	repoResolver *reporesolver.RepoResolver,
 	pages *pages.Pages,
 	resolver *idresolver.Resolver,
-	refResolver *refresolver.Resolver,
+	mentionsResolver *mentions.Resolver,
 	db *db.DB,
 	config *config.Config,
 	notifier notify.Notifier,
···
 	logger *slog.Logger,
 ) *Pulls {
 	return &Pulls{
-		oauth:        oauth,
-		repoResolver: repoResolver,
-		pages:        pages,
-		idResolver:   resolver,
-		refResolver:  refResolver,
-		db:           db,
-		config:       config,
-		notifier:     notifier,
-		enforcer:     enforcer,
-		logger:       logger,
-		validator:    validator,
-		indexer:      indexer,
+		oauth:            oauth,
+		repoResolver:     repoResolver,
+		pages:            pages,
+		idResolver:       resolver,
+		mentionsResolver: mentionsResolver,
+		db:               db,
+		config:           config,
+		notifier:         notifier,
+		enforcer:         enforcer,
+		logger:           logger,
+		validator:        validator,
+		indexer:          indexer,
 	}
 }
 
···
 	ps, err := db.GetPipelineStatuses(
 		s.db,
 		len(shas),
-		db.FilterEq("repo_owner", f.Did),
-		db.FilterEq("repo_name", f.Name),
-		db.FilterEq("knot", f.Knot),
-		db.FilterIn("sha", shas),
+		orm.FilterEq("repo_owner", f.Did),
+		orm.FilterEq("repo_name", f.Name),
+		orm.FilterEq("knot", f.Knot),
+		orm.FilterIn("sha", shas),
 	)
 	if err != nil {
 		log.Printf("failed to fetch pipeline statuses: %s", err)
···
 
 	labelDefs, err := db.GetLabelDefinitions(
 		s.db,
-		db.FilterIn("at_uri", f.Labels),
-		db.FilterContains("scope", tangled.RepoPullNSID),
+		orm.FilterIn("at_uri", f.Labels),
+		orm.FilterContains("scope", tangled.RepoPullNSID),
 	)
 	if err != nil {
 		log.Println("failed to fetch labels", err)
···
 
 	pulls, err := db.GetPulls(
 		s.db,
-		db.FilterIn("id", ids),
+		orm.FilterIn("id", ids),
 	)
 	if err != nil {
 		log.Println("failed to get pulls", err)
···
 	ps, err := db.GetPipelineStatuses(
 		s.db,
 		len(shas),
-		db.FilterEq("repo_owner", f.Did),
-		db.FilterEq("repo_name", f.Name),
-		db.FilterEq("knot", f.Knot),
-		db.FilterIn("sha", shas),
+		orm.FilterEq("repo_owner", f.Did),
+		orm.FilterEq("repo_name", f.Name),
+		orm.FilterEq("knot", f.Knot),
+		orm.FilterIn("sha", shas),
 	)
 	if err != nil {
 		log.Printf("failed to fetch pipeline statuses: %s", err)
···
 
 	labelDefs, err := db.GetLabelDefinitions(
 		s.db,
-		db.FilterIn("at_uri", f.Labels),
-		db.FilterContains("scope", tangled.RepoPullNSID),
+		orm.FilterIn("at_uri", f.Labels),
+		orm.FilterContains("scope", tangled.RepoPullNSID),
 	)
 	if err != nil {
 		log.Println("failed to fetch labels", err)
···
 			return
 		}
 
-		mentions, references := s.refResolver.Resolve(r.Context(), body)
+		mentions, references := s.mentionsResolver.Resolve(r.Context(), body)
 
 		// Start a transaction
 		tx, err := s.db.BeginTx(r.Context(), nil)
···
 		}
 	}
 
-	mentions, references := s.refResolver.Resolve(r.Context(), body)
+	mentions, references := s.mentionsResolver.Resolve(r.Context(), body)
 
 	rkey := tid.TID()
 	initialSubmission := models.PullSubmission{
···
 		return
 	}
 
+	blob, err := comatproto.RepoUploadBlob(r.Context(), client, strings.NewReader(patch))
+	if err != nil {
+		log.Println("failed to upload patch", err)
+		s.pages.Notice(w, "pull", "Failed to create pull request. Try again later.")
+		return
+	}
+
 	_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 		Collection: tangled.RepoPullNSID,
 		Repo:       user.Did,
···
 					Repo:   string(repo.RepoAt()),
 					Branch: targetBranch,
 				},
-				Patch:     patch,
+				PatchBlob: blob.Blob,
 				Source:    recordPullSource,
 				CreatedAt: time.Now().Format(time.RFC3339),
 			},
···
 	// apply all record creations at once
 	var writes []*comatproto.RepoApplyWrites_Input_Writes_Elem
 	for _, p := range stack {
+		blob, err := comatproto.RepoUploadBlob(r.Context(), client, strings.NewReader(p.LatestPatch()))
+		if err != nil {
+			log.Println("failed to upload patch blob", err)
+			s.pages.Notice(w, "pull", "Failed to create pull request. Try again later.")
+			return
+		}
+
 		record := p.AsRecord()
-		write := comatproto.RepoApplyWrites_Input_Writes_Elem{
+		record.PatchBlob = blob.Blob
+		writes = append(writes, &comatproto.RepoApplyWrites_Input_Writes_Elem{
 			RepoApplyWrites_Create: &comatproto.RepoApplyWrites_Create{
 				Collection: tangled.RepoPullNSID,
 				Rkey:       &p.Rkey,
···
 					Val: &record,
 				},
 			},
-		}
-		writes = append(writes, &write)
+		})
 	}
 	_, err = comatproto.RepoApplyWrites(r.Context(), client, &comatproto.RepoApplyWrites_Input{
 		Repo:   user.Did,
···
 			s.pages.Notice(w, "pull", "Failed to create pull request. Try again later.")
 			return
 		}
+
 	}
 
 	if err = tx.Commit(); err != nil {
 		log.Println("failed to create pull request", err)
 		s.pages.Notice(w, "pull", "Failed to create pull request. Try again later.")
 		return
+	}
+
+	// notify about each pull
+	//
+	// this is performed after tx.Commit, because it could result in a locked DB otherwise
+	for _, p := range stack {
+		s.notifier.NewPull(r.Context(), p)
 	}
 
 	ownerSlashRepo := reporesolver.GetBaseRepoPath(r, repo)
···
 	// fork repo
 	repo, err := db.GetRepo(
 		s.db,
-		db.FilterEq("did", forkOwnerDid),
-		db.FilterEq("name", forkName),
+		orm.FilterEq("did", forkOwnerDid),
+		orm.FilterEq("name", forkName),
 	)
 	if err != nil {
 		log.Println("failed to get repo", "did", forkOwnerDid, "name", forkName, "err", err)
···
 		return
 	}
 
-	var recordPullSource *tangled.RepoPull_Source
-	if pull.IsBranchBased() {
-		recordPullSource = &tangled.RepoPull_Source{
-			Branch: pull.PullSource.Branch,
-			Sha:    sourceRev,
-		}
-	}
-	if pull.IsForkBased() {
-		repoAt := pull.PullSource.RepoAt.String()
-		recordPullSource = &tangled.RepoPull_Source{
-			Branch: pull.PullSource.Branch,
-			Repo:   &repoAt,
-			Sha:    sourceRev,
-		}
+	blob, err := comatproto.RepoUploadBlob(r.Context(), client, strings.NewReader(patch))
+	if err != nil {
+		log.Println("failed to upload patch blob", err)
+		s.pages.Notice(w, "resubmit-error", "Failed to update pull request on the PDS. Try again later.")
+		return
 	}
+	record := pull.AsRecord()
+	record.PatchBlob = blob.Blob
+	record.CreatedAt = time.Now().Format(time.RFC3339)
 
 	_, err = comatproto.RepoPutRecord(r.Context(), client, &comatproto.RepoPutRecord_Input{
 		Collection: tangled.RepoPullNSID,
···
 		Rkey:       pull.Rkey,
 		SwapRecord: ex.Cid,
 		Record: &lexutil.LexiconTypeDecoder{
-			Val: &tangled.RepoPull{
-				Title: pull.Title,
-				Target: &tangled.RepoPull_Target{
-					Repo:   string(repo.RepoAt()),
-					Branch: pull.TargetBranch,
-				},
-				Patch:     patch, // new patch
-				Source:    recordPullSource,
-				CreatedAt: time.Now().Format(time.RFC3339),
-			},
+			Val: &record,
 		},
 	})
 	if err != nil {
···
 	}
 	defer tx.Rollback()
 
+	client, err := s.oauth.AuthorizedClient(r)
+	if err != nil {
+		log.Println("failed to authorize client")
+		s.pages.Notice(w, "resubmit-error", "Failed to create pull request. Try again later.")
+		return
+	}
+
 	// pds updates to make
 	var writes []*comatproto.RepoApplyWrites_Input_Writes_Elem
 
···
 			return
 		}
 
+		blob, err := comatproto.RepoUploadBlob(r.Context(), client, strings.NewReader(patch))
+		if err != nil {
+			log.Println("failed to upload patch blob", err)
+			s.pages.Notice(w, "resubmit-error", "Failed to update pull request on the PDS. Try again later.")
+			return
+		}
 		record := p.AsRecord()
+		record.PatchBlob = blob.Blob
 		writes = append(writes, &comatproto.RepoApplyWrites_Input_Writes_Elem{
 			RepoApplyWrites_Create: &comatproto.RepoApplyWrites_Create{
 				Collection: tangled.RepoPullNSID,
···
 			return
 		}
 
+		blob, err := comatproto.RepoUploadBlob(r.Context(), client, strings.NewReader(patch))
+		if err != nil {
+			log.Println("failed to upload patch blob", err)
+			s.pages.Notice(w, "resubmit-error", "Failed to update pull request on the PDS. Try again later.")
+			return
+		}
 		record := np.AsRecord()
-
+		record.PatchBlob = blob.Blob
 		writes = append(writes, &comatproto.RepoApplyWrites_Input_Writes_Elem{
 			RepoApplyWrites_Update: &comatproto.RepoApplyWrites_Update{
 				Collection: tangled.RepoPullNSID,
···
 			tx,
 			p.ParentChangeId,
 			// these should be enough filters to be unique per-stack
-			db.FilterEq("repo_at", p.RepoAt.String()),
-			db.FilterEq("owner_did", p.OwnerDid),
-			db.FilterEq("change_id", p.ChangeId),
+			orm.FilterEq("repo_at", p.RepoAt.String()),
+			orm.FilterEq("owner_did", p.OwnerDid),
+			orm.FilterEq("change_id", p.ChangeId),
 		)
 
 		if err != nil {
···
 	if err != nil {
 		log.Println("failed to resubmit pull", err)
 		s.pages.Notice(w, "pull-resubmit-error", "Failed to resubmit pull request. Try again later.")
-		return
-	}
-
-	client, err := s.oauth.AuthorizedClient(r)
-	if err != nil {
-		log.Println("failed to authorize client")
-		s.pages.Notice(w, "resubmit-error", "Failed to create pull request. Try again later.")
 		return
 	}
 
···
 		body := fp.Body
 		rkey := tid.TID()
 
-		mentions, references := s.refResolver.Resolve(ctx, body)
+		mentions, references := s.mentionsResolver.Resolve(ctx, body)
 
 		initialSubmission := models.PullSubmission{
 			Patch:     fp.Raw,

appview/refresolver/resolver.go appview/mentions/resolver.go

···
-package refresolver
+package mentions
 
 import (
 	"context"
···
 
 func (r *Resolver) Resolve(ctx context.Context, source string) ([]syntax.DID, []syntax.ATURI) {
 	l := r.logger.With("method", "Resolve")
+
 	rawMentions, rawRefs := markup.FindReferences(r.config.Core.AppviewHost, source)
 	l.Debug("found possible references", "mentions", rawMentions, "refs", rawRefs)
+
 	idents := r.idResolver.ResolveIdents(ctx, rawMentions)
 	var mentions []syntax.DID
 	for _, ident := range idents {

appview/repo/archive.go

···
 	l := rp.logger.With("handler", "DownloadArchive")
 	ref := chi.URLParam(r, "ref")
 	ref, _ = url.PathUnescape(ref)
+	ref = strings.TrimSuffix(ref, ".tar.gz")
 	f, err := rp.repoResolver.Resolve(r)
 	if err != nil {
 		l.Error("failed to get repo and knot", "err", err)

appview/repo/artifact.go

···
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/xrpcclient"
+	"tangled.org/core/orm"
 	"tangled.org/core/tid"
 	"tangled.org/core/types"
 
···
 
 	artifacts, err := db.GetArtifact(
 		rp.db,
-		db.FilterEq("repo_at", f.RepoAt()),
-		db.FilterEq("tag", tag.Tag.Hash[:]),
-		db.FilterEq("name", filename),
+		orm.FilterEq("repo_at", f.RepoAt()),
+		orm.FilterEq("tag", tag.Tag.Hash[:]),
+		orm.FilterEq("name", filename),
 	)
 	if err != nil {
 		log.Println("failed to get artifacts", err)
···
 
 	artifacts, err := db.GetArtifact(
 		rp.db,
-		db.FilterEq("repo_at", f.RepoAt()),
-		db.FilterEq("tag", tag[:]),
-		db.FilterEq("name", filename),
+		orm.FilterEq("repo_at", f.RepoAt()),
+		orm.FilterEq("tag", tag[:]),
+		orm.FilterEq("name", filename),
 	)
 	if err != nil {
 		log.Println("failed to get artifacts", err)
···
 	defer tx.Rollback()
 
 	err = db.DeleteArtifact(tx,
-		db.FilterEq("repo_at", f.RepoAt()),
-		db.FilterEq("tag", artifact.Tag[:]),
-		db.FilterEq("name", filename),
+		orm.FilterEq("repo_at", f.RepoAt()),
+		orm.FilterEq("tag", artifact.Tag[:]),
+		orm.FilterEq("name", filename),
 	)
 	if err != nil {
 		log.Println("failed to remove artifact record from db", err)

appview/repo/feed.go

···
 	"tangled.org/core/appview/db"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/pagination"
+	"tangled.org/core/orm"
 
 	"github.com/bluesky-social/indigo/atproto/identity"
 	"github.com/bluesky-social/indigo/atproto/syntax"
···
 func (rp *Repo) getRepoFeed(ctx context.Context, repo *models.Repo, ownerSlashRepo string) (*feeds.Feed, error) {
 	const feedLimitPerType = 100
 
-	pulls, err := db.GetPullsWithLimit(rp.db, feedLimitPerType, db.FilterEq("repo_at", repo.RepoAt()))
+	pulls, err := db.GetPullsWithLimit(rp.db, feedLimitPerType, orm.FilterEq("repo_at", repo.RepoAt()))
 	if err != nil {
 		return nil, err
 	}
···
 	issues, err := db.GetIssuesPaginated(
 		rp.db,
 		pagination.Page{Limit: feedLimitPerType},
-		db.FilterEq("repo_at", repo.RepoAt()),
+		orm.FilterEq("repo_at", repo.RepoAt()),
 	)
 	if err != nil {
 		return nil, err

appview/repo/index.go

···
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/xrpcclient"
+	"tangled.org/core/orm"
 	"tangled.org/core/types"
 
 	"github.com/go-chi/chi/v5"
···
 		l.Error("failed to get email to did map", "err", err)
 	}
 
-	vc, err := commitverify.GetVerifiedObjectCommits(rp.db, emailToDidMap, commitsTrunc)
+	vc, err := commitverify.GetVerifiedCommits(rp.db, emailToDidMap, commitsTrunc)
 	if err != nil {
 		l.Error("failed to GetVerifiedObjectCommits", "err", err)
 	}
···
 	// first attempt to fetch from db
 	langs, err := db.GetRepoLanguages(
 		rp.db,
-		db.FilterEq("repo_at", repo.RepoAt()),
-		db.FilterEq("ref", currentRef),
+		orm.FilterEq("repo_at", repo.RepoAt()),
+		orm.FilterEq("ref", currentRef),
 	)
 
 	if err != nil || langs == nil {

appview/repo/log.go

···
 		l.Error("failed to fetch email to did mapping", "err", err)
 	}
 
-	vc, err := commitverify.GetVerifiedObjectCommits(rp.db, emailToDidMap, xrpcResp.Commits)
+	vc, err := commitverify.GetVerifiedCommits(rp.db, emailToDidMap, xrpcResp.Commits)
 	if err != nil {
 		l.Error("failed to GetVerifiedObjectCommits", "err", err)
 	}
···
 		l.Error("failed to get email to did mapping", "err", err)
 	}
 
-	vc, err := commitverify.GetVerifiedCommits(rp.db, emailToDidMap, []types.NiceDiff{*result.Diff})
+	vc, err := commitverify.GetVerifiedCommits(rp.db, emailToDidMap, []types.Commit{result.Diff.Commit})
 	if err != nil {
 		l.Error("failed to GetVerifiedCommits", "err", err)
 	}

appview/repo/opengraph.go

···
 	"tangled.org/core/appview/db"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/ogcard"
+	"tangled.org/core/orm"
 	"tangled.org/core/types"
 )
 
···
 	dollyX := dollyBounds.Min.X + (dollyBounds.Dx() / 2) - (dollySize / 2)
 	dollyY := statsY + iconBaselineOffset - dollySize/2 + 25
 	dollyColor := color.RGBA{180, 180, 180, 255} // light gray
-	err = dollyArea.DrawDollySilhouette(dollyX, dollyY, dollySize, dollyColor)
+	err = dollyArea.DrawDolly(dollyX, dollyY, dollySize, dollyColor)
 	if err != nil {
 		log.Printf("dolly silhouette not available (this is ok): %v", err)
 	}
···
 	var languageStats []types.RepoLanguageDetails
 	langs, err := db.GetRepoLanguages(
 		rp.db,
-		db.FilterEq("repo_at", f.RepoAt()),
-		db.FilterEq("is_default_ref", 1),
+		orm.FilterEq("repo_at", f.RepoAt()),
+		orm.FilterEq("is_default_ref", 1),
 	)
 	if err != nil {
 		log.Printf("failed to get language stats from db: %v", err)

appview/repo/repo.go

···
 	xrpcclient "tangled.org/core/appview/xrpcclient"
 	"tangled.org/core/eventconsumer"
 	"tangled.org/core/idresolver"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 	"tangled.org/core/tid"
 	"tangled.org/core/xrpc/serviceauth"
···
 	// get form values
 	labelId := r.FormValue("label-id")
 
-	label, err := db.GetLabelDefinition(rp.db, db.FilterEq("id", labelId))
+	label, err := db.GetLabelDefinition(rp.db, orm.FilterEq("id", labelId))
 	if err != nil {
 		fail("Failed to find label definition.", err)
 		return
···
 
 	err = db.UnsubscribeLabel(
 		tx,
-		db.FilterEq("repo_at", f.RepoAt()),
-		db.FilterEq("label_at", removedAt),
+		orm.FilterEq("repo_at", f.RepoAt()),
+		orm.FilterEq("label_at", removedAt),
 	)
 	if err != nil {
 		fail("Failed to unsubscribe label.", err)
 		return
 	}
 
-	err = db.DeleteLabelDefinition(tx, db.FilterEq("id", label.Id))
+	err = db.DeleteLabelDefinition(tx, orm.FilterEq("id", label.Id))
 	if err != nil {
 		fail("Failed to delete label definition.", err)
 		return
···
 	}
 
 	labelAts := r.Form["label"]
-	_, err = db.GetLabelDefinitions(rp.db, db.FilterIn("at_uri", labelAts))
+	_, err = db.GetLabelDefinitions(rp.db, orm.FilterIn("at_uri", labelAts))
 	if err != nil {
 		fail("Failed to subscribe to label.", err)
 		return
···
 	}
 
 	labelAts := r.Form["label"]
-	_, err = db.GetLabelDefinitions(rp.db, db.FilterIn("at_uri", labelAts))
+	_, err = db.GetLabelDefinitions(rp.db, orm.FilterIn("at_uri", labelAts))
 	if err != nil {
 		fail("Failed to unsubscribe to label.", err)
 		return
···
 
 	err = db.UnsubscribeLabel(
 		rp.db,
-		db.FilterEq("repo_at", f.RepoAt()),
-		db.FilterIn("label_at", labelAts),
+		orm.FilterEq("repo_at", f.RepoAt()),
+		orm.FilterIn("label_at", labelAts),
 	)
 	if err != nil {
 		fail("Failed to unsubscribe label.", err)
···
 
 	labelDefs, err := db.GetLabelDefinitions(
 		rp.db,
-		db.FilterIn("at_uri", f.Labels),
-		db.FilterContains("scope", subject.Collection().String()),
+		orm.FilterIn("at_uri", f.Labels),
+		orm.FilterContains("scope", subject.Collection().String()),
 	)
 	if err != nil {
 		l.Error("failed to fetch label defs", "err", err)
···
 		defs[l.AtUri().String()] = &l
 	}
 
-	states, err := db.GetLabels(rp.db, db.FilterEq("subject", subject))
+	states, err := db.GetLabels(rp.db, orm.FilterEq("subject", subject))
 	if err != nil {
 		l.Error("failed to build label state", "err", err)
 		return
···
 
 	labelDefs, err := db.GetLabelDefinitions(
 		rp.db,
-		db.FilterIn("at_uri", f.Labels),
-		db.FilterContains("scope", subject.Collection().String()),
+		orm.FilterIn("at_uri", f.Labels),
+		orm.FilterContains("scope", subject.Collection().String()),
 	)
 	if err != nil {
 		l.Error("failed to fetch labels", "err", err)
···
 		defs[l.AtUri().String()] = &l
 	}
 
-	states, err := db.GetLabels(rp.db, db.FilterEq("subject", subject))
+	states, err := db.GetLabels(rp.db, orm.FilterEq("subject", subject))
 	if err != nil {
 		l.Error("failed to build label state", "err", err)
 		return
···
 		// in the user's account.
 		existingRepo, err := db.GetRepo(
 			rp.db,
-			db.FilterEq("did", user.Did),
-			db.FilterEq("name", forkName),
+			orm.FilterEq("did", user.Did),
+			orm.FilterEq("name", forkName),
 		)
 		if err != nil {
 			if !errors.Is(err, sql.ErrNoRows) {

appview/repo/repo_util.go

···
 package repo
 
 import (
+	"maps"
 	"slices"
 	"sort"
 	"strings"
 
 	"tangled.org/core/appview/db"
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 	"tangled.org/core/types"
-
-	"github.com/go-git/go-git/v5/plumbing/object"
 )
 
 func sortFiles(files []types.NiceTree) {
···
 	})
 }
 
-func uniqueEmails(commits []*object.Commit) []string {
+func uniqueEmails(commits []types.Commit) []string {
 	emails := make(map[string]struct{})
 	for _, commit := range commits {
-		if commit.Author.Email != "" {
-			emails[commit.Author.Email] = struct{}{}
-		}
-		if commit.Committer.Email != "" {
-			emails[commit.Committer.Email] = struct{}{}
+		emails[commit.Author.Email] = struct{}{}
+		emails[commit.Committer.Email] = struct{}{}
+		for _, c := range commit.CoAuthors() {
+			emails[c.Email] = struct{}{}
 		}
 	}
-	var uniqueEmails []string
-	for email := range emails {
-		uniqueEmails = append(uniqueEmails, email)
-	}
-	return uniqueEmails
+
+	// delete empty emails if any, from the set
+	delete(emails, "")
+
+	return slices.Collect(maps.Keys(emails))
 }
 
 func balanceIndexItems(commitCount, branchCount, tagCount, fileCount int) (commitsTrunc int, branchesTrunc int, tagsTrunc int) {
···
 	ps, err := db.GetPipelineStatuses(
 		d,
 		len(shas),
-		db.FilterEq("repo_owner", repo.Did),
-		db.FilterEq("repo_name", repo.Name),
-		db.FilterEq("knot", repo.Knot),
-		db.FilterIn("sha", shas),
+		orm.FilterEq("repo_owner", repo.Did),
+		orm.FilterEq("repo_name", repo.Name),
+		orm.FilterEq("knot", repo.Knot),
+		orm.FilterIn("sha", shas),
 	)
 	if err != nil {
 		return nil, err

appview/repo/settings.go

···
 	"tangled.org/core/appview/oauth"
 	"tangled.org/core/appview/pages"
 	xrpcclient "tangled.org/core/appview/xrpcclient"
+	"tangled.org/core/orm"
 	"tangled.org/core/types"
 
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
···
 		return
 	}
 
-	defaultLabels, err := db.GetLabelDefinitions(rp.db, db.FilterIn("at_uri", rp.config.Label.DefaultLabelDefs))
+	defaultLabels, err := db.GetLabelDefinitions(rp.db, orm.FilterIn("at_uri", rp.config.Label.DefaultLabelDefs))
 	if err != nil {
 		l.Error("failed to fetch labels", "err", err)
 		rp.pages.Error503(w)
 		return
 	}
 
-	labels, err := db.GetLabelDefinitions(rp.db, db.FilterIn("at_uri", f.Labels))
+	labels, err := db.GetLabelDefinitions(rp.db, orm.FilterIn("at_uri", f.Labels))
 	if err != nil {
 		l.Error("failed to fetch labels", "err", err)
 		rp.pages.Error503(w)

appview/repo/tags.go

···
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/pages"
 	xrpcclient "tangled.org/core/appview/xrpcclient"
+	"tangled.org/core/orm"
 	"tangled.org/core/types"
 
 	indigoxrpc "github.com/bluesky-social/indigo/xrpc"
···
 		rp.pages.Error503(w)
 		return
 	}
-	artifacts, err := db.GetArtifact(rp.db, db.FilterEq("repo_at", f.RepoAt()))
+	artifacts, err := db.GetArtifact(rp.db, orm.FilterEq("repo_at", f.RepoAt()))
 	if err != nil {
 		l.Error("failed grab artifacts", "err", err)
 		return

appview/reporesolver/resolver.go

···
 	}
 
 	// get dir/ref
-	currentDir := path.Dir(extractPathAfterRef(r.URL.EscapedPath()))
+	currentDir := extractCurrentDir(r.URL.EscapedPath())
 	ref := chi.URLParam(r, "ref")
 
 	repoAt := repo.RepoAt()
···
 	}
 
 	return repoInfo
+}
+
+// extractCurrentDir gets the current directory for markdown link resolution.
+// for blob paths, returns the parent dir. for tree paths, returns the path itself.
+//
+//	/@user/repo/blob/main/docs/README.md => docs
+//	/@user/repo/tree/main/docs           => docs
+func extractCurrentDir(fullPath string) string {
+	fullPath = strings.TrimPrefix(fullPath, "/")
+
+	blobPattern := regexp.MustCompile(`blob/[^/]+/(.*)$`)
+	if matches := blobPattern.FindStringSubmatch(fullPath); len(matches) > 1 {
+		return path.Dir(matches[1])
+	}
+
+	treePattern := regexp.MustCompile(`tree/[^/]+/(.*)$`)
+	if matches := treePattern.FindStringSubmatch(fullPath); len(matches) > 1 {
+		dir := strings.TrimSuffix(matches[1], "/")
+		if dir == "" {
+			return "."
+		}
+		return dir
+	}
+
+	return "."
 }
 
 // extractPathAfterRef gets the actual repository path

appview/reporesolver/resolver_test.go

···
+package reporesolver
+
+import "testing"
+
+func TestExtractCurrentDir(t *testing.T) {
+	tests := []struct {
+		path string
+		want string
+	}{
+		{"/@user/repo/blob/main/docs/README.md", "docs"},
+		{"/@user/repo/blob/main/README.md", "."},
+		{"/@user/repo/tree/main/docs", "docs"},
+		{"/@user/repo/tree/main/docs/", "docs"},
+		{"/@user/repo/tree/main", "."},
+	}
+
+	for _, tt := range tests {
+		if got := extractCurrentDir(tt.path); got != tt.want {
+			t.Errorf("extractCurrentDir(%q) = %q, want %q", tt.path, got, tt.want)
+		}
+	}
+}

appview/serververify/verify.go

···
 	"tangled.org/core/api/tangled"
 	"tangled.org/core/appview/db"
 	"tangled.org/core/appview/xrpcclient"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 )
 
···
 	// mark this spindle as verified in the db
 	rowId, err := db.VerifySpindle(
 		tx,
-		db.FilterEq("owner", owner),
-		db.FilterEq("instance", instance),
+		orm.FilterEq("owner", owner),
+		orm.FilterEq("instance", instance),
 	)
 	if err != nil {
 		return 0, fmt.Errorf("failed to write to DB: %w", err)
···
 	// mark as registered
 	err = db.MarkRegistered(
 		tx,
-		db.FilterEq("did", owner),
-		db.FilterEq("domain", domain),
+		orm.FilterEq("did", owner),
+		orm.FilterEq("domain", domain),
 	)
 	if err != nil {
 		return fmt.Errorf("failed to register domain: %w", err)

appview/spindles/spindles.go

···
 	"tangled.org/core/appview/serververify"
 	"tangled.org/core/appview/xrpcclient"
 	"tangled.org/core/idresolver"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 	"tangled.org/core/tid"
 
