@moritzwilksch/diffle 0.1.6 → 0.1.8

package/dist/server/main.js

@@ -3951,7 +3951,7 @@ function generateCompletion(program, { shell, executable = program.name() }) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.1.6";
+var version$1 = "0.1.8";
 //#endregion
 //#region src/server/comments/anchor.ts
 function splitLines(contents) {
@@ -4369,7 +4369,7 @@ var GitRepo = class GitRepo {
 	}
 	/**
 	* Changed files between two revs, or a rev and the worktree (incl. untracked).
-	* One diff call yields status, line counts and, against a commit, the new-side
+	* One diff call yields status, line counts and, against a commit, each side's
 	* blob; the worktree's blobs are hashed from disk.
 	*/
 	async numstat(oldRev, newRev) {
@@ -4395,6 +4395,7 @@ var GitRepo = class GitRepo {
 				deletions: 0,
 				binary: false,
 				blob: "",
+				oldBlob: "",
 				generated: false
 			};
 			const st = await lstat(resolve(this.root, path)).catch(() => null);
@@ -4411,44 +4412,68 @@ var GitRepo = class GitRepo {
 			return file;
 		});
 		const all = [...files, ...extra].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
-		if (newRev === "worktree") await this.hashWorktree(all.filter((f) => f.status !== "D"));
+		if (newRev === "worktree") {
+			const present = all.filter((f) => f.status !== "D");
+			(await this.hashWorktree(present)).forEach((sha, i) => present[i].blob = sha);
+		}
+		if (reverse) {
+			const present = all.filter((f) => f.status !== "A");
+			const entries = present.map((f) => ({
+				path: f.oldPath ?? f.path,
+				submodule: f.submodule
+			}));
+			(await this.hashWorktree(entries)).forEach((sha, i) => present[i].oldBlob = sha);
+		}
 		return all;
 	}
 	/**
-	* Sets `blob` to what git would store for each worktree entry: the file's
+	* What git would store for each worktree entry, in order: the file's
 	* blob, a symlink's target blob, a submodule's checked-out commit. Regular
 	* files go to one `hash-object --stdin-paths` call; everything else is hashed
 	* on its own, so a gitlink, a broken link or an unreadable path never fails
 	* the batch. A path containing a newline cannot ride the stdin list either.
-	* A path that cannot be hashed keeps an empty blob.
+	* A path that cannot be hashed gets an empty blob.
 	*/
 	async hashWorktree(files) {
+		const shas = files.map(() => "");
 		const regular = [];
-		await mapLimit(files, READ_CONCURRENCY$1, async (f) => {
-			f.blob = "";
-			if (f.submodule) {
-				f.blob = await this.submoduleHead(f.path);
+		await mapLimit([...files.keys()], READ_CONCURRENCY$1, async (i) => {
+			const { path, submodule } = files[i];
+			if (submodule) {
+				shas[i] = await this.submoduleHead(path);
 				return;
 			}
-			const st = await lstat(resolve(this.root, f.path)).catch(() => null);
-			if (st?.isSymbolicLink()) f.blob = blobSha(Buffer.from(await readlink(resolve(this.root, f.path)), "utf8"));
-			else if (st?.isFile()) regular.push(f);
+			const st = await lstat(resolve(this.root, path)).catch(() => null);
+			if (st?.isSymbolicLink()) shas[i] = blobSha(Buffer.from(await readlink(resolve(this.root, path)), "utf8"));
+			else if (st?.isFile()) regular.push(i);
 		});
-		const batch = regular.filter((f) => !f.path.includes("\n"));
-		const single = regular.filter((f) => f.path.includes("\n"));
+		const batch = regular.filter((i) => !files[i].path.includes("\n"));
+		const single = regular.filter((i) => files[i].path.includes("\n"));
 		if (batch.length) try {
-			const shas = (await this.text(["hash-object", "--stdin-paths"], { input: batch.map((f) => f.path).join("\n") + "\n" })).trim().split("\n");
-			batch.forEach((f, i) => f.blob = shas[i] ?? "");
+			const lines = (await this.text(["hash-object", "--stdin-paths"], { input: batch.map((i) => files[i].path).join("\n") + "\n" })).trim().split("\n");
+			batch.forEach((i, j) => shas[i] = lines[j] ?? "");
 		} catch {
 			single.push(...batch);
 		}
-		await mapLimit(single, READ_CONCURRENCY$1, async (f) => {
-			f.blob = await this.text([
+		await mapLimit(single, READ_CONCURRENCY$1, async (i) => {
+			shas[i] = await this.text([
 				"hash-object",
 				"--",
-				f.path
+				files[i].path
 			]).then((s) => s.trim()).catch(() => "");
 		});
+		return shas;
+	}
+	/**
+	* What git would store for `content` at worktree `path`, its clean filters applied: equals the
+	* snapshot's blob for a worktree file whose bytes are still the snapshot's.
+	*/
+	async hashObject(content, path) {
+		return (await this.text([
+			"hash-object",
+			"--stdin",
+			`--path=${path}`
+		], { input: content })).trim();
 	}
 	/** The commit a checked-out submodule is at, or '' if it is not a repository. */
 	async submoduleHead(path) {
@@ -5048,8 +5073,8 @@ function splitZ(buf) {
 * `-z -M --raw --no-abbrev --numstat`: the raw records come first, then the numstat records,
 * each path-terminated by NUL. Raw: ":mode mode sha sha X\0path\0", renames and
 * copies "R100\0old\0new\0". Numstat: "add\tdel\tpath\0", renames "add\tdel\t\0old\0new\0".
-* Binary files count as "-\t-". The dst sha is the new-side blob against a
-* commit; against the worktree it is zeros and the caller hashes the file.
+* Binary files count as "-\t-". The src and dst shas are each side's blob
+* against a commit; against the worktree, or where a side is absent, they are zeros.
 * Mode 160000 on either side marks a gitlink, which no file operation may touch.
 */
 function parseRawNumstat(buf) {
@@ -5057,7 +5082,7 @@ function parseRawNumstat(buf) {
 	const byPath = /* @__PURE__ */ new Map();
 	let i = 0;
 	for (; i < parts.length && parts[i].startsWith(":"); i++) {
-		const [srcMode = "", dstMode = "", , dstSha = "", code = ""] = parts[i].split(" ");
+		const [srcMode = "", dstMode = "", srcSha = "", dstSha = "", code = ""] = parts[i].split(" ");
 		const status = code[0];
 		const oldPath = status === "R" || status === "C" ? parts[++i] : void 0;
 		const path = parts[++i];
@@ -5068,6 +5093,7 @@ function parseRawNumstat(buf) {
 			deletions: 0,
 			binary: false,
 			blob: /^0+$/.test(dstSha) ? "" : dstSha,
+			oldBlob: /^0+$/.test(srcSha) ? "" : srcSha,
 			generated: false
 		};
 		if (oldPath != null) file.oldPath = oldPath;
@@ -5112,460 +5138,1340 @@ function diffRange(oldRev, newRev) {
 	return oldRev === "worktree" ? ["-R", newRev] : newRev === "worktree" ? [oldRev] : [oldRev, newRev];
 }
 //#endregion
-//#region src/server/github.ts
-/** A precondition the user can fix (no gh, no PR, wrong mode, unpushed head): the route answers 4xx. */
-var GithubError = class extends Error {
-	status;
-	constructor(message, status = 409) {
-		super(message);
-		this.status = status;
-	}
+//#region node_modules/universal-user-agent/index.js
+function getUserAgent() {
+	if (typeof navigator === "object" && "userAgent" in navigator) return navigator.userAgent;
+	if (typeof process === "object" && process.version !== void 0) return `Node.js/${process.version.substr(1)} (${process.platform}; ${process.arch})`;
+	return "<environment undetectable>";
+}
+//#endregion
+//#region node_modules/before-after-hook/lib/register.js
+function register(state, name, method, options) {
+	if (typeof method !== "function") throw new Error("method for before hook must be a function");
+	if (!options) options = {};
+	if (Array.isArray(name)) return name.reverse().reduce((callback, name) => {
+		return register.bind(null, state, name, callback, options);
+	}, method)();
+	return Promise.resolve().then(() => {
+		if (!state.registry[name]) return method(options);
+		return state.registry[name].reduce((method, registered) => {
+			return registered.hook.bind(null, method, options);
+		}, method)();
+	});
+}
+//#endregion
+//#region node_modules/before-after-hook/lib/add.js
+function addHook(state, kind, name, hook) {
+	const orig = hook;
+	if (!state.registry[name]) state.registry[name] = [];
+	if (kind === "before") hook = (method, options) => {
+		return Promise.resolve().then(orig.bind(null, options)).then(method.bind(null, options));
+	};
+	if (kind === "after") hook = (method, options) => {
+		let result;
+		return Promise.resolve().then(method.bind(null, options)).then((result_) => {
+			result = result_;
+			return orig(result, options);
+		}).then(() => {
+			return result;
+		});
+	};
+	if (kind === "error") hook = (method, options) => {
+		return Promise.resolve().then(method.bind(null, options)).catch((error) => {
+			return orig(error, options);
+		});
+	};
+	state.registry[name].push({
+		hook,
+		orig
+	});
+}
+//#endregion
+//#region node_modules/before-after-hook/lib/remove.js
+function removeHook(state, name, method) {
+	if (!state.registry[name]) return;
+	const index = state.registry[name].map((registered) => {
+		return registered.orig;
+	}).indexOf(method);
+	if (index === -1) return;
+	state.registry[name].splice(index, 1);
+}
+//#endregion
+//#region node_modules/before-after-hook/index.js
+const bind = Function.bind;
+const bindable = bind.bind(bind);
+function bindApi(hook, state, name) {
+	const removeHookRef = bindable(removeHook, null).apply(null, name ? [state, name] : [state]);
+	hook.api = { remove: removeHookRef };
+	hook.remove = removeHookRef;
+	[
+		"before",
+		"error",
+		"after",
+		"wrap"
+	].forEach((kind) => {
+		const args = name ? [
+			state,
+			kind,
+			name
+		] : [state, kind];
+		hook[kind] = hook.api[kind] = bindable(addHook, null).apply(null, args);
+	});
+}
+function Singular() {
+	const singularHookName = Symbol("Singular");
+	const singularHookState = { registry: {} };
+	const singularHook = register.bind(null, singularHookState, singularHookName);
+	bindApi(singularHook, singularHookState, singularHookName);
+	return singularHook;
+}
+function Collection() {
+	const state = { registry: {} };
+	const hook = register.bind(null, state);
+	bindApi(hook, state);
+	return hook;
+}
+var before_after_hook_default = {
+	Singular,
+	Collection
 };
-function isFileComment(c) {
-	return "subject_type" in c;
+//#endregion
+//#region node_modules/@octokit/endpoint/dist-bundle/index.js
+var DEFAULTS = {
+	method: "GET",
+	baseUrl: "https://api.github.com",
+	headers: {
+		accept: "application/vnd.github.v3+json",
+		"user-agent": `octokit-endpoint.js/0.0.0-development ${getUserAgent()}`
+	},
+	mediaType: { format: "" }
+};
+function lowercaseKeys(object) {
+	if (!object) return {};
+	return Object.keys(object).reduce((newObj, key) => {
+		newObj[key.toLowerCase()] = object[key];
+		return newObj;
+	}, {});
+}
+function isPlainObject$2(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (Object.prototype.toString.call(value) !== "[object Object]") return false;
+	const proto = Object.getPrototypeOf(value);
+	if (proto === null) return true;
+	const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
+	return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
+}
+function mergeDeep(defaults, options) {
+	const result = Object.assign({}, defaults);
+	Object.keys(options).forEach((key) => {
+		if (isPlainObject$2(options[key])) {
+			if (!(key in defaults)) Object.assign(result, { [key]: options[key] });
+			else result[key] = mergeDeep(defaults[key], options[key]);
+		} else Object.assign(result, { [key]: options[key] });
+	});
+	return result;
 }
-/**
-* Threads → the comments of one pending GitHub review, one per thread. Stale threads are skipped:
-* their lines no longer sit in the diff, and GitHub would refuse them anyway. With
-* `threadIds`, only those (resolved included, the user asked for them by hand);
-* without, every unresolved thread. `review.comments` holds the line comments REST can
-* create; the file comments are appended afterwards, but `ids` counts both, in review order.