···
 	user := s.OAuth.GetUser(r)
 	all, err := db.GetSpindles(
 		s.Db,
-		db.FilterEq("owner", user.Did),
+		orm.FilterEq("owner", user.Did),
 	)
 	if err != nil {
 		s.Logger.Error("failed to fetch spindles", "err", err)
···
 
 	spindles, err := db.GetSpindles(
 		s.Db,
-		db.FilterEq("instance", instance),
-		db.FilterEq("owner", user.Did),
-		db.FilterIsNot("verified", "null"),
+		orm.FilterEq("instance", instance),
+		orm.FilterEq("owner", user.Did),
+		orm.FilterIsNot("verified", "null"),
 	)
 	if err != nil || len(spindles) != 1 {
 		l.Error("failed to get spindle", "err", err, "len(spindles)", len(spindles))
···
 	repos, err := db.GetRepos(
 		s.Db,
 		0,
-		db.FilterEq("spindle", instance),
+		orm.FilterEq("spindle", instance),
 	)
 	if err != nil {
 		l.Error("failed to get spindle repos", "err", err)
···
 
 	spindles, err := db.GetSpindles(
 		s.Db,
-		db.FilterEq("owner", user.Did),
-		db.FilterEq("instance", instance),
+		orm.FilterEq("owner", user.Did),
+		orm.FilterEq("instance", instance),
 	)
 	if err != nil || len(spindles) != 1 {
 		l.Error("failed to retrieve instance", "err", err, "len(spindles)", len(spindles))
···
 	// remove spindle members first
 	err = db.RemoveSpindleMember(
 		tx,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("instance", instance),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("instance", instance),
 	)
 	if err != nil {
 		l.Error("failed to remove spindle members", "err", err)
···
 
 	err = db.DeleteSpindle(
 		tx,
-		db.FilterEq("owner", user.Did),
-		db.FilterEq("instance", instance),
+		orm.FilterEq("owner", user.Did),
+		orm.FilterEq("instance", instance),
 	)
 	if err != nil {
 		l.Error("failed to delete spindle", "err", err)
···
 
 	spindles, err := db.GetSpindles(
 		s.Db,
-		db.FilterEq("owner", user.Did),
-		db.FilterEq("instance", instance),
+		orm.FilterEq("owner", user.Did),
+		orm.FilterEq("instance", instance),
 	)
 	if err != nil || len(spindles) != 1 {
 		l.Error("failed to retrieve instance", "err", err, "len(spindles)", len(spindles))
···
 
 	verifiedSpindle, err := db.GetSpindles(
 		s.Db,
-		db.FilterEq("id", rowId),
+		orm.FilterEq("id", rowId),
 	)
 	if err != nil || len(verifiedSpindle) != 1 {
 		l.Error("failed get new spindle", "err", err)
···
 
 	spindles, err := db.GetSpindles(
 		s.Db,
-		db.FilterEq("owner", user.Did),
-		db.FilterEq("instance", instance),
+		orm.FilterEq("owner", user.Did),
+		orm.FilterEq("instance", instance),
 	)
 	if err != nil || len(spindles) != 1 {
 		l.Error("failed to retrieve instance", "err", err, "len(spindles)", len(spindles))
···
 
 	spindles, err := db.GetSpindles(
 		s.Db,
-		db.FilterEq("owner", user.Did),
-		db.FilterEq("instance", instance),
+		orm.FilterEq("owner", user.Did),
+		orm.FilterEq("instance", instance),
 	)
 	if err != nil || len(spindles) != 1 {
 		l.Error("failed to retrieve instance", "err", err, "len(spindles)", len(spindles))
···
 		s.Pages.Notice(w, noticeId, "Failed to remove member, identity resolution failed.")
 		return
 	}
-	if memberId.Handle.IsInvalidHandle() {
-		l.Error("failed to resolve member identity to handle")
-		s.Pages.Notice(w, noticeId, "Failed to remove member, identity resolution failed.")
-		return
-	}
 
 	tx, err := s.Db.Begin()
 	if err != nil {
···
 	// get the record from the DB first:
 	members, err := db.GetSpindleMembers(
 		s.Db,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("instance", instance),
-		db.FilterEq("subject", memberId.DID),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("instance", instance),
+		orm.FilterEq("subject", memberId.DID),
 	)
 	if err != nil || len(members) != 1 {
 		l.Error("failed to get member", "err", err)
···
 	// remove from db
 	if err = db.RemoveSpindleMember(
 		tx,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("instance", instance),
-		db.FilterEq("subject", memberId.DID),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("instance", instance),
+		orm.FilterEq("subject", memberId.DID),
 	); err != nil {
 		l.Error("failed to remove spindle member", "err", err)
 		fail()

appview/state/gfi.go

···
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/pagination"
 	"tangled.org/core/consts"
+	"tangled.org/core/orm"
 )
 
 func (s *State) GoodFirstIssues(w http.ResponseWriter, r *http.Request) {
···
 
 	goodFirstIssueLabel := s.config.Label.GoodFirstIssue
 
-	gfiLabelDef, err := db.GetLabelDefinition(s.db, db.FilterEq("at_uri", goodFirstIssueLabel))
+	gfiLabelDef, err := db.GetLabelDefinition(s.db, orm.FilterEq("at_uri", goodFirstIssueLabel))
 	if err != nil {
 		log.Println("failed to get gfi label def", err)
 		s.pages.Error500(w)
 		return
 	}
 
-	repoLabels, err := db.GetRepoLabels(s.db, db.FilterEq("label_at", goodFirstIssueLabel))
+	repoLabels, err := db.GetRepoLabels(s.db, orm.FilterEq("label_at", goodFirstIssueLabel))
 	if err != nil {
 		log.Println("failed to get repo labels", err)
 		s.pages.Error503(w)
···
 		pagination.Page{
 			Limit: 500,
 		},
-		db.FilterIn("repo_at", repoUris),
-		db.FilterEq("open", 1),
+		orm.FilterIn("repo_at", repoUris),
+		orm.FilterEq("open", 1),
 	)
 	if err != nil {
 		log.Println("failed to get issues", err)
···
 		}
 
 		if len(uriList) > 0 {
-			allLabelDefs, err = db.GetLabelDefinitions(s.db, db.FilterIn("at_uri", uriList))
+			allLabelDefs, err = db.GetLabelDefinitions(s.db, orm.FilterIn("at_uri", uriList))
 			if err != nil {
 				log.Println("failed to fetch labels", err)
 			}

appview/state/git_http.go

···
 
 }
 
+func (s *State) UploadArchive(w http.ResponseWriter, r *http.Request) {
+	user, ok := r.Context().Value("resolvedId").(identity.Identity)
+	if !ok {
+		http.Error(w, "failed to resolve user", http.StatusInternalServerError)
+		return
+	}
+	repo := r.Context().Value("repo").(*models.Repo)
+
+	scheme := "https"
+	if s.config.Core.Dev {
+		scheme = "http"
+	}
+
+	targetURL := fmt.Sprintf("%s://%s/%s/%s/git-upload-archive?%s", scheme, repo.Knot, user.DID, repo.Name, r.URL.RawQuery)
+	s.proxyRequest(w, r, targetURL)
+}
+
 func (s *State) UploadPack(w http.ResponseWriter, r *http.Request) {
 	user, ok := r.Context().Value("resolvedId").(identity.Identity)
 	if !ok {

appview/state/knotstream.go

···
 	ec "tangled.org/core/eventconsumer"
 	"tangled.org/core/eventconsumer/cursor"
 	"tangled.org/core/log"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 	"tangled.org/core/workflow"
 
···
 
 	knots, err := db.GetRegistrations(
 		d,
-		db.FilterIsNot("registered", "null"),
+		orm.FilterIsNot("registered", "null"),
 	)
 	if err != nil {
 		return nil, err
···
 	repos, err := db.GetRepos(
 		d,
 		0,
-		db.FilterEq("did", record.RepoDid),
-		db.FilterEq("name", record.RepoName),
+		orm.FilterEq("did", record.RepoDid),
+		orm.FilterEq("name", record.RepoName),
 	)
 	if err != nil {
 		return fmt.Errorf("failed to look for repo in DB (%s/%s): %w", record.RepoDid, record.RepoName, err)
···
 	repos, err := db.GetRepos(
 		d,
 		0,
-		db.FilterEq("did", record.TriggerMetadata.Repo.Did),
-		db.FilterEq("name", record.TriggerMetadata.Repo.Repo),
+		orm.FilterEq("did", record.TriggerMetadata.Repo.Did),
+		orm.FilterEq("name", record.TriggerMetadata.Repo.Repo),
 	)
 	if err != nil {
 		return fmt.Errorf("failed to look for repo in DB: nsid %s, rkey %s, %w", msg.Nsid, msg.Rkey, err)

appview/state/manifest.go

···
+package state
+
+import (
+	"encoding/json"
+	"net/http"
+)
+
+// https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Manifest
+// https://www.w3.org/TR/appmanifest/
+var manifestData = map[string]any{
+	"name":        "tangled",
+	"description": "tightly-knit social coding.",
+	"icons": []map[string]string{
+		{
+			"src":   "/static/logos/dolly.svg",
+			"sizes": "144x144",
+		},
+	},
+	"start_url":        "/",
+	"id":               "https://tangled.org",
+	"display":          "standalone",
+	"background_color": "#111827",
+	"theme_color":      "#111827",
+}
+
+func (p *State) WebAppManifest(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Content-Type", "application/manifest+json")
+	json.NewEncoder(w).Encode(manifestData)
+}

appview/state/profile.go

···
 	"tangled.org/core/appview/db"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/pages"
+	"tangled.org/core/orm"
 )
 
 func (s *State) Profile(w http.ResponseWriter, r *http.Request) {
···
 		return nil, fmt.Errorf("failed to get profile: %w", err)
 	}
 
-	repoCount, err := db.CountRepos(s.db, db.FilterEq("did", did))
+	repoCount, err := db.CountRepos(s.db, orm.FilterEq("did", did))
 	if err != nil {
 		return nil, fmt.Errorf("failed to get repo count: %w", err)
 	}
 
-	stringCount, err := db.CountStrings(s.db, db.FilterEq("did", did))
+	stringCount, err := db.CountStrings(s.db, orm.FilterEq("did", did))
 	if err != nil {
 		return nil, fmt.Errorf("failed to get string count: %w", err)
 	}
 
-	starredCount, err := db.CountStars(s.db, db.FilterEq("did", did))
+	starredCount, err := db.CountStars(s.db, orm.FilterEq("did", did))
 	if err != nil {
 		return nil, fmt.Errorf("failed to get starred repo count: %w", err)
 	}
···
 	startOfYear := time.Date(now.Year(), 1, 1, 0, 0, 0, 0, time.UTC)
 	punchcard, err := db.MakePunchcard(
 		s.db,
-		db.FilterEq("did", did),
-		db.FilterGte("date", startOfYear.Format(time.DateOnly)),
-		db.FilterLte("date", now.Format(time.DateOnly)),
+		orm.FilterEq("did", did),
+		orm.FilterGte("date", startOfYear.Format(time.DateOnly)),
+		orm.FilterLte("date", now.Format(time.DateOnly)),
 	)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get punchcard for %s: %w", did, err)
···
 	repos, err := db.GetRepos(
 		s.db,
 		0,
-		db.FilterEq("did", profile.UserDid),
+		orm.FilterEq("did", profile.UserDid),
 	)
 	if err != nil {
 		l.Error("failed to fetch repos", "err", err)
···
 	}
 
 	// populate commit counts in the timeline, using the punchcard
-	currentMonth := time.Now().Month()
+	now := time.Now()
 	for _, p := range profile.Punchcard.Punches {
-		idx := currentMonth - p.Date.Month()
-		if int(idx) < len(timeline.ByMonth) {
-			timeline.ByMonth[idx].Commits += p.Count
+		years := now.Year() - p.Date.Year()
+		months := int(now.Month() - p.Date.Month())
+		monthsAgo := years*12 + months
+		if monthsAgo >= 0 && monthsAgo < len(timeline.ByMonth) {
+			timeline.ByMonth[monthsAgo].Commits += p.Count
 		}
 	}
 
···
 	repos, err := db.GetRepos(
 		s.db,
 		0,
-		db.FilterEq("did", profile.UserDid),
+		orm.FilterEq("did", profile.UserDid),
 	)
 	if err != nil {
 		l.Error("failed to get repos", "err", err)
···
 	}
 	l = l.With("profileDid", profile.UserDid)
 
-	stars, err := db.GetRepoStars(s.db, 0, db.FilterEq("did", profile.UserDid))
+	stars, err := db.GetRepoStars(s.db, 0, orm.FilterEq("did", profile.UserDid))
 	if err != nil {
 		l.Error("failed to get stars", "err", err)
 		s.pages.Error500(w)
···
 	}
 	l = l.With("profileDid", profile.UserDid)
 
-	strings, err := db.GetStrings(s.db, 0, db.FilterEq("did", profile.UserDid))
+	strings, err := db.GetStrings(s.db, 0, orm.FilterEq("did", profile.UserDid))
 	if err != nil {
 		l.Error("failed to get strings", "err", err)
 		s.pages.Error500(w)
···
 		followDids = append(followDids, extractDid(follow))
 	}
 
-	profiles, err := db.GetProfiles(s.db, db.FilterIn("did", followDids))
+	profiles, err := db.GetProfiles(s.db, orm.FilterIn("did", followDids))
 	if err != nil {
 		l.Error("failed to get profiles", "followDids", followDids, "err", err)
 		return &params, err
···
 		log.Printf("getting profile data for %s: %s", user.Did, err)
 	}
 
-	repos, err := db.GetRepos(s.db, 0, db.FilterEq("did", user.Did))
+	repos, err := db.GetRepos(s.db, 0, orm.FilterEq("did", user.Did))
 	if err != nil {
 		log.Printf("getting repos for %s: %s", user.Did, err)
 	}

appview/state/router.go

···
 		s.pages,
 	)
 
-	router.Get("/favicon.svg", s.Favicon)
-	router.Get("/favicon.ico", s.Favicon)
-	router.Get("/pwa-manifest.json", s.PWAManifest)
+	router.Get("/pwa-manifest.json", s.WebAppManifest)
 	router.Get("/robots.txt", s.RobotsTxt)
 
 	userRouter := s.UserRouter(&middleware)
···
 
 			// These routes get proxied to the knot
 			r.Get("/info/refs", s.InfoRefs)
+			r.Post("/git-upload-archive", s.UploadArchive)
 			r.Post("/git-upload-pack", s.UploadPack)
 			r.Post("/git-receive-pack", s.ReceivePack)
 
···
 	})
 
 	r.NotFound(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
 		s.pages.Error404(w)
 	})
 
···
 	r.Get("/brand", s.Brand)
 
 	r.NotFound(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
 		s.pages.Error404(w)
 	})
 	return r
···
 		s.enforcer,
 		s.pages,
 		s.idResolver,
-		s.refResolver,
+		s.mentionsResolver,
 		s.db,
 		s.config,
 		s.notifier,
···
 		s.repoResolver,
 		s.pages,
 		s.idResolver,
-		s.refResolver,
+		s.mentionsResolver,
 		s.db,
 		s.config,
 		s.notifier,

appview/state/spindlestream.go

···
 	ec "tangled.org/core/eventconsumer"
 	"tangled.org/core/eventconsumer/cursor"
 	"tangled.org/core/log"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 	spindle "tangled.org/core/spindle/models"
 )
···
 
 	spindles, err := db.GetSpindles(
 		d,
-		db.FilterIsNot("verified", "null"),
+		orm.FilterIsNot("verified", "null"),
 	)
 	if err != nil {
 		return nil, err

appview/state/state.go

···
 	"tangled.org/core/appview/config"
 	"tangled.org/core/appview/db"
 	"tangled.org/core/appview/indexer"
+	"tangled.org/core/appview/mentions"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/notify"
 	dbnotify "tangled.org/core/appview/notify/db"
 	phnotify "tangled.org/core/appview/notify/posthog"
 	"tangled.org/core/appview/oauth"
 	"tangled.org/core/appview/pages"
-	"tangled.org/core/appview/refresolver"
 	"tangled.org/core/appview/reporesolver"
 	"tangled.org/core/appview/validator"
 	xrpcclient "tangled.org/core/appview/xrpcclient"
···
 	"tangled.org/core/jetstream"
 	"tangled.org/core/log"
 	tlog "tangled.org/core/log"
+	"tangled.org/core/orm"
 	"tangled.org/core/rbac"
 	"tangled.org/core/tid"
 
···
 )
 
 type State struct {
-	db            *db.DB
-	notifier      notify.Notifier
-	indexer       *indexer.Indexer
-	oauth         *oauth.OAuth
-	enforcer      *rbac.Enforcer
-	pages         *pages.Pages
-	idResolver    *idresolver.Resolver
-	refResolver   *refresolver.Resolver
-	posthog       posthog.Client
-	jc            *jetstream.JetstreamClient
-	config        *config.Config
-	repoResolver  *reporesolver.RepoResolver
-	knotstream    *eventconsumer.Consumer
-	spindlestream *eventconsumer.Consumer
-	logger        *slog.Logger
-	validator     *validator.Validator
+	db               *db.DB
+	notifier         notify.Notifier
+	indexer          *indexer.Indexer
+	oauth            *oauth.OAuth
+	enforcer         *rbac.Enforcer
+	pages            *pages.Pages
+	idResolver       *idresolver.Resolver
+	mentionsResolver *mentions.Resolver
+	posthog          posthog.Client
+	jc               *jetstream.JetstreamClient
+	config           *config.Config
+	repoResolver     *reporesolver.RepoResolver
+	knotstream       *eventconsumer.Consumer
+	spindlestream    *eventconsumer.Consumer
+	logger           *slog.Logger
+	validator        *validator.Validator
 }
 
 func Make(ctx context.Context, config *config.Config) (*State, error) {
···
 
 	repoResolver := reporesolver.New(config, enforcer, d)
 
-	refResolver := refresolver.New(config, res, d, log.SubLogger(logger, "refResolver"))
+	mentionsResolver := mentions.New(config, res, d, log.SubLogger(logger, "mentionsResolver"))
 
 	wrapper := db.DbWrapper{Execer: d}
 	jc, err := jetstream.NewJetstreamClient(
···
 		enforcer,
 		pages,
 		res,
-		refResolver,
+		mentionsResolver,
 		posthog,
 		jc,
 		config,
···
 	return s.db.Close()
 }
 
-func (s *State) Favicon(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "image/svg+xml")
-	w.Header().Set("Cache-Control", "public, max-age=31536000") // one year
-	w.Header().Set("ETag", `"favicon-svg-v1"`)
-
-	if match := r.Header.Get("If-None-Match"); match == `"favicon-svg-v1"` {
-		w.WriteHeader(http.StatusNotModified)
-		return
-	}
-
-	s.pages.Favicon(w)
-}
-
 func (s *State) RobotsTxt(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/plain")
 	w.Header().Set("Cache-Control", "public, max-age=86400") // one day
···
 	w.Write([]byte(robotsTxt))
 }
 
-// https://developer.mozilla.org/en-US/docs/Web/Progressive_web_apps/Manifest
-const manifestJson = `{
-  "name": "tangled",
-  "description": "tightly-knit social coding.",
-  "icons": [
-    {
-      "src": "/favicon.svg",
-      "sizes": "144x144"
-    }
-  ],
-  "start_url": "/",
-  "id": "org.tangled",
-
-  "display": "standalone",
-  "background_color": "#111827",
-  "theme_color": "#111827"
-}`
-
-func (p *State) PWAManifest(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "application/json")
-	w.Write([]byte(manifestJson))
-}
-
 func (s *State) TermsOfService(w http.ResponseWriter, r *http.Request) {
 	user := s.oauth.GetUser(r)
 	s.pages.TermsOfService(w, pages.TermsOfServiceParams{
···
 		return
 	}
 
-	gfiLabel, err := db.GetLabelDefinition(s.db, db.FilterEq("at_uri", s.config.Label.GoodFirstIssue))
+	gfiLabel, err := db.GetLabelDefinition(s.db, orm.FilterEq("at_uri", s.config.Label.GoodFirstIssue))
 	if err != nil {
 		// non-fatal
 	}
···
 
 	regs, err := db.GetRegistrations(
 		s.db,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("needs_upgrade", 1),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("needs_upgrade", 1),
 	)
 	if err != nil {
 		l.Error("non-fatal: failed to get registrations", "err", err)
···
 
 	spindles, err := db.GetSpindles(
 		s.db,
-		db.FilterEq("owner", user.Did),
-		db.FilterEq("needs_upgrade", 1),
+		orm.FilterEq("owner", user.Did),
+		orm.FilterEq("needs_upgrade", 1),
 	)
 	if err != nil {
 		l.Error("non-fatal: failed to get spindles", "err", err)
···
 		// Check for existing repos
 		existingRepo, err := db.GetRepo(
 			s.db,
-			db.FilterEq("did", user.Did),
-			db.FilterEq("name", repoName),
+			orm.FilterEq("did", user.Did),
+			orm.FilterEq("name", repoName),
 		)
 		if err == nil && existingRepo != nil {
 			l.Info("repo exists")
···
 }
 
 func BackfillDefaultDefs(e db.Execer, r *idresolver.Resolver, defaults []string) error {
-	defaultLabels, err := db.GetLabelDefinitions(e, db.FilterIn("at_uri", defaults))
+	defaultLabels, err := db.GetLabelDefinitions(e, orm.FilterIn("at_uri", defaults))
 	if err != nil {
 		return err
 	}

appview/strings/strings.go

···
 	"tangled.org/core/appview/pages"
 	"tangled.org/core/appview/pages/markup"
 	"tangled.org/core/idresolver"
+	"tangled.org/core/orm"
 	"tangled.org/core/tid"
 
 	"github.com/bluesky-social/indigo/api/atproto"
···
 	strings, err := db.GetStrings(
 		s.Db,
 		0,
-		db.FilterEq("did", id.DID),
-		db.FilterEq("rkey", rkey),
+		orm.FilterEq("did", id.DID),
+		orm.FilterEq("rkey", rkey),
 	)
 	if err != nil {
 		l.Error("failed to fetch string", "err", err)
···
 	all, err := db.GetStrings(
 		s.Db,
 		0,
-		db.FilterEq("did", id.DID),
-		db.FilterEq("rkey", rkey),
+		orm.FilterEq("did", id.DID),
+		orm.FilterEq("rkey", rkey),
 	)
 	if err != nil {
 		l.Error("failed to fetch string", "err", err)
···
 
 	if err := db.DeleteString(
 		s.Db,
-		db.FilterEq("did", user.Did),
-		db.FilterEq("rkey", rkey),
+		orm.FilterEq("did", user.Did),
+		orm.FilterEq("rkey", rkey),
 	); err != nil {
 		fail("Failed to delete string.", err)
 		return

appview/validator/issue.go

···
 
 	"tangled.org/core/appview/db"
 	"tangled.org/core/appview/models"
+	"tangled.org/core/orm"
 )
 
 func (v *Validator) ValidateIssueComment(comment *models.IssueComment) error {
 	// if comments have parents, only ingest ones that are 1 level deep
 	if comment.ReplyTo != nil {
-		parents, err := db.GetIssueComments(v.db, db.FilterEq("at_uri", *comment.ReplyTo))
+		parents, err := db.GetIssueComments(v.db, orm.FilterEq("at_uri", *comment.ReplyTo))
 		if err != nil {
 			return fmt.Errorf("failed to fetch parent comment: %w", err)
 		}

cmd/dolly/main.go

···
+package main
+
+import (
+	"bytes"
+	"flag"
+	"fmt"
+	"image"
+	"image/color"
+	"image/png"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"text/template"
+
+	"github.com/srwiley/oksvg"
+	"github.com/srwiley/rasterx"
+	"golang.org/x/image/draw"
+	"tangled.org/core/appview/pages"
+	"tangled.org/core/ico"
+)
+
+func main() {
+	var (
+		size      string
+		fillColor string
+		output    string
+	)
+
+	flag.StringVar(&size, "size", "512x512", "Output size in format WIDTHxHEIGHT (e.g., 512x512)")
+	flag.StringVar(&fillColor, "color", "#000000", "Fill color in hex format (e.g., #FF5733)")
+	flag.StringVar(&output, "output", "dolly.svg", "Output file path (format detected from extension: .svg, .png, or .ico)")
+	flag.Parse()
+
+	width, height, err := parseSize(size)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error parsing size: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Detect format from file extension
+	ext := strings.ToLower(filepath.Ext(output))
+	format := strings.TrimPrefix(ext, ".")
+
+	if format != "svg" && format != "png" && format != "ico" {
+		fmt.Fprintf(os.Stderr, "Invalid file extension: %s. Must be .svg, .png, or .ico\n", ext)
+		os.Exit(1)
+	}
+
+	if fillColor != "currentColor" && !isValidHexColor(fillColor) {
+		fmt.Fprintf(os.Stderr, "Invalid color format: %s. Use hex format like #FF5733\n", fillColor)
+		os.Exit(1)
+	}
+
+	svgData, err := dolly(fillColor)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error generating SVG: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Create output directory if it doesn't exist
+	dir := filepath.Dir(output)
+	if dir != "" && dir != "." {
+		if err := os.MkdirAll(dir, 0755); err != nil {
+			fmt.Fprintf(os.Stderr, "Error creating output directory: %v\n", err)
+			os.Exit(1)
+		}
+	}
+
+	switch format {
+	case "svg":
+		err = saveSVG(svgData, output, width, height)
+	case "png":
+		err = savePNG(svgData, output, width, height)
+	case "ico":
+		err = saveICO(svgData, output, width, height)
+	}
+
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error saving file: %v\n", err)
+		os.Exit(1)
+	}
+
+	fmt.Printf("Successfully generated %s (%dx%d)\n", output, width, height)
+}
+
+func dolly(hexColor string) ([]byte, error) {
+	tpl, err := template.New("dolly").
+		ParseFS(pages.Files, "templates/fragments/dolly/logo.html")
+	if err != nil {
+		return nil, err
+	}
+
+	var svgData bytes.Buffer
+	if err := tpl.ExecuteTemplate(&svgData, "fragments/dolly/logo", pages.DollyParams{
+		FillColor: hexColor,
+	}); err != nil {
+		return nil, err
+	}
+
+	return svgData.Bytes(), nil
+}
+
+func svgToImage(svgData []byte, w, h int) (image.Image, error) {
+	icon, err := oksvg.ReadIconStream(bytes.NewReader(svgData))
+	if err != nil {
+		return nil, fmt.Errorf("error parsing SVG: %v", err)
+	}
+
+	icon.SetTarget(0, 0, float64(w), float64(h))
+	rgba := image.NewRGBA(image.Rect(0, 0, w, h))
+	draw.Draw(rgba, rgba.Bounds(), &image.Uniform{color.Transparent}, image.Point{}, draw.Src)
+	scanner := rasterx.NewScannerGV(w, h, rgba, rgba.Bounds())
+	raster := rasterx.NewDasher(w, h, scanner)
+	icon.Draw(raster, 1.0)
+
+	return rgba, nil
+}
+
+func parseSize(size string) (int, int, error) {
+	parts := strings.Split(size, "x")
+	if len(parts) != 2 {
+		return 0, 0, fmt.Errorf("invalid size format, use WIDTHxHEIGHT")
+	}
+
+	width, err := strconv.Atoi(parts[0])
+	if err != nil {
+		return 0, 0, fmt.Errorf("invalid width: %v", err)
+	}
+
+	height, err := strconv.Atoi(parts[1])
+	if err != nil {
+		return 0, 0, fmt.Errorf("invalid height: %v", err)
+	}
+
+	if width <= 0 || height <= 0 {
+		return 0, 0, fmt.Errorf("width and height must be positive")
+	}
+
+	return width, height, nil
+}
+
+func isValidHexColor(hex string) bool {
+	if len(hex) != 7 || hex[0] != '#' {
+		return false
+	}
+	_, err := strconv.ParseUint(hex[1:], 16, 32)
+	return err == nil
+}
+
+func saveSVG(svgData []byte, filepath string, _, _ int) error {
+	return os.WriteFile(filepath, svgData, 0644)
+}
+
+func savePNG(svgData []byte, filepath string, width, height int) error {
+	img, err := svgToImage(svgData, width, height)
+	if err != nil {
+		return err
+	}
+
+	f, err := os.Create(filepath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	return png.Encode(f, img)
+}
+
+func saveICO(svgData []byte, filepath string, width, height int) error {
+	img, err := svgToImage(svgData, width, height)
+	if err != nil {
+		return err
+	}
+
+	icoData, err := ico.ImageToIco(img)
+	if err != nil {
+		return err
+	}
+
+	return os.WriteFile(filepath, icoData, 0644)
+}

crypto/verify.go

···
 	"crypto/sha256"
 	"encoding/base64"
 	"fmt"
-	"strings"
 
 	"github.com/hiddeco/sshsig"
 	"golang.org/x/crypto/ssh"
-	"tangled.org/core/types"
 )
 
 func VerifySignature(pubKey, signature, payload []byte) (error, bool) {
···
 	// multiple algorithms but sha-512 is most secure, and git's ssh signing defaults
 	// to sha-512 for all key types anyway.
 	err = sshsig.Verify(buf, sig, pub, sshsig.HashSHA512, "git")
-	return err, err == nil
-}
 
-// VerifyCommitSignature reconstructs the payload used to sign a commit. This is
-// essentially the git cat-file output but without the gpgsig header.
-//
-// Caveats: signature verification will fail on commits with more than one parent,
-// i.e. merge commits, because types.NiceDiff doesn't carry more than one Parent field
-// and we are unable to reconstruct the payload correctly.
-//
-// Ideally this should directly operate on an *object.Commit.
-func VerifyCommitSignature(pubKey string, commit types.NiceDiff) (error, bool) {
-	signature := commit.Commit.PGPSignature
-
-	author := bytes.NewBuffer([]byte{})
-	committer := bytes.NewBuffer([]byte{})
-	commit.Commit.Author.Encode(author)
-	commit.Commit.Committer.Encode(committer)
-
-	payload := strings.Builder{}
-
-	fmt.Fprintf(&payload, "tree %s\n", commit.Commit.Tree)
-	if commit.Commit.Parent != "" {
-		fmt.Fprintf(&payload, "parent %s\n", commit.Commit.Parent)
-	}
-	fmt.Fprintf(&payload, "author %s\n", author.String())
-	fmt.Fprintf(&payload, "committer %s\n", committer.String())
-	if commit.Commit.ChangedId != "" {
-		fmt.Fprintf(&payload, "change-id %s\n", commit.Commit.ChangedId)
-	}
-	fmt.Fprintf(&payload, "\n%s", commit.Commit.Message)
-
-	return VerifySignature([]byte(pubKey), []byte(signature), []byte(payload.String()))
+	return err, err == nil
 }
 
 // SSHFingerprint computes the fingerprint of the supplied ssh pubkey.

docs/DOCS.md

···
+---
+title: Tangled docs
+author: The Tangled Contributors
+date: 21 Sun, Dec 2025
+abstract: |
+    Tangled is a decentralized code hosting and collaboration
+    platform. Every component of Tangled is open-source and
+    self-hostable. [tangled.org](https://tangled.org) also
+    provides hosting and CI services that are free to use.
+
+    There are several models for decentralized code
+    collaboration platforms, ranging from ActivityPub’s
+    (Forgejo) federated model, to Radicle’s entirely P2P model.
+    Our approach attempts to be the best of both worlds by
+    adopting the AT Protocol—a protocol for building decentralized
+    social applications with a central identity
+
+    Our approach to this is the idea of “knots”. Knots are
+    lightweight, headless servers that enable users to host Git
+    repositories with ease. Knots are designed for either single
+    or multi-tenant use which is perfect for self-hosting on a
+    Raspberry Pi at home, or larger “community” servers. By
+    default, Tangled provides managed knots where you can host
+    your repositories for free.
+
+    The appview at tangled.org acts as a consolidated "view"
+    into the whole network, allowing users to access, clone and
+    contribute to repositories hosted across different knots
+    seamlessly.
+---
+
+# Quick start guide
+
+## Login or sign up
+
+You can [login](https://tangled.org) by using your AT Protocol
+account. If you are unclear on what that means, simply head
+to the [signup](https://tangled.org/signup) page and create
+an account. By doing so, you will be choosing Tangled as
+your account provider (you will be granted a handle of the
+form `user.tngl.sh`).
+
+In the AT Protocol network, users are free to choose their account
+provider (known as a "Personal Data Service", or PDS), and
+login to applications that support AT accounts.
+
+You can think of it as "one account for all of the atmosphere"!
+
+If you already have an AT account (you may have one if you
+signed up to Bluesky, for example), you can login with the
+same handle on Tangled (so just use `user.bsky.social` on
+the login page).
+
+## Add an SSH key
+
+Once you are logged in, you can start creating repositories
+and pushing code. Tangled supports pushing git repositories
+over SSH.
+
+First, you'll need to generate an SSH key if you don't
+already have one:
+
+```bash
+ssh-keygen -t ed25519 -C "[e-mail]"
+```
+
+When prompted, save the key to the default location
+(`~/.ssh/id_ed25519`) and optionally set a passphrase.
+
+Copy your public key to your clipboard:
+
+```bash
+# on X11
+cat ~/.ssh/id_ed25519.pub | xclip -sel c
+
+# on wayland
+cat ~/.ssh/id_ed25519.pub | wl-copy
+
+# on macos
+cat ~/.ssh/id_ed25519.pub | pbcopy
+```
+
+Now, navigate to 'Settings' -> 'Keys' and hit 'Add Key',
+paste your public key, give it a descriptive name, and hit
+save.
+
+## Create a repository
+
+Once your SSH key is added, create your first repository:
+
+1. Hit the green `+` icon on the topbar, and select
+   repository
+2. Enter a repository name
+3. Add a description
+4. Choose a knotserver to host this repository on
+5. Hit create
+
+Knots are self-hostable, lightweight Git servers that can
+host your repository. Unlike traditional code forges, your
+code can live on any server. Read the [Knots](TODO) section
+for more.
+
+## Configure SSH
+
+To ensure Git uses the correct SSH key and connects smoothly
+to Tangled, add this configuration to your `~/.ssh/config`
+file:
+
+```
+Host tangled.org
+    Hostname tangled.org
+    User git
+    IdentityFile ~/.ssh/id_ed25519
+    AddressFamily inet
+```
+
+This tells SSH to use your specific key when connecting to
+Tangled and prevents authentication issues if you have
+multiple SSH keys.
+
+Note that this configuration only works for knotservers that
+are hosted by tangled.org. If you use a custom knot, refer
+to the [Knots](TODO) section.
+
+## Push your first repository
+
+Initialize a new Git repository:
+
+```bash
+mkdir my-project
+cd my-project
+
+git init
+echo "# My Project" > README.md 
+```
+
+Add some content and push!
+
+```bash
+git add README.md
+git commit -m "Initial commit"
+git remote add origin [e-mail]:user.tngl.sh/my-project
+git push -u origin main
+```
+
+That's it! Your code is now hosted on Tangled.
+
+## Migrating an existing repository
+
+Moving your repositories from GitHub, GitLab, Bitbucket, or
+any other Git forge to Tangled is straightforward. You'll
+simply change your repository's remote URL. At the moment,
+Tangled does not have any tooling to migrate data such as
+GitHub issues or pull requests.
+
+First, create a new repository on tangled.org as described
+in the [Quick Start Guide](#create-a-repository).
+
+Navigate to your existing local repository:
+
+```bash
+cd /path/to/your/existing/repo
+```
+
+You can inspect your existing Git remote like so:
+
+```bash
+git remote -v
+```
+
+You'll see something like:
+
+```
+origin  [e-mail]:username/my-project (fetch)
+origin  [e-mail]:username/my-project (push)
+```
+
+Update the remote URL to point to tangled:
+
+```bash
+git remote set-url origin [e-mail]:user.tngl.sh/my-project
+```
+
+Verify the change:
+
+```bash
+git remote -v
+```
+
+You should now see:
+
+```
+origin  [e-mail]:user.tngl.sh/my-project (fetch)
+origin  [e-mail]:user.tngl.sh/my-project (push)
+```
+
+Push all your branches and tags to Tangled:
+
+```bash
+git push -u origin --all
+git push -u origin --tags
+```
+
+Your repository is now migrated to Tangled! All commit
+history, branches, and tags have been preserved.
+
+## Mirroring a repository to Tangled
+
+If you want to maintain your repository on multiple forges
+simultaneously, for example, keeping your primary repository
+on GitHub while mirroring to Tangled for backup or
+redundancy, you can do so by adding multiple remotes.
+
+You can configure your local repository to push to both
+Tangled and, say, GitHub. You may already have the following
+setup:
+
+```
+$ git remote -v
+origin  [e-mail]:username/my-project (fetch)
+origin  [e-mail]:username/my-project (push)
+```
+
+Now add Tangled as an additional push URL to the same
+remote:
+
+```bash
+git remote set-url --add --push origin [e-mail]:user.tngl.sh/my-project
+```
+
+You also need to re-add the original URL as a push
+destination (Git replaces the push URL when you use `--add`
+the first time):
+
+```bash
+git remote set-url --add --push origin [e-mail]:username/my-project
+```
+
+Verify your configuration:
+
+```
+$ git remote -v
+origin  [e-mail]:username/repo (fetch)
+origin  [e-mail]:username/my-project (push)
+origin  [e-mail]:username/repo (push)
+```
+
+Notice that there's one fetch URL (the primary remote) and
+two push URLs. Now, whenever you push, Git will
+automatically push to both remotes:
+
+```bash
+git push origin main
+```
+
+This single command pushes your `main` branch to both GitHub
+and Tangled simultaneously.
+
+To push all branches and tags:
+
+```bash
+git push origin --all
+git push origin --tags
+```
+
+If you prefer more control over which remote you push to,
+you can maintain separate remotes:
+
+```bash
+git remote add github [e-mail]:username/my-project
+git remote add tangled [e-mail]:username/my-project
+```
+
+Then push to each explicitly:
+
+```bash
+git push github main
+git push tangled main
+```
+
+# Knot self-hosting guide
+
+So you want to run your own knot server? Great! Here are a few prerequisites:
+
+1. A server of some kind (a VPS, a Raspberry Pi, etc.). Preferably running a Linux distribution of some kind.
+2. A (sub)domain name. People generally use `knot.example.com`.
+3. A valid SSL certificate for your domain.
+
+## NixOS
+
+Refer to the [knot
+module](https://tangled.org/tangled.org/core/blob/master/nix/modules/knot.nix)
+for a full list of options. Sample configurations:
+
+- [The test VM](https://tangled.org/tangled.org/core/blob/master/nix/vm.nix#L85)
+- [@pyrox.dev/nix](https://tangled.org/pyrox.dev/nix/blob/d19571cc1b5fe01035e1e6951ec8cf8a476b4dee/hosts/marvin/services/tangled.nix#L15-25)
+
+## Docker
+
+Refer to
+[@tangled.org/knot-docker](https://tangled.org/@tangled.org/knot-docker).
+Note that this is community maintained.
+
+## Manual setup
+
+First, clone this repository:
+
+```
+git clone https://tangled.org/@tangled.org/core
+```
+
+Then, build the `knot` CLI. This is the knot administration
+and operation tool. For the purpose of this guide, we're
+only concerned with these subcommands:
+
+ * `knot server`: the main knot server process, typically
+   run as a supervised service
+ * `knot guard`: handles role-based access control for git
+   over SSH (you'll never have to run this yourself)
+ * `knot keys`: fetches SSH keys associated with your knot;
+   we'll use this to generate the SSH
+   `AuthorizedKeysCommand`
+
+```
+cd core
+export CGO_ENABLED=1
+go build -o knot ./cmd/knot
+```
+
+Next, move the `knot` binary to a location owned by `root` --
+`/usr/local/bin/` is a good choice. Make sure the binary itself is also owned by `root`:
+
+```
+sudo mv knot /usr/local/bin/knot
+sudo chown root:root /usr/local/bin/knot
+```
+
+This is necessary because SSH `AuthorizedKeysCommand` requires [really
+specific permissions](https://stackoverflow.com/a/27638306). The
+`AuthorizedKeysCommand` specifies a command that is run by `sshd` to
+retrieve a user's public SSH keys dynamically for authentication. Let's
+set that up.
+
+```
+sudo tee /etc/ssh/sshd_config.d/authorized_keys_command.conf <<EOF
+Match User git
+  AuthorizedKeysCommand /usr/local/bin/knot keys -o authorized-keys
+  AuthorizedKeysCommandUser nobody
+EOF
+```
+
+Then, reload `sshd`:
+
+```
+sudo systemctl reload ssh
+```
+
+Next, create the `git` user. We'll use the `git` user's home directory
+to store repositories:
+
+```
+sudo adduser git
+```
+
+Create `/home/git/.knot.env` with the following, updating the values as
+necessary. The `KNOT_SERVER_OWNER` should be set to your
+DID, you can find your DID in the [Settings](https://tangled.sh/settings) page.
+
+```
+KNOT_REPO_SCAN_PATH=/home/git
+KNOT_SERVER_HOSTNAME=knot.example.com
+APPVIEW_ENDPOINT=https://tangled.org
+KNOT_SERVER_OWNER=did:plc:foobar
+KNOT_SERVER_INTERNAL_LISTEN_ADDR=127.0.0.1:5444
+KNOT_SERVER_LISTEN_ADDR=127.0.0.1:5555
+```
+
+If you run a Linux distribution that uses systemd, you can use the provided
+service file to run the server. Copy
+[`knotserver.service`](/systemd/knotserver.service)
+to `/etc/systemd/system/`. Then, run:
+
+```
+systemctl enable knotserver
+systemctl start knotserver
+```
+
+The last step is to configure a reverse proxy like Nginx or Caddy to front your
+knot. Here's an example configuration for Nginx:
+
+```
+server {
+    listen 80;
+    listen [::]:80;
+    server_name knot.example.com;
+
+    location / {
+        proxy_pass http://localhost:5555;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    # wss endpoint for git events
+    location /events {
+        proxy_set_header   X-Forwarded-For $remote_addr;
+        proxy_set_header   Host $http_host;
+        proxy_set_header Upgrade websocket;
+        proxy_set_header Connection Upgrade;
+        proxy_pass http://localhost:5555;
+    }
+  # additional config for SSL/TLS go here.
+}
+
+```
+
+Remember to use Let's Encrypt or similar to procure a certificate for your
+knot domain.
+
+You should now have a running knot server! You can finalize
+your registration by hitting the `verify` button on the
+[/settings/knots](https://tangled.org/settings/knots) page. This simply creates
+a record on your PDS to announce the existence of the knot.
+
+### Custom paths
+
+(This section applies to manual setup only. Docker users should edit the mounts
+in `docker-compose.yml` instead.)
+
+Right now, the database and repositories of your knot lives in `/home/git`. You
+can move these paths if you'd like to store them in another folder. Be careful
+when adjusting these paths:
+
+* Stop your knot when moving data (e.g. `systemctl stop knotserver`) to prevent
+any possible side effects. Remember to restart it once you're done.
+* Make backups before moving in case something goes wrong.
+* Make sure the `git` user can read and write from the new paths.
+
+#### Database
+
+As an example, let's say the current database is at `/home/git/knotserver.db`,
+and we want to move it to `/home/git/database/knotserver.db`.
+
+Copy the current database to the new location. Make sure to copy the `.db-shm`
+and `.db-wal` files if they exist.
+
+```
+mkdir /home/git/database
+cp /home/git/knotserver.db* /home/git/database
+```
+
+In the environment (e.g. `/home/git/.knot.env`), set `KNOT_SERVER_DB_PATH` to
+the new file path (_not_ the directory):
+
+```
+KNOT_SERVER_DB_PATH=/home/git/database/knotserver.db
+```
+
+#### Repositories
+
+As an example, let's say the repositories are currently in `/home/git`, and we
+want to move them into `/home/git/repositories`.
+
+Create the new folder, then move the existing repositories (if there are any):
+
+```
+mkdir /home/git/repositories
+# move all DIDs into the new folder; these will vary for you!
+mv /home/git/did:plc:wshs7t2adsemcrrd4snkeqli /home/git/repositories
+```
+
+In the environment (e.g. `/home/git/.knot.env`), update `KNOT_REPO_SCAN_PATH`
+to the new directory:
+
+```
+KNOT_REPO_SCAN_PATH=/home/git/repositories
+```
+
+Similarly, update your `sshd` `AuthorizedKeysCommand` to use the updated
+repository path:
+
+```
+sudo tee /etc/ssh/sshd_config.d/authorized_keys_command.conf <<EOF
+Match User git
+  AuthorizedKeysCommand /usr/local/bin/knot keys -o authorized-keys -git-dir /home/git/repositories
+  AuthorizedKeysCommandUser nobody
+EOF
+```
+
+Make sure to restart your SSH server!
+
+#### MOTD (message of the day)
+
+To configure the MOTD used ("Welcome to this knot!" by default), edit the
+`/home/git/motd` file:
+
+```
+printf "Hi from this knot!\n" > /home/git/motd
+```
+
+Note that you should add a newline at the end if setting a non-empty message
+since the knot won't do this for you.
+
+# Spindles
+
+## Pipelines
+
+Spindle workflows allow you to write CI/CD pipelines in a
+simple format. They're located in the `.tangled/workflows`
+directory at the root of your repository, and are defined
+using YAML.
+
+The fields are:
+
+- [Trigger](#trigger): A **required** field that defines
+  when a workflow should be triggered.
+- [Engine](#engine): A **required** field that defines which
+  engine a workflow should run on.
+- [Clone options](#clone-options): An **optional** field
+  that defines how the repository should be cloned.
+- [Dependencies](#dependencies): An **optional** field that
+  allows you to list dependencies you may need.
+- [Environment](#environment): An **optional** field that
+  allows you to define environment variables.
+- [Steps](#steps): An **optional** field that allows you to
+  define what steps should run in the workflow.
+
+### Trigger
+
+The first thing to add to a workflow is the trigger, which
+defines when a workflow runs. This is defined using a `when`
+field, which takes in a list of conditions. Each condition
+has the following fields:
+
+- `event`: This is a **required** field that defines when
+  your workflow should run. It's a list that can take one or
+  more of the following values:
+  - `push`: The workflow should run every time a commit is
+    pushed to the repository.
+  - `pull_request`: The workflow should run every time a
+    pull request is made or updated.
+  - `manual`: The workflow can be triggered manually.
+- `branch`: Defines which branches the workflow should run
+  for. If used with the `push` event, commits to the
+  branch(es) listed here will trigger the workflow. If used
+  with the `pull_request` event, updates to pull requests
+  targeting the branch(es) listed here will trigger the
+  workflow. This field has no effect with the `manual`
+  event. Supports glob patterns using `*` and `**` (e.g.,
+  `main`, `develop`, `release-*`). Either `branch` or `tag`
+  (or both) must be specified for `push` events.
+- `tag`: Defines which tags the workflow should run for.
+  Only used with the `push` event - when tags matching the
+  pattern(s) listed here are pushed, the workflow will
+  trigger. This field has no effect with `pull_request` or
+  `manual` events. Supports glob patterns using `*` and `**`
+  (e.g., `v*`, `v1.*`, `release-**`). Either `branch` or
+  `tag` (or both) must be specified for `push` events.
+
+For example, if you'd like to define a workflow that runs
+when commits are pushed to the `main` and `develop`
+branches, or when pull requests that target the `main`
+branch are updated, or manually, you can do so with:
+
+```yaml
+when:
+  - event: ["push", "manual"]
+    branch: ["main", "develop"]
+  - event: ["pull_request"]
+    branch: ["main"]
+```
+
+You can also trigger workflows on tag pushes. For instance,
+to run a deployment workflow when tags matching `v*` are
+pushed:
+
+```yaml
+when:
+  - event: ["push"]
+    tag: ["v*"]
+```
+
+You can even combine branch and tag patterns in a single
+constraint (the workflow triggers if either matches):
+
+```yaml
+when:
+  - event: ["push"]
+    branch: ["main", "release-*"]
+    tag: ["v*", "stable"]
+```
+
+### Engine
+
+Next is the engine on which the workflow should run, defined
+using the **required** `engine` field. The currently
+supported engines are:
+
+- `nixery`: This uses an instance of
+  [Nixery](https://nixery.dev) to run steps, which allows
+  you to add [dependencies](#dependencies) from
+  Nixpkgs (https://github.com/NixOS/nixpkgs). You can
+  search for packages on https://search.nixos.org, and
+  there's a pretty good chance the package(s) you're looking
+  for will be there.
+
+Example:
+
+```yaml
+engine: "nixery"
+```
+
+### Clone options
+
+When a workflow starts, the first step is to clone the
+repository. You can customize this behavior using the
+**optional** `clone` field. It has the following fields:
+
+- `skip`: Setting this to `true` will skip cloning the
+  repository. This can be useful if your workflow is doing
+  something that doesn't require anything from the
+  repository itself. This is `false` by default.
+- `depth`: This sets the number of commits, or the "clone
+  depth", to fetch from the repository. For example, if you
+  set this to 2, the last 2 commits will be fetched. By
+  default, the depth is set to 1, meaning only the most
+  recent commit will be fetched, which is the commit that
+  triggered the workflow.
+- `submodules`: If you use Git submodules
+  (https://git-scm.com/book/en/v2/Git-Tools-Submodules)
+  in your repository, setting this field to `true` will
+  recursively fetch all submodules. This is `false` by
+  default.
+
+The default settings are:
+
+```yaml
+clone:
+  skip: false
+  depth: 1
+  submodules: false
+```
+
+### Dependencies
+
+Usually when you're running a workflow, you'll need
+additional dependencies. The `dependencies` field lets you
+define which dependencies to get, and from where. It's a
+key-value map, with the key being the registry to fetch
+dependencies from, and the value being the list of
+dependencies to fetch.
+
+Say you want to fetch Node.js and Go from `nixpkgs`, and a
+package called `my_pkg` you've made from your own registry
+at your repository at
+`https://tangled.org/@example.com/my_pkg`. You can define
+those dependencies like so:
+
+```yaml
+dependencies:
+  # nixpkgs
+  nixpkgs:
+    - nodejs
+    - go
+  # custom registry
+  git+https://tangled.org/@example.com/my_pkg:
+    - my_pkg
+```
+
+Now these dependencies are available to use in your
+workflow!
+
+### Environment
+
+The `environment` field allows you define environment
+variables that will be available throughout the entire
+workflow. **Do not put secrets here, these environment
+variables are visible to anyone viewing the repository. You
+can add secrets for pipelines in your repository's
+settings.**
+
+Example:
+
+```yaml
+environment:
+  GOOS: "linux"
+  GOARCH: "arm64"
+  NODE_ENV: "production"
+  MY_ENV_VAR: "MY_ENV_VALUE"
+```
+
+### Steps
+
+The `steps` field allows you to define what steps should run
+in the workflow. It's a list of step objects, each with the
+following fields:
+
+- `name`: This field allows you to give your step a name.
+  This name is visible in your workflow runs, and is used to
+  describe what the step is doing.
+- `command`: This field allows you to define a command to
+  run in that step. The step is run in a Bash shell, and the
+  logs from the command will be visible in the pipelines
+  page on the Tangled website. The
+  [dependencies](#dependencies) you added will be available
+  to use here.
+- `environment`: Similar to the global
+  [environment](#environment) config, this **optional**
+  field is a key-value map that allows you to set
+  environment variables for the step. **Do not put secrets
+  here, these environment variables are visible to anyone
+  viewing the repository. You can add secrets for pipelines
+  in your repository's settings.**
+
+Example:
+
+```yaml
+steps:
+  - name: "Build backend"
+    command: "go build"
+    environment:
+      GOOS: "darwin"
+      GOARCH: "arm64"
+  - name: "Build frontend"
+    command: "npm run build"
+    environment:
+      NODE_ENV: "production"
+```
+
+### Complete workflow
+
+```yaml
+# .tangled/workflows/build.yml
+
+when:
+  - event: ["push", "manual"]
+    branch: ["main", "develop"]
+  - event: ["pull_request"]
+    branch: ["main"]
+
+engine: "nixery"
+
+# using the default values
+clone:
+  skip: false
+  depth: 1
+  submodules: false
+
+dependencies:
+  # nixpkgs
+  nixpkgs:
+    - nodejs
+    - go
+  # custom registry
+  git+https://tangled.org/@example.com/my_pkg:
+    - my_pkg
+
+environment:
+  GOOS: "linux"
+  GOARCH: "arm64"
+  NODE_ENV: "production"
+  MY_ENV_VAR: "MY_ENV_VALUE"
+
+steps:
+  - name: "Build backend"
+    command: "go build"
+    environment:
+      GOOS: "darwin"
+      GOARCH: "arm64"
+  - name: "Build frontend"
+    command: "npm run build"
+    environment:
+      NODE_ENV: "production"
+```
+
+If you want another example of a workflow, you can look at
+the one [Tangled uses to build the
+project](https://tangled.org/@tangled.org/core/blob/master/.tangled/workflows/build.yml).
+
+## Self-hosting guide
+
+### Prerequisites
+
+* Go
+* Docker (the only supported backend currently)
+
+### Configuration
+
+Spindle is configured using environment variables. The following environment variables are available:
+
+* `SPINDLE_SERVER_LISTEN_ADDR`: The address the server listens on (default: `"0.0.0.0:6555"`).
+* `SPINDLE_SERVER_DB_PATH`: The path to the SQLite database file (default: `"spindle.db"`).
+* `SPINDLE_SERVER_HOSTNAME`: The hostname of the server (required).
+* `SPINDLE_SERVER_JETSTREAM_ENDPOINT`: The endpoint of the Jetstream server (default: `"wss://jetstream1.us-west.bsky.network/subscribe"`).
+* `SPINDLE_SERVER_DEV`: A boolean indicating whether the server is running in development mode (default: `false`).
+* `SPINDLE_SERVER_OWNER`: The DID of the owner (required).
+* `SPINDLE_PIPELINES_NIXERY`: The Nixery URL (default: `"nixery.tangled.sh"`).
+* `SPINDLE_PIPELINES_WORKFLOW_TIMEOUT`: The default workflow timeout (default: `"5m"`).
+* `SPINDLE_PIPELINES_LOG_DIR`: The directory to store workflow logs (default: `"/var/log/spindle"`).
+
+### Running spindle
+
+1.  **Set the environment variables.**  For example:
+
+    ```shell
+    export SPINDLE_SERVER_HOSTNAME="your-hostname"
+    export SPINDLE_SERVER_OWNER="your-did"
+    ```
+
+2.  **Build the Spindle binary.**
+
+    ```shell
+    cd core
+    go mod download
+    go build -o cmd/spindle/spindle cmd/spindle/main.go
+    ```
+
+3.  **Create the log directory.**
+
+    ```shell
+    sudo mkdir -p /var/log/spindle
+    sudo chown $USER:$USER -R /var/log/spindle
+    ```
+
+4.  **Run the Spindle binary.**
+
+    ```shell
+    ./cmd/spindle/spindle
+    ```
+
+Spindle will now start, connect to the Jetstream server, and begin processing pipelines.
+
+## Architecture
+
+Spindle is a small CI runner service. Here's a high-level overview of how it operates:
+
+* Listens for [`sh.tangled.spindle.member`](/lexicons/spindle/member.json) and
+[`sh.tangled.repo`](/lexicons/repo.json) records on the Jetstream.
+* When a new repo record comes through (typically when you add a spindle to a
+repo from the settings), spindle then resolves the underlying knot and
+subscribes to repo events (see:
+[`sh.tangled.pipeline`](/lexicons/pipeline.json)).
+* The spindle engine then handles execution of the pipeline, with results and
+logs beamed on the spindle event stream over WebSocket
+
+### The engine
+
+At present, the only supported backend is Docker (and Podman, if Docker
+compatibility is enabled, so that `/run/docker.sock` is created). spindle
+executes each step in the pipeline in a fresh container, with state persisted
+across steps within the `/tangled/workspace` directory.
+
+The base image for the container is constructed on the fly using
+[Nixery](https://nixery.dev), which is handy for caching layers for frequently
+used packages.
+
+The pipeline manifest is [specified here](https://docs.tangled.org/spindles.html#pipelines).
+
+## Secrets with openbao
+
+This document covers setting up spindle to use OpenBao for secrets
+management via OpenBao Proxy instead of the default SQLite backend.
+
+### Overview
+
+Spindle now uses OpenBao Proxy for secrets management. The proxy handles
+authentication automatically using AppRole credentials, while spindle
+connects to the local proxy instead of directly to the OpenBao server.
+
+This approach provides better security, automatic token renewal, and
+simplified application code.
+
+### Installation
+
+Install OpenBao from Nixpkgs:
+
+```bash
+nix shell nixpkgs#openbao   # for a local server
+```
+
+### Setup
+
+The setup process can is documented for both local development and production.
+
+#### Local development
+
+Start OpenBao in dev mode:
+
+```bash
+bao server -dev -dev-root-token-id="root" -dev-listen-address=127.0.0.1:8201
+```
+
+This starts OpenBao on `http://localhost:8201` with a root token.
+
+Set up environment for bao CLI:
+
+```bash
+export BAO_ADDR=http://localhost:8200
+export BAO_TOKEN=root
+```
+
+#### Production
+
+You would typically use a systemd service with a
+configuration file. Refer to
+[@tangled.org/infra](https://tangled.org/@tangled.org/infra)
+for how this can be achieved using Nix.
+
+Then, initialize the bao server:
+
+```bash
+bao operator init -key-shares=1 -key-threshold=1
+```
+
+This will print out an unseal key and a root key. Save them
+somewhere (like a password manager). Then unseal the vault
+to begin setting it up:
+
+```bash
+bao operator unseal <unseal_key>
+```
+
+All steps below remain the same across both dev and
+production setups.
+
+#### Configure openbao server
+
+Create the spindle KV mount:
+
+```bash
+bao secrets enable -path=spindle -version=2 kv
+```
+
+Set up AppRole authentication and policy:
+
+Create a policy file `spindle-policy.hcl`:
+
+```hcl
+# Full access to spindle KV v2 data
+path "spindle/data/*" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+
+# Access to metadata for listing and management
+path "spindle/metadata/*" {
+  capabilities = ["list", "read", "delete", "update"]
+}
+
+# Allow listing at root level
+path "spindle/" {
+  capabilities = ["list"]
+}
+
+# Required for connection testing and health checks
+path "auth/token/lookup-self" {
+  capabilities = ["read"]
+}
+```
+
+Apply the policy and create an AppRole:
+
+```bash
+bao policy write spindle-policy spindle-policy.hcl
+bao auth enable approle
+bao write auth/approle/role/spindle \
+    token_policies="spindle-policy" \
+    token_ttl=1h \
+    token_max_ttl=4h \
+    bind_secret_id=true \
+    secret_id_ttl=0 \
+    secret_id_num_uses=0
+```
+
+Get the credentials:
+
+```bash
+# Get role ID (static)
+ROLE_ID=$(bao read -field=role_id auth/approle/role/spindle/role-id)
+
+# Generate secret ID
+SECRET_ID=$(bao write -f -field=secret_id auth/approle/role/spindle/secret-id)
+
+echo "Role ID: $ROLE_ID"
+echo "Secret ID: $SECRET_ID"
+```
+
+#### Create proxy configuration
+
+Create the credential files:
+
+```bash
+# Create directory for OpenBao files
+mkdir -p /tmp/openbao
+
+# Save credentials
+echo "$ROLE_ID" > /tmp/openbao/role-id
+echo "$SECRET_ID" > /tmp/openbao/secret-id
+chmod 600 /tmp/openbao/role-id /tmp/openbao/secret-id
+```
+
+Create a proxy configuration file `/tmp/openbao/proxy.hcl`:
+
+```hcl
+# OpenBao server connection
+vault {
+  address = "http://localhost:8200"
+}
+
+# Auto-Auth using AppRole
+auto_auth {
+  method "approle" {
+    mount_path = "auth/approle"
+    config = {
+      role_id_file_path   = "/tmp/openbao/role-id"
+      secret_id_file_path = "/tmp/openbao/secret-id"
+    }
+  }
+
+  # Optional: write token to file for debugging
+  sink "file" {
+    config = {
+      path = "/tmp/openbao/token"
+      mode = 0640
+    }
+  }
+}
+
+# Proxy listener for spindle
+listener "tcp" {
+  address     = "127.0.0.1:8201"
+  tls_disable = true
+}
+
+# Enable API proxy with auto-auth token
+api_proxy {
+  use_auto_auth_token = true
+}
+
+# Enable response caching
+cache {
+  use_auto_auth_token = true
+}
+
+# Logging
+log_level = "info"
+```
+
+#### Start the proxy
+
+Start OpenBao Proxy:
+
+```bash
+bao proxy -config=/tmp/openbao/proxy.hcl
+```
+
+The proxy will authenticate with OpenBao and start listening on
+`127.0.0.1:8201`.
+
+#### Configure spindle
+
+Set these environment variables for spindle:
+
+```bash
+export SPINDLE_SERVER_SECRETS_PROVIDER=openbao
+export SPINDLE_SERVER_SECRETS_OPENBAO_PROXY_ADDR=http://127.0.0.1:8201
+export SPINDLE_SERVER_SECRETS_OPENBAO_MOUNT=spindle
+```
+
+On startup, spindle will now connect to the local proxy,
+which handles all authentication automatically.
+
+### Production setup for proxy
+
+For production, you'll want to run the proxy as a service:
+
+Place your production configuration in
+`/etc/openbao/proxy.hcl` with proper TLS settings for the
+vault connection.
+
+### Verifying setup
+
+Test the proxy directly:
+
+```bash
+# Check proxy health
+curl -H "X-Vault-Request: true" http://127.0.0.1:8201/v1/sys/health
+
+# Test token lookup through proxy
+curl -H "X-Vault-Request: true" http://127.0.0.1:8201/v1/auth/token/lookup-self
+```
+
+Test OpenBao operations through the server:
+
+```bash
+# List all secrets
+bao kv list spindle/
+
+# Add a test secret via the spindle API, then check it exists
+bao kv list spindle/repos/
+
+# Get a specific secret
+bao kv get spindle/repos/your_repo_path/SECRET_NAME
+```
+
+### How it works
+
+- Spindle connects to OpenBao Proxy on localhost (typically
+  port 8200 or 8201)
+- The proxy authenticates with OpenBao using AppRole
+  credentials
+- All spindle requests go through the proxy, which injects
+  authentication tokens
+- Secrets are stored at
+  `spindle/repos/{sanitized_repo_path}/{secret_key}`
+- Repository paths like `did:plc:alice/myrepo` become
+  `did_plc_alice_myrepo`
+- The proxy handles all token renewal automatically
+- Spindle no longer manages tokens or authentication
+  directly
+
+### Troubleshooting
+
+**Connection refused**: Check that the OpenBao Proxy is
+running and listening on the configured address.
+
+**403 errors**: Verify the AppRole credentials are correct
+and the policy has the necessary permissions.
+
+**404 route errors**: The spindle KV mount probably doesn't
+exist—run the mount creation step again.
+
+**Proxy authentication failures**: Check the proxy logs and
+verify the role-id and secret-id files are readable and
+contain valid credentials.
+
+**Secret not found after writing**: This can indicate policy
+permission issues. Verify the policy includes both
+`spindle/data/*` and `spindle/metadata/*` paths with
+appropriate capabilities.
+
+Check proxy logs:
+
+```bash
+# If running as systemd service
+journalctl -u openbao-proxy -f
+
+# If running directly, check the console output
+```
+
+Test AppRole authentication manually:
+
+```bash
+bao write auth/approle/login \
+    role_id="$(cat /tmp/openbao/role-id)" \
+    secret_id="$(cat /tmp/openbao/secret-id)"
+```
+
+# Migrating knots and spindles
+
+Sometimes, non-backwards compatible changes are made to the
+knot/spindle XRPC APIs. If you host a knot or a spindle, you
+will need to follow this guide to upgrade. Typically, this
+only requires you to deploy the newest version.
+
+This document is laid out in reverse-chronological order.
+Newer migration guides are listed first, and older guides
+are further down the page.
+
+## Upgrading from v1.8.x
+
+After v1.8.2, the HTTP API for knots and spindles has been
+deprecated and replaced with XRPC. Repositories on outdated
+knots will not be viewable from the appview. Upgrading is
+straightforward however.
+
+For knots:
+
+- Upgrade to the latest tag (v1.9.0 or above)
+- Head to the [knot dashboard](https://tangled.org/settings/knots) and
+  hit the "retry" button to verify your knot
+
+For spindles:
+
+- Upgrade to the latest tag (v1.9.0 or above)
+- Head to the [spindle
+  dashboard](https://tangled.org/settings/spindles) and hit the
+  "retry" button to verify your spindle
+
+## Upgrading from v1.7.x
+
+After v1.7.0, knot secrets have been deprecated. You no
+longer need a secret from the appview to run a knot. All
+authorized commands to knots are managed via [Inter-Service
+Authentication](https://atproto.com/specs/xrpc#inter-service-authentication-jwt).
+Knots will be read-only until upgraded.
+
+Upgrading is quite easy, in essence:
+
+- `KNOT_SERVER_SECRET` is no more, you can remove this
+  environment variable entirely
+- `KNOT_SERVER_OWNER` is now required on boot, set this to
+  your DID. You can find your DID in the
+  [settings](https://tangled.org/settings) page.
+- Restart your knot once you have replaced the environment
+  variable
+- Head to the [knot dashboard](https://tangled.org/settings/knots) and
+  hit the "retry" button to verify your knot. This simply
+  writes a `sh.tangled.knot` record to your PDS.
+
+If you use the nix module, simply bump the flake to the
+latest revision, and change your config block like so:
+
+```diff
+ services.tangled.knot = {
+   enable = true;
+   server = {
+-    secretFile = /path/to/secret;
++    owner = "did:plc:foo";
+   };
+ };
+```
+
+# Hacking on Tangled
+
+We highly recommend [installing
+Nix](https://nixos.org/download/) (the package manager)
+before working on the codebase. The Nix flake provides a lot
+of helpers to get started and most importantly, builds and
+dev shells are entirely deterministic.
+
+To set up your dev environment:
+
+```bash
+nix develop
+```
+
+Non-Nix users can look at the `devShell` attribute in the
+`flake.nix` file to determine necessary dependencies.
+
+## Running the appview
+
+The Nix flake also exposes a few `app` attributes (run `nix
+flake show` to see a full list of what the flake provides),
+one of the apps runs the appview with the `air`
+live-reloader:
+
+```bash
+TANGLED_DEV=true nix run .#watch-appview
+
+# TANGLED_DB_PATH might be of interest to point to
+# different sqlite DBs
+
+# in a separate shell, you can live-reload tailwind
+nix run .#watch-tailwind
+```
+
+To authenticate with the appview, you will need Redis and
+OAuth JWKs to be set up:
+
+```
+# OAuth JWKs should already be set up by the Nix devshell:
+echo $TANGLED_OAUTH_CLIENT_SECRET
+z42ty4RT1ovnTopY8B8ekz9NuziF2CuMkZ7rbRFpAR9jBqMc
+
+echo $TANGLED_OAUTH_CLIENT_KID
[phone]
+
+# if not, you can set it up yourself:
+goat key generate -t P-256
+Key Type: P-256 / secp256r1 / ES256 private key
+Secret Key (Multibase Syntax): save this securely (eg, add to password manager)
+        z42tuPDKRfM2mz2Kv953ARen2jmrPA8S9LX9tRq4RVcUMwwL
+Public Key (DID Key Syntax): share or publish this (eg, in DID document)
+        did:key:zDnaeUBxtG6Xuv3ATJE4GaWeyXM3jyamJsZw3bSPpxx4bNXDR
+
+# the secret key from above
+export TANGLED_OAUTH_CLIENT_SECRET="z42tuP..."
+
+# Run Redis in a new shell to store OAuth sessions
+redis-server
+```
+
+## Running knots and spindles
+
+An end-to-end knot setup requires setting up a machine with
+`sshd`, `AuthorizedKeysCommand`, and a Git user, which is
+quite cumbersome. So the Nix flake provides a
+`nixosConfiguration` to do so.
+
+<details>
+  <summary><strong>macOS users will have to set up a Nix Builder first</strong></summary>
+
+  In order to build Tangled's dev VM on macOS, you will
+  first need to set up a Linux Nix builder. The recommended
+  way to do so is to run a [`darwin.linux-builder`
+  VM](https://nixos.org/manual/nixpkgs/unstable/#sec-darwin-builder)
+  and to register it in `nix.conf` as a builder for Linux
+  with the same architecture as your Mac (`linux-aarch64` if
+  you are using Apple Silicon).
+
+  > IMPORTANT: You must build `darwin.linux-builder` somewhere other than inside
+  > the Tangled repo so that it doesn't conflict with the other VM. For example,
+  > you can do
+  >
+  > ```shell
+  > cd $(mktemp -d buildervm.XXXXX) && nix run nixpkgs#darwin.linux-builder
+  > ```
+  >
+  > to store the builder VM in a temporary dir.
+  >
+  > You should read and follow [all the other intructions][darwin builder vm] to
+  >  avoid subtle problems.
+
+  Alternatively, you can use any other method to set up a
+  Linux machine with Nix installed that you can `sudo ssh`
+  into (in other words, root user on your Mac has to be able
+  to ssh into the Linux machine without entering a password)
+  and that has the same architecture as your Mac. See
+  [remote builder
+  instructions](https://nix.dev/manual/nix/2.28/advanced-topics/distributed-builds.html#requirements)
+  for how to register such a builder in `nix.conf`.
+
+  > WARNING: If you'd like to use
+  > [`nixos-lima`](https://github.com/nixos-lima/nixos-lima) or
+  > [Orbstack](https://orbstack.dev/), note that setting them up so that `sudo
+  > ssh` works can be tricky. It seems to be [possible with
+  > Orbstack](https://github.com/orgs/orbstack/discussions/1669).
+
+</details>
+
+To begin, grab your DID from http://localhost:3000/settings.
+Then, set `TANGLED_VM_KNOT_OWNER` and
+`TANGLED_VM_SPINDLE_OWNER` to your DID. You can now start a
+lightweight NixOS VM like so:
+
+```bash
+nix run --impure .#vm
+
+# type `poweroff` at the shell to exit the VM
+```
+
+This starts a knot on port 6444, a spindle on port 6555
+with `ssh` exposed on port 2222.
+
+Once the services are running, head to
+http://localhost:3000/settings/knots and hit "Verify". It should
+verify the ownership of the services instantly if everything
+went smoothly.
+
+You can push repositories to this VM with this ssh config
+block on your main machine:
+
+```bash
+Host nixos-shell
+    Hostname localhost
+    Port 2222
+    User git
+    IdentityFile ~/.ssh/my_tangled_key
+```
+
+Set up a remote called `local-dev` on a git repo:
+
+```bash
+git remote add local-dev git@nixos-shell:user/repo
+git push local-dev main
+```
+
+The above VM should already be running a spindle on
+`localhost:6555`. Head to http://localhost:3000/settings/spindles and
+hit "Verify". You can then configure each repository to use
+this spindle and run CI jobs.
+
+Of interest when debugging spindles:
+
+```
+# Service logs from journald:
+journalctl -xeu spindle
+
+# CI job logs from disk:
+ls /var/log/spindle
+
+# Debugging spindle database:
+sqlite3 /var/lib/spindle/spindle.db
+
+# litecli has a nicer REPL interface:
+litecli /var/lib/spindle/spindle.db
+```
+
+If for any reason you wish to disable either one of the
+services in the VM, modify [nix/vm.nix](/nix/vm.nix) and set
+`services.tangled.spindle.enable` (or
+`services.tangled.knot.enable`) to `false`.
+
+# Contribution guide
+
+## Commit guidelines
+
+We follow a commit style similar to the Go project. Please keep commits:
+
+* **atomic**: each commit should represent one logical change
+* **descriptive**: the commit message should clearly describe what the
+change does and why it's needed
+
+### Message format
+
+```
+<service/top-level directory>/<affected package/directory>: <short summary of change>
+
+Optional longer description can go here, if necessary. Explain what the
+change does and why, especially if not obvious. Reference relevant
+issues or PRs when applicable. These can be links for now since we don't
+auto-link issues/PRs yet.
+```
+
+Here are some examples:
+
+```
+appview/state: fix token expiry check in middleware
+
+The previous check did not account for clock drift, leading to premature
+token invalidation.
+```
+
+```
+knotserver/git/service: improve error checking in upload-pack
+```
+
+
+### General notes
+
+- PRs get merged "as-is" (fast-forward)—like applying a patch-series
+using `git am`. At present, there is no squashing—so please author
+your commits as they would appear on `master`, following the above
+guidelines.
+- If there is a lot of nesting, for example "appview:
+pages/templates/repo/fragments: ...", these can be truncated down to
+just "appview: repo/fragments: ...". If the change affects a lot of
+subdirectories, you may abbreviate to just the top-level names, e.g.
+"appview: ..." or "knotserver: ...".
+- Keep commits lowercased with no trailing period.
+- Use the imperative mood in the summary line (e.g., "fix bug" not
+"fixed bug" or "fixes bug").
+- Try to keep the summary line under 72 characters, but we aren't too
+fussed about this.
+- Follow the same formatting for PR titles if filled manually.
+- Don't include unrelated changes in the same commit.
+- Avoid noisy commit messages like "wip" or "final fix"—rewrite history
+before submitting if necessary.
+
+## Code formatting
+
+We use a variety of tools to format our code, and multiplex them with
+[`treefmt`](https://treefmt.com). All you need to do to format your changes
+is run `nix run .#fmt` (or just `treefmt` if you're in the devshell).
+
+## Proposals for bigger changes
+
+Small fixes like typos, minor bugs, or trivial refactors can be
+submitted directly as PRs.
+
+For larger changes—especially those introducing new features, significant
+refactoring, or altering system behavior—please open a proposal first. This
+helps us evaluate the scope, design, and potential impact before implementation.
+
+Create a new issue titled:
+
+```
+proposal: <affected scope>: <summary of change>
+```
+
+In the description, explain:
+
+- What the change is
+- Why it's needed
+- How you plan to implement it (roughly)
+- Any open questions or tradeoffs
+
+We'll use the issue thread to discuss and refine the idea before moving
+forward.
+
+## Developer Certificate of Origin (DCO)
+
+We require all contributors to certify that they have the right to
+submit the code they're contributing. To do this, we follow the
+[Developer Certificate of Origin
+(DCO)](https://developercertificate.org/).
+
+By signing your commits, you're stating that the contribution is your
+own work, or that you have the right to submit it under the project's
+license. This helps us keep things clean and legally sound.
+
+To sign your commit, just add the `-s` flag when committing:
+
+```sh
+git commit -s -m "your commit message"
+```
+
+This appends a line like:
+
+```
+Signed-off-by: Your Name <[e-mail]>
+```
+
+We won't merge commits if they aren't signed off. If you forget, you can
+amend the last commit like this:
+
+```sh
+git commit --amend -s
+```
+
+If you're submitting a PR with multiple commits, make sure each one is
+signed.
+
+For [jj](https://jj-vcs.github.io/jj/latest/) users, you can run the following command
+to make it sign off commits in the tangled repo:
+
+```shell
+# Safety check, should say "No matching config key..."
+jj config list templates.commit_trailers
+# The command below may need to be adjusted if the command above returned something.
+jj config set --repo templates.commit_trailers "format_signed_off_by_trailer(self)"
+```
+
+Refer to the [jujutsu
+documentation](https://jj-vcs.github.io/jj/latest/config/#commit-trailers)
+for more information.