-*/
-function buildReview(threads, commitId, threadIds) {
-	const skipped = [];
-	let chosen;
-	if (threadIds) {
-		const byId = new Map(threads.map((t) => [t.id, t]));
-		chosen = [];
-		for (const id of threadIds) {
-			const t = byId.get(id);
-			if (t) chosen.push(t);
-			else skipped.push({
-				id,
-				reason: "unknown thread"
+function removeUndefinedProperties(obj) {
+	for (const key in obj) if (obj[key] === void 0) delete obj[key];
+	return obj;
+}
+function merge$1(defaults, route, options) {
+	if (typeof route === "string") {
+		let [method, url] = route.split(" ");
+		options = Object.assign(url ? {
+			method,
+			url
+		} : { url: method }, options);
+	} else options = Object.assign({}, route);
+	options.headers = lowercaseKeys(options.headers);
+	removeUndefinedProperties(options);
+	removeUndefinedProperties(options.headers);
+	const mergedOptions = mergeDeep(defaults || {}, options);
+	if (options.url === "/graphql") {
+		if (defaults && defaults.mediaType.previews?.length) mergedOptions.mediaType.previews = defaults.mediaType.previews.filter((preview) => !mergedOptions.mediaType.previews.includes(preview)).concat(mergedOptions.mediaType.previews);
+		mergedOptions.mediaType.previews = (mergedOptions.mediaType.previews || []).map((preview) => preview.replace(/-preview/, ""));
+	}
+	return mergedOptions;
+}
+function addQueryParameters(url, parameters) {
+	const separator = /\?/.test(url) ? "&" : "?";
+	const names = Object.keys(parameters);
+	if (names.length === 0) return url;
+	return url + separator + names.map((name) => {
+		if (name === "q") return "q=" + parameters.q.split("+").map(encodeURIComponent).join("+");
+		return `${name}=${encodeURIComponent(parameters[name])}`;
+	}).join("&");
+}
+var urlVariableRegex = /\{[^{}}]+\}/g;
+function removeNonChars(variableName) {
+	return variableName.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
+}
+function extractUrlVariableNames(url) {
+	const matches = url.match(urlVariableRegex);
+	if (!matches) return [];
+	return matches.map(removeNonChars).reduce((a, b) => a.concat(b), []);
+}
+function omit$1(object, keysToOmit) {
+	const result = { __proto__: null };
+	for (const key of Object.keys(object)) if (keysToOmit.indexOf(key) === -1) result[key] = object[key];
+	return result;
+}
+function encodeReserved(str) {
+	return str.split(/(%[0-9A-Fa-f]{2})/g).map(function(part) {
+		if (!/%[0-9A-Fa-f]/.test(part)) part = encodeURI(part).replace(/%5B/g, "[").replace(/%5D/g, "]");
+		return part;
+	}).join("");
+}
+function encodeUnreserved(str) {
+	return encodeURIComponent(str).replace(/[!'()*]/g, function(c) {
+		return "%" + c.charCodeAt(0).toString(16).toUpperCase();
+	});
+}
+function encodeValue(operator, value, key) {
+	value = operator === "+" || operator === "#" ? encodeReserved(value) : encodeUnreserved(value);
+	if (key) return encodeUnreserved(key) + "=" + value;
+	else return value;
+}
+function isDefined(value) {
+	return value !== void 0 && value !== null;
+}
+function isKeyOperator(operator) {
+	return operator === ";" || operator === "&" || operator === "?";
+}
+function getValues(context, operator, key, modifier) {
+	var value = context[key], result = [];
+	if (isDefined(value) && value !== "") {
+		if (typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean") {
+			value = value.toString();
+			if (modifier && modifier !== "*") value = value.substring(0, parseInt(modifier, 10));
+			result.push(encodeValue(operator, value, isKeyOperator(operator) ? key : ""));
+		} else if (modifier === "*") {
+			if (Array.isArray(value)) value.filter(isDefined).forEach(function(value2) {
+				result.push(encodeValue(operator, value2, isKeyOperator(operator) ? key : ""));
+			});
+			else Object.keys(value).forEach(function(k) {
+				if (isDefined(value[k])) result.push(encodeValue(operator, value[k], k));
+			});
+		} else {
+			const tmp = [];
+			if (Array.isArray(value)) value.filter(isDefined).forEach(function(value2) {
+				tmp.push(encodeValue(operator, value2));
+			});
+			else Object.keys(value).forEach(function(k) {
+				if (isDefined(value[k])) {
+					tmp.push(encodeUnreserved(k));
+					tmp.push(encodeValue(operator, value[k].toString()));
+				}
 			});
+			if (isKeyOperator(operator)) result.push(encodeUnreserved(key) + "=" + tmp.join(","));
+			else if (tmp.length !== 0) result.push(tmp.join(","));
 		}
-	} else chosen = threads.filter((t) => !t.resolved);
-	const comments = [];
-	const ids = [];
-	for (const t of [...chosen].sort(compareThreads)) {
-		if (t.stale) {
-			skipped.push({
-				id: t.id,
-				reason: "stale"
+	} else if (operator === ";") {
+		if (isDefined(value)) result.push(encodeUnreserved(key));
+	} else if (value === "" && (operator === "&" || operator === "?")) result.push(encodeUnreserved(key) + "=");
+	else if (value === "") result.push("");
+	return result;
+}
+function parseUrl(template) {
+	return { expand: expand.bind(null, template) };
+}
+function expand(template, context) {
+	var operators = [
+		"+",
+		"#",
+		".",
+		"/",
+		";",
+		"?",
+		"&"
+	];
+	template = template.replace(/\{([^\{\}]+)\}|([^\{\}]+)/g, function(_, expression, literal) {
+		if (expression) {
+			let operator = "";
+			const values = [];
+			if (operators.indexOf(expression.charAt(0)) !== -1) {
+				operator = expression.charAt(0);
+				expression = expression.substr(1);
+			}
+			expression.split(/,/g).forEach(function(variable) {
+				var tmp = /([^:\*]*)(?::(\d+)|(\*))?/.exec(variable);
+				values.push(getValues(context, operator, tmp[1], tmp[2] || tmp[3]));
 			});
-			continue;
+			if (operator && operator !== "+") {
+				var separator = ",";
+				if (operator === "?") separator = "&";
+				else if (operator !== "#") separator = operator;
+				return (values.length !== 0 ? operator : "") + values.join(separator);
+			} else return values.join(",");
+		} else return encodeReserved(literal);
+	});
+	if (template === "/") return template;
+	else return template.replace(/\/$/, "");
+}
+function parse$2(options) {
+	let method = options.method.toUpperCase();
+	let url = (options.url || "/").replace(/:([a-z]\w+)/g, "{$1}");
+	let headers = Object.assign({}, options.headers);
+	let body;
+	let parameters = omit$1(options, [
+		"method",
+		"baseUrl",
+		"url",
+		"headers",
+		"request",
+		"mediaType"
+	]);
+	const urlVariableNames = extractUrlVariableNames(url);
+	url = parseUrl(url).expand(parameters);
+	if (!/^http/.test(url)) url = options.baseUrl + url;
+	const remainingParameters = omit$1(parameters, Object.keys(options).filter((option) => urlVariableNames.includes(option)).concat("baseUrl"));
+	if (!/application\/octet-stream/i.test(headers.accept)) {
+		if (options.mediaType.format) headers.accept = headers.accept.split(/,/).map((format) => format.replace(/application\/vnd(\.\w+)(\.v3)?(\.\w+)?(\+json)?$/, `application/vnd$1$2.${options.mediaType.format}`)).join(",");
+		if (url.endsWith("/graphql")) {
+			if (options.mediaType.previews?.length) headers.accept = (headers.accept.match(/(?<![\w-])[\w-]+(?=-preview)/g) || []).concat(options.mediaType.previews).map((preview) => {
+				return `application/vnd.github.${preview}-preview${options.mediaType.format ? `.${options.mediaType.format}` : "+json"}`;
+			}).join(",");
+		}
+	}
+	if (["GET", "HEAD"].includes(method)) url = addQueryParameters(url, remainingParameters);
+	else if ("data" in remainingParameters) body = remainingParameters.data;
+	else if (Object.keys(remainingParameters).length) body = remainingParameters;
+	if (!headers["content-type"] && typeof body !== "undefined") headers["content-type"] = "application/json; charset=utf-8";
+	if (["PATCH", "PUT"].includes(method) && typeof body === "undefined") body = "";
+	return Object.assign({
+		method,
+		url,
+		headers
+	}, typeof body !== "undefined" ? { body } : null, options.request ? { request: options.request } : null);
+}
+function endpointWithDefaults(defaults, route, options) {
+	return parse$2(merge$1(defaults, route, options));
+}
+function withDefaults$2(oldDefaults, newDefaults) {
+	const DEFAULTS2 = merge$1(oldDefaults, newDefaults);
+	const endpoint2 = endpointWithDefaults.bind(null, DEFAULTS2);
+	return Object.assign(endpoint2, {
+		DEFAULTS: DEFAULTS2,
+		defaults: withDefaults$2.bind(null, DEFAULTS2),
+		merge: merge$1.bind(null, DEFAULTS2),
+		parse: parse$2
+	});
+}
+var endpoint = withDefaults$2(null, DEFAULTS);
+//#endregion
+//#region node_modules/content-type/dist/index.js
+/*!
+* content-type
+* Copyright(c) 2015 Douglas Christopher Wilson
+* MIT Licensed
+*/
+const SP = 32;
+const HTAB = 9;
+const SEMI = 59;
+const EQ = 61;
+const DQUOTE = 34;
+const BSLASH = 92;
+const COMMA = 44;
+const LOWER_CASE = 1;
+const OWS = 2;
+const SEMI_FLAG = 4;
+const COMMA_FLAG = 8;
+const TOKEN_FLAG = 16;
+const NON_ASCII = 65280;
+const CASE_FLAGS = 65281;
+/**
+* Character flags used to normalize HTTP field values while scanning.
+* Out-of-range reads intentionally coerce to zero in bitwise expressions.
+*/
+const CHAR_MAP = /* @__PURE__ */ new Uint8Array(256);
+CHAR_MAP[HTAB] |= OWS;
+CHAR_MAP[SP] |= OWS;
+CHAR_MAP[SEMI] |= SEMI_FLAG;
+CHAR_MAP[COMMA] |= COMMA_FLAG;
+for (let code = 128; code <= 255; code++) CHAR_MAP[code] |= LOWER_CASE;
+for (const char of "!#$%&'*+-.^_`|~") CHAR_MAP[char.charCodeAt(0)] |= TOKEN_FLAG;
+for (let code = 48; code <= 57; code++) CHAR_MAP[code] |= TOKEN_FLAG;
+for (let code = 65; code <= 90; code++) CHAR_MAP[code] |= 17;
+for (let code = 97; code <= 122; code++) CHAR_MAP[code] |= TOKEN_FLAG;
+/**
+* Null object perf optimization. Faster than `Object.create(null)` and `{ __proto__: null }`.
+*/
+const NullObject = /* @__PURE__ */ (() => {
+	const C = function() {};
+	C.prototype = Object.create(null);
+	return C;
+})();
+/**
+* Parse a `Content-Type` header.
+*/
+function parse$1(header, options) {
+	const stopFlags = SEMI_FLAG | (options?.comma === true ? COMMA_FLAG : 0);
+	const len = header.length;
+	let valueStart = options?.start ?? 0;
+	while ((CHAR_MAP[header.charCodeAt(valueStart)] & OWS) !== 0) valueStart++;
+	let index = valueStart;
+	let typeFlags = 0;
+	let whitespace = -1;
+	let stop = options?.parameters === false ? COMMA_FLAG : 0;
+	while (index < len) {
+		const code = header.charCodeAt(index);
+		const flags = CHAR_MAP[code];
+		if ((flags & stopFlags) !== 0) {
+			stop |= flags & COMMA_FLAG;
+			break;
+		}
+		if ((flags & OWS) !== 0) {
+			if (whitespace === -1) whitespace = index;
+		} else whitespace = -1;
+		typeFlags |= code & NON_ASCII | flags;
+		index++;
+	}
+	const valueEnd = whitespace === -1 ? index : whitespace;
+	const value = header.slice(valueStart, valueEnd);
+	const type = (typeFlags & CASE_FLAGS) === 0 ? value : value.toLowerCase();
+	if (index === len || stop !== 0) return {
+		type,
+		index,
+		parameters: new NullObject()
+	};
+	return parseParameters(header, type, index, len, stopFlags);
+}
+/**
+* Parses the parameters of a `Content-Type` header starting at the given index.
+*/
+function parseParameters(header, type, index, len, stopFlags) {
+	const parameters = new NullObject();
+	parameter: while (index < len) {
+		index++;
+		while ((CHAR_MAP[header.charCodeAt(index)] & OWS) !== 0) index++;
+		const keyStart = index;
+		let keyFlags = 0;
+		let keyWhitespace = -1;
+		while (index < len) {
+			const code = header.charCodeAt(index);
+			const flags = CHAR_MAP[code];
+			if ((flags & stopFlags) !== 0) {
+				if ((flags & COMMA_FLAG) !== 0) break parameter;
+				continue parameter;
+			}
+			if (code === EQ) {
+				const keyEnd = keyWhitespace === -1 ? index : keyWhitespace;
+				const value = header.slice(keyStart, keyEnd);
+				const key = (keyFlags & CASE_FLAGS) === 0 ? value : value.toLowerCase();
+				index++;
+				while ((CHAR_MAP[header.charCodeAt(index)] & OWS) !== 0) index++;
+				if (index < len && header.charCodeAt(index) === DQUOTE) {
+					const quotedStart = ++index;
+					let escaped = false;
+					while (index < len) {
+						const code = header.charCodeAt(index);
+						if (code === DQUOTE) {
+							if (parameters[key] === void 0) parameters[key] = escaped ? unescapeQuotedPairs(header, quotedStart, index) : header.slice(quotedStart, index);
+							index++;
+							let stop = 0;
+							while (index < len) {
+								const code = header.charCodeAt(index);
+								const flags = CHAR_MAP[code];
+								if ((flags & stopFlags) !== 0) {
+									stop = flags & COMMA_FLAG;
+									break;
+								}
+								index++;
+							}
+							if (stop !== 0) break parameter;
+							continue parameter;
+						}
+						if (code === BSLASH && index + 1 < len) {
+							escaped = true;
+							index += 2;
+							continue;
+						}
+						index++;
+					}
+					continue parameter;
+				}
+				const valueStart = index;
+				let stop = 0;
+				let valueWhitespace = -1;
+				while (index < len) {
+					const code = header.charCodeAt(index);
+					const flags = CHAR_MAP[code];
+					if ((flags & stopFlags) !== 0) {
+						stop = flags & COMMA_FLAG;
+						break;
+					}
+					if ((flags & OWS) !== 0) {
+						if (valueWhitespace === -1) valueWhitespace = index;
+					} else valueWhitespace = -1;
+					index++;
+				}
+				if (parameters[key] === void 0) {
+					const valueEnd = valueWhitespace === -1 ? index : valueWhitespace;
+					parameters[key] = header.slice(valueStart, valueEnd);
+				}
+				if (stop !== 0) break parameter;
+				continue parameter;
+			}
+			if ((flags & OWS) !== 0) {
+				if (keyWhitespace === -1) keyWhitespace = index;
+			} else keyWhitespace = -1;
+			keyFlags |= code & NON_ASCII | flags;
+			index++;
 		}
-		comments.push(toReviewComment(t));
-		ids.push(t.id);
 	}
 	return {
-		review: {
-			commit_id: commitId,
-			comments: comments.filter((c) => !isFileComment(c))
-		},
-		comments,
-		ids,
-		skipped
+		type,
+		index,
+		parameters
 	};
 }
-function toReviewComment(t) {
-	const { anchor } = t;
-	const body = formatBody(t.messages);
-	if (anchor.kind === "file") return {
-		path: anchor.path,
-		subject_type: "file",
-		body
-	};
-	const side = anchor.side === "old" ? "LEFT" : "RIGHT";
-	const c = {
-		path: anchor.path,
-		line: anchor.endLine,
-		side,
-		body
-	};
-	if (anchor.startLine !== anchor.endLine) {
-		c.start_line = anchor.startLine;
-		c.start_side = side;
+/**
+* Remove backslashes from quoted pairs in a known-terminated quoted string body.
+*/
+function unescapeQuotedPairs(str, start, end) {
+	let result = "";
+	for (let index = start; index < end; index++) if (str.charCodeAt(index) === BSLASH) {
+		result += str.slice(start, index);
+		start = ++index;
 	}
-	return c;
+	return result + str.slice(start, end);
 }
+//#endregion
+//#region node_modules/json-with-bigint/json-with-bigint.js
+const intRegex = /^-?\d+$/;
+const noiseValue = /^-?\d+n+$/;
+const originalStringify = JSON.stringify;
+const originalParse = JSON.parse;
+const customFormat = /^-?\d+n$/;
+const bigIntsStringify = /([\[:])?"(-?\d+)n"($|\s*[,\}\]])/g;
+const noiseStringify = /([\[:])?("-?\d+n+)n("$|"\s*[,\}\]])/g;
 /**
-* Messages joined as markdown. GitHub renders ```suggestion fences itself, so bodies
-* stay verbatim.