docs/contributing.md

···
-# tangled contributing guide
-
-## commit guidelines
-
-We follow a commit style similar to the Go project. Please keep commits:
-
-* **atomic**: each commit should represent one logical change
-* **descriptive**: the commit message should clearly describe what the
-change does and why it's needed
-
-### message format
-
-```
-<service/top-level directory>/<affected package/directory>: <short summary of change>
-
-
-Optional longer description can go here, if necessary. Explain what the
-change does and why, especially if not obvious. Reference relevant
-issues or PRs when applicable. These can be links for now since we don't
-auto-link issues/PRs yet.
-```
-
-Here are some examples:
-
-```
-appview/state: fix token expiry check in middleware
-
-The previous check did not account for clock drift, leading to premature
-token invalidation.
-```
-
-```
-knotserver/git/service: improve error checking in upload-pack
-```
-
-
-### general notes
-
-- PRs get merged "as-is" (fast-forward) -- like applying a patch-series
-using `git am`. At present, there is no squashing -- so please author
-your commits as they would appear on `master`, following the above
-guidelines.
-- If there is a lot of nesting, for example "appview:
-pages/templates/repo/fragments: ...", these can be truncated down to
-just "appview: repo/fragments: ...". If the change affects a lot of
-subdirectories, you may abbreviate to just the top-level names, e.g.
-"appview: ..." or "knotserver: ...".
-- Keep commits lowercased with no trailing period.
-- Use the imperative mood in the summary line (e.g., "fix bug" not
-"fixed bug" or "fixes bug").
-- Try to keep the summary line under 72 characters, but we aren't too
-fussed about this.
-- Follow the same formatting for PR titles if filled manually.
-- Don't include unrelated changes in the same commit.
-- Avoid noisy commit messages like "wip" or "final fix"—rewrite history
-before submitting if necessary.
-
-## code formatting
-
-We use a variety of tools to format our code, and multiplex them with
-[`treefmt`](https://treefmt.com): all you need to do to format your changes
-is run `nix run .#fmt` (or just `treefmt` if you're in the devshell).
-
-## proposals for bigger changes
-
-Small fixes like typos, minor bugs, or trivial refactors can be
-submitted directly as PRs.
-
-For larger changes—especially those introducing new features, significant
-refactoring, or altering system behavior—please open a proposal first. This
-helps us evaluate the scope, design, and potential impact before implementation.
-
-### proposal format
-
-Create a new issue titled:
-
-```
-proposal: <affected scope>: <summary of change>
-```
-
-In the description, explain:
-
-- What the change is
-- Why it's needed
-- How you plan to implement it (roughly)
-- Any open questions or tradeoffs
-
-We'll use the issue thread to discuss and refine the idea before moving
-forward.
-
-## developer certificate of origin (DCO)
-
-We require all contributors to certify that they have the right to
-submit the code they're contributing. To do this, we follow the
-[Developer Certificate of Origin
-(DCO)](https://developercertificate.org/).
-
-By signing your commits, you're stating that the contribution is your
-own work, or that you have the right to submit it under the project's
-license. This helps us keep things clean and legally sound.
-
-To sign your commit, just add the `-s` flag when committing:
-
-```sh
-git commit -s -m "your commit message"
-```
-
-This appends a line like:
-
-```
-Signed-off-by: Your Name <[e-mail]>
-```
-
-We won't merge commits if they aren't signed off. If you forget, you can
-amend the last commit like this:
-
-```sh
-git commit --amend -s
-```
-
-If you're submitting a PR with multiple commits, make sure each one is
-signed.
-
-For [jj](https://jj-vcs.github.io/jj/latest/) users, you can run the following command
-to make it sign off commits in the tangled repo:
-
-```shell
-# Safety check, should say "No matching config key..."
-jj config list templates.commit_trailers
-# The command below may need to be adjusted if the command above returned something.
-jj config set --repo templates.commit_trailers "format_signed_off_by_trailer(self)"
-```
-
-Refer to the [jj
-documentation](https://jj-vcs.github.io/jj/latest/config/#commit-trailers)
-for more information.

docs/hacking.md

···
-# hacking on tangled
-
-We highly recommend [installing
-nix](https://nixos.org/download/) (the package manager)
-before working on the codebase. The nix flake provides a lot
-of helpers to get started and most importantly, builds and
-dev shells are entirely deterministic.
-
-To set up your dev environment:
-
-```bash
-nix develop
-```
-
-Non-nix users can look at the `devShell` attribute in the
-`flake.nix` file to determine necessary dependencies.
-
-## running the appview
-
-The nix flake also exposes a few `app` attributes (run `nix
-flake show` to see a full list of what the flake provides),
-one of the apps runs the appview with the `air`
-live-reloader:
-
-```bash
-TANGLED_DEV=true nix run .#watch-appview
-
-# TANGLED_DB_PATH might be of interest to point to
-# different sqlite DBs
-
-# in a separate shell, you can live-reload tailwind
-nix run .#watch-tailwind
-```
-
-To authenticate with the appview, you will need redis and
-OAUTH JWKs to be setup:
-
-```
-# oauth jwks should already be setup by the nix devshell:
-echo $TANGLED_OAUTH_CLIENT_SECRET
-z42ty4RT1ovnTopY8B8ekz9NuziF2CuMkZ7rbRFpAR9jBqMc
-
-echo $TANGLED_OAUTH_CLIENT_KID
-1761667908
-
-# if not, you can set it up yourself:
-goat key generate -t P-256
-Key Type: P-256 / secp256r1 / ES256 private key
-Secret Key (Multibase Syntax): save this securely (eg, add to password manager)
-        z42tuPDKRfM2mz2Kv953ARen2jmrPA8S9LX9tRq4RVcUMwwL
-Public Key (DID Key Syntax): share or publish this (eg, in DID document)
-        did:key:zDnaeUBxtG6Xuv3ATJE4GaWeyXM3jyamJsZw3bSPpxx4bNXDR
-
-# the secret key from above
-export TANGLED_OAUTH_CLIENT_SECRET="z42tuP..."
-
-# run redis in at a new shell to store oauth sessions
-redis-server
-```
-
-## running knots and spindles
-
-An end-to-end knot setup requires setting up a machine with
-`sshd`, `AuthorizedKeysCommand`, and git user, which is
-quite cumbersome. So the nix flake provides a
-`nixosConfiguration` to do so.
-
-<details>
-  <summary><strong>MacOS users will have to setup a Nix Builder first</strong></summary>
-
-  In order to build Tangled's dev VM on macOS, you will
-  first need to set up a Linux Nix builder. The recommended
-  way to do so is to run a [`darwin.linux-builder`
-  VM](https://nixos.org/manual/nixpkgs/unstable/#sec-darwin-builder)
-  and to register it in `nix.conf` as a builder for Linux
-  with the same architecture as your Mac (`linux-aarch64` if
-  you are using Apple Silicon).
-
-  > IMPORTANT: You must build `darwin.linux-builder` somewhere other than inside
-  > the tangled repo so that it doesn't conflict with the other VM. For example,
-  > you can do
-  >
-  > ```shell
-  > cd $(mktemp -d buildervm.XXXXX) && nix run nixpkgs#darwin.linux-builder
-  > ```
-  >
-  > to store the builder VM in a temporary dir.
-  >
-  > You should read and follow [all the other intructions][darwin builder vm] to
-  >  avoid subtle problems.
-
-  Alternatively, you can use any other method to set up a
-  Linux machine with `nix` installed that you can `sudo ssh`
-  into (in other words, root user on your Mac has to be able
-  to ssh into the Linux machine without entering a password)
-  and that has the same architecture as your Mac. See
-  [remote builder
-  instructions](https://nix.dev/manual/nix/2.28/advanced-topics/distributed-builds.html#requirements)
-  for how to register such a builder in `nix.conf`.
-
-  > WARNING: If you'd like to use
-  > [`nixos-lima`](https://github.com/nixos-lima/nixos-lima) or
-  > [Orbstack](https://orbstack.dev/), note that setting them up so that `sudo
-  > ssh` works can be tricky. It seems to be [possible with
-  > Orbstack](https://github.com/orgs/orbstack/discussions/1669).
-
-</details>
-
-To begin, grab your DID from http://localhost:3000/settings.
-Then, set `TANGLED_VM_KNOT_OWNER` and
-`TANGLED_VM_SPINDLE_OWNER` to your DID. You can now start a
-lightweight NixOS VM like so:
-
-```bash
-nix run --impure .#vm
-
-# type `poweroff` at the shell to exit the VM
-```
-
-This starts a knot on port 6444, a spindle on port 6555
-with `ssh` exposed on port 2222.
-
-Once the services are running, head to
-http://localhost:3000/settings/knots and hit verify. It should
-verify the ownership of the services instantly if everything
-went smoothly.
-
-You can push repositories to this VM with this ssh config
-block on your main machine:
-
-```bash
-Host nixos-shell
-    Hostname localhost
-    Port 2222
-    User git
-    IdentityFile ~/.ssh/my_tangled_key
-```
-
-Set up a remote called `local-dev` on a git repo:
-
-```bash
-git remote add local-dev git@nixos-shell:user/repo
-git push local-dev main
-```
-
-### running a spindle
-
-The above VM should already be running a spindle on
-`localhost:6555`. Head to http://localhost:3000/settings/spindles and
-hit verify. You can then configure each repository to use
-this spindle and run CI jobs.
-
-Of interest when debugging spindles:
-
-```
-# service logs from journald:
-journalctl -xeu spindle
-
-# CI job logs from disk:
-ls /var/log/spindle
-
-# debugging spindle db:
-sqlite3 /var/lib/spindle/spindle.db
-
-# litecli has a nicer REPL interface:
-litecli /var/lib/spindle/spindle.db
-```
-
-If for any reason you wish to disable either one of the
-services in the VM, modify [nix/vm.nix](/nix/vm.nix) and set
-`services.tangled.spindle.enable` (or
-`services.tangled.knot.enable`) to `false`.