+* @typedef {(this: any, key: string | number | undefined, value: any) => any} Replacer
+* @typedef {(key: string | number | undefined, value: any, context?: { source: string }) => any} Reviver
 */
-function formatBody(messages) {
-	return messages.map((m) => m.body.trim()).join("\n\n---\n\n");
-}
-/** The base repository the pull request lives in, taken from its url (a fork's own remote is not it). */
-function repoOfPrUrl(url) {
-	const m = /^\/([^/]+)\/([^/]+)\/pull\/\d+/.exec(new URL(url).pathname);
-	if (!m) throw new GithubError(`cannot read owner/repo from the pull request url: ${url}`, 502);
-	return {
-		owner: m[1],
-		repo: m[2]
+/**
+* Checks if a value is unstringifiable according to native JSON.stringify rules.
+*
+* @param {any} val The value to check.
+* @returns {boolean} True if the value is undefined, a function, or a symbol.
+*/
+const isUnstringifiable = (val) => val === void 0 || typeof val === "function" || typeof val === "symbol";
+/**
+* Checks if a value is a native JSON.rawJSON object (Node.js 22+).
+*
+* @param {any} val The value to check.
+* @returns {boolean} True if the value is a RawJSON instance.
+*/
+const isRawJSON = (val) => val !== null && typeof val === "object" && val.constructor && val.constructor.name === "RawJSON";
+/**
+* Iteratively converts a JS value to a JSON string.
+* Used as a fallback when the native JSON.stringify hits the Maximum Call Stack size.
+* Fully compliant with JSON formatting (space), replacers, and toJSON behaviors.
+*
+* @param {any} rootValue The value to stringify.
+* @param {Replacer | Array<string | number> | null} [replacer] User's custom replacer function.
+* @param {string | number} [spaceParam] Indentation for pretty-printing.
+* @returns {string | undefined} The generated JSON string.
+*/
+const stringifyIteratively = (rootValue, replacer, spaceParam) => {
+	let space = "";
+	if (typeof spaceParam === "number") space = " ".repeat(Math.min(10, Math.max(0, Math.floor(spaceParam))));
+	else if (typeof spaceParam === "string") space = spaceParam.slice(0, 10);
+	const isFunctionReplacer = typeof replacer === "function";
+	const propertyList = Array.isArray(replacer) ? new Set(replacer.map(String)) : null;
+	/**
+	* Prepares a value for stringification by resolving toJSON, handling BigInts,
+	* applying custom replacers, and unwrapping primitive objects.
+	*
+	* @param {object|Array} parent The parent object or array holding the value.
+	* @param {string} key The key associated with the value.
+	* @param {any} val The raw value to process.
+	* @returns {any} The processed value ready for stringification.
+	*/
+	const prepareVal = (parent, key, val) => {
+		if (val !== null && typeof val === "object" && typeof val.toJSON === "function") val = val.toJSON(key);
+		if (typeof val === "string" && noiseValue.test(val)) return val + "n";
+		if (typeof val === "bigint") {
+			if ("rawJSON" in JSON) return JSON.rawJSON(val.toString());
+			return val.toString() + "n";
+		}
+		if (isFunctionReplacer) val = replacer.call(parent, key, val);
+		if (val !== null && typeof val === "object") {
+			if (val instanceof Number || val instanceof String || val instanceof Boolean) val = val.valueOf();
+		}
+		return val;
 	};
-}
-/** Serializes validation and writes so overlapping exports cannot add the same thread twice. */
-var GithubExporter = class {
-	queue = Promise.resolve();
-	export(prepare) {
-		const result = this.queue.then(async () => exportToGithub(await prepare()));
-		this.queue = result.catch(() => {});
-		return result;
+	const rootProcessed = prepareVal({ "": rootValue }, "", rootValue);
+	if (isUnstringifiable(rootProcessed)) return;
+	const isRootPrimitive = rootProcessed === null || typeof rootProcessed !== "object";
+	const isRootNativeRawJSON = isRawJSON(rootProcessed);
+	if (isRootPrimitive || isRootNativeRawJSON) return originalStringify(rootProcessed);
+	const chunks = [];
+	let level = 0;
+	const stack = [{
+		parent: { "": rootProcessed },
+		key: "",
+		val: rootProcessed,
+		isArray: Array.isArray(rootProcessed),
+		keys: Array.isArray(rootProcessed) ? null : Object.keys(rootProcessed),
+		index: 0,
+		first: true
+	}];
+	const visited = new WeakSet([rootProcessed]);
+	while (stack.length > 0) {
+		const node = stack[stack.length - 1];
+		if (node.index === 0) {
+			chunks.push(node.isArray ? "[" : "{");
+			level++;
+		}
+		let isDone = false;
+		if (node.isArray) {
+			if (node.index < node.val.length) {
+				if (!node.first) chunks.push(",");
+				if (space) chunks.push("\n" + space.repeat(level));
+				const childRaw = node.val[node.index];
+				const childVal = prepareVal(node.val, String(node.index), childRaw);
+				if (isUnstringifiable(childVal)) {
+					chunks.push("null");
+					node.first = false;
+					node.index++;
+				} else {
+					const isComplexObject = childVal !== null && typeof childVal === "object";
+					const isNativeRaw = isRawJSON(childVal);
+					if (isComplexObject && !isNativeRaw) {
+						if (visited.has(childVal)) throw new TypeError("Converting circular structure to JSON");
+						visited.add(childVal);
+						stack.push({
+							parent: node.val,
+							key: String(node.index),
+							val: childVal,
+							isArray: Array.isArray(childVal),
+							keys: Array.isArray(childVal) ? null : Object.keys(childVal),
+							index: 0,
+							first: true
+						});
+						node.first = false;
+						node.index++;
+					} else {
+						chunks.push(originalStringify(childVal));
+						node.first = false;
+						node.index++;
+					}
+				}
+			} else isDone = true;
+		} else {
+			while (node.index < node.keys.length) {
+				const k = node.keys[node.index++];
+				if (propertyList && !propertyList.has(k)) continue;
+				const childRaw = node.val[k];
+				const childVal = prepareVal(node.val, k, childRaw);
+				if (isUnstringifiable(childVal)) continue;
+				if (!node.first) chunks.push(",");
+				if (space) chunks.push("\n" + space.repeat(level) + originalStringify(k) + ": ");
+				else chunks.push(originalStringify(k) + ":");
+				const isComplexObject = childVal !== null && typeof childVal === "object";
+				const isNativeRaw = isRawJSON(childVal);
+				if (isComplexObject && !isNativeRaw) {
+					if (visited.has(childVal)) throw new TypeError("Converting circular structure to JSON");
+					visited.add(childVal);
+					stack.push({
+						parent: node.val,
+						key: k,
+						val: childVal,
+						isArray: Array.isArray(childVal),
+						keys: Array.isArray(childVal) ? null : Object.keys(childVal),
+						index: 0,
+						first: true
+					});
+					node.first = false;
+					break;
+				} else {
+					chunks.push(originalStringify(childVal));
+					node.first = false;
+				}
+			}
+			if (node.index >= node.keys.length && stack[stack.length - 1] === node) isDone = true;
+		}
+		if (isDone) {
+			level--;
+			if (!node.first && space) chunks.push("\n" + space.repeat(level));
+			chunks.push(node.isArray ? "]" : "}");
+			visited.delete(node.val);
+			stack.pop();
+		}
 	}
+	return chunks.join("");
 };
 /**
-* Adds the threads to a *pending* review on the active PR, creating the pending review
-* when there is none. The review is never submitted: the human opens the PR and submits
-* it themselves. The caller validates the comparison inside the export queue before posting.
+* Converts a JavaScript value to a JSON string.
 *
-* Re-exporting matches a hidden thread ID and its anchor in the pending review.
-* A matching comment is left alone when its body matches and rewritten when it does not, so
-* editing a thread and exporting again does not stack a second comment on the line. Comments
-* of an already-submitted review are out of reach — those would have to be replied to.
+* Supports serialization of BigInt values using two strategies:
+* 1. Custom format "123n" → "123" (universal fallback)
+* 2. Native JSON.rawJSON() (Node.js 22+, fastest) when available
+*
+* All other values are serialized exactly like native JSON.stringify().
+*
+* @param {*} value The value to convert to a JSON string.
+* @param {Replacer | Array<string | number> | null} [replacer]
+* A function that alters the behavior of the stringification process,
+* or an array of strings/numbers to indicate properties to exclude.
+* @param {string | number} [space]
+* A string or number to specify indentation or pretty-printing.
+* @returns {string} The JSON string representation.
 */
-async function exportToGithub({ snap, pullRequest: pr, threads, threadIds, run = runGh }) {
-	if (snap.newSha === "worktree") throw new GithubError("GitHub cannot anchor comments to the worktree");
-	const { review, comments, ids, skipped } = buildReview(threads, snap.newSha, threadIds);
-	if (comments.length === 0) throw new GithubError(skipped.length ? `nothing to post: ${describe(skipped)}` : "nothing to post", 400);
-	for (const [i, comment] of comments.entries()) comment.body += `\n\n${threadMarker(ids[i])}`;
-	const pending = await findPendingReview(run, snap.root, pr);
-	if (!pending) {
-		const created = await createPendingReview(run, snap.root, pr.repository, pr.number, review);
-		let appended = 0;
-		try {
-			for (const c of comments.filter(isFileComment)) {
-				await addToPendingReview(run, snap.root, created.id, c);
-				appended++;
-			}
-		} catch (e) {
-			const detail = e instanceof Error ? e.message : String(e);
-			throw new GithubError(`created the pending review with ${review.comments.length + appended} comments, then ${detail}`, 502);
+const JSONStringify = (value, replacer, space) => {
+	try {
+		if ("rawJSON" in JSON) return originalStringify(value, (key, val) => {
+			if (typeof val === "bigint") return JSON.rawJSON(val.toString());
+			if (typeof replacer === "function") return replacer(key, val);
+			if (Array.isArray(replacer) && replacer.includes(key)) return val;
+			return val;
+		}, space);
+		if (!value) return originalStringify(value, replacer, space);
+		return originalStringify(value, (key, val) => {
+			if (typeof val === "string" && noiseValue.test(val)) return val.toString() + "n";
+			if (typeof val === "bigint") return val.toString() + "n";
+			if (typeof replacer === "function") return replacer(key, val);
+			if (Array.isArray(replacer) && replacer.includes(key)) return val;
+			return val;
+		}, space).replace(bigIntsStringify, "$1$2$3").replace(noiseStringify, "$1$2$3");
+	} catch (error) {
+		if (error instanceof RangeError) {
+			const convertedJSON = stringifyIteratively(value, replacer, space);
+			if (convertedJSON === void 0) return void 0;
+			if ("rawJSON" in JSON) return convertedJSON;
+			return convertedJSON.replace(bigIntsStringify, "$1$2$3").replace(noiseStringify, "$1$2$3");
 		}
-		return {
-			url: pr.url,
-			posted: comments.length,
-			updated: 0,
-			review: "created",
-			skipped
-		};
+		throw error;
 	}
-	const existing = await pendingComments(run, snap.root, pr, pending.id);
-	const add = [];
-	let updated = 0;
-	let posted = 0;
+};
+const featureCache = /* @__PURE__ */ new Map();
+/**
+* Detects if the current JSON.parse implementation supports the context.source feature.
+*
+* Uses toString() fingerprinting to cache results and automatically detect runtime
+* replacements of JSON.parse (polyfills, mocks, etc.).
+*
+* @returns {boolean} true if context.source is supported, false otherwise.
+*/
+const isContextSourceSupported = () => {
+	const parseFingerprint = JSON.parse.toString();
+	if (featureCache.has(parseFingerprint)) return featureCache.get(parseFingerprint);
 	try {
-		for (const [i, c] of comments.entries()) {
-			const id = ids[i];
-			const at = existing.get(anchorKey(c));
-			const index = at?.findIndex((comment) => comment.body.trimEnd().endsWith(threadMarker(id))) ?? -1;
-			const hit = index < 0 ? void 0 : at.splice(index, 1)[0];
-			if (!hit) {
-				add.push(c);
-				continue;
-			}
-			if (hit.body.trim() === c.body.trim()) {
-				skipped.push({
-					id,
-					reason: "already in the review"
-				});
-				continue;
-			}
-			await graphql(run, snap.root, UPDATE_COMMENT, { input: {
-				pullRequestReviewCommentId: hit.nodeId,
-				body: c.body
-			} });
-			updated++;
-		}
-		for (const c of add) {
-			await addToPendingReview(run, snap.root, pending.id, c);
-			posted++;
-		}
-	} catch (e) {
-		if (updated === 0 && posted === 0) throw e;
-		const detail = e instanceof Error ? e.message : String(e);
-		throw new GithubError(`updated ${updated} and added ${posted} comments in the pending review, then ${detail}`, 502);
+		const result = JSON.parse("1", (_, __, context) => !!context?.source && context.source === "1");
+		featureCache.set(parseFingerprint, result);
+		return result;
+	} catch {
+		featureCache.set(parseFingerprint, false);
+		return false;
 	}
-	return {
-		url: pr.url,
-		posted,
-		updated,
-		review: "existing",
-		skipped
-	};
-}
-function threadMarker(id) {
-	return `<!-- diffle-thread:${encodeURIComponent(id)} -->`;
-}
-/** The anchor must still match before we rewrite an exported thread. */
-function anchorKey(c) {
-	if (isFileComment(c)) return [c.path, "FILE"].join("\0");
-	return [
-		c.path,
-		c.side,
-		c.start_line ?? c.line,
-		c.line
-	].join("\0");
-}
-const PENDING_QUERY = `query($owner:String!,$repo:String!,$number:Int!){
-  viewer{login}
-  repository(owner:$owner,name:$repo){pullRequest(number:$number){reviews(last:20,states:[PENDING]){nodes{id author{login}}}}}
-}`;
+};
 /**
-* The viewer's own pending review on the PR, or null. GitHub hides other people's pending
-* reviews, and the login check makes sure of it: appending to someone else's draft would
-* put our comments in their review.
+* Reviver function that converts custom-format BigInt strings back to BigInt values.
+* Also handles "noise" strings that accidentally match the BigInt format.
+*
+* @param {string | number | undefined} key The object key.
+* @param {*} value The value being parsed.
+* @param {object} [context] Parse context (if supported by JSON.parse).
+* @param {Reviver} [userReviver] User's custom reviver function.
+* @returns {any} The transformed value.
 */
-async function findPendingReview(run, cwd, pr) {
-	const { owner, repo } = repoOfPrUrl(pr.url);
-	const data = await graphql(run, cwd, PENDING_QUERY, {
-		owner,
-		repo,
-		number: pr.number
+const convertMarkedBigIntsReviver = (key, value, context, userReviver) => {
+	if (typeof value === "string" && customFormat.test(value)) return BigInt(value.slice(0, -1));
+	if (typeof value === "string" && noiseValue.test(value)) return value.slice(0, -1);
+	if (!(typeof userReviver === "function")) return value;
+	return userReviver(key, value, context);
+};
+/**
+* Fast JSON.parse implementation (~2x faster than classic fallback).
+* Uses JSON.parse's context.source feature to detect integers and convert
+* large numbers directly to BigInt without string manipulation.
+*
+* Does not support legacy custom format from v1 of this library.
+*
+* @param {string} text JSON string to parse.
+* @param {Reviver} [reviver] Transform function to apply to each value.
+* @returns {any} Parsed JavaScript value.
+*/
+const JSONParseV2 = (text, reviver) => {
+	return JSON.parse(text, (key, value, context) => {
+		const isNumber = typeof value === "number";
+		const isOutOfBounds = value > Number.MAX_SAFE_INTEGER || value < Number.MIN_SAFE_INTEGER;
+		const isBigNumber = isNumber && isOutOfBounds;
+		const isInt = context && intRegex.test(context.source);
+		if (isBigNumber && isInt) return BigInt(context.source);
+		if (!(typeof reviver === "function")) return value;
+		return reviver(key, value, context);
 	});
-	const login = data.viewer?.login;
-	for (const node of data.repository?.pullRequest?.reviews?.nodes ?? []) if (node?.id && node.author?.login === login) return { id: node.id };
-	return null;
-}
-const THREADS_QUERY = `query($owner:String!,$repo:String!,$number:Int!,$after:String){
-  repository(owner:$owner,name:$repo){pullRequest(number:$number){reviewThreads(first:100,after:$after){
-    pageInfo{hasNextPage endCursor}
-    nodes{path line startLine diffSide subjectType comments(first:1){nodes{id body pullRequestReview{id}}}}
-  }}}
-}`;
+};
+const MAX_INT = Number.MAX_SAFE_INTEGER.toString();
+const MAX_DIGITS = MAX_INT.length;
+const stringsOrLargeNumbers = /"(?:[^"\\]|\\.)*"|-?(0|[1-9][0-9]*)(\.[0-9]+)?([eE][+-]?[0-9]+)?/g;
+const noiseValueWithQuotes = /^"-?\d+n+"$/;
 /**
-* The pending review's own comments, by anchor. It has to be `reviewThreads`: it is the only view
-* that reports a *pending* comment's real position — REST's review-comment list leaves `line`,
-* `side` and `start_line` null for one, and the GraphQL comment type has no side field at all.
-* A failed or incomplete lookup aborts the export: absence is safe to infer only from a complete read.
+* Iteratively traverses the parsed object bottom-up (post-order),
+* emulating the native JSON.parse reviver behavior.
+* This avoids Call Stack overflows (RangeError) on deeply nested structures.
+*
+* @param {any} parsed The natively parsed JSON object.
+* @param {Reviver} [userReviver] User's custom reviver function.
+* @returns {any} The fully processed object.
 */
-async function pendingComments(run, cwd, pr, reviewId) {
-	const by = /* @__PURE__ */ new Map();
-	const { owner, repo } = repoOfPrUrl(pr.url);
-	let after = null;
-	for (let page = 0; page < 10; page++) {
-		const threads = (await graphql(run, cwd, THREADS_QUERY, {
-			owner,
-			repo,
-			number: pr.number,
-			after
-		})).repository?.pullRequest?.reviewThreads;
-		if (!threads?.nodes || typeof threads.pageInfo?.hasNextPage !== "boolean") throw new GithubError("cannot read the complete pending review", 502);
-		for (const t of threads.nodes) {
-			const c = t?.comments?.nodes?.[0];
-			if (!t?.path || !c?.id || c.pullRequestReview?.id !== reviewId) continue;
-			const key = pendingKey(t);
-			if (key == null) continue;
-			const at = by.get(key);
-			if (at) at.push({
-				nodeId: c.id,
-				body: c.body ?? ""
-			});
-			else by.set(key, [{
-				nodeId: c.id,
-				body: c.body ?? ""
-			}]);
+const applyReviverIteratively = (parsed, userReviver) => {
+	const rootHolder = { "": parsed };
+	const stack = [{
+		parent: rootHolder,
+		key: "",
+		visited: false
+	}];
+	while (stack.length > 0) {
+		const node = stack[stack.length - 1];
+		if (!node.visited) {
+			node.visited = true;
+			const value = node.parent[node.key];
+			if (value !== null && typeof value === "object") {
+				const keys = Object.keys(value);
+				for (let i = keys.length - 1; i >= 0; i--) stack.push({
+					parent: value,
+					key: keys[i],
+					visited: false
+				});
+			}
+		} else {
+			const { parent, key } = node;
+			let value = parent[key];
+			if (typeof value === "string") {
+				if (customFormat.test(value)) value = BigInt(value.slice(0, -1));
+				else if (noiseValue.test(value)) value = value.slice(0, -1);
+			}
+			if (typeof userReviver === "function") value = userReviver.call(parent, key, value);
+			if (value === void 0) delete parent[key];
+			else parent[key] = value;
+			stack.pop();
 		}
-		if (!threads.pageInfo.hasNextPage) return by;
-		if (!threads.pageInfo.endCursor || threads.pageInfo.endCursor === after) throw new GithubError("cannot read the next page of the pending review", 502);
-		after = threads.pageInfo.endCursor;
 	}
-	throw new GithubError("pending review exceeds the 1000-thread lookup limit; export stopped without changes", 502);
-}
-/** The anchor key of a thread already in the review, or null for one GitHub reports without a position. */
-function pendingKey(t) {
-	const path = t.path;
-	if (t.subjectType === "FILE") return anchorKey({
-		path,
-		subject_type: "file",
-		body: ""
-	});
-	if (t.line == null) return null;
-	return anchorKey({
-		path,
-		side: t.diffSide === "LEFT" ? "LEFT" : "RIGHT",
-		line: t.line,
-		start_line: t.startLine ?? void 0,
-		body: ""
-	});
-}
-const UPDATE_COMMENT = `mutation($input:UpdatePullRequestReviewCommentInput!){updatePullRequestReviewComment(input:$input){pullRequestReviewComment{id}}}`;
+	return rootHolder[""];
+};
 /**
-* No `event` in the body, so GitHub keeps the new review pending with all of its comments.
-* Resolves the review's node id, for the comments REST cannot carry.
+* Pre-processes the JSON string to mark large numbers with an 'n' suffix.
+*
+* @param {string} text The raw JSON string.
+* @returns {string} The serialized string with marked BigInts.
 */
-async function createPendingReview(run, cwd, repository, number, review) {
-	const out = await run([
-		"api",
-		"--method",
-		"POST",
-		`repos/${repository}/pulls/${number}/reviews`,
-		"--input",
-		"-"
-	], {
-		cwd,
-		input: JSON.stringify(review)
+const serializeBigInts = (text) => {
+	return text.replace(stringsOrLargeNumbers, (match, digits, fractional, exponential) => {
+		const isString = match[0] === "\"";
+		if (isString && noiseValueWithQuotes.test(match)) return match.substring(0, match.length - 1) + "n\"";
+		const hasFractionalOrExponential = fractional || exponential;
+		const isLessThanMaxSafeInt = digits && (digits.length < MAX_DIGITS || digits.length === MAX_DIGITS && digits <= MAX_INT);
+		if (isString || hasFractionalOrExponential || isLessThanMaxSafeInt) return match;
+		return "\"" + match + "n\"";
 	});
-	let id;
+};
+/**
+* Converts a JSON string into a JavaScript value.
+*
+* Supports parsing of large integers using two strategies:
+* 1. Classic fallback: Marks large numbers with "123n" format, then converts to BigInt
+* 2. Fast path (JSONParseV2): Uses context.source feature (~2x faster) when available
+*
+* All other JSON values are parsed exactly like native JSON.parse().
+*
+* @param {string} text A valid JSON string.
+* @param {Reviver} [reviver]
+* A function that transforms the results. This function is called for each member
+* of the object. If a member contains nested objects, the nested objects are
+* transformed before the parent object is.
+* @returns {any} The parsed JavaScript value.
+* @throws {SyntaxError} If text is not valid JSON.
+*/
+const JSONParse = (text, reviver) => {
+	if (!text) return originalParse(text, reviver);
 	try {
-		id = JSON.parse(out).node_id;
-	} catch {
-		throw new GithubError(`unexpected output from gh api: ${out.slice(0, 200)}`, 502);
+		if (isContextSourceSupported()) return JSONParseV2(text, reviver);
+		const serializedData = serializeBigInts(text);
+		return originalParse(serializedData, (key, value, context) => convertMarkedBigIntsReviver(key, value, context, reviver));
+	} catch (error) {
+		if (error instanceof RangeError) {
+			const serializedData = serializeBigInts(text);
+			const parsed = originalParse(serializedData);
+			return applyReviverIteratively(parsed, reviver);
+		}
+		throw error;
 	}
-	if (typeof id !== "string") throw new GithubError(`unexpected output from gh api: ${out.slice(0, 200)}`, 502);
-	return { id };
+};
+//#endregion
+//#region node_modules/@octokit/request-error/dist-src/index.js
+var RequestError$1 = class extends Error {
+	name;
+	/**
+	* http status code
+	*/
+	status;
+	/**
+	* Request options that lead to the error.
+	*/
+	request;
+	/**
+	* Response object if a response was received
+	*/
+	response;
+	constructor(message, statusCode, options) {
+		super(message, { cause: options.cause });
+		this.name = "HttpError";
+		this.status = Number.parseInt(statusCode);
+		if (Number.isNaN(this.status)) this.status = 0;
+		/* v8 ignore else -- @preserve -- Bug with vitest coverage where it sees an else branch that doesn't exist */
+		if ("response" in options) this.response = options.response;
+		const requestCopy = Object.assign({}, options.request);
+		if (options.request.headers.authorization) requestCopy.headers = Object.assign({}, options.request.headers, { authorization: options.request.headers.authorization.replace(/(?<! ) .*$/, " [REDACTED]") });
+		requestCopy.url = requestCopy.url.replace(/\bclient_secret=\w+/g, "client_secret=[REDACTED]").replace(/\baccess_token=\w+/g, "access_token=[REDACTED]");
+		this.request = requestCopy;
+	}
+};
+//#endregion
+//#region node_modules/@octokit/request/dist-bundle/index.js
+var defaults_default = { headers: { "user-agent": `octokit-request.js/10.0.16 ${getUserAgent()}` } };
+function isPlainObject$1(value) {
+	if (typeof value !== "object" || value === null) return false;
+	if (Object.prototype.toString.call(value) !== "[object Object]") return false;
+	const proto = Object.getPrototypeOf(value);
+	if (proto === null) return true;
+	const Ctor = Object.prototype.hasOwnProperty.call(proto, "constructor") && proto.constructor;
+	return typeof Ctor === "function" && Ctor instanceof Ctor && Function.prototype.call(Ctor) === Function.prototype.call(value);
+}
+var noop$1 = () => "";
+async function fetchWrapper(requestOptions) {
+	const fetch = requestOptions.request?.fetch || globalThis.fetch;
+	if (!fetch) throw new Error("fetch is not set. Please pass a fetch implementation as new Octokit({ request: { fetch }}). Learn more at https://github.com/octokit/octokit.js/#fetch-missing");
+	const log = requestOptions.request?.log || console;
+	const parseSuccessResponseBody = requestOptions.request?.parseSuccessResponseBody !== false;
+	const body = isPlainObject$1(requestOptions.body) || Array.isArray(requestOptions.body) ? JSONStringify(requestOptions.body) : requestOptions.body;
+	const requestHeaders = Object.fromEntries(Object.entries(requestOptions.headers).map(([name, value]) => [name, String(value)]));
+	let fetchResponse;
+	try {
+		fetchResponse = await fetch(requestOptions.url, {
+			method: requestOptions.method,
+			body,
+			redirect: requestOptions.request?.redirect,
+			headers: requestHeaders,
+			signal: requestOptions.request?.signal,
+			...requestOptions.body && { duplex: "half" }
+		});
+	} catch (error) {
+		let message = "Unknown Error";
+		if (error instanceof Error) {
+			if (error.name === "AbortError") {
+				error.status = 500;
+				throw error;
+			}
+			message = error.message;
+			if (error.name === "TypeError" && "cause" in error) {
+				if (error.cause instanceof Error) message = error.cause.message;
+				else if (typeof error.cause === "string") message = error.cause;
+			}
+		}
+		const requestError = new RequestError$1(message, 500, { request: requestOptions });
+		requestError.cause = error;
+		throw requestError;
+	}
+	const status = fetchResponse.status;
+	const url = fetchResponse.url;
+	const responseHeaders = {};
+	for (const [key, value] of fetchResponse.headers) responseHeaders[key] = value;
+	const octokitResponse = {
+		url,
+		status,
+		headers: responseHeaders,
+		data: ""
+	};
+	if ("deprecation" in responseHeaders) {
+		const matches = responseHeaders.link && responseHeaders.link.match(/<([^<>]+)>; rel="deprecation"/);
+		const deprecationLink = matches && matches.pop();
+		log.warn(`[@octokit/request] "${requestOptions.method} ${requestOptions.url}" is deprecated. It is scheduled to be removed on ${responseHeaders.sunset}${deprecationLink ? `. See ${deprecationLink}` : ""}`);
+	}
+	if (status === 204 || status === 205) return octokitResponse;
+	if (requestOptions.method === "HEAD") {
+		if (status < 400) return octokitResponse;
+		throw new RequestError$1(fetchResponse.statusText, status, {
+			response: octokitResponse,
+			request: requestOptions
+		});
+	}
+	if (status === 304) {
+		octokitResponse.data = await getResponseData(fetchResponse);
+		throw new RequestError$1("Not modified", status, {
+			response: octokitResponse,
+			request: requestOptions
+		});
+	}
+	if (status >= 400) {
+		octokitResponse.data = await getResponseData(fetchResponse);
+		throw new RequestError$1(toErrorMessage(octokitResponse.data), status, {
+			response: octokitResponse,
+			request: requestOptions
+		});
+	}
+	octokitResponse.data = parseSuccessResponseBody ? await getResponseData(fetchResponse) : fetchResponse.body;