docs/highlight.theme

···
+{
+    "text-color": null,
+    "background-color": null,
+    "line-number-color": null,
+    "line-number-background-color": null,
+    "text-styles": {
+        "Annotation": {
+            "text-color": null,
+            "background-color": null,
+            "bold": false,
+            "italic": true,
+            "underline": false
+        },
+        "ControlFlow": {
+            "text-color": null,
+            "background-color": null,
+            "bold": true,
+            "italic": false,
+            "underline": false
+        },
+        "Error": {
+            "text-color": null,
+            "background-color": null,
+            "bold": true,
+            "italic": false,
+            "underline": false
+        },
+        "Alert": {
+            "text-color": null,
+            "background-color": null,
+            "bold": true,
+            "italic": false,
+            "underline": false
+        },
+        "Preprocessor": {
+            "text-color": null,
+            "background-color": null,
+            "bold": true,
+            "italic": false,
+            "underline": false
+        },
+        "Information": {
+            "text-color": null,
+            "background-color": null,
+            "bold": false,
+            "italic": true,
+            "underline": false
+        },
+        "Warning": {
+            "text-color": null,
+            "background-color": null,
+            "bold": false,
+            "italic": true,
+            "underline": false
+        },
+        "Documentation": {
+            "text-color": null,
+            "background-color": null,
+            "bold": false,
+            "italic": true,
+            "underline": false
+        },
+        "DataType": {
+            "text-color": "#8f4e8b",
+            "background-color": null,
+            "bold": false,
+            "italic": false,
+            "underline": false
+        },
+        "Comment": {
+            "text-color": null,
+            "background-color": null,
+            "bold": false,
+            "italic": true,
+            "underline": false
+        },
+        "CommentVar": {
+            "text-color": null,
+            "background-color": null,
+            "bold": false,
+            "italic": true,
+            "underline": false
+        },
+        "Keyword": {
+            "text-color": null,
+            "background-color": null,
+            "bold": true,
+            "italic": false,
+            "underline": false
+        }
+    }
+}
+

docs/knot-hosting.md

···
-# knot self-hosting guide
-
-So you want to run your own knot server? Great! Here are a few prerequisites:
-
-1. A server of some kind (a VPS, a Raspberry Pi, etc.). Preferably running a Linux distribution of some kind.
-2. A (sub)domain name. People generally use `knot.example.com`.
-3. A valid SSL certificate for your domain.
-
-There's a couple of ways to get started:
-* NixOS: refer to
-[flake.nix](https://tangled.sh/@tangled.sh/core/blob/master/flake.nix)
-* Docker: Documented at
-[@tangled.sh/knot-docker](https://tangled.sh/@tangled.sh/knot-docker)
-(community maintained: support is not guaranteed!)
-* Manual: Documented below.
-
-## manual setup
-
-First, clone this repository:
-
-```
-git clone https://tangled.org/@tangled.org/core
-```
-
-Then, build the `knot` CLI. This is the knot administration and operation tool.
-For the purpose of this guide, we're only concerned with these subcommands:
-
-* `knot server`: the main knot server process, typically run as a
-supervised service
-* `knot guard`: handles role-based access control for git over SSH
-(you'll never have to run this yourself)
-* `knot keys`: fetches SSH keys associated with your knot; we'll use
-this to generate the SSH `AuthorizedKeysCommand`
-
-```
-cd core
-export CGO_ENABLED=1
-go build -o knot ./cmd/knot
-```
-
-Next, move the `knot` binary to a location owned by `root` --
-`/usr/local/bin/` is a good choice. Make sure the binary itself is also owned by `root`:
-
-```
-sudo mv knot /usr/local/bin/knot
-sudo chown root:root /usr/local/bin/knot
-```
-
-This is necessary because SSH `AuthorizedKeysCommand` requires [really
-specific permissions](https://stackoverflow.com/a/27638306). The
-`AuthorizedKeysCommand` specifies a command that is run by `sshd` to
-retrieve a user's public SSH keys dynamically for authentication. Let's
-set that up.
-
-```
-sudo tee /etc/ssh/sshd_config.d/authorized_keys_command.conf <<EOF
-Match User git
-  AuthorizedKeysCommand /usr/local/bin/knot keys -o authorized-keys
-  AuthorizedKeysCommandUser nobody
-EOF
-```
-
-Then, reload `sshd`:
-
-```
-sudo systemctl reload ssh
-```
-
-Next, create the `git` user. We'll use the `git` user's home directory
-to store repositories:
-
-```
-sudo adduser git
-```
-
-Create `/home/git/.knot.env` with the following, updating the values as
-necessary. The `KNOT_SERVER_OWNER` should be set to your
-DID, you can find your DID in the [Settings](https://tangled.sh/settings) page.
-
-```
-KNOT_REPO_SCAN_PATH=/home/git
-KNOT_SERVER_HOSTNAME=knot.example.com
-APPVIEW_ENDPOINT=https://tangled.sh
-KNOT_SERVER_OWNER=did:plc:foobar
-KNOT_SERVER_INTERNAL_LISTEN_ADDR=127.0.0.1:5444
-KNOT_SERVER_LISTEN_ADDR=127.0.0.1:5555
-```
-
-If you run a Linux distribution that uses systemd, you can use the provided
-service file to run the server. Copy
-[`knotserver.service`](/systemd/knotserver.service)
-to `/etc/systemd/system/`. Then, run:
-
-```
-systemctl enable knotserver
-systemctl start knotserver
-```
-
-The last step is to configure a reverse proxy like Nginx or Caddy to front your
-knot. Here's an example configuration for Nginx:
-
-```
-server {
-    listen 80;
-    listen [::]:80;
-    server_name knot.example.com;
-
-    location / {
-        proxy_pass http://localhost:5555;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-    }
-
-    # wss endpoint for git events
-    location /events {
-        proxy_set_header   X-Forwarded-For $remote_addr;
-        proxy_set_header   Host $http_host;
-        proxy_set_header Upgrade websocket;
-        proxy_set_header Connection Upgrade;
-        proxy_pass http://localhost:5555;
-    }
-  # additional config for SSL/TLS go here.
-}
-
-```
-
-Remember to use Let's Encrypt or similar to procure a certificate for your
-knot domain.
-
-You should now have a running knot server! You can finalize
-your registration by hitting the `verify` button on the
-[/settings/knots](https://tangled.org/settings/knots) page. This simply creates
-a record on your PDS to announce the existence of the knot.
-
-### custom paths
-
-(This section applies to manual setup only. Docker users should edit the mounts
-in `docker-compose.yml` instead.)
-
-Right now, the database and repositories of your knot lives in `/home/git`. You
-can move these paths if you'd like to store them in another folder. Be careful
-when adjusting these paths:
-
-* Stop your knot when moving data (e.g. `systemctl stop knotserver`) to prevent
-any possible side effects. Remember to restart it once you're done.
-* Make backups before moving in case something goes wrong.
-* Make sure the `git` user can read and write from the new paths.
-
-#### database
-
-As an example, let's say the current database is at `/home/git/knotserver.db`,
-and we want to move it to `/home/git/database/knotserver.db`.
-
-Copy the current database to the new location. Make sure to copy the `.db-shm`
-and `.db-wal` files if they exist.
-
-```
-mkdir /home/git/database
-cp /home/git/knotserver.db* /home/git/database
-```
-
-In the environment (e.g. `/home/git/.knot.env`), set `KNOT_SERVER_DB_PATH` to
-the new file path (_not_ the directory):
-
-```
-KNOT_SERVER_DB_PATH=/home/git/database/knotserver.db
-```
-
-#### repositories
-
-As an example, let's say the repositories are currently in `/home/git`, and we
-want to move them into `/home/git/repositories`.
-
-Create the new folder, then move the existing repositories (if there are any):
-
-```
-mkdir /home/git/repositories
-# move all DIDs into the new folder; these will vary for you!
-mv /home/git/did:plc:wshs7t2adsemcrrd4snkeqli /home/git/repositories
-```
-
-In the environment (e.g. `/home/git/.knot.env`), update `KNOT_REPO_SCAN_PATH`
-to the new directory:
-
-```
-KNOT_REPO_SCAN_PATH=/home/git/repositories
-```
-
-Similarly, update your `sshd` `AuthorizedKeysCommand` to use the updated
-repository path:
-
-```
-sudo tee /etc/ssh/sshd_config.d/authorized_keys_command.conf <<EOF
-Match User git
-  AuthorizedKeysCommand /usr/local/bin/knot keys -o authorized-keys -git-dir /home/git/repositories
-  AuthorizedKeysCommandUser nobody
-EOF
-```
-
-Make sure to restart your SSH server!
-
-#### MOTD (message of the day)
-
-To configure the MOTD used ("Welcome to this knot!" by default), edit the
-`/home/git/motd` file:
-
-```
-printf "Hi from this knot!\n" > /home/git/motd
-```
-
-Note that you should add a newline at the end if setting a non-empty message
-since the knot won't do this for you.

docs/logo.html

···
+<div class="flex items-center gap-2 w-fit mx-auto">
+  <span class="w-16 h-16 [&>svg]:w-full [&>svg]:h-full text-black dark:text-white">
+    ${ dolly.svg() }
+  </span>
+  <span class="font-bold text-4xl not-italic text-black dark:text-white">tangled</span>
+</div>

docs/migrations.md

···
-# Migrations
-
-This document is laid out in reverse-chronological order.
-Newer migration guides are listed first, and older guides
-are further down the page.
-
-## Upgrading from v1.8.x
-
-After v1.8.2, the HTTP API for knot and spindles have been
-deprecated and replaced with XRPC. Repositories on outdated
-knots will not be viewable from the appview. Upgrading is
-straightforward however.
-
-For knots:
-
-- Upgrade to latest tag (v1.9.0 or above)
-- Head to the [knot dashboard](https://tangled.org/settings/knots) and
-  hit the "retry" button to verify your knot
-
-For spindles:
-
-- Upgrade to latest tag (v1.9.0 or above)
-- Head to the [spindle
-  dashboard](https://tangled.org/settings/spindles) and hit the
-  "retry" button to verify your spindle
-
-## Upgrading from v1.7.x
-
-After v1.7.0, knot secrets have been deprecated. You no
-longer need a secret from the appview to run a knot. All
-authorized commands to knots are managed via [Inter-Service
-Authentication](https://atproto.com/specs/xrpc#inter-service-authentication-jwt).
-Knots will be read-only until upgraded.
-
-Upgrading is quite easy, in essence:
-
-- `KNOT_SERVER_SECRET` is no more, you can remove this
-  environment variable entirely
-- `KNOT_SERVER_OWNER` is now required on boot, set this to
-  your DID. You can find your DID in the
-  [settings](https://tangled.org/settings) page.
-- Restart your knot once you have replaced the environment
-  variable
-- Head to the [knot dashboard](https://tangled.org/settings/knots) and
-  hit the "retry" button to verify your knot. This simply
-  writes a `sh.tangled.knot` record to your PDS.
-
-If you use the nix module, simply bump the flake to the
-latest revision, and change your config block like so:
-
-```diff
- services.tangled.knot = {
-   enable = true;
-   server = {
--    secretFile = /path/to/secret;
-+    owner = "did:plc:foo";
-   };
- };
-```

docs/mode.html

···
+<a class="px-4 py-2 mt-8 block text-center w-full rounded-sm shadow-sm border border-gray-200 dark:border-gray-700 no-underline hover:no-underline" href="$if(single-page)$/$else$/single-page.html$endif$">
+  $if(single-page)$View as multi-page$else$View as single-page$endif$
+</a>

docs/search.html

···
+<form action="https://google.com/search" role="search" aria-label="Sitewide" class="w-full">
+  <input type="hidden" name="q" value="+[inurl:https://docs.tangled.org]">
+  <label>
+    <span style="display:none;">Search</span>
+    <input type="text" name="q" placeholder="Search docs ..." class="w-full font-normal">
+  </label>
+</form>

docs/spindle/architecture.md

···
-# spindle architecture
-
-Spindle is a small CI runner service. Here's a high level overview of how it operates:
-
-* listens for [`sh.tangled.spindle.member`](/lexicons/spindle/member.json) and
-[`sh.tangled.repo`](/lexicons/repo.json) records on the Jetstream.
-* when a new repo record comes through (typically when you add a spindle to a
-repo from the settings), spindle then resolves the underlying knot and
-subscribes to repo events (see:
-[`sh.tangled.pipeline`](/lexicons/pipeline.json)).
-* the spindle engine then handles execution of the pipeline, with results and
-logs beamed on the spindle event stream over wss
-
-### the engine
-
-At present, the only supported backend is Docker (and Podman, if Docker
-compatibility is enabled, so that `/run/docker.sock` is created). Spindle
-executes each step in the pipeline in a fresh container, with state persisted
-across steps within the `/tangled/workspace` directory.
-
-The base image for the container is constructed on the fly using
-[Nixery](https://nixery.dev), which is handy for caching layers for frequently
-used packages.
-
-The pipeline manifest is [specified here](/docs/spindle/pipeline.md).

docs/spindle/hosting.md

···
-# spindle self-hosting guide
-
-## prerequisites
-
-* Go
-* Docker (the only supported backend currently)
-
-## configuration
-
-Spindle is configured using environment variables. The following environment variables are available:
-
-* `SPINDLE_SERVER_LISTEN_ADDR`: The address the server listens on (default: `"0.0.0.0:6555"`).
-* `SPINDLE_SERVER_DB_PATH`: The path to the SQLite database file (default: `"spindle.db"`).
-* `SPINDLE_SERVER_HOSTNAME`: The hostname of the server (required).
-* `SPINDLE_SERVER_JETSTREAM_ENDPOINT`: The endpoint of the Jetstream server (default: `"wss://jetstream1.us-west.bsky.network/subscribe"`).
-* `SPINDLE_SERVER_DEV`: A boolean indicating whether the server is running in development mode (default: `false`).
-* `SPINDLE_SERVER_OWNER`: The DID of the owner (required).
-* `SPINDLE_PIPELINES_NIXERY`: The Nixery URL (default: `"nixery.tangled.sh"`).
-* `SPINDLE_PIPELINES_WORKFLOW_TIMEOUT`: The default workflow timeout (default: `"5m"`).
-* `SPINDLE_PIPELINES_LOG_DIR`: The directory to store workflow logs (default: `"/var/log/spindle"`).
-
-## running spindle
-
-1.  **Set the environment variables.**  For example:
-
-    ```shell
-    export SPINDLE_SERVER_HOSTNAME="your-hostname"
-    export SPINDLE_SERVER_OWNER="your-did"
-    ```
-
-2.  **Build the Spindle binary.**
-
-    ```shell
-    cd core
-    go mod download
-    go build -o cmd/spindle/spindle cmd/spindle/main.go
-    ```
-
-3.  **Create the log directory.**
-
-    ```shell
-    sudo mkdir -p /var/log/spindle
-    sudo chown $USER:$USER -R /var/log/spindle
-    ```
-
-4.  **Run the Spindle binary.**
-
-    ```shell
-    ./cmd/spindle/spindle
-    ```
-
-Spindle will now start, connect to the Jetstream server, and begin processing pipelines.

docs/spindle/openbao.md

···
-# spindle secrets with openbao
-
-This document covers setting up Spindle to use OpenBao for secrets
-management via OpenBao Proxy instead of the default SQLite backend.
-
-## overview
-
-Spindle now uses OpenBao Proxy for secrets management. The proxy handles
-authentication automatically using AppRole credentials, while Spindle
-connects to the local proxy instead of directly to the OpenBao server.
-
-This approach provides better security, automatic token renewal, and
-simplified application code.
-
-## installation
-
-Install OpenBao from nixpkgs:
-
-```bash
-nix shell nixpkgs#openbao   # for a local server
-```
-
-## setup
-
-The setup process can is documented for both local development and production.
-
-### local development
-
-Start OpenBao in dev mode:
-
-```bash
-bao server -dev -dev-root-token-id="root" -dev-listen-address=127.0.0.1:8201
-```
-
-This starts OpenBao on `http://localhost:8201` with a root token.
-
-Set up environment for bao CLI:
-
-```bash
-export BAO_ADDR=http://localhost:8200
-export BAO_TOKEN=root
-```
-
-### production
-
-You would typically use a systemd service with a configuration file. Refer to
-[@tangled.org/infra](https://tangled.org/@tangled.org/infra) for how this can be
-achieved using Nix.
-
-Then, initialize the bao server:
-```bash
-bao operator init -key-shares=1 -key-threshold=1
-```
-
-This will print out an unseal key and a root key. Save them somewhere (like a password manager). Then unseal the vault to begin setting it up:
-```bash
-bao operator unseal <unseal_key>
-```
-
-All steps below remain the same across both dev and production setups.
-
-### configure openbao server
-
-Create the spindle KV mount:
-
-```bash
-bao secrets enable -path=spindle -version=2 kv
-```
-
-Set up AppRole authentication and policy:
-
-Create a policy file `spindle-policy.hcl`:
-
-```hcl
-# Full access to spindle KV v2 data
-path "spindle/data/*" {
-  capabilities = ["create", "read", "update", "delete"]
-}
-
-# Access to metadata for listing and management
-path "spindle/metadata/*" {
-  capabilities = ["list", "read", "delete", "update"]
-}
-
-# Allow listing at root level
-path "spindle/" {
-  capabilities = ["list"]
-}
-
-# Required for connection testing and health checks
-path "auth/token/lookup-self" {
-  capabilities = ["read"]
-}
-```
-
-Apply the policy and create an AppRole:
-
-```bash
-bao policy write spindle-policy spindle-policy.hcl
-bao auth enable approle
-bao write auth/approle/role/spindle \
-    token_policies="spindle-policy" \
-    token_ttl=1h \
-    token_max_ttl=4h \
-    bind_secret_id=true \
-    secret_id_ttl=0 \
-    secret_id_num_uses=0
-```
-
-Get the credentials:
-
-```bash
-# Get role ID (static)
-ROLE_ID=$(bao read -field=role_id auth/approle/role/spindle/role-id)
-
-# Generate secret ID
-SECRET_ID=$(bao write -f -field=secret_id auth/approle/role/spindle/secret-id)
-
-echo "Role ID: $ROLE_ID"
-echo "Secret ID: $SECRET_ID"
-```
-
-### create proxy configuration
-
-Create the credential files:
-
-```bash
-# Create directory for OpenBao files
-mkdir -p /tmp/openbao
-
-# Save credentials
-echo "$ROLE_ID" > /tmp/openbao/role-id
-echo "$SECRET_ID" > /tmp/openbao/secret-id
-chmod 600 /tmp/openbao/role-id /tmp/openbao/secret-id
-```
-
-Create a proxy configuration file `/tmp/openbao/proxy.hcl`:
-
-```hcl
-# OpenBao server connection
-vault {
-  address = "http://localhost:8200"
-}
-
-# Auto-Auth using AppRole
-auto_auth {
-  method "approle" {
-    mount_path = "auth/approle"
-    config = {
-      role_id_file_path   = "/tmp/openbao/role-id"
-      secret_id_file_path = "/tmp/openbao/secret-id"
-    }
-  }
-
-  # Optional: write token to file for debugging
-  sink "file" {
-    config = {
-      path = "/tmp/openbao/token"
-      mode = 0640
-    }
-  }
-}
-
-# Proxy listener for Spindle
-listener "tcp" {
-  address     = "127.0.0.1:8201"
-  tls_disable = true
-}
-
-# Enable API proxy with auto-auth token
-api_proxy {
-  use_auto_auth_token = true
-}
-
-# Enable response caching
-cache {
-  use_auto_auth_token = true
-}
-
-# Logging
-log_level = "info"
-```
-
-### start the proxy
-
-Start OpenBao Proxy:
-
-```bash
-bao proxy -config=/tmp/openbao/proxy.hcl
-```
-
-The proxy will authenticate with OpenBao and start listening on
-`127.0.0.1:8201`.
-
-### configure spindle
-
-Set these environment variables for Spindle:
-
-```bash
-export SPINDLE_SERVER_SECRETS_PROVIDER=openbao
-export SPINDLE_SERVER_SECRETS_OPENBAO_PROXY_ADDR=http://127.0.0.1:8201
-export SPINDLE_SERVER_SECRETS_OPENBAO_MOUNT=spindle
-```
-
-Start Spindle:
-
-Spindle will now connect to the local proxy, which handles all
-authentication automatically.
-
-## production setup for proxy
-
-For production, you'll want to run the proxy as a service:
-
-Place your production configuration in `/etc/openbao/proxy.hcl` with
-proper TLS settings for the vault connection.
-
-## verifying setup
-
-Test the proxy directly:
-
-```bash
-# Check proxy health
-curl -H "X-Vault-Request: true" http://127.0.0.1:8201/v1/sys/health
-
-# Test token lookup through proxy
-curl -H "X-Vault-Request: true" http://127.0.0.1:8201/v1/auth/token/lookup-self
-```
-
-Test OpenBao operations through the server:
-
-```bash
-# List all secrets
-bao kv list spindle/
-
-# Add a test secret via Spindle API, then check it exists
-bao kv list spindle/repos/
-
-# Get a specific secret
-bao kv get spindle/repos/your_repo_path/SECRET_NAME
-```
-
-## how it works
-
-- Spindle connects to OpenBao Proxy on localhost (typically port 8200 or 8201)
-- The proxy authenticates with OpenBao using AppRole credentials
-- All Spindle requests go through the proxy, which injects authentication tokens
-- Secrets are stored at `spindle/repos/{sanitized_repo_path}/{secret_key}`
-- Repository paths like `did:plc:alice/myrepo` become `did_plc_alice_myrepo`
-- The proxy handles all token renewal automatically
-- Spindle no longer manages tokens or authentication directly
-
-## troubleshooting
-
-**Connection refused**: Check that the OpenBao Proxy is running and
-listening on the configured address.
-
-**403 errors**: Verify the AppRole credentials are correct and the policy
-has the necessary permissions.
-
-**404 route errors**: The spindle KV mount probably doesn't exist - run
-the mount creation step again.
-
-**Proxy authentication failures**: Check the proxy logs and verify the
-role-id and secret-id files are readable and contain valid credentials.
-
-**Secret not found after writing**: This can indicate policy permission
-issues. Verify the policy includes both `spindle/data/*` and
-`spindle/metadata/*` paths with appropriate capabilities.
-
-Check proxy logs:
-
-```bash
-# If running as systemd service
-journalctl -u openbao-proxy -f
-
-# If running directly, check the console output
-```
-
-Test AppRole authentication manually:
-
-```bash
-bao write auth/approle/login \
-    role_id="$(cat /tmp/openbao/role-id)" \
-    secret_id="$(cat /tmp/openbao/secret-id)"
-```

docs/spindle/pipeline.md

···
-# spindle pipelines
-
-Spindle workflows allow you to write CI/CD pipelines in a simple format. They're located in the `.tangled/workflows` directory at the root of your repository, and are defined using YAML.
-
-The fields are:
-
-- [Trigger](#trigger): A **required** field that defines when a workflow should be triggered.
-- [Engine](#engine): A **required** field that defines which engine a workflow should run on.
-- [Clone options](#clone-options): An **optional** field that defines how the repository should be cloned.
-- [Dependencies](#dependencies): An **optional** field that allows you to list dependencies you may need.
-- [Environment](#environment): An **optional** field that allows you to define environment variables.
-- [Steps](#steps): An **optional** field that allows you to define what steps should run in the workflow.
-
-## Trigger
-
-The first thing to add to a workflow is the trigger, which defines when a workflow runs. This is defined using a `when` field, which takes in a list of conditions. Each condition has the following fields:
-
-- `event`: This is a **required** field that defines when your workflow should run. It's a list that can take one or more of the following values:
-  - `push`: The workflow should run every time a commit is pushed to the repository.
-  - `pull_request`: The workflow should run every time a pull request is made or updated.
-  - `manual`: The workflow can be triggered manually.
-- `branch`: Defines which branches the workflow should run for. If used with the `push` event, commits to the branch(es) listed here will trigger the workflow. If used with the `pull_request` event, updates to pull requests targeting the branch(es) listed here will trigger the workflow. This field has no effect with the `manual` event. Supports glob patterns using `*` and `**` (e.g., `main`, `develop`, `release-*`). Either `branch` or `tag` (or both) must be specified for `push` events.
-- `tag`: Defines which tags the workflow should run for. Only used with the `push` event - when tags matching the pattern(s) listed here are pushed, the workflow will trigger. This field has no effect with `pull_request` or `manual` events. Supports glob patterns using `*` and `**` (e.g., `v*`, `v1.*`, `release-**`). Either `branch` or `tag` (or both) must be specified for `push` events.
-
-For example, if you'd like to define a workflow that runs when commits are pushed to the `main` and `develop` branches, or when pull requests that target the `main` branch are updated, or manually, you can do so with:
-
-```yaml
-when:
-  - event: ["push", "manual"]
-    branch: ["main", "develop"]
-  - event: ["pull_request"]
-    branch: ["main"]
-```
-
-You can also trigger workflows on tag pushes. For instance, to run a deployment workflow when tags matching `v*` are pushed:
-
-```yaml
-when:
-  - event: ["push"]
-    tag: ["v*"]
-```
-
-You can even combine branch and tag patterns in a single constraint (the workflow triggers if either matches):
-
-```yaml
-when:
-  - event: ["push"]
-    branch: ["main", "release-*"]
-    tag: ["v*", "stable"]
-```
-
-## Engine
-
-Next is the engine on which the workflow should run, defined using the **required** `engine` field. The currently supported engines are:
-
-- `nixery`: This uses an instance of [Nixery](https://nixery.dev) to run steps, which allows you to add [dependencies](#dependencies) from [Nixpkgs](https://github.com/NixOS/nixpkgs). You can search for packages on https://search.nixos.org, and there's a pretty good chance the package(s) you're looking for will be there.
-
-Example:
-
-```yaml
-engine: "nixery"
-```
-
-## Clone options
-
-When a workflow starts, the first step is to clone the repository. You can customize this behavior using the **optional** `clone` field. It has the following fields:
-
-- `skip`: Setting this to `true` will skip cloning the repository. This can be useful if your workflow is doing something that doesn't require anything from the repository itself. This is `false` by default.
-- `depth`: This sets the number of commits, or the "clone depth", to fetch from the repository. For example, if you set this to 2, the last 2 commits will be fetched. By default, the depth is set to 1, meaning only the most recent commit will be fetched, which is the commit that triggered the workflow.
-- `submodules`: If you use [git submodules](https://git-scm.com/book/en/v2/Git-Tools-Submodules) in your repository, setting this field to `true` will recursively fetch all submodules. This is `false` by default.
-
-The default settings are:
-
-```yaml
-clone:
-  skip: false
-  depth: 1
-  submodules: false
-```
-
-## Dependencies
-
-Usually when you're running a workflow, you'll need additional dependencies. The `dependencies` field lets you define which dependencies to get, and from where. It's a key-value map, with the key being the registry to fetch dependencies from, and the value being the list of dependencies to fetch.
-
-Say you want to fetch Node.js and Go from `nixpkgs`, and a package called `my_pkg` you've made from your own registry at your repository at `https://tangled.sh/@example.com/my_pkg`. You can define those dependencies like so:
-
-```yaml
-dependencies:
-  # nixpkgs
-  nixpkgs:
-    - nodejs
-    - go
-  # custom registry
-  git+https://tangled.org/@example.com/my_pkg:
-    - my_pkg
-```
-
-Now these dependencies are available to use in your workflow!
-
-## Environment
-
-The `environment` field allows you define environment variables that will be available throughout the entire workflow. **Do not put secrets here, these environment variables are visible to anyone viewing the repository. You can add secrets for pipelines in your repository's settings.**
-
-Example:
-
-```yaml
-environment:
-  GOOS: "linux"
-  GOARCH: "arm64"
-  NODE_ENV: "production"
-  MY_ENV_VAR: "MY_ENV_VALUE"
-```
-
-## Steps
-
-The `steps` field allows you to define what steps should run in the workflow. It's a list of step objects, each with the following fields:
-
-- `name`: This field allows you to give your step a name. This name is visible in your workflow runs, and is used to describe what the step is doing.
-- `command`: This field allows you to define a command to run in that step. The step is run in a Bash shell, and the logs from the command will be visible in the pipelines page on the Tangled website. The [dependencies](#dependencies) you added will be available to use here.
-- `environment`: Similar to the global [environment](#environment) config, this **optional** field is a key-value map that allows you to set environment variables for the step. **Do not put secrets here, these environment variables are visible to anyone viewing the repository. You can add secrets for pipelines in your repository's settings.**
-
-Example:
-
-```yaml
-steps:
-  - name: "Build backend"
-    command: "go build"
-    environment:
-      GOOS: "darwin"
-      GOARCH: "arm64"
-  - name: "Build frontend"
-    command: "npm run build"
-    environment:
-      NODE_ENV: "production"
-```
-
-## Complete workflow
-
-```yaml
-# .tangled/workflows/build.yml
-
-when:
-  - event: ["push", "manual"]
-    branch: ["main", "develop"]
-  - event: ["pull_request"]
-    branch: ["main"]
-
-engine: "nixery"
-
-# using the default values
-clone:
-  skip: false
-  depth: 1
-  submodules: false
-
-dependencies:
-  # nixpkgs
-  nixpkgs:
-    - nodejs
-    - go
-  # custom registry
-  git+https://tangled.org/@example.com/my_pkg:
-    - my_pkg
-
-environment:
-  GOOS: "linux"
-  GOARCH: "arm64"
-  NODE_ENV: "production"
-  MY_ENV_VAR: "MY_ENV_VALUE"
-
-steps:
-  - name: "Build backend"
-    command: "go build"
-    environment:
-      GOOS: "darwin"
-      GOARCH: "arm64"
-  - name: "Build frontend"
-    command: "npm run build"
-    environment:
-      NODE_ENV: "production"
-```
-
-If you want another example of a workflow, you can look at the one [Tangled uses to build the project](https://tangled.sh/@tangled.sh/core/blob/master/.tangled/workflows/build.yml).