+	return octokitResponse;
 }
-const ADD_THREAD = `mutation($input:AddPullRequestReviewThreadInput!){addPullRequestReviewThread(input:$input){thread{id}}}`;
-/** Appends one thread through GraphQL; REST cannot extend a pending review, nor place a file comment. */
-async function addToPendingReview(run, cwd, reviewId, c) {
-	const input = {
-		pullRequestReviewId: reviewId,
-		path: c.path,
-		body: c.body
+async function getResponseData(response) {
+	const contentType = response.headers.get("content-type");
+	if (!contentType) return response.text().catch(noop$1);
+	const mimetype = parse$1(contentType);
+	if (isJSONResponse(mimetype)) {
+		let text = "";
+		try {
+			text = await response.text();
+			return JSONParse(text);
+		} catch (err) {
+			return text;
+		}
+	} else if (mimetype.type.startsWith("text/") || mimetype.parameters.charset?.toLowerCase() === "utf-8" && mimetype.type !== "application/octet-stream") return response.text().catch(noop$1);
+	else return response.arrayBuffer().catch(
+		/* v8 ignore next -- @preserve */
+		() => /* @__PURE__ */ new ArrayBuffer(0)
+	);
+}
+function isJSONResponse(mimetype) {
+	return mimetype.type === "application/json" || mimetype.type === "application/scim+json";
+}
+function toErrorMessage(data) {
+	if (typeof data === "string") return data;
+	if (data instanceof ArrayBuffer) return "Unknown error";
+	if (typeof data === "object" && data !== null && "message" in data) {
+		const objectData = data;
+		const suffix = "documentation_url" in objectData ? ` - ${objectData.documentation_url}` : "";
+		return Array.isArray(objectData.errors) ? `${objectData.message}: ${objectData.errors.map((v) => JSON.stringify(v)).join(", ")}${suffix}` : `${objectData.message}${suffix}`;
+	}
+	return `Unknown error: ${JSON.stringify(data)}`;
+}
+function withDefaults$1(oldEndpoint, newDefaults) {
+	const endpoint2 = oldEndpoint.defaults(newDefaults);
+	const newApi = function(route, parameters) {
+		const endpointOptions = endpoint2.merge(route, parameters);
+		if (!endpointOptions.request || !endpointOptions.request.hook) return fetchWrapper(endpoint2.parse(endpointOptions));
+		const request2 = (route2, parameters2) => {
+			return fetchWrapper(endpoint2.parse(endpoint2.merge(route2, parameters2)));
+		};
+		Object.assign(request2, {
+			endpoint: endpoint2,
+			defaults: withDefaults$1.bind(null, endpoint2)
+		});
+		return endpointOptions.request.hook(request2, endpointOptions);
 	};
-	if (isFileComment(c)) input.subjectType = "FILE";
-	else {
-		input.line = c.line;
-		input.side = c.side;
-		if (c.start_line != null) {
-			input.startLine = c.start_line;
-			input.startSide = c.start_side;
-		}
-	}
-	await graphql(run, cwd, ADD_THREAD, { input });
-}
-/** Runs a GraphQL document through `gh api graphql` and returns its `data`. */
-async function graphql(run, cwd, query, variables) {
-	const out = await run([
-		"api",
-		"graphql",
-		"--input",
-		"-"
-	], {
-		cwd,
-		input: JSON.stringify({
-			query,
-			variables
-		})
+	return Object.assign(newApi, {
+		endpoint: endpoint2,
+		defaults: withDefaults$1.bind(null, endpoint2)
 	});
-	let body;
-	try {
-		body = JSON.parse(out);
-	} catch {
-		throw new GithubError(`unexpected output from gh api graphql: ${out.slice(0, 200)}`, 502);
-	}
-	if (body.data == null) throw new GithubError(`unexpected output from gh api graphql: ${out.slice(0, 200)}`, 502);
-	return body.data;
 }
-function describe(skipped) {
-	const counts = /* @__PURE__ */ new Map();
-	for (const s of skipped) counts.set(s.reason, (counts.get(s.reason) ?? 0) + 1);
-	return [...counts].map(([reason, n]) => `${n} ${reason}`).join(", ");
+var request = withDefaults$1(endpoint, defaults_default);
+/* v8 ignore next -- @preserve */
+/* v8 ignore else -- @preserve */
+//#endregion
+//#region node_modules/@octokit/graphql/dist-bundle/index.js
+var VERSION$1 = "0.0.0-development";
+function _buildMessageForResponseErrors(data) {
+	return `Request failed due to following response errors:
+` + data.errors.map((e) => ` - ${e.message}`).join("\n");
+}
+var GraphqlResponseError = class extends Error {
+	constructor(request2, headers, response) {
+		super(_buildMessageForResponseErrors(response));
+		this.request = request2;
+		this.headers = headers;
+		this.response = response;
+		this.errors = response.errors;
+		this.data = response.data;
+		if (Error.captureStackTrace) Error.captureStackTrace(this, this.constructor);
+	}
+	request;
+	headers;
+	response;
+	name = "GraphqlResponseError";
+	errors;
+	data;
+};
+var NON_VARIABLE_OPTIONS = [
+	"method",
+	"baseUrl",
+	"url",
+	"headers",
+	"request",
+	"query",
+	"mediaType",
+	"operationName"
+];
+var FORBIDDEN_VARIABLE_OPTIONS = [
+	"query",
+	"method",
+	"url"
+];
+var GHES_V3_SUFFIX_REGEX = /\/api\/v3\/?$/;
+function graphql(request2, query, options) {
+	if (options) {
+		if (typeof query === "string" && "query" in options) return Promise.reject(/* @__PURE__ */ new Error(`[@octokit/graphql] "query" cannot be used as variable name`));
+		for (const key in options) {
+			if (!FORBIDDEN_VARIABLE_OPTIONS.includes(key)) continue;
+			return Promise.reject(/* @__PURE__ */ new Error(`[@octokit/graphql] "${key}" cannot be used as variable name`));
+		}
+	}
+	const parsedOptions = typeof query === "string" ? Object.assign({ query }, options) : query;
+	const requestOptions = Object.keys(parsedOptions).reduce((result, key) => {
+		if (NON_VARIABLE_OPTIONS.includes(key)) {
+			result[key] = parsedOptions[key];
+			return result;
+		}
+		if (!result.variables) result.variables = {};
+		result.variables[key] = parsedOptions[key];
+		return result;
+	}, {});
+	const baseUrl = parsedOptions.baseUrl || request2.endpoint.DEFAULTS.baseUrl;
+	if (GHES_V3_SUFFIX_REGEX.test(baseUrl)) requestOptions.url = baseUrl.replace(GHES_V3_SUFFIX_REGEX, "/api/graphql");
+	return request2(requestOptions).then((response) => {
+		if (response.data.errors) {
+			const headers = {};
+			for (const key of Object.keys(response.headers)) headers[key] = response.headers[key];
+			throw new GraphqlResponseError(requestOptions, headers, response.data);
+		}
+		return response.data.data;
+	});
 }
-/** Spawns the local `gh`. A missing binary or a failing command becomes a GithubError carrying gh's own message. */
-const runGh = (args, { cwd, input, timeoutMs }) => new Promise((resolve, reject) => {
-	const child = execFile("gh", args, {
-		cwd,
-		maxBuffer: 16777216,
-		timeout: timeoutMs
-	}, (err, stdout, stderr) => {
-		if (!err) return resolve(stdout);
-		if (err.code === "ENOENT") return reject(new GithubError("gh is not installed; see https://cli.github.com"));
-		const detail = (stderr || err.message).trim().split("\n")[0] ?? "";
-		reject(new GithubError(`gh ${args[0]} ${args[1] ?? ""} failed: ${detail}`.trim(), args[0] === "api" ? 502 : 409));
+function withDefaults(request2, newDefaults) {
+	const newRequest = request2.defaults(newDefaults);
+	const newApi = (query, options) => {
+		return graphql(newRequest, query, options);
+	};
+	return Object.assign(newApi, {
+		defaults: withDefaults.bind(null, newRequest),
+		endpoint: newRequest.endpoint
 	});
-	if (input != null) child.stdin?.end(input);
-	else child.stdin?.end();
+}
+withDefaults(request, {
+	headers: { "user-agent": `octokit-graphql.js/${VERSION$1} ${getUserAgent()}` },
+	method: "POST",
+	url: "/graphql"
 });
-const PR_FIELDS = "number,url,title,state,isDraft,baseRefOid,baseRefName,headRefName,headRefOid,headRepository,headRepositoryOwner";
+function withCustomRequest(customRequest) {
+	return withDefaults(customRequest, {
+		method: "POST",
+		url: "/graphql"
+	});
+}
+/* v8 ignore if -- @preserve */
+//#endregion
+//#region node_modules/@octokit/auth-token/dist-bundle/index.js
+var b64url = "(?:[a-zA-Z0-9_-]+)";
+var sep$1 = "\\.";
+var jwtRE = new RegExp(`^${b64url}${sep$1}${b64url}${sep$1}${b64url}$`);
+var isJWT = jwtRE.test.bind(jwtRE);
+async function auth(token) {
+	const isApp = isJWT(token);
+	const isInstallation = token.startsWith("v1.") || token.startsWith("ghs_");
+	const isUserToServer = token.startsWith("ghu_");
+	return {
+		type: "token",
+		token,
+		tokenType: isApp ? "app" : isInstallation ? "installation" : isUserToServer ? "user-to-server" : "oauth"
+	};
+}
+function withAuthorizationPrefix(token) {
+	if (token.split(/\./).length === 3) return `bearer ${token}`;
+	return `token ${token}`;
+}
+async function hook(token, request, route, parameters) {
+	const endpoint = request.endpoint.merge(route, parameters);
+	endpoint.headers.authorization = withAuthorizationPrefix(token);
+	return request(endpoint);
+}
+var createTokenAuth = function createTokenAuth2(token) {
+	if (!token) throw new Error("[@octokit/auth-token] No token passed to createTokenAuth");
+	if (typeof token !== "string") throw new Error("[@octokit/auth-token] Token passed to createTokenAuth is not a string");
+	token = token.replace(/^(token|bearer) +/i, "");
+	return Object.assign(auth.bind(null, token), { hook: hook.bind(null, token) });
+};
+//#endregion
+//#region node_modules/@octokit/core/dist-src/version.js
+const VERSION = "7.0.8";
+//#endregion
+//#region node_modules/@octokit/core/dist-src/index.js
+const noop = () => {};
+const consoleWarn = console.warn.bind(console);
+const consoleError = console.error.bind(console);
+function createLogger(logger = {}) {
+	if (typeof logger.debug !== "function") logger.debug = noop;
+	if (typeof logger.info !== "function") logger.info = noop;
+	if (typeof logger.warn !== "function") logger.warn = consoleWarn;
+	if (typeof logger.error !== "function") logger.error = consoleError;
+	return logger;
+}
+const userAgentTrail = `octokit-core.js/${VERSION} ${getUserAgent()}`;
+var Octokit = class {
+	static VERSION = VERSION;
+	static defaults(defaults) {
+		const OctokitWithDefaults = class extends this {
+			constructor(...args) {
+				const options = args[0] || {};
+				if (typeof defaults === "function") {
+					super(defaults(options));
+					return;
+				}
+				super(Object.assign({}, defaults, options, options.userAgent && defaults.userAgent ? { userAgent: `${options.userAgent} ${defaults.userAgent}` } : null));
+			}
+		};
+		return OctokitWithDefaults;
+	}
+	static plugins = [];
+	/**
+	* Attach a plugin (or many) to your Octokit instance.
+	*
+	* @example
+	* const API = Octokit.plugin(plugin1, plugin2, plugin3, ...)
+	*/
+	static plugin(...newPlugins) {
+		const currentPlugins = this.plugins;
+		const NewOctokit = class extends this {
+			static plugins = currentPlugins.concat(newPlugins.filter((plugin) => !currentPlugins.includes(plugin)));
+		};
+		return NewOctokit;
+	}
+	constructor(options = {}) {
+		const hook = new before_after_hook_default.Collection();
+		const requestDefaults = {
+			baseUrl: request.endpoint.DEFAULTS.baseUrl,
+			headers: {},
+			request: Object.assign({}, options.request, { hook: hook.bind(null, "request") }),
+			mediaType: {
+				previews: [],
+				format: ""
+			}
+		};
+		requestDefaults.headers["user-agent"] = options.userAgent ? `${options.userAgent} ${userAgentTrail}` : userAgentTrail;
+		if (options.baseUrl) requestDefaults.baseUrl = options.baseUrl;
+		if (options.previews) requestDefaults.mediaType.previews = options.previews;
+		if (options.timeZone) requestDefaults.headers["time-zone"] = options.timeZone;
+		this.request = request.defaults(requestDefaults);
+		this.graphql = withCustomRequest(this.request).defaults(requestDefaults);
+		this.log = createLogger(options.log);
+		this.hook = hook;
+		if (!options.authStrategy) {
+			if (!options.auth) this.auth = async () => ({ type: "unauthenticated" });
+			else {
+				const auth = createTokenAuth(options.auth);
+				hook.wrap("request", auth.hook);
+				this.auth = auth;
+			}
+		} else {
+			const { authStrategy, ...otherOptions } = options;
+			const auth = authStrategy(Object.assign({
+				request: this.request,
+				log: this.log,
+				octokit: this,
+				octokitOptions: otherOptions
+			}, options.auth));
+			hook.wrap("request", auth.hook);
+			this.auth = auth;
+		}
+		const classConstructor = this.constructor;
+		for (let i = 0; i < classConstructor.plugins.length; ++i) Object.assign(this, classConstructor.plugins[i](this, options));
+	}
+	request;
+	graphql;
+	log;
+	hook;
+	auth;
+};
+//#endregion
+//#region src/server/github/client.ts
+/** A precondition the user can fix (no token, no PR, wrong mode, unpushed head): the route answers 4xx. */
+var GithubError = class extends Error {
+	status;
+	constructor(message, status = 409) {
+		super(message);
+		this.status = status;
+	}
+};
+/** Said wherever a GitHub feature is asked for without a token. */
+const NO_TOKEN = "No GitHub token: set GITHUB_TOKEN or sign in with gh auth login";
 /**
-* `gh pr view` for a PR named by number, `#number`, URL or branch. Without a
-* selector, the PR of the checked-out branch. Option-shaped selectors are
-* refused so a stray flag never reaches gh.
+* `GITHUB_TOKEN`, then `GH_TOKEN`, then the token `gh` holds. Null when none of them has
+* one: diffle then runs without GitHub, the origin repository still shows and everything
+* else says why it is off.