docs/styles.css

···
+svg {
+  width: 16px;
+  height: 16px;
+}
+
+:root {
+  --syntax-alert: #d20f39;
+  --syntax-annotation: #fe640b;
+  --syntax-attribute: #df8e1d;
+  --syntax-basen: #40a02b;
+  --syntax-builtin: #1e66f5;
+  --syntax-controlflow: #8839ef;
+  --syntax-char: #04a5e5;
+  --syntax-constant: #fe640b;
+  --syntax-comment: #9ca0b0;
+  --syntax-commentvar: #7c7f93;
+  --syntax-documentation: #9ca0b0;
+  --syntax-datatype: #df8e1d;
+  --syntax-decval: #40a02b;
+  --syntax-error: #d20f39;
+  --syntax-extension: #4c4f69;
+  --syntax-float: #40a02b;
+  --syntax-function: #1e66f5;
+  --syntax-import: #40a02b;
+  --syntax-information: #04a5e5;
+  --syntax-keyword: #8839ef;
+  --syntax-operator: #179299;
+  --syntax-other: #8839ef;
+  --syntax-preprocessor: #ea76cb;
+  --syntax-specialchar: #04a5e5;
+  --syntax-specialstring: #ea76cb;
+  --syntax-string: #40a02b;
+  --syntax-variable: #8839ef;
+  --syntax-verbatimstring: #40a02b;
+  --syntax-warning: #df8e1d;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --syntax-alert: #f38ba8;
+    --syntax-annotation: #fab387;
+    --syntax-attribute: #f9e2af;
+    --syntax-basen: #a6e3a1;
+    --syntax-builtin: #89b4fa;
+    --syntax-controlflow: #cba6f7;
+    --syntax-char: #89dceb;
+    --syntax-constant: #fab387;
+    --syntax-comment: #6c7086;
+    --syntax-commentvar: #585b70;
+    --syntax-documentation: #6c7086;
+    --syntax-datatype: #f9e2af;
+    --syntax-decval: #a6e3a1;
+    --syntax-error: #f38ba8;
+    --syntax-extension: #cdd6f4;
+    --syntax-float: #a6e3a1;
+    --syntax-function: #89b4fa;
+    --syntax-import: #a6e3a1;
+    --syntax-information: #89dceb;
+    --syntax-keyword: #cba6f7;
+    --syntax-operator: #94e2d5;
+    --syntax-other: #cba6f7;
+    --syntax-preprocessor: #f5c2e7;
+    --syntax-specialchar: #89dceb;
+    --syntax-specialstring: #f5c2e7;
+    --syntax-string: #a6e3a1;
+    --syntax-variable: #cba6f7;
+    --syntax-verbatimstring: #a6e3a1;
+    --syntax-warning: #f9e2af;
+  }
+}
+
+/* pandoc syntax highlighting classes */
+code span.al { color: var(--syntax-alert); font-weight: bold; }                           /* alert          */
+code span.an { color: var(--syntax-annotation); font-weight: bold; font-style: italic; }  /* annotation     */
+code span.at { color: var(--syntax-attribute); }                                          /* attribute      */
+code span.bn { color: var(--syntax-basen); }                                              /* basen          */
+code span.bu { color: var(--syntax-builtin); }                                            /* builtin        */
+code span.cf { color: var(--syntax-controlflow); font-weight: bold; }                     /* controlflow    */
+code span.ch { color: var(--syntax-char); }                                               /* char           */
+code span.cn { color: var(--syntax-constant); }                                           /* constant       */
+code span.co { color: var(--syntax-comment); font-style: italic; }                        /* comment        */
+code span.cv { color: var(--syntax-commentvar); font-weight: bold; font-style: italic; }  /* commentvar     */
+code span.do { color: var(--syntax-documentation); font-style: italic; }                  /* documentation  */
+code span.dt { color: var(--syntax-datatype); }                                           /* datatype       */
+code span.dv { color: var(--syntax-decval); }                                             /* decval         */
+code span.er { color: var(--syntax-error); font-weight: bold; }                           /* error          */
+code span.ex { color: var(--syntax-extension); }                                          /* extension      */
+code span.fl { color: var(--syntax-float); }                                              /* float          */
+code span.fu { color: var(--syntax-function); }                                           /* function       */
+code span.im { color: var(--syntax-import); font-weight: bold; }                          /* import         */
+code span.in { color: var(--syntax-information); font-weight: bold; font-style: italic; } /* information    */
+code span.kw { color: var(--syntax-keyword); font-weight: bold; }                         /* keyword        */
+code span.op { color: var(--syntax-operator); }                                           /* operator       */
+code span.ot { color: var(--syntax-other); }                                              /* other          */
+code span.pp { color: var(--syntax-preprocessor); }                                       /* preprocessor   */
+code span.sc { color: var(--syntax-specialchar); }                                        /* specialchar    */
+code span.ss { color: var(--syntax-specialstring); }                                      /* specialstring  */
+code span.st { color: var(--syntax-string); }                                             /* string         */
+code span.va { color: var(--syntax-variable); }                                           /* variable       */
+code span.vs { color: var(--syntax-verbatimstring); }                                     /* verbatimstring */
+code span.wa { color: var(--syntax-warning); font-weight: bold; font-style: italic; }     /* warning        */

docs/template.html

···
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml" lang="$lang$" xml:lang="$lang$"$if(dir)$ dir="$dir$"$endif$>
+  <head>
+    <meta charset="utf-8" />
+    <meta name="generator" content="pandoc" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
+    $for(author-meta)$
+      <meta name="author" content="$author-meta$" />
+    $endfor$
+
+    $if(date-meta)$
+      <meta name="dcterms.date" content="$date-meta$" />
+    $endif$
+
+    $if(keywords)$
+      <meta name="keywords" content="$for(keywords)$$keywords$$sep$, $endfor$" />
+    $endif$
+
+    $if(description-meta)$
+      <meta name="description" content="$description-meta$" />
+    $endif$
+
+    <title>$pagetitle$</title>
+
+    <style>
+      $styles.css()$
+    </style>
+
+    $for(css)$
+      <link rel="stylesheet" href="$css$" />
+    $endfor$
+
+    $for(header-includes)$
+      $header-includes$
+    $endfor$
+
+    <link rel="preload" href="/static/fonts/InterVariable.woff2" as="font" type="font/woff2" crossorigin />
+
+  </head>
+  <body class="bg-white dark:bg-gray-900 flex flex-col min-h-svh">
+    $for(include-before)$
+      $include-before$
+    $endfor$
+
+    $if(toc)$
+      <!-- mobile TOC trigger -->
+      <div class="md:hidden px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+        <button
+          type="button"
+          popovertarget="mobile-toc-popover"
+          popovertargetaction="toggle"
+          class="w-full flex gap-2 items-center text-sm font-semibold dark:text-white"
+        >
+          ${ menu.svg() }
+          $if(toc-title)$$toc-title$$else$Table of Contents$endif$
+        </button>
+      </div>
+
+      <div
+        id="mobile-toc-popover"
+        popover
+        class="mobile-toc-popover
+               bg-gray-50 dark:bg-gray-800 border-r border-gray-200 dark:border-gray-700
+               h-full overflow-y-auto shadow-sm
+               px-6 py-4 fixed inset-x-0 top-0 w-fit max-w-4/5 m-0"
+      >
+        <div class="flex flex-col min-h-full">
+          <div class="flex-1 space-y-4">
+            <button
+              type="button"
+              popovertarget="mobile-toc-popover"
+              popovertargetaction="toggle"
+              class="w-full flex gap-2 items-center text-sm font-semibold dark:text-white mb-4">
+              ${ x.svg() }
+              $if(toc-title)$$toc-title$$else$Table of Contents$endif$
+            </button>
+            ${ logo.html() }
+            ${ search.html() }
+            ${ table-of-contents:toc.html() }
+          </div>
+          ${ single-page:mode.html() }
+        </div>
+      </div>
+
+      <!-- desktop sidebar toc -->
+      <nav
+        id="$idprefix$TOC"
+        role="doc-toc"
+        class="hidden md:flex md:flex-col gap-4 fixed left-0 top-0 w-80 h-screen
+               bg-gray-50 dark:bg-gray-800 border-r border-gray-200 dark:border-gray-700
+               p-4 z-50 overflow-y-auto">
+        ${ logo.html() }
+        ${ search.html() }
+        <div class="flex-1">
+          $if(toc-title)$
+            <h2 id="$idprefix$toc-title" class="text-lg font-semibold mb-4 text-gray-900">$toc-title$</h2>
+          $endif$
+          ${ table-of-contents:toc.html() }
+        </div>
+        ${ single-page:mode.html() }
+      </nav>
+    $endif$
+
+    <div class="$if(toc)$md:ml-80$endif$ flex-1 flex flex-col">
+      <main class="max-w-4xl w-full mx-auto p-6 flex-1">
+        $if(top)$
+          $-- only print title block if this is NOT the top page
+        $else$
+        $if(title)$
+          <header id="title-block-header" class="mb-8 pb-8 border-b border-gray-200 dark:border-gray-700">
+            <h1 class="text-4xl font-bold mb-2 text-black dark:text-white">$title$</h1>
+              $if(subtitle)$
+                <p class="text-xl text-gray-500 dark:text-gray-400 mb-2">$subtitle$</p>
+              $endif$
+              $for(author)$
+                <p class="text-sm text-gray-500 dark:text-gray-400">$author$</p>
+              $endfor$
+              $if(date)$
+                <p class="text-sm text-gray-500 dark:text-gray-400">Updated on $date$</p>
+              $endif$
+            $endif$
+          </header>
+        $endif$
+
+        $if(abstract)$
+          <article class="prose dark:prose-invert max-w-none">
+            $abstract$
+          </article>
+        $endif$
+
+        <article class="prose dark:prose-invert max-w-none">
+          $body$
+        </article>
+      </main>
+      <nav id="sitenav" class="border-t border-gray-200 dark:border-gray-700 bg-gray-50 dark:bg-gray-800">
+        <div class="max-w-4xl mx-auto px-8 py-4">
+          <div class="flex justify-between gap-4">
+            <span class="flex-1">
+              $if(previous.url)$
+              <span class="text-xs text-gray-500 dark:text-gray-400 uppercase block mb-1">Previous</span>
+              <a href="$previous.url$" accesskey="p" rel="previous">$previous.title$</a>
+              $endif$
+            </span>
+            <span class="flex-1 text-right">
+              $if(next.url)$
+              <span class="text-xs text-gray-500 dark:text-gray-400 uppercase block mb-1">Next</span>
+              <a href="$next.url$" accesskey="n" rel="next">$next.title$</a>
+              $endif$
+            </span>
+          </div>
+        </div>
+      </nav>
+    </div>
+    $for(include-after)$
+    $include-after$
+    $endfor$
+  </body>
+</html>

docs/toc.html

···
+<div class="[&_ul]:space-y-6 [&_ul]:pl-0 [&_ul]:font-bold [&_ul_ul]:pl-4 [&_ul_ul]:font-normal [&_ul_ul]:space-y-2 [&_li]:space-y-2">
+  $table-of-contents$
+</div>
+

flake.lock

···
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1694529238,
-        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
···
         ]
       },
       "locked": {
-        "lastModified": 1754078208,
-        "narHash": "sha256-YVoIFDCDpYuU3riaDEJ3xiGdPOtsx4sR5eTzHTytPV8=",
+        "lastModified": 1763982521,
+        "narHash": "sha256-ur4QIAHwgFc0vXiaxn5No/FuZicxBr2p0gmT54xZkUQ=",
         "owner": "nix-community",
         "repo": "gomod2nix",
-        "rev": "7f963246a71626c7fc70b431a315c4388a0c95cf",
+        "rev": "02e63a239d6eabd595db56852535992c898eba72",
         "type": "github"
       },
       "original": {
···
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1751984180,
-        "narHash": "sha256-LwWRsENAZJKUdD3SpLluwDmdXY9F45ZEgCb0X+xgOL0=",
+        "lastModified": 1766070988,
+        "narHash": "sha256-G/WVghka6c4bAzMhTwT2vjLccg/awmHkdKSd2JrycLc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9807714d6944a957c2e036f84b0ff8caf9930bc0",
+        "rev": "c6245e83d836d0433170a16eb185cefe0572f8b8",
         "type": "github"
       },
       "original": {

flake.nix

···
           };
         buildGoApplication =
           (self.callPackage "${gomod2nix}/builder" {
-            gomod2nix = gomod2nix.legacyPackages.${pkgs.system}.gomod2nix;
+            gomod2nix = gomod2nix.legacyPackages.${pkgs.stdenv.hostPlatform.system}.gomod2nix;
           }).buildGoApplication;
         modules = ./nix/gomod2nix.toml;
         sqlite-lib = self.callPackage ./nix/pkgs/sqlite-lib.nix {
-          inherit (pkgs) gcc;
           inherit sqlite-lib-src;
         };
         lexgen = self.callPackage ./nix/pkgs/lexgen.nix {inherit indigo;};
···
           inherit htmx-src htmx-ws-src lucide-src inter-fonts-src ibm-plex-mono-src actor-typeahead-src;
         };
         appview = self.callPackage ./nix/pkgs/appview.nix {};
+        docs = self.callPackage ./nix/pkgs/docs.nix {
+          inherit inter-fonts-src ibm-plex-mono-src lucide-src;
+        };
         spindle = self.callPackage ./nix/pkgs/spindle.nix {};
         knot-unwrapped = self.callPackage ./nix/pkgs/knot-unwrapped.nix {};
         knot = self.callPackage ./nix/pkgs/knot.nix {};
+        dolly = self.callPackage ./nix/pkgs/dolly.nix {};
       });
   in {
     overlays.default = final: prev: {
-      inherit (mkPackageSet final) lexgen goat sqlite-lib spindle knot-unwrapped knot appview;
+      inherit (mkPackageSet final) lexgen goat sqlite-lib spindle knot-unwrapped knot appview docs dolly;
     };
 
     packages = forAllSystems (system: let
···
       staticPackages = mkPackageSet pkgs.pkgsStatic;
       crossPackages = mkPackageSet pkgs.pkgsCross.gnu64.pkgsStatic;
     in {
-      inherit (packages) appview appview-static-files lexgen goat spindle knot knot-unwrapped sqlite-lib;
+      inherit
+        (packages)
+        appview
+        appview-static-files
+        lexgen
+        goat
+        spindle
+        knot
+        knot-unwrapped
+        sqlite-lib
+        docs
+        dolly
+        ;
 
       pkgsStatic-appview = staticPackages.appview;
       pkgsStatic-knot = staticPackages.knot;
       pkgsStatic-knot-unwrapped = staticPackages.knot-unwrapped;
       pkgsStatic-spindle = staticPackages.spindle;
       pkgsStatic-sqlite-lib = staticPackages.sqlite-lib;
+      pkgsStatic-dolly = staticPackages.dolly;
 
       pkgsCross-gnu64-pkgsStatic-appview = crossPackages.appview;
       pkgsCross-gnu64-pkgsStatic-knot = crossPackages.knot;
       pkgsCross-gnu64-pkgsStatic-knot-unwrapped = crossPackages.knot-unwrapped;
       pkgsCross-gnu64-pkgsStatic-spindle = crossPackages.spindle;
+      pkgsCross-gnu64-pkgsStatic-dolly = crossPackages.dolly;
 
       treefmt-wrapper = pkgs.treefmt.withConfig {
         settings.formatter = {
···
         nativeBuildInputs = [
           pkgs.go
           pkgs.air
-          pkgs.tilt
           pkgs.gopls
           pkgs.httpie
           pkgs.litecli

go.mod

···
 module tangled.org/core
 
-go 1.24.4
+go 1.25.0
 
 require (
 	github.com/Blank-Xu/sql-adapter v1.1.1
···
 	github.com/stretchr/testify v1.10.0
 	github.com/urfave/cli/v3 v3.3.3
 	github.com/whyrusleeping/cbor-gen v0.3.1
-	github.com/wyatt915/goldmark-treeblood v0.0.1
 	github.com/yuin/goldmark v1.7.13
+	github.com/yuin/goldmark-emoji v1.0.6
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	gitlab.com/staticnoise/goldmark-callout v0.0.0-20240609120641-6366b799e4ab
 	golang.org/x/crypto v0.40.0
 	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
 	golang.org/x/image v0.31.0
 	golang.org/x/net v0.42.0
-	golang.org/x/sync v0.17.0
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
 	gopkg.in/yaml.v3 v3.0.1
 )
···
 	github.com/vmihailenco/go-tinylfu v0.2.2 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
-	github.com/wyatt915/treeblood v0.1.16 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	gitlab.com/yawning/secp256k1-voi v0.0.0-20230925100816-f2616030848b // indirect
 	gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02 // indirect
···
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
 	golang.org/x/sys v0.34.0 // indirect
 	golang.org/x/text v0.29.0 // indirect
 	golang.org/x/time v0.12.0 // indirect

go.sum

···
 github.com/warpfork/go-wish v0.0.0-20220906213052-39a1cc7a02d0/go.mod h1:x6AKhvSSexNrVSrViXSHUEbICjmGXhtgABaHIySUSGw=
 github.com/whyrusleeping/cbor-gen v0.3.1 h1:82ioxmhEYut7LBVGhGq8xoRkXPLElVuh5mV67AFfdv0=
 github.com/whyrusleeping/cbor-gen v0.3.1/go.mod h1:pM99HXyEbSQHcosHc0iW7YFmwnscr+t9Te4ibko05so=
-github.com/wyatt915/goldmark-treeblood v0.0.1 h1:6vLJcjFrHgE4ASu2ga4hqIQmbvQLU37v53jlHZ3pqDs=
-github.com/wyatt915/goldmark-treeblood v0.0.1/go.mod h1:SmcJp5EBaV17rroNlgNQFydYwy0+fv85CUr/ZaCz208=
-github.com/wyatt915/treeblood v0.1.16 h1:byxNbWZhnPDxdTp7W5kQhCeaY8RBVmojTFz1tEHgg8Y=
-github.com/wyatt915/treeblood v0.1.16/go.mod h1:i7+yhhmzdDP17/97pIsOSffw74EK/xk+qJ0029cSXUY=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
···
 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.7.13 h1:GPddIs617DnBLFFVJFgpo1aBfe/4xcvMc3SB5t/D0pA=
 github.com/yuin/goldmark v1.7.13/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark-emoji v1.0.6 h1:QWfF2FYaXwL74tfGOW5izeiZepUDroDJfWubQI9HTHs=
+github.com/yuin/goldmark-emoji v1.0.6/go.mod h1:ukxJDKFpdFb5x0a5HqbdlcKtebh086iJpI31LTKmWuA=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I=
 gitlab.com/staticnoise/goldmark-callout v0.0.0-20240609120641-6366b799e4ab h1:gK9tS6QJw5F0SIhYJnGG2P83kuabOdmWBbSmZhJkz2A=

hook/hook.go

···
 		},
 		Commands: []*cli.Command{
 			{
-				Name:   "post-recieve",
-				Usage:  "sends a post-recieve hook to the knot (waits for stdin)",
-				Action: postRecieve,
+				Name:   "post-receive",
+				Usage:  "sends a post-receive hook to the knot (waits for stdin)",
+				Action: postReceive,
 			},
 		},
 	}
 }
 
-func postRecieve(ctx context.Context, cmd *cli.Command) error {
+func postReceive(ctx context.Context, cmd *cli.Command) error {
 	gitDir := cmd.String("git-dir")
 	userDid := cmd.String("user-did")
 	userHandle := cmd.String("user-handle")

hook/setup.go

···
     option_var="GIT_PUSH_OPTION_$i"
     push_options+=(-push-option "${!option_var}")
 done
-%s hook -git-dir "$GIT_DIR" -user-did "$GIT_USER_DID" -user-handle "$GIT_USER_HANDLE" -internal-api "%s" "${push_options[@]}" post-recieve
+%s hook -git-dir "$GIT_DIR" -user-did "$GIT_USER_DID" -user-handle "$GIT_USER_HANDLE" -internal-api "%s" "${push_options[@]}" post-receive
 	`, executablePath, config.internalApi)
 
 	return os.WriteFile(hookPath, []byte(hookContent), 0755)

ico/ico.go

···
+package ico
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"image"
+	"image/png"
+)
+
+type IconDir struct {
+	Reserved uint16 // must be 0
+	Type     uint16 // 1 for ICO, 2 for CUR
+	Count    uint16 // number of images
+}
+
+type IconDirEntry struct {
+	Width        uint8 // 0 means 256
+	Height       uint8 // 0 means 256
+	ColorCount   uint8
+	Reserved     uint8  // must be 0
+	ColorPlanes  uint16 // 0 or 1
+	BitsPerPixel uint16
+	SizeInBytes  uint32
+	Offset       uint32
+}
+
+func ImageToIco(img image.Image) ([]byte, error) {
+	// encode image as png
+	var pngBuf bytes.Buffer
+	if err := png.Encode(&pngBuf, img); err != nil {
+		return nil, fmt.Errorf("failed to encode PNG: %w", err)
+	}
+	pngData := pngBuf.Bytes()
+
+	// get image dimensions
+	bounds := img.Bounds()
+	width := bounds.Dx()
+	height := bounds.Dy()
+
+	// prepare output buffer
+	var icoBuf bytes.Buffer
+
+	iconDir := IconDir{
+		Reserved: 0,
+		Type:     1, // ICO format
+		Count:    1, // One image
+	}
+
+	w := uint8(width)
+	h := uint8(height)
+
+	// width/height of 256 should be stored as 0
+	if width == 256 {
+		w = 0
+	}
+	if height == 256 {
+		h = 0
+	}
+
+	iconDirEntry := IconDirEntry{
+		Width:        w,
+		Height:       h,
+		ColorCount:   0, // 0 for PNG (32-bit)
+		Reserved:     0,
+		ColorPlanes:  1,
+		BitsPerPixel: 32, // PNG with alpha
+		SizeInBytes:  uint32(len(pngData)),
+		Offset:       6 + 16, // Size of ICONDIR + ICONDIRENTRY
+	}
+
+	// write IconDir
+	if err := binary.Write(&icoBuf, binary.LittleEndian, iconDir); err != nil {
+		return nil, fmt.Errorf("failed to write ICONDIR: %w", err)
+	}
+
+	// write IconDirEntry
+	if err := binary.Write(&icoBuf, binary.LittleEndian, iconDirEntry); err != nil {
+		return nil, fmt.Errorf("failed to write ICONDIRENTRY: %w", err)
+	}
+
+	// write PNG data directly
+	if _, err := icoBuf.Write(pngData); err != nil {
+		return nil, fmt.Errorf("failed to write PNG data: %w", err)
+	}
+
+	return icoBuf.Bytes(), nil
+}

input.css

···
         }
 
         .prose a.mention {
-            @apply no-underline hover:underline;
+            @apply no-underline hover:underline font-bold;
         }
 
         .prose li {
···
             @apply py-1 text-gray-900 dark:text-gray-100;
         }
     }
+
 }
 
 /* Background */

knotserver/db/init.go knotserver/db/db.go

···
 package db
 
 import (
+	"context"
 	"database/sql"
+	"log/slog"
 	"strings"
 
 	_ "github.com/mattn/go-sqlite3"
+	"tangled.org/core/log"
 )
 
 type DB struct {
-	db *sql.DB
+	db     *sql.DB
+	logger *slog.Logger
 }
 
-func Setup(dbPath string) (*DB, error) {
+func Setup(ctx context.Context, dbPath string) (*DB, error) {
 	// https://github.com/mattn/go-sqlite3#connection-string
 	opts := []string{
 		"_foreign_keys=1",
···
 		"_auto_vacuum=incremental",
 	}
 
+	logger := log.FromContext(ctx)
+	logger = log.SubLogger(logger, "db")
+
 	db, err := sql.Open("sqlite3", dbPath+"?"+strings.Join(opts, "&"))
 	if err != nil {
 		return nil, err
 	}
 
-	// NOTE: If any other migration is added here, you MUST
-	// copy the pattern in appview: use a single sql.Conn
-	// for every migration.
+	conn, err := db.Conn(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer conn.Close()
 
-	_, err = db.Exec(`
+	_, err = conn.ExecContext(ctx, `
 		create table if not exists known_dids (
 			did text primary key
 		);
···
 			created integer not null default (strftime('%s', 'now')),
 			primary key (rkey, nsid)
 		);
+
+		create table if not exists migrations (
+			id integer primary key autoincrement,
+			name text unique
+		);
 	`)
 	if err != nil {
 		return nil, err
 	}
 
-	return &DB{db: db}, nil
+	return &DB{
+		db:     db,
+		logger: logger,
+	}, nil
 }

knotserver/git.go

···
 	}
 }
 
+func (h *Knot) UploadArchive(w http.ResponseWriter, r *http.Request) {
+	did := chi.URLParam(r, "did")
+	name := chi.URLParam(r, "name")
+	repo, err := securejoin.SecureJoin(h.c.Repo.ScanPath, filepath.Join(did, name))
+	if err != nil {
+		gitError(w, err.Error(), http.StatusInternalServerError)
+		h.l.Error("git: failed to secure join repo path", "handler", "UploadPack", "error", err)
+		return
+	}
+
+	const expectedContentType = "application/x-git-upload-archive-request"
+	contentType := r.Header.Get("Content-Type")
+	if contentType != expectedContentType {
+		gitError(w, fmt.Sprintf("Expected Content-Type: '%s', but received '%s'.", expectedContentType, contentType), http.StatusUnsupportedMediaType)
+	}
+
+	var bodyReader io.ReadCloser = r.Body
+	if r.Header.Get("Content-Encoding") == "gzip" {
+		gzipReader, err := gzip.NewReader(r.Body)
+		if err != nil {
+			gitError(w, err.Error(), http.StatusInternalServerError)
+			h.l.Error("git: failed to create gzip reader", "handler", "UploadArchive", "error", err)
+			return
+		}
+		defer gzipReader.Close()
+		bodyReader = gzipReader
+	}
+
+	w.Header().Set("Content-Type", "application/x-git-upload-archive-result")
+
+	h.l.Info("git: executing git-upload-archive", "handler", "UploadArchive", "repo", repo)
+
+	cmd := service.ServiceCommand{
+		GitProtocol: r.Header.Get("Git-Protocol"),
+		Dir:         repo,
+		Stdout:      w,
+		Stdin:       bodyReader,
+	}
+
+	w.WriteHeader(http.StatusOK)
+
+	if err := cmd.UploadArchive(); err != nil {
+		h.l.Error("git: failed to execute git-upload-pack", "handler", "UploadPack", "error", err)
+		return
+	}
+}
+
 func (h *Knot) UploadPack(w http.ResponseWriter, r *http.Request) {
 	did := chi.URLParam(r, "did")
 	name := chi.URLParam(r, "name")

knotserver/git/diff.go

···
 		nd.Diff = append(nd.Diff, ndiff)
 	}
 
-	nd.Stat.FilesChanged = len(diffs)
-	nd.Commit.This = c.Hash.String()
-	nd.Commit.PGPSignature = c.PGPSignature
-	nd.Commit.Committer = c.Committer
-	nd.Commit.Tree = c.TreeHash.String()
-
-	if parent.Hash.IsZero() {
-		nd.Commit.Parent = ""
-	} else {
-		nd.Commit.Parent = parent.Hash.String()
-	}
-	nd.Commit.Author = c.Author
-	nd.Commit.Message = c.Message
-
-	if v, ok := c.ExtraHeaders["change-id"]; ok {
-		nd.Commit.ChangedId = string(v)
-	}
+	nd.Commit.FromGoGitCommit(c)
 
 	return &nd, nil
 }

knotserver/git/service/service.go

···
 	return c.RunService(cmd)
 }
 
+func (c *ServiceCommand) UploadArchive() error {
+	cmd := exec.Command("git", []string{
+		"upload-archive",
+		".",
+	}...)
+
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	cmd.Env = append(cmd.Env, fmt.Sprintf("GIT_PROTOCOL=%s", c.GitProtocol))
+	cmd.Dir = c.Dir
+
+	return c.RunService(cmd)
+}
+
 func (c *ServiceCommand) UploadPack() error {
 	cmd := exec.Command("git", []string{
-		"-c", "uploadpack.allowFilter=true",
 		"upload-pack",
 		"--stateless-rpc",
 		".",

knotserver/router.go

···
 		r.Route("/{name}", func(r chi.Router) {
 			// routes for git operations
 			r.Get("/info/refs", h.InfoRefs)
+			r.Post("/git-upload-archive", h.UploadArchive)
 			r.Post("/git-upload-pack", h.UploadPack)
 			r.Post("/git-receive-pack", h.ReceivePack)
 		})

knotserver/server.go

···
 		logger.Info("running in dev mode, signature verification is disabled")
 	}
 
-	db, err := db.Setup(c.Server.DBPath)
+	db, err := db.Setup(ctx, c.Server.DBPath)
 	if err != nil {
 		return fmt.Errorf("failed to load db: %w", err)
 	}

knotserver/xrpc/repo_log.go

···
 		return
 	}
 
+	tcommits := make([]types.Commit, len(commits))
+	for i, c := range commits {
+		tcommits[i].FromGoGitCommit(c)
+	}
+
 	// Create response using existing types.RepoLogResponse
 	response := types.RepoLogResponse{
-		Commits: commits,
+		Commits: tcommits,
 		Ref:     ref,
 		Page:    (offset / limit) + 1,
 		PerPage: limit,

lexicons/pulls/pull.json

···
         "required": [
           "target",
           "title",
-          "patch",
+          "patchBlob",
           "createdAt"
         ],
         "properties": {
···
             "type": "string"
           },
           "patch": {
-            "type": "string"
+            "type": "string",
+            "description": "(deprecated) use patchBlob instead"
+          },
+          "patchBlob": {
+            "type": "blob",
+            "accept": [
+              "text/x-patch"
+            ],
+            "description": "patch content"
           },
           "source": {
             "type": "ref",

nix/gomod2nix.toml

···
   [mod."github.com/davecgh/go-spew"]
     version = "v1.1.2-0.20180830191138-d8f796af33cc"
     hash = "sha256-fV9oI51xjHdOmEx6+dlq7Ku2Ag+m/bmbzPo6A4Y74qc="
-  [mod."github.com/decred/dcrd/dcrec/secp256k1/v4"]
-    version = "v4.4.0"
-    hash = "sha256-qrhEIwhDll3cxoVpMbm1NQ9/HTI42S7ms8Buzlo5HCg="
   [mod."github.com/dgraph-io/ristretto"]
     version = "v0.2.0"
     hash = "sha256-bnpxX+oO/Qf7IJevA0gsbloVoqRx+5bh7RQ9d9eLNYw="
···
   [mod."github.com/klauspost/cpuid/v2"]
     version = "v2.3.0"
     hash = "sha256-50JhbQyT67BK38HIdJihPtjV7orYp96HknI2VP7A9Yc="
-  [mod."github.com/lestrrat-go/blackmagic"]
-    version = "v1.0.4"
-    hash = "sha256-HmWOpwoPDNMwLdOi7onNn3Sb+ZsAa3Ai3gVBbXmQ0e8="
-  [mod."github.com/lestrrat-go/httpcc"]
-    version = "v1.0.1"
-    hash = "sha256-SMRSwJpqDIs/xL0l2e8vP0W65qtCHX2wigcOeqPJmos="
-  [mod."github.com/lestrrat-go/httprc"]
-    version = "v1.0.6"
-    hash = "sha256-mfZzePEhrmyyu/avEBd2MsDXyto8dq5+fyu5lA8GUWM="
-  [mod."github.com/lestrrat-go/iter"]
-    version = "v1.0.2"
-    hash = "sha256-30tErRf7Qu/NOAt1YURXY/XJSA6sCr6hYQfO8QqHrtw="
-  [mod."github.com/lestrrat-go/jwx/v2"]
-    version = "v2.1.6"
-    hash = "sha256-0LszXRZIba+X8AOrs3T4uanAUafBdlVB8/MpUNEFpbc="
-  [mod."github.com/lestrrat-go/option"]
-    version = "v1.0.1"
-    hash = "sha256-jVcIYYVsxElIS/l2akEw32vdEPR8+anR6oeT1FoYULI="
   [mod."github.com/lucasb-eyer/go-colorful"]
     version = "v1.2.0"
     hash = "sha256-Gg9dDJFCTaHrKHRR1SrJgZ8fWieJkybljybkI9x0gyE="
···
   [mod."github.com/ryanuber/go-glob"]
     version = "v1.0.0"
     hash = "sha256-YkMl1utwUhi3E0sHK23ISpAsPyj4+KeXyXKoFYGXGVY="
-  [mod."github.com/segmentio/asm"]
-    version = "v1.2.0"
-    hash = "sha256-zbNuKxNrUDUc6IlmRQNuJQzVe5Ol/mqp7srDg9IMMqs="
   [mod."github.com/sergi/go-diff"]
     version = "v1.1.0"
     hash = "sha256-8NJMabldpf40uwQN20T6QXx5KORDibCBJL02KD661xY="
···
   [mod."github.com/whyrusleeping/cbor-gen"]
     version = "v0.3.1"
     hash = "sha256-PAd8M2Z8t6rVRBII+Rg8Bz+QaJIwbW64bfyqsv31kgc="
-  [mod."github.com/wyatt915/goldmark-treeblood"]
-    version = "v0.0.1"
-    hash = "sha256-hAVFaktO02MiiqZFffr8ZlvFEfwxw4Y84OZ2t7e5G7g="
-  [mod."github.com/wyatt915/treeblood"]
-    version = "v0.1.16"
-    hash = "sha256-T68sa+iVx0qY7dDjXEAJvRWQEGXYIpUsf9tcWwO1tIw="
   [mod."github.com/xo/terminfo"]
     version = "v0.0.0-20220910002029-abceb7e1c41e"
     hash = "sha256-GyCDxxMQhXA3Pi/TsWXpA8cX5akEoZV7CFx4RO3rARU="
   [mod."github.com/yuin/goldmark"]
     version = "v1.7.13"
     hash = "sha256-vBCxZrPYPc8x/nvAAv3Au59dCCyfS80Vw3/a9EXK7TE="
+  [mod."github.com/yuin/goldmark-emoji"]
+    version = "v1.0.6"
+    hash = "sha256-+d6bZzOPE+JSFsZbQNZMCWE+n3jgcQnkPETVk47mxSY="
   [mod."github.com/yuin/goldmark-highlighting/v2"]
     version = "v2.0.0-20230729083705-37449abec8cc"
     hash = "sha256-HpiwU7jIeDUAg2zOpTIiviQir8dpRPuXYh2nqFFccpg="

nix/pkgs/appview-static-files.nix

···
   actor-typeahead-src,
   sqlite-lib,
   tailwindcss,
+  dolly,
   src,
 }:
 runCommandLocal "appview-static-files" {
···
     (allow file-read* (subpath "/System/Library/OpenSSL"))
   '';
 } ''
-  mkdir -p $out/{fonts,icons} && cd $out
+  mkdir -p $out/{fonts,icons,logos} && cd $out
   cp -f ${htmx-src} htmx.min.js
   cp -f ${htmx-ws-src} htmx-ext-ws.min.js
   cp -rf ${lucide-src}/*.svg icons/
···
   cp -f ${inter-fonts-src}/InterVariable*.ttf fonts/
   cp -f ${ibm-plex-mono-src}/fonts/complete/woff2/IBMPlexMono*.woff2 fonts/
   cp -f ${actor-typeahead-src}/actor-typeahead.js .
+
+  ${dolly}/bin/dolly -output logos/dolly.png -size 180x180
+  ${dolly}/bin/dolly -output logos/dolly.ico -size 48x48
+  ${dolly}/bin/dolly -output logos/dolly.svg
   # tailwindcss -c $src/tailwind.config.js -i $src/input.css -o tw.css won't work
   # for whatever reason (produces broken css), so we are doing this instead
   cd ${src} && ${tailwindcss}/bin/tailwindcss -i input.css -o $out/tw.css

nix/pkgs/docs.nix

···
+{
+  pandoc,
+  tailwindcss,
+  runCommandLocal,
+  inter-fonts-src,
+  ibm-plex-mono-src,
+  lucide-src,
+  dolly,
+  src,
+}:
+runCommandLocal "docs" {} ''
+  mkdir -p working
+
+  # copy templates, themes, styles, filters to working directory
+  cp ${src}/docs/*.html working/
+  cp ${src}/docs/*.theme working/
+  cp ${src}/docs/*.css working/
+
+  # icons
+  cp -rf ${lucide-src}/*.svg working/
+
+  # logo
+  ${dolly}/bin/dolly -output working/dolly.svg -color currentColor
+
+  # content - chunked
+  ${pandoc}/bin/pandoc ${src}/docs/DOCS.md \
+    -o $out/ \
+    -t chunkedhtml \
+    --variable toc \
+    --variable-json single-page=false \
+    --toc-depth=2 \
+    --css=stylesheet.css \
+    --chunk-template="%i.html" \
+    --highlight-style=working/highlight.theme \
+    --template=working/template.html
+
+  # content - single page
+  ${pandoc}/bin/pandoc ${src}/docs/DOCS.md \
+    -o $out/single-page.html \
+    --toc \
+    --variable toc \
+    --variable single-page \
+    --toc-depth=2 \
+    --css=stylesheet.css \
+    --highlight-style=working/highlight.theme \
+    --template=working/template.html
+
+  # fonts
+  mkdir -p $out/static/fonts
+  cp -f ${inter-fonts-src}/web/InterVariable*.woff2 $out/static/fonts/
+  cp -f ${inter-fonts-src}/web/InterDisplay*.woff2 $out/static/fonts/
+  cp -f ${inter-fonts-src}/InterVariable*.ttf $out/static/fonts/
+  cp -f ${ibm-plex-mono-src}/fonts/complete/woff2/IBMPlexMono*.woff2 $out/static/fonts/
+
+  # styles
+  cd ${src} && ${tailwindcss}/bin/tailwindcss -i input.css -o $out/stylesheet.css
+''

nix/pkgs/dolly.nix

···
+{
+  buildGoApplication,
+  modules,
+  src,
+}:
+buildGoApplication {
+  pname = "dolly";
+  version = "0.1.0";
+  inherit src modules;
+
+  # patch the static dir
+  postUnpack = ''
+    pushd source
+    mkdir -p appview/pages/static
+    touch appview/pages/static/x
+    popd
+  '';
+
+  doCheck = false;
+  subPackages = ["cmd/dolly"];
+}

nix/pkgs/sqlite-lib.nix

···
 {
-  gcc,
   stdenv,
   sqlite-lib-src,
 }:
 stdenv.mkDerivation {
   name = "sqlite-lib";
   src = sqlite-lib-src;
-  nativeBuildInputs = [gcc];
+
   buildPhase = ''
-    gcc -c sqlite3.c
-    ar rcs libsqlite3.a sqlite3.o
-    ranlib libsqlite3.a
+    $CC -c sqlite3.c
+    $AR rcs libsqlite3.a sqlite3.o
+    $RANLIB libsqlite3.a
+  '';
+
+  installPhase = ''
     mkdir -p $out/include $out/lib
     cp *.h $out/include
     cp libsqlite3.a $out/lib

nix/vm.nix

···
     var = builtins.getEnv name;
   in
     if var == ""
-    then throw "\$${name} must be defined, see docs/hacking.md for more details"
+    then throw "\$${name} must be defined, see https://docs.tangled.org/hacking-on-tangled.html#hacking-on-tangled for more details"
     else var;
   envVarOr = name: default: let
     var = builtins.getEnv name;

orm/orm.go

···
+package orm
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"log/slog"
+	"reflect"
+	"strings"
+)
+
+type migrationFn = func(*sql.Tx) error
+
+func RunMigration(c *sql.Conn, logger *slog.Logger, name string, migrationFn migrationFn) error {
+	logger = logger.With("migration", name)
+
+	tx, err := c.BeginTx(context.Background(), nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+
+	var exists bool
+	err = tx.QueryRow("select exists (select 1 from migrations where name = ?)", name).Scan(&exists)
+	if err != nil {
+		return err
+	}
+
+	if !exists {
+		// run migration
+		err = migrationFn(tx)
+		if err != nil {
+			logger.Error("failed to run migration", "err", err)
+			return err
+		}
+
+		// mark migration as complete
+		_, err = tx.Exec("insert into migrations (name) values (?)", name)
+		if err != nil {
+			logger.Error("failed to mark migration as complete", "err", err)
+			return err
+		}
+
+		// commit the transaction
+		if err := tx.Commit(); err != nil {
+			return err
+		}
+
+		logger.Info("migration applied successfully")
+	} else {
+		logger.Warn("skipped migration, already applied")
+	}
+
+	return nil
+}
+
+type Filter struct {
+	Key string
+	arg any
+	Cmp string
+}
+
+func newFilter(key, cmp string, arg any) Filter {
+	return Filter{
+		Key: key,
+		arg: arg,
+		Cmp: cmp,
+	}
+}
+
+func FilterEq(key string, arg any) Filter      { return newFilter(key, "=", arg) }
+func FilterNotEq(key string, arg any) Filter   { return newFilter(key, "<>", arg) }
+func FilterGte(key string, arg any) Filter     { return newFilter(key, ">=", arg) }
+func FilterLte(key string, arg any) Filter     { return newFilter(key, "<=", arg) }
+func FilterIs(key string, arg any) Filter      { return newFilter(key, "is", arg) }
+func FilterIsNot(key string, arg any) Filter   { return newFilter(key, "is not", arg) }
+func FilterIn(key string, arg any) Filter      { return newFilter(key, "in", arg) }
+func FilterLike(key string, arg any) Filter    { return newFilter(key, "like", arg) }
+func FilterNotLike(key string, arg any) Filter { return newFilter(key, "not like", arg) }
+func FilterContains(key string, arg any) Filter {
+	return newFilter(key, "like", fmt.Sprintf("%%%v%%", arg))
+}
+
+func (f Filter) Condition() string {
+	rv := reflect.ValueOf(f.arg)
+	kind := rv.Kind()
+
+	// if we have `FilterIn(k, [1, 2, 3])`, compile it down to `k in (?, ?, ?)`
+	if (kind == reflect.Slice && rv.Type().Elem().Kind() != reflect.Uint8) || kind == reflect.Array {
+		if rv.Len() == 0 {
+			// always false
+			return "1 = 0"
+		}
+
+		placeholders := make([]string, rv.Len())
+		for i := range placeholders {
+			placeholders[i] = "?"
+		}
+
+		return fmt.Sprintf("%s %s (%s)", f.Key, f.Cmp, strings.Join(placeholders, ", "))
+	}
+
+	return fmt.Sprintf("%s %s ?", f.Key, f.Cmp)
+}
+
+func (f Filter) Arg() []any {
+	rv := reflect.ValueOf(f.arg)
+	kind := rv.Kind()
+	if (kind == reflect.Slice && rv.Type().Elem().Kind() != reflect.Uint8) || kind == reflect.Array {
+		if rv.Len() == 0 {
+			return nil
+		}
+
+		out := make([]any, rv.Len())
+		for i := range rv.Len() {
+			out[i] = rv.Index(i).Interface()
+		}
+		return out
+	}
+
+	return []any{f.arg}
+}

patchutil/patchutil.go

···
 	}
 
 	nd := types.NiceDiff{}
-	nd.Commit.Parent = targetBranch
 
 	for _, d := range diffs {
 		ndiff := types.Diff{}

readme.md

···
 
 ## docs
 
-* [knot hosting guide](/docs/knot-hosting.md)
-* [contributing guide](/docs/contributing.md) **please read before opening a PR!**
-* [hacking on tangled](/docs/hacking.md)
+- [knot hosting guide](https://docs.tangled.org/knot-self-hosting-guide.html#knot-self-hosting-guide)
+- [contributing guide](https://docs.tangled.org/contribution-guide.html#contribution-guide) **please read before opening a PR!**
+- [hacking on tangled](https://docs.tangled.org/hacking-on-tangled.html#hacking-on-tangled)
 
 ## security
 

sets/gen.go

···
+package sets
+
+import (
+	"math/rand"
+	"reflect"
+	"testing/quick"
+)
+
+func (_ Set[T]) Generate(rand *rand.Rand, size int) reflect.Value {
+	s := New[T]()
+
+	var zero T
+	itemType := reflect.TypeOf(zero)
+
+	for {
+		if s.Len() >= size {
+			break
+		}
+
+		item, ok := quick.Value(itemType, rand)
+		if !ok {
+			continue
+		}
+
+		if val, ok := item.Interface().(T); ok {
+			s.Insert(val)
+		}
+	}
+
+	return reflect.ValueOf(s)
+}

sets/readme.txt

···
+sets
+----
+set datastructure for go with generics and iterators. the
+api is supposed to mimic rust's std::collections::HashSet api.
+
+    s1 := sets.Collect(slices.Values([]int{1, 2, 3, 4}))
+    s2 := sets.Collect(slices.Values([]int{1, 2, 3, 4, 5, 6}))
+
+    union     := sets.Collect(s1.Union(s2))
+    intersect := sets.Collect(s1.Intersection(s2))
+    diff      := sets.Collect(s1.Difference(s2))
+    symdiff   := sets.Collect(s1.SymmetricDifference(s2))
+
+    s1.Len()          // 4
+    s1.Contains(1)    // true
+    s1.IsEmpty()      // false
+    s1.IsSubset(s2)   // true
+    s1.IsSuperset(s2) // false
+    s1.IsDisjoint(s2) // false
+
+    if exists := s1.Insert(1); exists {
+        // already existed in set
+    }
+
+    if existed := s1.Remove(1); existed {
+        // existed in set, now removed
+    }
+
+
+testing
+-------
+includes property-based tests using the wonderful
+testing/quick module!
+
+    go test -v

sets/set.go

···
+package sets
+
+import (
+	"iter"
+	"maps"
+)
+
+type Set[T comparable] struct {
+	data map[T]struct{}
+}
+
+func New[T comparable]() Set[T] {
+	return Set[T]{
+		data: make(map[T]struct{}),
+	}
+}
+
+func (s *Set[T]) Insert(item T) bool {
+	_, exists := s.data[item]
+	s.data[item] = struct{}{}
+	return !exists
+}
+
+func Singleton[T comparable](item T) Set[T] {
+	n := New[T]()
+	_ = n.Insert(item)
+	return n
+}
+
+func (s *Set[T]) Remove(item T) bool {
+	_, exists := s.data[item]
+	if exists {
+		delete(s.data, item)
+	}
+	return exists
+}
+
+func (s Set[T]) Contains(item T) bool {
+	_, exists := s.data[item]
+	return exists
+}
+
+func (s Set[T]) Len() int {
+	return len(s.data)
+}
+
+func (s Set[T]) IsEmpty() bool {
+	return len(s.data) == 0
+}
+
+func (s *Set[T]) Clear() {
+	s.data = make(map[T]struct{})
+}
+
+func (s Set[T]) All() iter.Seq[T] {
+	return func(yield func(T) bool) {
+		for item := range s.data {
+			if !yield(item) {
+				return
+			}
+		}
+	}
+}
+
+func (s Set[T]) Clone() Set[T] {
+	return Set[T]{
+		data: maps.Clone(s.data),
+	}
+}
+
+func (s Set[T]) Union(other Set[T]) iter.Seq[T] {
+	if s.Len() >= other.Len() {
+		return chain(s.All(), other.Difference(s))
+	} else {
+		return chain(other.All(), s.Difference(other))
+	}
+}
+
+func chain[T any](seqs ...iter.Seq[T]) iter.Seq[T] {
+	return func(yield func(T) bool) {
+		for _, seq := range seqs {
+			for item := range seq {
+				if !yield(item) {
+					return
+				}
+			}
+		}
+	}
+}
+
+func (s Set[T]) Intersection(other Set[T]) iter.Seq[T] {
+	return func(yield func(T) bool) {
+		for item := range s.data {
+			if other.Contains(item) {
+				if !yield(item) {
+					return
+				}
+			}
+		}
+	}
+}
+
+func (s Set[T]) Difference(other Set[T]) iter.Seq[T] {
+	return func(yield func(T) bool) {
+		for item := range s.data {
+			if !other.Contains(item) {
+				if !yield(item) {
+					return
+				}
+			}
+		}
+	}
+}
+
+func (s Set[T]) SymmetricDifference(other Set[T]) iter.Seq[T] {
+	return func(yield func(T) bool) {
+		for item := range s.data {
+			if !other.Contains(item) {
+				if !yield(item) {
+					return
+				}
+			}
+		}
+		for item := range other.data {
+			if !s.Contains(item) {
+				if !yield(item) {
+					return
+				}
+			}
+		}
+	}
+}
+
+func (s Set[T]) IsSubset(other Set[T]) bool {
+	for item := range s.data {
+		if !other.Contains(item) {
+			return false
+		}
+	}
+	return true
+}
+
+func (s Set[T]) IsSuperset(other Set[T]) bool {
+	return other.IsSubset(s)
+}
+
+func (s Set[T]) IsDisjoint(other Set[T]) bool {
+	for item := range s.data {
+		if other.Contains(item) {
+			return false
+		}
+	}
+	return true
+}
+
+func (s Set[T]) Equal(other Set[T]) bool {
+	if s.Len() != other.Len() {
+		return false
+	}
+	for item := range s.data {
+		if !other.Contains(item) {
+			return false
+		}
+	}
+	return true
+}
+
+func Collect[T comparable](seq iter.Seq[T]) Set[T] {
+	result := New[T]()
+	for item := range seq {
+		result.Insert(item)
+	}
+	return result
+}

sets/set_test.go

···
+package sets
+
+import (
+	"slices"
+	"testing"
+	"testing/quick"
+)
+
+func TestNew(t *testing.T) {
+	s := New[int]()
+	if s.Len() != 0 {
+		t.Errorf("New set should be empty, got length %d", s.Len())
+	}
+	if !s.IsEmpty() {
+		t.Error("New set should be empty")
+	}
+}
+
+func TestFromSlice(t *testing.T) {
+	s := Collect(slices.Values([]int{1, 2, 3, 2, 1}))
+	if s.Len() != 3 {
+		t.Errorf("Expected length 3, got %d", s.Len())
+	}
+	if !s.Contains(1) || !s.Contains(2) || !s.Contains(3) {
+		t.Error("Set should contain all unique elements from slice")
+	}
+}
+
+func TestInsert(t *testing.T) {
+	s := New[string]()
+
+	if !s.Insert("hello") {
+		t.Error("First insert should return true")
+	}
+	if s.Insert("hello") {
+		t.Error("Duplicate insert should return false")
+	}
+	if s.Len() != 1 {
+		t.Errorf("Expected length 1, got %d", s.Len())
+	}
+}
+
+func TestRemove(t *testing.T) {
+	s := Collect(slices.Values([]int{1, 2, 3}))
+
+	if !s.Remove(2) {
+		t.Error("Remove existing element should return true")
+	}
+	if s.Remove(2) {
+		t.Error("Remove non-existing element should return false")
+	}
+	if s.Contains(2) {
+		t.Error("Element should be removed")
+	}
+	if s.Len() != 2 {
+		t.Errorf("Expected length 2, got %d", s.Len())
+	}
+}
+
+func TestContains(t *testing.T) {
+	s := Collect(slices.Values([]int{1, 2, 3}))
+
+	if !s.Contains(1) {
+		t.Error("Should contain 1")
+	}
+	if s.Contains(4) {
+		t.Error("Should not contain 4")
+	}
+}
+
+func TestClear(t *testing.T) {
+	s := Collect(slices.Values([]int{1, 2, 3}))
+	s.Clear()
+
+	if !s.IsEmpty() {
+		t.Error("Set should be empty after clear")
+	}
+	if s.Len() != 0 {
+		t.Errorf("Expected length 0, got %d", s.Len())
+	}
+}
+
+func TestIterator(t *testing.T) {
+	s := Collect(slices.Values([]int{1, 2, 3}))
+	var items []int
+
+	for item := range s.All() {
+		items = append(items, item)
+	}
+
+	slices.Sort(items)
+	expected := []int{1, 2, 3}
+	if !slices.Equal(items, expected) {
+		t.Errorf("Expected %v, got %v", expected, items)
+	}
+}
+
+func TestClone(t *testing.T) {
+	s1 := Collect(slices.Values([]int{1, 2, 3}))
+	s2 := s1.Clone()
+
+	if !s1.Equal(s2) {
+		t.Error("Cloned set should be equal to original")
+	}
+
+	s2.Insert(4)
+	if s1.Contains(4) {
+		t.Error("Modifying clone should not affect original")
+	}
+}
+
+func TestUnion(t *testing.T) {
+	s1 := Collect(slices.Values([]int{1, 2}))
+	s2 := Collect(slices.Values([]int{2, 3}))
+
+	result := Collect(s1.Union(s2))
+	expected := Collect(slices.Values([]int{1, 2, 3}))
+
+	if !result.Equal(expected) {
+		t.Errorf("Expected %v, got %v", expected, result)
+	}
+}
+
+func TestIntersection(t *testing.T) {
+	s1 := Collect(slices.Values([]int{1, 2, 3}))
+	s2 := Collect(slices.Values([]int{2, 3, 4}))
+
+	expected := Collect(slices.Values([]int{2, 3}))
+	result := Collect(s1.Intersection(s2))
+
+	if !result.Equal(expected) {
+		t.Errorf("Expected %v, got %v", expected, result)
+	}
+}
+
+func TestDifference(t *testing.T) {
+	s1 := Collect(slices.Values([]int{1, 2, 3}))
+	s2 := Collect(slices.Values([]int{2, 3, 4}))
+
+	expected := Collect(slices.Values([]int{1}))
+	result := Collect(s1.Difference(s2))
+
+	if !result.Equal(expected) {
+		t.Errorf("Expected %v, got %v", expected, result)
+	}
+}
+
+func TestSymmetricDifference(t *testing.T) {
+	s1 := Collect(slices.Values([]int{1, 2, 3}))
+	s2 := Collect(slices.Values([]int{2, 3, 4}))
+
+	expected := Collect(slices.Values([]int{1, 4}))
+	result := Collect(s1.SymmetricDifference(s2))
+
+	if !result.Equal(expected) {
+		t.Errorf("Expected %v, got %v", expected, result)
+	}
+}
+
+func TestSymmetricDifferenceCommutativeProperty(t *testing.T) {
+	s1 := Collect(slices.Values([]int{1, 2, 3}))
+	s2 := Collect(slices.Values([]int{2, 3, 4}))
+
+	result1 := Collect(s1.SymmetricDifference(s2))
+	result2 := Collect(s2.SymmetricDifference(s1))
+
+	if !result1.Equal(result2) {
+		t.Errorf("Expected %v, got %v", result1, result2)
+	}
+}
+
+func TestIsSubset(t *testing.T) {
+	s1 := Collect(slices.Values([]int{1, 2}))
+	s2 := Collect(slices.Values([]int{1, 2, 3}))
+
+	if !s1.IsSubset(s2) {
+		t.Error("s1 should be subset of s2")
+	}
+	if s2.IsSubset(s1) {
+		t.Error("s2 should not be subset of s1")
+	}
+}
+
+func TestIsSuperset(t *testing.T) {
+	s1 := Collect(slices.Values([]int{1, 2, 3}))
+	s2 := Collect(slices.Values([]int{1, 2}))
+
+	if !s1.IsSuperset(s2) {
+		t.Error("s1 should be superset of s2")
+	}
+	if s2.IsSuperset(s1) {
+		t.Error("s2 should not be superset of s1")
+	}
+}
+
+func TestIsDisjoint(t *testing.T) {
+	s1 := Collect(slices.Values([]int{1, 2}))
+	s2 := Collect(slices.Values([]int{3, 4}))
+	s3 := Collect(slices.Values([]int{2, 3}))
+
+	if !s1.IsDisjoint(s2) {
+		t.Error("s1 and s2 should be disjoint")
+	}
+	if s1.IsDisjoint(s3) {
+		t.Error("s1 and s3 should not be disjoint")
+	}
+}
+
+func TestEqual(t *testing.T) {
+	s1 := Collect(slices.Values([]int{1, 2, 3}))
+	s2 := Collect(slices.Values([]int{3, 2, 1}))
+	s3 := Collect(slices.Values([]int{1, 2}))
+
+	if !s1.Equal(s2) {
+		t.Error("s1 and s2 should be equal")
+	}
+	if s1.Equal(s3) {
+		t.Error("s1 and s3 should not be equal")
+	}
+}
+
+func TestCollect(t *testing.T) {
+	s1 := Collect(slices.Values([]int{1, 2}))
+	s2 := Collect(slices.Values([]int{2, 3}))
+
+	unionSet := Collect(s1.Union(s2))
+	if unionSet.Len() != 3 {
+		t.Errorf("Expected union set length 3, got %d", unionSet.Len())
+	}
+	if !unionSet.Contains(1) || !unionSet.Contains(2) || !unionSet.Contains(3) {
+		t.Error("Union set should contain 1, 2, and 3")
+	}
+
+	diffSet := Collect(s1.Difference(s2))
+	if diffSet.Len() != 1 {
+		t.Errorf("Expected difference set length 1, got %d", diffSet.Len())
+	}
+	if !diffSet.Contains(1) {
+		t.Error("Difference set should contain 1")
+	}
+}
+
+func TestPropertySingleonLen(t *testing.T) {
+	f := func(item int) bool {
+		single := Singleton(item)
+		return single.Len() == 1
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertyInsertIdempotent(t *testing.T) {
+	f := func(s Set[int], item int) bool {
+		clone := s.Clone()
+
+		clone.Insert(item)
+		firstLen := clone.Len()
+
+		clone.Insert(item)
+		secondLen := clone.Len()
+
+		return firstLen == secondLen
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertyUnionCommutative(t *testing.T) {
+	f := func(s1 Set[int], s2 Set[int]) bool {
+		union1 := Collect(s1.Union(s2))
+		union2 := Collect(s2.Union(s1))
+		return union1.Equal(union2)
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertyIntersectionCommutative(t *testing.T) {
+	f := func(s1 Set[int], s2 Set[int]) bool {
+		inter1 := Collect(s1.Intersection(s2))
+		inter2 := Collect(s2.Intersection(s1))
+		return inter1.Equal(inter2)
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertyCloneEquals(t *testing.T) {
+	f := func(s Set[int]) bool {
+		clone := s.Clone()
+		return s.Equal(clone)
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertyIntersectionIsSubset(t *testing.T) {
+	f := func(s1 Set[int], s2 Set[int]) bool {
+		inter := Collect(s1.Intersection(s2))
+		return inter.IsSubset(s1) && inter.IsSubset(s2)
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertyUnionIsSuperset(t *testing.T) {
+	f := func(s1 Set[int], s2 Set[int]) bool {
+		union := Collect(s1.Union(s2))
+		return union.IsSuperset(s1) && union.IsSuperset(s2)
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertyDifferenceDisjoint(t *testing.T) {
+	f := func(s1 Set[int], s2 Set[int]) bool {
+		diff := Collect(s1.Difference(s2))
+		return diff.IsDisjoint(s2)
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertySymmetricDifferenceCommutative(t *testing.T) {
+	f := func(s1 Set[int], s2 Set[int]) bool {
+		symDiff1 := Collect(s1.SymmetricDifference(s2))
+		symDiff2 := Collect(s2.SymmetricDifference(s1))
+		return symDiff1.Equal(symDiff2)
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertyRemoveWorks(t *testing.T) {
+	f := func(s Set[int], item int) bool {
+		clone := s.Clone()
+		clone.Insert(item)
+		clone.Remove(item)
+		return !clone.Contains(item)
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertyClearEmpty(t *testing.T) {
+	f := func(s Set[int]) bool {
+		s.Clear()
+		return s.IsEmpty() && s.Len() == 0
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertyIsSubsetReflexive(t *testing.T) {
+	f := func(s Set[int]) bool {
+		return s.IsSubset(s)
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}
+
+func TestPropertyDeMorganUnion(t *testing.T) {
+	f := func(s1 Set[int], s2 Set[int], universe Set[int]) bool {
+		// create a universe that contains both sets
+		u := universe.Clone()
+		for item := range s1.All() {
+			u.Insert(item)
+		}
+		for item := range s2.All() {
+			u.Insert(item)
+		}
+
+		// (A u B)' = A' n B'
+		union := Collect(s1.Union(s2))
+		complementUnion := Collect(u.Difference(union))
+
+		complementS1 := Collect(u.Difference(s1))
+		complementS2 := Collect(u.Difference(s2))
+		intersectionComplements := Collect(complementS1.Intersection(complementS2))
+
+		return complementUnion.Equal(intersectionComplements)
+	}
+
+	if err := quick.Check(f, nil); err != nil {
+		t.Error(err)
+	}
+}