 */
-async function viewPr(selector, cwd, run = runGh, timeoutMs) {
-	return parsePullRequest(parseJson(await run([
-		"pr",
-		"view",
-		...selector == null ? [] : [normalizeSelector(selector)],
-		"--json",
-		PR_FIELDS
-	], {
-		cwd,
-		timeoutMs
-	}), "view"));
-}
-/** Open pull requests whose head is the named branch in the named remote repository. */
-async function listPrsForHead(baseRepo, base, head, headRepo, cwd, run = runGh, timeoutMs) {
-	const out = await run([
-		"pr",
-		"list",
-		"--repo",
-		baseRepo,
-		"--base",
-		base,
-		"--head",
-		head,
-		"--state",
-		"open",
-		"--limit",
-		"100",
-		"--json",
-		PR_FIELDS
-	], {
-		cwd,
-		timeoutMs
-	});
-	const values = parseJson(out, "list");
-	if (!Array.isArray(values)) throw new GithubError(`unexpected output from gh pr list: ${out.slice(0, 200)}`, 502);
-	return values.flatMap((value) => {
-		const candidate = value;
-		const owner = candidate?.headRepositoryOwner?.login;
-		const name = candidate?.headRepository?.name;
-		if (typeof owner !== "string" || typeof name !== "string") throw new GithubError(`unexpected output from gh pr list: ${out.slice(0, 200)}`, 502);
-		if (`${owner}/${name}`.toLowerCase() !== headRepo.toLowerCase()) return [];
-		return [parsePullRequest(value)];
+async function resolveToken(env = process.env, ghToken = ghAuthToken) {
+	for (const source of ["GITHUB_TOKEN", "GH_TOKEN"]) {
+		const token = env[source]?.trim();
+		if (token) return {
+			token,
+			source
+		};
+	}
+	const token = await ghToken();
+	return token ? {
+		token,
+		source: "gh auth token"
+	} : null;
+}
+/** The only `gh` left: its stored token, or null when gh is missing, signed out, or slow. */
+function ghAuthToken() {
+	return new Promise((resolve) => {
+		execFile("gh", ["auth", "token"], {
+			timeout: 5e3,
+			windowsHide: true
+		}, (err, stdout) => {
+			const token = stdout?.trim();
+			resolve(!err && token ? token : null);
+		});
 	});
 }
-function normalizeSelector(selector) {
-	const s = selector.trim();
-	if (s.startsWith("-")) throw new GithubError(`not a pull request: ${selector}`, 400);
-	const num = /^#?(\d+)$/.exec(s);
-	return num ? num[1] : s;
-}
-function parseJson(out, command) {
-	try {
-		return JSON.parse(out);
-	} catch {
-		throw new GithubError(`unexpected output from gh pr ${command}: ${out.slice(0, 200)}`, 502);
-	}
+/** The real client, over `@octokit/core`. */
+function createGithubClient(token, { baseUrl, fetch: customFetch } = {}) {
+	const octokit = new Octokit({
+		auth: token,
+		baseUrl: baseUrl || process.env.GITHUB_API_URL || void 0,
+		userAgent: `diffle/${version$1}`,
+		request: customFetch ? { fetch: customFetch } : {}
+	});
+	return { async graphql(query, variables, opts = {}) {
+		const request = opts.timeoutMs ? { signal: AbortSignal.timeout(opts.timeoutMs) } : void 0;
+		try {
+			return await octokit.graphql(query, {
+				...variables,
+				request
+			});
+		} catch (e) {
+			throw toGithubError(e, opts.timeoutMs);
+		}
+	} };
 }
-function parsePullRequest(value) {
-	const pr = value;
-	if (!(pr != null && typeof pr.title === "string" && [
-		"OPEN",
-		"CLOSED",
-		"MERGED"
-	].includes(pr.state ?? "") && typeof pr.isDraft === "boolean" && typeof pr.baseRefOid === "string" && typeof pr.number === "number" && typeof pr.url === "string" && typeof pr.baseRefName === "string" && typeof pr.headRefName === "string" && typeof pr.headRefOid === "string")) throw new GithubError("unexpected pull request data from gh", 502);
-	const slug = /^https?:\/\/[^/]+\/([^/]+\/[^/]+)\/pull\/\d+/.exec(pr.url);
-	if (!slug) throw new GithubError(`cannot read the repository from the pull request url: ${pr.url}`, 502);
-	const source = value;
-	const owner = source.headRepositoryOwner?.login;
-	const name = source.headRepository?.name;
-	return {
-		headRepository: typeof owner === "string" && typeof name === "string" ? `${owner}/${name}` : null,
-		number: pr.number,
-		url: pr.url,
-		title: pr.title,
-		state: pr.state,
-		isDraft: pr.isDraft,
-		repository: slug[1],
-		baseRefOid: pr.baseRefOid,
-		baseRefName: pr.baseRefName,
-		headRefName: pr.headRefName,
-		headRefOid: pr.headRefOid
-	};
+/**
+* GitHub's answer, as a `GithubError`. Something the user can fix (a rejected token, a missing
+* pull request) is 409; GitHub refusing the content (422) or not answering at all is 502.
+*/
+function toGithubError(e, timeoutMs) {
+	if (e instanceof GithubError) return e;
+	const err = e;
+	if (err?.name === "GraphqlResponseError" && Array.isArray(err.errors) && err.errors.length) {
+		const detail = err.errors.map((x) => x.message ?? "unknown error").join("; ");
+		const fixable = err.errors.every((x) => x.type === "NOT_FOUND" || x.type === "FORBIDDEN");
+		return new GithubError(`GitHub: ${detail}`, fixable ? 409 : 502);
+	}
+	if (err?.name === "HttpError" && typeof err.status === "number") {
+		const detail = firstLine(err.message);
+		if (err.response === void 0) {
+			const cause = err.cause?.name;
+			if (cause === "TimeoutError" || cause === "AbortError") return new GithubError(`GitHub did not answer within ${timeoutMs ?? "?"}ms`, 502);
+			return new GithubError(`cannot reach GitHub: ${detail}`, 502);
+		}
+		if (err.status === 401) return new GithubError(`GitHub rejected the token (401): ${detail}`, 409);
+		if (err.status === 403 || err.status === 404) return new GithubError(`GitHub ${err.status}: ${detail}`, 409);
+		return new GithubError(`GitHub ${err.status}: ${detail}`, 502);
+	}
+	if (err?.name === "TimeoutError" || err?.name === "AbortError") return new GithubError(`GitHub did not answer within ${timeoutMs ?? "?"}ms`, 502);
+	return new GithubError(`cannot reach GitHub: ${e instanceof Error ? firstLine(e.message) : String(e)}`, 502);
+}
+function firstLine(s) {
+	return (s ?? "").trim().split("\n")[0] ?? "";
 }
 //#endregion
 //#region node_modules/zod/v4/core/util.js
@@ -11255,6 +12161,8 @@ const ChangedFileSchema = object({
 	binary: boolean(),
 	/** New-side blob sha. '' for deletions. Keys the viewed state. */
 	blob: string(),
+	/** Old-side blob sha. '' for additions. A worktree side's blob, like `blob`, is '' when the file cannot be hashed. */
+	oldBlob: string(),
 	/** The `linguist-generated` gitattribute, a path pattern or a content sniff said this file is generated. Feeds auto-collapse and risk ranking. */
 	generated: boolean(),
 	/** A gitlink (mode 160000): `blob` is the recorded commit, the patch shows the commit-id change, and there is no file to open. */
@@ -11618,6 +12526,21 @@ const FileQuerySchema = object({
 	path: string().min(1),
 	rev: SideSchema
 });
+/**
+* `GET /api/image`: one side of a file as image bytes. The server answers 404 unless `key` is that side's
+* `imageKey` in its current snapshot, the bytes are still the ones the key names, and they are a raster image.
+*/
+const ImageQuerySchema = FileQuerySchema.extend({ key: string().min(1) });
+/**
+* Names the bytes of one side of `path`, or null when the side has no name: a changed file's blob on that
+* side, else the commit of a side that is one, since an unchanged path is alike on both. What a key names
+* never changes, so an image served under it may be cached for good.
+*/
+function imageKey(snap, path, side) {
+	const file = snap.changed.find((f) => f.path === path);
+	if (file) return (side === "new" ? file.blob : file.oldBlob) || null;
+	return [snap.newSha, snap.oldSha].find((rev) => rev !== "worktree") ?? null;
+}
 const offsetSchema = string().regex(/^[0-9]+$/).transform(Number).pipe(number().int().nonnegative());
 const LastCommitsQuerySchema = object({
 	oldOffset: offsetSchema,
@@ -15886,7 +16809,7 @@ const LOOPBACK = /* @__PURE__ */ new Set([
 	"::1",
 	"localhost"
 ]);
-const HINT = "if a reverse proxy sent it, trust that origin with --allowed-origin";
+const UNCONFIGURED = "if a reverse proxy sent it, trust that origin with --allowed-origin";
 /**
 * Restricts API and WebSocket requests to local hosts and the configured public origin.
 * Proxies may preserve the public Host or rewrite it to an allowed upstream Host.
@@ -15900,15 +16823,16 @@ function requestGuard(bindHost, names = ownNames(), allowedOrigin) {
 		...names.map((n) => n.toLowerCase())
 	]);
 	const publicHost = allowedOrigin == null ? void 0 : new URL(allowedOrigin).host;
+	const hint = allowedOrigin == null ? UNCONFIGURED : `allowed origin is "${allowedOrigin}"`;
 	return ({ host, origin }) => {
 		if (!host) return "missing Host header";
 		const name = hostnameOf(host).toLowerCase();
 		const localHost = loopback ? LOOPBACK.has(name) : isIP(name) !== 0 || allowed.has(name);
 		const proxyHost = publicHost != null && host.toLowerCase() === publicHost;
-		if (!localHost && !proxyHost) return `forbidden Host "${host}"; ${HINT}`;
+		if (!localHost && !proxyHost) return `forbidden Host "${host}"; ${hint}`;
 		if (origin == null || allowedOrigin != null && origin === allowedOrigin) return null;
 		if (!proxyHost && parseHost(origin) === host) return null;
-		return `forbidden Origin "${origin}" for Host "${host}"; ${HINT}`;
+		return `forbidden Origin "${origin}" for Host "${host}"; ${hint}`;
 	};
 }
 /** The host of a syntactically valid origin; undefined for `null` and other non-URLs. */
@@ -16405,6 +17329,67 @@ function migrateV1(v1) {
 	};
 }
 //#endregion
+//#region src/server/image.ts
+/** Leading bytes of the raster formats browsers display; `null` matches any byte. */
+const SIGNATURES = [
+	["image/png", [
+		137,
+		80,
+		78,
+		71,
+		13,
+		10,
+		26,
+		10
+	]],
+	["image/jpeg", [
+		255,
+		216,
+		255
+	]],
+	["image/gif", ascii("GIF8")],
+	["image/webp", [
+		...ascii("RIFF"),
+		null,
+		null,
+		null,
+		null,
+		...ascii("WEBP")
+	]],
+	["image/avif", [
+		null,
+		null,
+		null,
+		null,
+		...ascii("ftypavif")
+	]],
+	["image/avif", [
+		null,
+		null,
+		null,
+		null,
+		...ascii("ftypavis")
+	]],
+	["image/bmp", ascii("BM")],
+	["image/x-icon", [
+		0,
+		0,
+		1,
+		0
+	]]
+];
+function ascii(s) {
+	return [...s].map((ch) => ch.charCodeAt(0));
+}
+/**
+* The media type of a raster image, read from its leading bytes; null for anything else. The
+* extension is not consulted: only bytes that are an image get served as one.
+*/
+function imageType(buf) {
+	for (const [type, magic] of SIGNATURES) if (buf.length >= magic.length && magic.every((b, i) => b == null || buf[i] === b)) return type;
+	return null;
+}
+//#endregion
 //#region src/server/routes.ts
 /** Invalid JSON is a request error; failures after parsing still propagate. */
 async function readJson(c) {
@@ -16470,6 +17455,18 @@ function createApi(deps) {
 		};
 		return c.json(body);
 	});
+	app.get("/api/image", async (c) => {
+		const { path, rev, key } = ImageQuerySchema.parse(c.req.query());
+		const buf = await session.readImage(await session.snapshotter.current(), path, rev, key);
+		const type = buf && imageType(buf);
+		if (!type) return c.json({ error: "no image under that key" }, 404);
+		return c.body(new Uint8Array(buf), 200, {
+			"content-type": type,
+			"cache-control": "private, max-age=31536000, immutable",
+			"x-content-type-options": "nosniff",
+			"cross-origin-resource-policy": "same-origin"
+		});
+	});
 	app.get("/api/search", async (c) => {
 		const query = SearchQuerySchema.parse(c.req.query());
 		const { q, scope } = query;
@@ -16775,99 +17772,529 @@ var Server = class {
 				hasErrorLogged: () => false,
 				hasWarned: false
 			}
-		});
-		this.vite = vite;
+		});
+		this.vite = vite;
+	}
+	async close() {
+		await this.deps.hub.close();
+		await this.vite?.close().catch(() => {});
+		await new Promise((res) => {
+			if (!this.http) return res();
+			this.http.close(() => res());
+			this.http.closeAllConnections();
+		});
+	}
+};
+function projectRoot() {
+	return join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+}
+function resolveClientDir() {
+	return join(projectRoot(), "dist", "client");
+}
+function hasClientBuild() {
+	return existsSync(join(resolveClientDir(), "index.html"));
+}
+//#endregion
+//#region src/server/github/pulls.ts
+/** GitHub.com identity from a configured HTTPS, SSH, or scp-style remote URL. */
+function githubRepository(url) {
+	const match = /^(?:https?:\/\/github\.com\/|ssh:\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/|(?:[^/@]+@)?github\.com:)([^/]+)\/([^/]+?)\/?$/i.exec(url);
+	return match ? `${match[1]}/${match[2].replace(/\.git$/i, "")}` : null;
+}
+/** Local-only origin identity; works without a token or a network connection. */
+async function originRepository(repo) {
+	const origin = (await repo.remotes()).find((r) => r.name === "origin");
+	return origin ? githubRepository(origin.url) : null;
+}
+/**
+* The GitHub repository pull requests are looked up in: `origin`, or the only GitHub remote
+* when origin is not one. Any other layout has to name the pull request by url.
+*/
+async function baseRepository(repo) {
+	if (!repo) throw new GithubError("not in a git repository; name the pull request by url", 400);
+	const remotes = (await repo.remotes()).flatMap((r) => {
+		const repository = githubRepository(r.url);
+		return repository ? [{
+			name: r.name,
+			repository
+		}] : [];
+	});
+	const base = remotes.find((r) => r.name === "origin") ?? (remotes.length === 1 ? remotes[0] : void 0);
+	if (!base) throw new GithubError(`${remotes.length ? `${remotes.length} GitHub remotes and no origin` : "no GitHub remote"}; name the pull request by url`, 400);
+	return base.repository;
+}
+/** The base repository the pull request lives in, taken from its url (a fork's own remote is not it). */
+function repoOfPrUrl(url) {
+	const parsed = parsePrUrl(url);
+	if (!parsed) throw new GithubError(`cannot read owner/repo from the pull request url: ${url}`, 502);
+	return {
+		owner: parsed.owner,
+		repo: parsed.repo
+	};
+}
+function parsePrUrl(url) {
+	let pathname;
+	try {
+		pathname = new URL(url).pathname;
+	} catch {
+		return null;
+	}
+	const m = /^\/([^/]+)\/([^/]+)\/pull\/(\d+)(?:\/|$)/.exec(pathname);
+	return m ? {
+		owner: m[1],
+		repo: m[2],
+		number: Number(m[3])
+	} : null;
+}
+const PR_FIELDS = "number url title state isDraft baseRefOid baseRefName headRefName headRefOid headRepository{name owner{login}}";
+const BY_NUMBER = `query($owner:String!,$repo:String!,$number:Int!){
+  repository(owner:$owner,name:$repo){pullRequest(number:$number){${PR_FIELDS}}}
+}`;
+const BY_HEAD = `query($owner:String!,$repo:String!,$head:String!,$base:String){
+  repository(owner:$owner,name:$repo){pullRequests(headRefName:$head,baseRefName:$base,states:[OPEN],first:100){nodes{${PR_FIELDS}}}}
+}`;
+/**
+* The pull request a selector names: a number, `#number`, a URL, a branch (`owner:branch`
+* for a fork's), or, without one, the checked-out branch's. Everything but a URL is
+* looked up in the base repository (see `baseRepository`). Option-shaped selectors are refused.