spindle/db/repos.go

···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
 
 	var knots []string
 	for rows.Next() {

spindle/engine/engine.go

···
 import (
 	"context"
 	"errors"
-	"fmt"
 	"log/slog"
+	"sync"
 
 	securejoin "github.com/cyphar/filepath-securejoin"
-	"golang.org/x/sync/errgroup"
 	"tangled.org/core/notifier"
 	"tangled.org/core/spindle/config"
 	"tangled.org/core/spindle/db"
···
 		}
 	}
 
-	eg, ctx := errgroup.WithContext(ctx)
+	var wg sync.WaitGroup
 	for eng, wfs := range pipeline.Workflows {
 		workflowTimeout := eng.WorkflowTimeout()
 		l.Info("using workflow timeout", "timeout", workflowTimeout)
 
 		for _, w := range wfs {
-			eg.Go(func() error {
+			wg.Add(1)
+			go func() {
+				defer wg.Done()
+
 				wid := models.WorkflowId{
 					PipelineId: pipelineId,
 					Name:       w.Name,
···
 
 				err := db.StatusRunning(wid, n)
 				if err != nil {
-					return err
+					l.Error("failed to set workflow status to running", "wid", wid, "err", err)
+					return
 				}
 
 				err = eng.SetupWorkflow(ctx, wid, &w)
···
 
 					dbErr := db.StatusFailed(wid, err.Error(), -1, n)
 					if dbErr != nil {
-						return dbErr
+						l.Error("failed to set workflow status to failed", "wid", wid, "err", dbErr)
 					}
-					return err
+					return
 				}
 				defer eng.DestroyWorkflow(ctx, wid)
 
-				wfLogger, err := models.NewWorkflowLogger(cfg.Server.LogDir, wid)
+				secretValues := make([]string, len(allSecrets))
+				for i, s := range allSecrets {
+					secretValues[i] = s.Value
+				}
+				wfLogger, err := models.NewWorkflowLogger(cfg.Server.LogDir, wid, secretValues)
 				if err != nil {
 					l.Warn("failed to setup step logger; logs will not be persisted", "error", err)
 					wfLogger = nil
···
 						if errors.Is(err, ErrTimedOut) {
 							dbErr := db.StatusTimeout(wid, n)
 							if dbErr != nil {
-								return dbErr
+								l.Error("failed to set workflow status to timeout", "wid", wid, "err", dbErr)
 							}
 						} else {
 							dbErr := db.StatusFailed(wid, err.Error(), -1, n)
 							if dbErr != nil {
-								return dbErr
+								l.Error("failed to set workflow status to failed", "wid", wid, "err", dbErr)
 							}
 						}
-
-						return fmt.Errorf("starting steps image: %w", err)
+						return
 					}
 				}
 
 				err = db.StatusSuccess(wid, n)
 				if err != nil {
-					return err
+					l.Error("failed to set workflow status to success", "wid", wid, "err", err)
 				}
-
-				return nil
-			})
+			}()
 		}
 	}
 
-	if err := eg.Wait(); err != nil {
-		l.Error("failed to run one or more workflows", "err", err)
-	} else {
-		l.Info("successfully ran full pipeline")
-	}
+	wg.Wait()
+	l.Info("all workflows completed")
 }

spindle/engines/nixery/engine.go

···
 		workflowEnvs.AddEnv(s.Key, s.Value)
 	}
 
-	step := w.Steps[idx].(Step)
+	step := w.Steps[idx]
 
 	select {
 	case <-ctx.Done():
···
 	}
 
 	envs := append(EnvVars(nil), workflowEnvs...)
-	for k, v := range step.environment {
-		envs.AddEnv(k, v)
+	if nixStep, ok := step.(Step); ok {
+		for k, v := range nixStep.environment {
+			envs.AddEnv(k, v)
+		}
 	}
 	envs.AddEnv("HOME", homeDir)
 

spindle/models/logger.go

···
 type WorkflowLogger struct {
 	file    *os.File
 	encoder *json.Encoder
+	mask    *SecretMask
 }
 
-func NewWorkflowLogger(baseDir string, wid WorkflowId) (*WorkflowLogger, error) {
+func NewWorkflowLogger(baseDir string, wid WorkflowId, secretValues []string) (*WorkflowLogger, error) {
 	path := LogFilePath(baseDir, wid)
 
 	file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
···
 	return &WorkflowLogger{
 		file:    file,
 		encoder: json.NewEncoder(file),
+		mask:    NewSecretMask(secretValues),
 	}, nil
 }
 
···
 
 func (w *dataWriter) Write(p []byte) (int, error) {
 	line := strings.TrimRight(string(p), "\r\n")
+	if w.logger.mask != nil {
+		line = w.logger.mask.Mask(line)
+	}
 	entry := NewDataLogLine(w.idx, line, w.stream)
 	if err := w.logger.encoder.Encode(entry); err != nil {
 		return 0, err

spindle/models/secret_mask.go

···
+package models
+
+import (
+	"encoding/base64"
+	"strings"
+)
+
+// SecretMask replaces secret values in strings with "***".
+type SecretMask struct {
+	replacer *strings.Replacer
+}
+
+// NewSecretMask creates a mask for the given secret values.
+// Also registers base64-encoded variants of each secret.
+func NewSecretMask(values []string) *SecretMask {
+	var pairs []string
+
+	for _, value := range values {
+		if value == "" {
+			continue
+		}
+
+		pairs = append(pairs, value, "***")
+
+		b64 := base64.StdEncoding.EncodeToString([]byte(value))
+		if b64 != value {
+			pairs = append(pairs, b64, "***")
+		}
+
+		b64NoPad := strings.TrimRight(b64, "=")
+		if b64NoPad != b64 && b64NoPad != value {
+			pairs = append(pairs, b64NoPad, "***")
+		}
+	}
+
+	if len(pairs) == 0 {
+		return nil
+	}
+
+	return &SecretMask{
+		replacer: strings.NewReplacer(pairs...),
+	}
+}
+
+// Mask replaces all registered secret values with "***".
+func (m *SecretMask) Mask(input string) string {
+	if m == nil || m.replacer == nil {
+		return input
+	}
+	return m.replacer.Replace(input)
+}

spindle/models/secret_mask_test.go

···
+package models
+
+import (
+	"encoding/base64"
+	"testing"
+)
+
+func TestSecretMask_BasicMasking(t *testing.T) {
+	mask := NewSecretMask([]string{"mysecret123"})
+
+	input := "The password is mysecret123 in this log"
+	expected := "The password is *** in this log"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_Base64Encoded(t *testing.T) {
+	secret := "mysecret123"
+	mask := NewSecretMask([]string{secret})
+
+	b64 := base64.StdEncoding.EncodeToString([]byte(secret))
+	input := "Encoded: " + b64
+	expected := "Encoded: ***"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_Base64NoPadding(t *testing.T) {
+	// "test" encodes to "dGVzdA==" with padding
+	secret := "test"
+	mask := NewSecretMask([]string{secret})
+
+	b64NoPad := "dGVzdA" // base64 without padding
+	input := "Token: " + b64NoPad
+	expected := "Token: ***"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_MultipleSecrets(t *testing.T) {
+	mask := NewSecretMask([]string{"password1", "apikey123"})
+
+	input := "Using password1 and apikey123 for auth"
+	expected := "Using *** and *** for auth"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_MultipleOccurrences(t *testing.T) {
+	mask := NewSecretMask([]string{"secret"})
+
+	input := "secret appears twice: secret"
+	expected := "*** appears twice: ***"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_ShortValues(t *testing.T) {
+	mask := NewSecretMask([]string{"abc", "xy", ""})
+
+	if mask == nil {
+		t.Fatal("expected non-nil mask")
+	}
+
+	input := "abc xy test"
+	expected := "*** *** test"
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_NilMask(t *testing.T) {
+	var mask *SecretMask
+
+	input := "some input text"
+	result := mask.Mask(input)
+	if result != input {
+		t.Errorf("expected %q, got %q", input, result)
+	}
+}
+
+func TestSecretMask_EmptyInput(t *testing.T) {
+	mask := NewSecretMask([]string{"secret"})
+
+	result := mask.Mask("")
+	if result != "" {
+		t.Errorf("expected empty string, got %q", result)
+	}
+}
+
+func TestSecretMask_NoMatch(t *testing.T) {
+	mask := NewSecretMask([]string{"secretvalue"})
+
+	input := "nothing to mask here"
+	result := mask.Mask(input)
+	if result != input {
+		t.Errorf("expected %q, got %q", input, result)
+	}
+}
+
+func TestSecretMask_EmptySecretsList(t *testing.T) {
+	mask := NewSecretMask([]string{})
+
+	if mask != nil {
+		t.Error("expected nil mask for empty secrets list")
+	}
+}
+
+func TestSecretMask_EmptySecretsFiltered(t *testing.T) {
+	mask := NewSecretMask([]string{"ab", "validpassword", "", "xyz"})
+
+	input := "Using validpassword here"
+	expected := "Using *** here"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}

spindle/motd

···
                       **
                         ********
 
-This is a spindle server. More info at https://tangled.sh/@tangled.sh/core/tree/master/docs/spindle
+This is a spindle server. More info at https://docs.tangled.org/spindles.html#spindles
 
 Most API routes are under /xrpc/

spindle/server.go

···
 	"log/slog"
 	"maps"
 	"net/http"
+	"sync"
 
 	"github.com/go-chi/chi/v5"
 	"tangled.org/core/api/tangled"
···
 )
 
 //go:embed motd
-var motd []byte
+var defaultMotd []byte
 
 const (
 	rbacDomain = "thisserver"
 )
 
 type Spindle struct {
-	jc    *jetstream.JetstreamClient
-	db    *db.DB
-	e     *rbac.Enforcer
-	l     *slog.Logger
-	n     *notifier.Notifier
-	engs  map[string]models.Engine
-	jq    *queue.Queue
-	cfg   *config.Config
-	ks    *eventconsumer.Consumer
-	res   *idresolver.Resolver
-	vault secrets.Manager
+	jc     *jetstream.JetstreamClient
+	db     *db.DB
+	e      *rbac.Enforcer
+	l      *slog.Logger
+	n      *notifier.Notifier
+	engs   map[string]models.Engine
+	jq     *queue.Queue
+	cfg    *config.Config
+	ks     *eventconsumer.Consumer
+	res    *idresolver.Resolver
+	vault  secrets.Manager
+	motd   []byte
+	motdMu sync.RWMutex
 }
 
 // New creates a new Spindle server with the provided configuration and engines.
···
 		cfg:   cfg,
 		res:   resolver,
 		vault: vault,
+		motd:  defaultMotd,
 	}
 
 	err = e.AddSpindle(rbacDomain)
···
 	return s.e
 }
 
+// SetMotdContent sets custom MOTD content, replacing the embedded default.
+func (s *Spindle) SetMotdContent(content []byte) {
+	s.motdMu.Lock()
+	defer s.motdMu.Unlock()
+	s.motd = content
+}
+
+// GetMotdContent returns the current MOTD content.
+func (s *Spindle) GetMotdContent() []byte {
+	s.motdMu.RLock()
+	defer s.motdMu.RUnlock()
+	return s.motd
+}
+
 // Start starts the Spindle server (blocking).
 func (s *Spindle) Start(ctx context.Context) error {
 	// starts a job queue runner in the background
···
 	mux := chi.NewRouter()
 
 	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
-		w.Write(motd)
+		w.Write(s.GetMotdContent())
 	})
 	mux.HandleFunc("/events", s.Events)
 	mux.HandleFunc("/logs/{knot}/{rkey}/{name}", s.Logs)

tailwind.config.js

···
 const colors = require("tailwindcss/colors");
 
 module.exports = {
-	content: ["./appview/pages/templates/**/*.html", "./appview/pages/chroma.go"],
+	content: ["./appview/pages/templates/**/*.html", "./appview/pages/chroma.go", "./docs/*.html"],
 	darkMode: "media",
 	theme: {
 		container: {

types/commit.go

···
+package types
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"maps"
+	"regexp"
+	"strings"
+
+	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/object"
+)
+
+type Commit struct {
+	// hash of the commit object.
+	Hash plumbing.Hash `json:"hash,omitempty"`
+
+	// author is the original author of the commit.
+	Author object.Signature `json:"author"`
+
+	// committer is the one performing the commit, might be different from author.
+	Committer object.Signature `json:"committer"`
+
+	// message is the commit message, contains arbitrary text.
+	Message string `json:"message"`
+
+	// treehash is the hash of the root tree of the commit.
+	Tree string `json:"tree"`
+
+	// parents are the hashes of the parent commits of the commit.
+	ParentHashes []plumbing.Hash `json:"parent_hashes,omitempty"`
+
+	// pgpsignature is the pgp signature of the commit.
+	PGPSignature string `json:"pgp_signature,omitempty"`
+
+	// mergetag is the embedded tag object when a merge commit is created by
+	// merging a signed tag.
+	MergeTag string `json:"merge_tag,omitempty"`
+
+	// changeid is a unique identifier for the change (e.g., gerrit change-id).
+	ChangeId string `json:"change_id,omitempty"`
+
+	// extraheaders contains additional headers not captured by other fields.
+	ExtraHeaders map[string][]byte `json:"extra_headers,omitempty"`
+
+	// deprecated: kept for backwards compatibility with old json format.
+	This string `json:"this,omitempty"`
+
+	// deprecated: kept for backwards compatibility with old json format.
+	Parent string `json:"parent,omitempty"`
+}
+
+// types.Commit is an unify two commit structs:
+//   - git.object.Commit from
+//   - types.NiceDiff.commit
+//
+// to do this in backwards compatible fashion, we define the base struct
+// to use the same fields as NiceDiff.Commit, and then we also unmarshal
+// the struct fields from go-git structs, this custom unmarshal makes sense
+// of both representations and unifies them to have maximal data in either
+// form.
+func (c *Commit) UnmarshalJSON(data []byte) error {
+	type Alias Commit
+
+	aux := &struct {
+		*object.Commit
+		*Alias
+	}{
+		Alias: (*Alias)(c),
+	}
+
+	if err := json.Unmarshal(data, aux); err != nil {
+		return err
+	}
+
+	c.FromGoGitCommit(aux.Commit)
+
+	return nil
+}
+
+// fill in as much of Commit as possible from the given go-git commit
+func (c *Commit) FromGoGitCommit(gc *object.Commit) {
+	if gc == nil {
+		return
+	}
+
+	if c.Hash.IsZero() {
+		c.Hash = gc.Hash
+	}
+	if c.This == "" {
+		c.This = gc.Hash.String()
+	}
+	if isEmptySignature(c.Author) {
+		c.Author = gc.Author
+	}
+	if isEmptySignature(c.Committer) {
+		c.Committer = gc.Committer
+	}
+	if c.Message == "" {
+		c.Message = gc.Message
+	}
+	if c.Tree == "" {
+		c.Tree = gc.TreeHash.String()
+	}
+	if c.PGPSignature == "" {
+		c.PGPSignature = gc.PGPSignature
+	}
+	if c.MergeTag == "" {
+		c.MergeTag = gc.MergeTag
+	}
+
+	if len(c.ParentHashes) == 0 {
+		c.ParentHashes = gc.ParentHashes
+	}
+	if c.Parent == "" && len(gc.ParentHashes) > 0 {
+		c.Parent = gc.ParentHashes[0].String()
+	}
+
+	if len(c.ExtraHeaders) == 0 {
+		c.ExtraHeaders = make(map[string][]byte)
+		maps.Copy(c.ExtraHeaders, gc.ExtraHeaders)
+	}
+
+	if c.ChangeId == "" {
+		if v, ok := gc.ExtraHeaders["change-id"]; ok {
+			c.ChangeId = string(v)
+		}
+	}
+}
+
+func isEmptySignature(s object.Signature) bool {
+	return s.Email == "" && s.Name == "" && s.When.IsZero()
+}
+
+// produce a verifiable payload from this commit's metadata
+func (c *Commit) Payload() string {
+	author := bytes.NewBuffer([]byte{})
+	c.Author.Encode(author)
+
+	committer := bytes.NewBuffer([]byte{})
+	c.Committer.Encode(committer)
+
+	payload := strings.Builder{}
+
+	fmt.Fprintf(&payload, "tree %s\n", c.Tree)
+
+	if len(c.ParentHashes) > 0 {
+		for _, p := range c.ParentHashes {
+			fmt.Fprintf(&payload, "parent %s\n", p.String())
+		}
+	} else {
+		// present for backwards compatibility
+		fmt.Fprintf(&payload, "parent %s\n", c.Parent)
+	}
+
+	fmt.Fprintf(&payload, "author %s\n", author.String())
+	fmt.Fprintf(&payload, "committer %s\n", committer.String())
+
+	if c.ChangeId != "" {
+		fmt.Fprintf(&payload, "change-id %s\n", c.ChangeId)
+	} else if v, ok := c.ExtraHeaders["change-id"]; ok {
+		fmt.Fprintf(&payload, "change-id %s\n", string(v))
+	}
+
+	fmt.Fprintf(&payload, "\n%s", c.Message)
+
+	return payload.String()
+}
+
+var (
+	coAuthorRegex = regexp.MustCompile(`(?im)^Co-authored-by:\s*(.+?)\s*<([^>]+)>`)
+)
+
+func (commit Commit) CoAuthors() []object.Signature {
+	var coAuthors []object.Signature
+	seen := make(map[string]bool)
+	matches := coAuthorRegex.FindAllStringSubmatch(commit.Message, -1)
+
+	for _, match := range matches {
+		if len(match) >= 3 {
+			name := strings.TrimSpace(match[1])
+			email := strings.TrimSpace(match[2])
+
+			if seen[email] {
+				continue
+			}
+			seen[email] = true
+
+			coAuthors = append(coAuthors, object.Signature{
+				Name:  name,
+				Email: email,
+				When:  commit.Committer.When,
+			})
+		}
+	}
+
+	return coAuthors
+}

types/diff.go

···
 
 import (
 	"github.com/bluekeyes/go-gitdiff/gitdiff"
-	"github.com/go-git/go-git/v5/plumbing/object"
 )
 
 type DiffOpts struct {
···
 
 // A nicer git diff representation.
 type NiceDiff struct {
-	Commit struct {
-		Message      string           `json:"message"`
-		Author       object.Signature `json:"author"`
-		This         string           `json:"this"`
-		Parent       string           `json:"parent"`
-		PGPSignature string           `json:"pgp_signature"`
-		Committer    object.Signature `json:"committer"`
-		Tree         string           `json:"tree"`
-		ChangedId    string           `json:"change_id"`
-	} `json:"commit"`
-	Stat struct {
+	Commit Commit `json:"commit"`
+	Stat   struct {
 		FilesChanged int `json:"files_changed"`
 		Insertions   int `json:"insertions"`
 		Deletions    int `json:"deletions"`
···
 
 // used by html elements as a unique ID for hrefs
 func (d *Diff) Id() string {
+	if d.IsDelete {
+		return d.Name.Old
+	}
 	return d.Name.New
 }
 

types/diff_test.go

···
+package types
+
+import "testing"
+
+func TestDiffId(t *testing.T) {
+	tests := []struct {
+		name     string
+		diff     Diff
+		expected string
+	}{
+		{
+			name: "regular file uses new name",
+			diff: Diff{
+				Name: struct {
+					Old string `json:"old"`
+					New string `json:"new"`
+				}{Old: "", New: "src/main.go"},
+			},
+			expected: "src/main.go",
+		},
+		{
+			name: "new file uses new name",
+			diff: Diff{
+				Name: struct {
+					Old string `json:"old"`
+					New string `json:"new"`
+				}{Old: "", New: "src/new.go"},
+				IsNew: true,
+			},
+			expected: "src/new.go",
+		},
+		{
+			name: "deleted file uses old name",
+			diff: Diff{
+				Name: struct {
+					Old string `json:"old"`
+					New string `json:"new"`
+				}{Old: "src/deleted.go", New: ""},
+				IsDelete: true,
+			},
+			expected: "src/deleted.go",
+		},
+		{
+			name: "renamed file uses new name",
+			diff: Diff{
+				Name: struct {
+					Old string `json:"old"`
+					New string `json:"new"`
+				}{Old: "src/old.go", New: "src/renamed.go"},
+				IsRename: true,
+			},
+			expected: "src/renamed.go",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := tt.diff.Id(); got != tt.expected {
+				t.Errorf("Diff.Id() = %q, want %q", got, tt.expected)
+			}
+		})
+	}
+}
+
+func TestChangedFilesMatchesDiffId(t *testing.T) {
+	// ChangedFiles() must return values matching each Diff's Id()
+	// so that sidebar links point to the correct anchors.
+	// Tests existing, deleted, new, and renamed files.
+	nd := NiceDiff{
+		Diff: []Diff{
+			{
+				Name: struct {
+					Old string `json:"old"`
+					New string `json:"new"`
+				}{Old: "", New: "src/modified.go"},
+			},
+			{
+				Name: struct {
+					Old string `json:"old"`
+					New string `json:"new"`
+				}{Old: "src/deleted.go", New: ""},
+				IsDelete: true,
+			},
+			{
+				Name: struct {
+					Old string `json:"old"`
+					New string `json:"new"`
+				}{Old: "", New: "src/new.go"},
+				IsNew: true,
+			},
+			{
+				Name: struct {
+					Old string `json:"old"`
+					New string `json:"new"`
+				}{Old: "src/old.go", New: "src/renamed.go"},
+				IsRename: true,
+			},
+		},
+	}
+
+	changedFiles := nd.ChangedFiles()
+
+	if len(changedFiles) != len(nd.Diff) {
+		t.Fatalf("ChangedFiles() returned %d items, want %d", len(changedFiles), len(nd.Diff))
+	}
+
+	for i, diff := range nd.Diff {
+		if changedFiles[i] != diff.Id() {
+			t.Errorf("ChangedFiles()[%d] = %q, but Diff.Id() = %q", i, changedFiles[i], diff.Id())
+		}
+	}
+}

types/repo.go

···
 )
 
 type RepoIndexResponse struct {
-	IsEmpty        bool             `json:"is_empty"`
-	Ref            string           `json:"ref,omitempty"`
-	Readme         string           `json:"readme,omitempty"`
-	ReadmeFileName string           `json:"readme_file_name,omitempty"`
-	Commits        []*object.Commit `json:"commits,omitempty"`
-	Description    string           `json:"description,omitempty"`
-	Files          []NiceTree       `json:"files,omitempty"`
-	Branches       []Branch         `json:"branches,omitempty"`
-	Tags           []*TagReference  `json:"tags,omitempty"`
-	TotalCommits   int              `json:"total_commits,omitempty"`
+	IsEmpty        bool            `json:"is_empty"`
+	Ref            string          `json:"ref,omitempty"`
+	Readme         string          `json:"readme,omitempty"`
+	ReadmeFileName string          `json:"readme_file_name,omitempty"`
+	Commits        []Commit        `json:"commits,omitempty"`
+	Description    string          `json:"description,omitempty"`
+	Files          []NiceTree      `json:"files,omitempty"`
+	Branches       []Branch        `json:"branches,omitempty"`
+	Tags           []*TagReference `json:"tags,omitempty"`
+	TotalCommits   int             `json:"total_commits,omitempty"`
 }
 
 type RepoLogResponse struct {
-	Commits     []*object.Commit `json:"commits,omitempty"`
-	Ref         string           `json:"ref,omitempty"`
-	Description string           `json:"description,omitempty"`
-	Log         bool             `json:"log,omitempty"`
-	Total       int              `json:"total,omitempty"`
-	Page        int              `json:"page,omitempty"`
-	PerPage     int              `json:"per_page,omitempty"`
+	Commits     []Commit `json:"commits,omitempty"`
+	Ref         string   `json:"ref,omitempty"`
+	Description string   `json:"description,omitempty"`
+	Log         bool     `json:"log,omitempty"`
+	Total       int      `json:"total,omitempty"`
+	Page        int      `json:"page,omitempty"`
+	PerPage     int      `json:"per_page,omitempty"`
 }
 
 type RepoCommitResponse struct {