+*/
+async function viewPr(selector, repo, github, timeoutMs) {
+	if (selector == null) {
+		if (!repo) throw new GithubError("not in a git repository; name the pull request by url", 400);
+		const ref = await repo.branchRef("HEAD");
+		if (!ref?.startsWith("refs/heads/")) throw new GithubError("HEAD is not on a branch; name the pull request by number or url", 400);
+		const upstream = await repo.upstreamBranch("HEAD");
+		const remotes = await repo.remotes();
+		const remoteUrl = upstream && remotes.find((r) => r.name === upstream.remote)?.url;
+		const headRepo = remoteUrl ? githubRepository(remoteUrl) : null;
+		return byHead(github, await baseRepository(repo), upstream?.branch ?? ref.slice(11), {
+			owner: headRepo?.split("/")[0],
+			timeoutMs
+		});
+	}
+	const s = selector.trim();
+	if (s.startsWith("-")) throw new GithubError(`not a pull request: ${selector}`, 400);
+	const url = /^https?:\/\//.test(s) ? parsePrUrl(s) : null;
+	if (url) return byNumber(github, `${url.owner}/${url.repo}`, url.number, timeoutMs);
+	if (/^https?:\/\//.test(s)) throw new GithubError(`not a pull request url: ${selector}`, 400);
+	const num = /^#?(\d+)$/.exec(s);
+	if (num) return byNumber(github, await baseRepository(repo), Number(num[1]), timeoutMs);
+	const colon = s.indexOf(":");
+	const owner = colon > 0 ? s.slice(0, colon) : void 0;
+	return byHead(github, await baseRepository(repo), colon > 0 ? s.slice(colon + 1) : s, {
+		owner,
+		timeoutMs
+	});
+}
+async function byNumber(github, repository, number, timeoutMs) {
+	const [owner, repo] = repository.split("/");
+	const data = await github.graphql(BY_NUMBER, {
+		owner,
+		repo,
+		number
+	}, { timeoutMs });
+	if (!data.repository?.pullRequest) throw new GithubError(`no pull request ${repository}#${number}`, 409);
+	return parsePullRequest(data.repository.pullRequest);
+}
+async function byHead(github, baseRepo, head, { owner, timeoutMs }) {
+	const label = owner ? `${owner}:${head}` : head;
+	const prs = (await pullRequestsForHead(github, baseRepo, head, void 0, timeoutMs)).filter((pr) => !owner || pr.headRepository?.split("/")[0]?.toLowerCase() === owner.toLowerCase());
+	if (prs.length === 0) throw new GithubError(`no open pull request in ${baseRepo} for ${label}`, 409);
+	if (prs.length > 1) throw new GithubError(`${prs.length} open pull requests in ${baseRepo} for ${label}; open one by number`, 409);
+	return prs[0];
+}
+/** Open pull requests of `baseRepo` whose head is the named branch, from any head repository, into `base` if given. */
+async function pullRequestsForHead(github, baseRepo, head, base, timeoutMs) {
+	const [owner, repo] = baseRepo.split("/");
+	const nodes = (await github.graphql(BY_HEAD, {
+		owner,
+		repo,
+		head,
+		base: base ?? null
+	}, { timeoutMs })).repository?.pullRequests?.nodes;
+	if (!Array.isArray(nodes)) throw new GithubError("unexpected pull request data from GitHub", 502);
+	return nodes.map(parsePullRequest);
+}
+const PullRequestNodeSchema = GithubPullRequestSchema.omit({ repository: true }).extend({
+	baseRefOid: string(),
+	baseRefName: string(),
+	headRefName: string(),
+	headRefOid: string(),
+	headRepository: object({
+		name: string(),
+		owner: object({ login: string() })
+	}).nullable().transform((source) => source ? `${source.owner.login}/${source.name}` : null)
+});
+function parsePullRequest(value) {
+	const result = PullRequestNodeSchema.safeParse(value);
+	if (!result.success) throw new GithubError("unexpected pull request data from GitHub", 502);
+	const pr = result.data;
+	const slug = /^https?:\/\/[^/]+\/([^/]+\/[^/]+)\/pull\/\d+/.exec(pr.url);
+	if (!slug) throw new GithubError(`cannot read the repository from the pull request url: ${pr.url}`, 502);
+	return {
+		...pr,
+		repository: slug[1]
+	};
+}
+//#endregion
+//#region src/server/GithubMetadata.ts
+const LOOKUP_TIMEOUT_MS = 5e3;
+/**
+* Enriches a comparison without fetching commits, changing its endpoints, or changing comment
+* storage. Without a client (no token), only the origin repository is known.
+*/
+async function discoverGithub(repo, snap, { github, prUrl } = {}) {
+	const repository = await originRepository(repo);
+	const absent = (reason) => ({
+		version: snap.version,
+		repository,
+		pullRequest: null,
+		reason
+	});
+	if (!github) return absent(NO_TOKEN);
+	try {
+		let pr;
+		if (prUrl) pr = await viewPr(prUrl, repo, github, LOOKUP_TIMEOUT_MS);
+		else {
+			const [old, next, remotes] = await Promise.all([
+				repo.upstreamBranch(snap.mode.old),
+				repo.upstreamBranch(snap.mode.new),
+				repo.remotes()
+			]);
+			if (!old || !next) return absent("No branch with an upstream available for both endpoints");
+			const repository = (remote) => {
+				const url = remotes.find((r) => r.name === remote)?.url;
+				return url ? githubRepository(url) : null;
+			};
+			const baseRepo = repository(old.remote);
+			const headRepo = repository(next.remote);
+			if (!baseRepo || !headRepo) return absent("Both branches must have GitHub remotes");
+			const prs = (await pullRequestsForHead(github, baseRepo, next.branch, old.branch, LOOKUP_TIMEOUT_MS)).filter((pr) => pr.headRepository?.toLowerCase() === headRepo.toLowerCase());
+			if (!prs.length) return absent("No matching pull request");
+			if (prs.length !== 1) return absent("Multiple matching pull requests; open one explicitly");
+			pr = prs[0];
+		}
+		let reason = null;
+		if (pr.state !== "OPEN") reason = "The pull request is not open";
+		else if (snap.oldSha === "worktree" || snap.newSha === "worktree") reason = "GitHub cannot anchor comments to the worktree";
+		else if (snap.newSha !== pr.headRefOid) reason = "The comparison does not end at the pull request head";
+		else try {
+			if (snap.oldSha !== await repo.mergeBase(pr.baseRefOid, pr.headRefOid)) reason = "The comparison does not match the pull request diff";
+		} catch (e) {
+			if (!(e instanceof GitError)) throw e;
+			reason = "Fetch the pull request base to verify its diff";
+		}
+		return {
+			version: snap.version,
+			repository,
+			pullRequest: {
+				repository: pr.repository,
+				number: pr.number,
+				url: pr.url,
+				title: pr.title,
+				state: pr.state,
+				isDraft: pr.isDraft
+			},
+			reason
+		};
+	} catch (error) {
+		if (!(error instanceof GithubError)) throw error;
+		return absent(`Lookup failed: ${error.message}`);
+	}
+}
+//#endregion
+//#region src/server/github/review.ts
+function isFileComment(c) {
+	return "subjectType" in c;
+}
+/**
+* Threads → the comments of one pending GitHub review, one per thread. Stale threads are skipped:
+* their lines no longer sit in the diff, and GitHub would refuse them anyway. With
+* `threadIds`, only those (resolved included, the user asked for them by hand);
+* without, every unresolved thread.
+*/
+function buildReview(threads, threadIds) {
+	const skipped = [];
+	let chosen;
+	if (threadIds) {
+		const byId = new Map(threads.map((t) => [t.id, t]));
+		chosen = [];
+		for (const id of threadIds) {
+			const t = byId.get(id);
+			if (t) chosen.push(t);
+			else skipped.push({
+				id,
+				reason: "unknown thread"
+			});
+		}
+	} else chosen = threads.filter((t) => !t.resolved);
+	const comments = [];
+	const ids = [];
+	for (const t of [...chosen].sort(compareThreads)) {
+		if (t.stale) {
+			skipped.push({
+				id: t.id,
+				reason: "stale"
+			});
+			continue;
+		}
+		comments.push(toReviewComment(t));
+		ids.push(t.id);
+	}
+	return {
+		comments,
+		ids,
+		skipped
+	};
+}
+function toReviewComment(t) {
+	const { anchor } = t;
+	const body = formatBody(t.messages);
+	if (anchor.kind === "file") return {
+		path: anchor.path,
+		subjectType: "FILE",
+		body
+	};
+	const side = anchor.side === "old" ? "LEFT" : "RIGHT";
+	const c = {
+		path: anchor.path,
+		line: anchor.endLine,
+		side,
+		body
+	};
+	if (anchor.startLine !== anchor.endLine) {
+		c.startLine = anchor.startLine;
+		c.startSide = side;
+	}
+	return c;
+}
+/**
+* Messages joined as markdown. GitHub renders ```suggestion fences itself, so bodies
+* stay verbatim.
+*/
+function formatBody(messages) {
+	return messages.map((m) => m.body.trim()).join("\n\n---\n\n");
+}
+/** Serializes validation and writes so overlapping exports cannot add the same thread twice. */
+var GithubExporter = class {
+	queue = Promise.resolve();
+	export(prepare) {
+		const result = this.queue.then(async () => exportToGithub(await prepare()));
+		this.queue = result.catch(() => {});
+		return result;
+	}
+};
+/**
+* Adds the threads to a *pending* review on the active PR, creating the pending review
+* when there is none. The review is never submitted: the human opens the PR and submits
+* it themselves. The caller validates the comparison inside the export queue before posting.
+*
+* Re-exporting matches a hidden thread ID and its anchor in the pending review.
+* A matching comment is left alone when its body matches and rewritten when it does not, so
+* editing a thread and exporting again does not stack a second comment on the line. Comments
+* of an already-submitted review are out of reach — those would have to be replied to.
+*/
+async function exportToGithub({ snap, pullRequest: pr, threads, threadIds, github }) {
+	if (snap.newSha === "worktree") throw new GithubError("GitHub cannot anchor comments to the worktree");
+	const { comments, ids, skipped } = buildReview(threads, threadIds);
+	if (comments.length === 0) throw new GithubError(skipped.length ? `nothing to post: ${describe(skipped)}` : "nothing to post", 400);
+	for (const [i, comment] of comments.entries()) comment.body += `\n\n${threadMarker(ids[i])}`;
+	const { pullRequestId, pending } = await findPendingReview(github, pr);
+	if (!pending) {
+		const lines = comments.filter((c) => !isFileComment(c));
+		const created = await createPendingReview(github, pullRequestId, snap.newSha, lines);
+		let appended = 0;
+		try {
+			for (const c of comments.filter(isFileComment)) {
+				await addToPendingReview(github, created.id, c);
+				appended++;
+			}
+		} catch (e) {
+			const detail = e instanceof Error ? e.message : String(e);
+			throw new GithubError(`created the pending review with ${lines.length + appended} comments, then ${detail}`, 502);
+		}
+		return {
+			url: pr.url,
+			posted: comments.length,
+			updated: 0,
+			review: "created",
+			skipped
+		};
 	}
-	async close() {
-		await this.deps.hub.close();
-		await this.vite?.close().catch(() => {});
-		await new Promise((res) => {
-			if (!this.http) return res();
-			this.http.close(() => res());
-			this.http.closeAllConnections();
-		});
+	const existing = await pendingComments(github, pr, pending.id);
+	const add = [];
+	let updated = 0;
+	let posted = 0;
+	try {
+		for (const [i, c] of comments.entries()) {
+			const id = ids[i];
+			const at = existing.get(anchorKey(c));
+			const index = at?.findIndex((comment) => comment.body.trimEnd().endsWith(threadMarker(id))) ?? -1;
+			const hit = index < 0 ? void 0 : at.splice(index, 1)[0];
+			if (!hit) {
+				add.push(c);
+				continue;
+			}
+			if (hit.body.trim() === c.body.trim()) {
+				skipped.push({
+					id,
+					reason: "already in the review"
+				});
+				continue;
+			}
+			await github.graphql(UPDATE_COMMENT, { input: {
+				pullRequestReviewCommentId: hit.nodeId,
+				body: c.body
+			} });
+			updated++;
+		}
+		for (const c of add) {
+			await addToPendingReview(github, pending.id, c);
+			posted++;
+		}
+	} catch (e) {
+		if (updated === 0 && posted === 0) throw e;
+		const detail = e instanceof Error ? e.message : String(e);
+		throw new GithubError(`updated ${updated} and added ${posted} comments in the pending review, then ${detail}`, 502);
 	}
-};
-function projectRoot() {
-	return join(dirname(fileURLToPath(import.meta.url)), "..", "..");
-}
-function resolveClientDir() {
-	return join(projectRoot(), "dist", "client");
-}
-function hasClientBuild() {
-	return existsSync(join(resolveClientDir(), "index.html"));
+	return {
+		url: pr.url,
+		posted,
+		updated,
+		review: "existing",
+		skipped
+	};
 }
-//#endregion
-//#region src/server/GithubMetadata.ts
-const LOOKUP_TIMEOUT_MS = 5e3;
-/** GitHub.com identity from a configured HTTPS, SSH, or scp-style remote URL. */
-function githubRepository(url) {
-	const match = /^(?:https?:\/\/github\.com\/|ssh:\/\/(?:[^/@]+@)?github\.com(?::\d+)?\/|(?:[^/@]+@)?github\.com:)([^/]+)\/([^/]+?)\/?$/i.exec(url);
-	return match ? `${match[1]}/${match[2].replace(/\.git$/i, "")}` : null;
+function threadMarker(id) {
+	return `<!-- diffle-thread:${encodeURIComponent(id)} -->`;
 }
-/** Local-only origin identity; works without gh, authentication, or a network connection. */
-async function originRepository(repo) {
-	const origin = (await repo.remotes()).find((r) => r.name === "origin");
-	return origin ? githubRepository(origin.url) : null;
+/** The anchor must still match before we rewrite an exported thread. */
+function anchorKey(c) {
+	if (isFileComment(c)) return [c.path, "FILE"].join("\0");
+	return [
+		c.path,
+		c.side,
+		c.startLine ?? c.line,
+		c.line
+	].join("\0");
 }
-/** Enriches a comparison without fetching commits, changing its endpoints, or changing comment storage. */
-async function discoverGithub(repo, snap, { run = runGh, prUrl } = {}) {
-	const repository = await originRepository(repo);
-	const absent = (reason) => ({
-		version: snap.version,
-		repository,
-		pullRequest: null,
-		reason
+const PENDING_QUERY = `query($owner:String!,$repo:String!,$number:Int!){
+  viewer{login}
+  repository(owner:$owner,name:$repo){pullRequest(number:$number){id reviews(last:20,states:[PENDING]){nodes{id author{login}}}}}
+}`;
+/**
+* The PR's node id and the viewer's own pending review on it, or null. GitHub hides other
+* people's pending reviews, and the login check makes sure of it: appending to someone
+* else's draft would put our comments in their review.
+*/
+async function findPendingReview(github, pr) {
+	const { owner, repo } = repoOfPrUrl(pr.url);
+	const data = await github.graphql(PENDING_QUERY, {
+		owner,
+		repo,
+		number: pr.number
 	});
-	try {
-		let pr;
-		if (prUrl) pr = await viewPr(prUrl, repo.root, run, LOOKUP_TIMEOUT_MS);
-		else {
-			const [old, next, remotes] = await Promise.all([
-				repo.upstreamBranch(snap.mode.old),
-				repo.upstreamBranch(snap.mode.new),
-				repo.remotes()
-			]);
-			if (!old || !next) return absent("No branch with an upstream available for both endpoints");
-			const repository = (remote) => {
-				const url = remotes.find((r) => r.name === remote)?.url;
-				return url ? githubRepository(url) : null;
-			};
-			const baseRepo = repository(old.remote);
-			const headRepo = repository(next.remote);
-			if (!baseRepo || !headRepo) return absent("Both branches must have GitHub remotes");
-			const prs = await listPrsForHead(baseRepo, old.branch, next.branch, headRepo, repo.root, run, LOOKUP_TIMEOUT_MS);
-			if (!prs.length) return absent("No matching pull request");
-			if (prs.length !== 1) return absent("Multiple matching pull requests; open one explicitly");
-			pr = prs[0];
-		}
-		let reason = null;
-		if (pr.state !== "OPEN") reason = "The pull request is not open";
-		else if (snap.oldSha === "worktree" || snap.newSha === "worktree") reason = "GitHub cannot anchor comments to the worktree";
-		else if (snap.newSha !== pr.headRefOid) reason = "The comparison does not end at the pull request head";
-		else try {
-			if (snap.oldSha !== await repo.mergeBase(pr.baseRefOid, pr.headRefOid)) reason = "The comparison does not match the pull request diff";
-		} catch (e) {
-			if (!(e instanceof GitError)) throw e;
-			reason = "Fetch the pull request base to verify its diff";
+	const pullRequestId = data.repository?.pullRequest?.id;
+	if (typeof pullRequestId !== "string") throw new GithubError(`cannot read pull request ${pr.url} from GitHub`, 502);
+	const login = data.viewer?.login;
+	for (const node of data.repository?.pullRequest?.reviews?.nodes ?? []) if (node?.id && node.author?.login === login) return {
+		pullRequestId,
+		pending: { id: node.id }
+	};
+	return {
+		pullRequestId,
+		pending: null
+	};
+}
+const THREADS_QUERY = `query($owner:String!,$repo:String!,$number:Int!,$after:String){
+  repository(owner:$owner,name:$repo){pullRequest(number:$number){reviewThreads(first:100,after:$after){
+    pageInfo{hasNextPage endCursor}
+    nodes{path line startLine diffSide subjectType comments(first:1){nodes{id body pullRequestReview{id}}}}
+  }}}
+}`;
+/**
+* The pending review's own comments, by anchor. It has to be `reviewThreads`: it is the only view
+* that reports a *pending* comment's real position — REST's review-comment list leaves `line`,
+* `side` and `start_line` null for one, and the GraphQL comment type has no side field at all.
+* A failed or incomplete lookup aborts the export: absence is safe to infer only from a complete read.
+*/
+async function pendingComments(github, pr, reviewId) {
+	const by = /* @__PURE__ */ new Map();
+	const { owner, repo } = repoOfPrUrl(pr.url);
+	let after = null;
+	for (let page = 0; page < 10; page++) {
+		const threads = (await github.graphql(THREADS_QUERY, {
+			owner,
+			repo,
+			number: pr.number,
+			after
+		})).repository?.pullRequest?.reviewThreads;
+		if (!threads?.nodes || typeof threads.pageInfo?.hasNextPage !== "boolean") throw new GithubError("cannot read the complete pending review", 502);
+		for (const t of threads.nodes) {
+			const c = t?.comments?.nodes?.[0];
+			if (!t?.path || !c?.id || c.pullRequestReview?.id !== reviewId) continue;
+			const key = pendingKey(t);
+			if (key == null) continue;
+			const at = by.get(key);
+			if (at) at.push({
+				nodeId: c.id,
+				body: c.body ?? ""
+			});
+			else by.set(key, [{
+				nodeId: c.id,
+				body: c.body ?? ""
+			}]);
 		}
-		return {
-			version: snap.version,
-			repository,
-			pullRequest: {
-				repository: pr.repository,
-				number: pr.number,
-				url: pr.url,
-				title: pr.title,
-				state: pr.state,
-				isDraft: pr.isDraft
-			},
-			reason
-		};
-	} catch (error) {
-		if (!(error instanceof GithubError)) throw error;
-		return absent(`Lookup failed: ${error.message}`);
+		if (!threads.pageInfo.hasNextPage) return by;
+		if (!threads.pageInfo.endCursor || threads.pageInfo.endCursor === after) throw new GithubError("cannot read the next page of the pending review", 502);
+		after = threads.pageInfo.endCursor;
 	}
+	throw new GithubError("pending review exceeds the 1000-thread lookup limit; export stopped without changes", 502);
+}
+/** The anchor key of a thread already in the review, or null for one GitHub reports without a position. */
+function pendingKey(t) {
+	const path = t.path;
+	if (t.subjectType === "FILE") return anchorKey({
+		path,
+		subjectType: "FILE",
+		body: ""
+	});
+	if (t.line == null) return null;
+	return anchorKey({
+		path,
+		side: t.diffSide === "LEFT" ? "LEFT" : "RIGHT",
+		line: t.line,
+		startLine: t.startLine ?? void 0,
+		body: ""
+	});
+}
+const UPDATE_COMMENT = `mutation($input:UpdatePullRequestReviewCommentInput!){updatePullRequestReviewComment(input:$input){pullRequestReviewComment{id}}}`;
+const CREATE_REVIEW = `mutation($input:AddPullRequestReviewInput!){addPullRequestReview(input:$input){pullRequestReview{id}}}`;
+/**
+* No `event` in the input, so GitHub keeps the new review pending with all of its threads.
+* Resolves the review's node id, for the comments a new review cannot carry.
+*/
+async function createPendingReview(github, pullRequestId, commitOID, threads) {
+	const id = (await github.graphql(CREATE_REVIEW, { input: {
+		pullRequestId,
+		commitOID,
+		threads
+	} })).addPullRequestReview?.pullRequestReview?.id;
+	if (typeof id !== "string") throw new GithubError("GitHub did not return the created review", 502);
+	return { id };
+}
+const ADD_THREAD = `mutation($input:AddPullRequestReviewThreadInput!){addPullRequestReviewThread(input:$input){thread{id}}}`;
+/** Appends one thread to the pending review; the only way to extend one, or to place a file comment. */
+async function addToPendingReview(github, reviewId, c) {
+	await github.graphql(ADD_THREAD, { input: {
+		pullRequestReviewId: reviewId,
+		...c
+	} });
+}
+function describe(skipped) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const s of skipped) counts.set(s.reason, (counts.get(s.reason) ?? 0) + 1);
+	return [...counts].map(([reason, n]) => `${n} ${reason}`).join(", ");
 }
 //#endregion
 //#region src/server/mode.ts
@@ -16926,8 +18353,8 @@ async function resolveComparison(repo, comparison) {
 	};
 }
 /** Resolves an input command into a comparison and optional explicit PR identity. */
-async function resolveReview(req, repo, gh = runGh) {
-	if (req.kind === "pr") return resolvePr(req, repo, gh);
+async function resolveReview(req, repo, github) {
+	if (req.kind === "pr") return resolvePr(req, repo, github);
 	const parsed = req.kind === "working" ? {
 		old: "HEAD",
 		new: "worktree",
@@ -16979,14 +18406,15 @@ function branchKey(old, next, mergeBase) {
 }
 /**
 * A GitHub pull request, as GitHub shows it: merge-base(base tip, head) vs head.
-* `gh` names the PR, then one fetch brings the base tip and the PR head into
+* GitHub names the PR, then one fetch brings the base tip and the PR head into
 * session-owned refs named after the branches, so a PR nobody has checked out
 * is reviewable. These refs stay fixed until another fetch; review state uses
 * the same branch identities as ordinary comparisons, so comments survive
 * pushes and reopening by branch.
 */
-async function resolvePr(req, repo, gh) {
-	const pr = await viewPr(req.pr, repo.root, gh);
+async function resolvePr(req, repo, github) {
+	if (!github) throw new GithubError(NO_TOKEN);
+	const pr = await viewPr(req.pr, repo, github);
 	const head = `${repo.reviewRefs}/${pr.number}/head/${pr.headRefName}`;
 	const base = `${repo.reviewRefs}/${pr.number}/base/${pr.baseRefName}`;
 	await repo.fetch(await fetchSource(repo, pr), [`+refs/pull/${pr.number}/head:${head}`, `+refs/heads/${pr.baseRefName}:${base}`]);
@@ -17263,7 +18691,7 @@ var Session = class {
 		const cached = active.github;
 		if (cached?.snapshot === snap && cached.expires > Date.now()) return cached.promise;
 		const promise = discoverGithub(this.repo, snap, {
-			run: this.opts.gh,
+			github: this.opts.github,
 			prUrl: active.prUrl
 		});
 		const entry = {
@@ -17283,8 +18711,10 @@ var Session = class {
 			const active = this.require();
 			const snap = await active.snapshotter.current();
 			if (active !== this.active) throw new GithubError("Comparison changed; try again");
+			const github = this.opts.github;
+			if (!github) throw new GithubError(NO_TOKEN);
 			const metadata = await discoverGithub(this.repo, snap, {
-				run: this.opts.gh,
+				github,
 				prUrl: active.prUrl
 			});
 			if (!metadata.pullRequest || metadata.reason !== null) throw new GithubError(metadata.reason ?? "No matching pull request");
@@ -17294,7 +18724,7 @@ var Session = class {
 				pullRequest: metadata.pullRequest,
 				threads: active.comments.threads({ state: "all" }),
 				threadIds,
-				run: this.opts.gh
+				github
 			};
 		});
 	}
@@ -17321,10 +18751,17 @@ var Session = class {
 			console.error("[diffle] snapshot listener failed:", e);
 		}
 	}
-	/** First mode. Rejects `ready()` on failure so early requests error out. */
-	async start(req) {
+	/**
+	* Resolves a request into a review without activating it, so a caller can reject
+	* invalid input before serving. Queued, so `close()` waits for a PR fetch.
+	*/
+	resolve(req) {
+		return this.run(() => resolveReview(req, this.repo, this.opts.github));
+	}
+	/** First mode, from `resolve`. Rejects `ready()` on failure so early requests error out. */
+	async start(review) {
 		try {
-			const snap = await this.enter(req);
+			const snap = await this.run(() => this.activate(review));
 			this.resolveReady();
 			return snap;
 		} catch (e) {
@@ -17334,7 +18771,7 @@ var Session = class {
 	}
 	/** Switch modes at runtime. Broadcasts a snapshot bump on success. */
 	async switchMode(req) {
-		const snap = await this.enter(req);
+		const snap = await this.run(async () => this.activate(await resolveReview(req, this.repo, this.opts.github)));
 		this.hub.broadcast({
 			type: "snapshot",
 			version: snap.version
@@ -17350,11 +18787,7 @@ var Session = class {
 		this.queue = r.catch(() => {});
 		return r;
 	}
-	enter(req) {
-		return this.run(() => this.transition(req));
-	}
-	async transition(req) {
-		const { mode, prUrl } = await resolveReview(req, this.repo, this.opts.gh);
+	async activate({ mode, prUrl }) {
 		const snapshotter = new Snapshotter(this.repo, mode, ++this.version, this.opts.context);
 		const [comments, snap] = await Promise.all([CommentStore.open(this.repo.gitDir, mode.commentKey), snapshotter.current()]);
 		const next = {
@@ -17447,6 +18880,18 @@ var Session = class {
 		if (side === "new") return snap.newSha === "worktree" ? this.repo.readWorktree(target) : this.repo.show(snap.newSha, target);
 		return snap.oldSha === "worktree" ? this.repo.readWorktree(target) : this.repo.show(snap.oldSha, target);
 	}
+	/**
+	* The bytes `key` names on one side of `path`, or null unless `key` is that side's `imageKey` in `snap`.
+	* A worktree file that changed since `snap` reads as null too, so a key never serves other bytes.
+	*/
+	async readImage(snap, path, side, key) {
+		if (key !== imageKey(snap, path, side)) return null;
+		if (!snap.changed.some((f) => f.path === path)) return this.readSide(snap, path, key === snap.newSha ? "new" : "old");
+		const buf = await this.readSide(snap, path, side);
+		if (buf == null || (side === "new" ? snap.newSha : snap.oldSha) !== "worktree") return buf;
+		const target = sidePath(this.readablePaths(snap), path, side);
+		return target != null && await this.repo.hashObject(buf, target) === key ? buf : null;
+	}
 	/** Whether `readSide` would find `path` on `side`: the allowlist alone, no read. */
 	hasSide(snap, path, side) {
 		return sidePath(this.readablePaths(snap), path, side) != null;
@@ -21372,7 +22817,7 @@ function openBrowser(url) {
 //#endregion
 //#region src/cli/repository.ts
 /** Foreign PRs live in a disposable clone, never in the caller's object database. */
-async function openReviewRepository(req, cwd, gh = runGh) {
+async function openReviewRepository(req, cwd, github) {
 	let local;
 	try {
 		local = await GitRepo.open(cwd);
@@ -21383,7 +22828,8 @@ async function openReviewRepository(req, cwd, gh = runGh) {
 		repo: local,
 		close: () => local.cleanReviewRefs()
 	};
-	const pr = await viewPr(req.pr, cwd, gh);
+	if (!github) throw new GithubError(NO_TOKEN);
+	const pr = await viewPr(req.pr, local ?? null, github);
 	if (local && (await local.remotes()).some((r) => remoteSlug(r.url) === pr.repository.toLowerCase())) return {
 		repo: local,
 		close: () => local.cleanReviewRefs()
@@ -21540,14 +22986,16 @@ async function run(req, opts) {
 	process.on("SIGTERM", interrupt);
 	let review;
 	try {
-		review = await openReviewRepository(req, opts.C ?? process.cwd());
+		const github = await connectGithub();
+		timing.mark("github token");
+		review = await openReviewRepository(req, opts.C ?? process.cwd(), github.client);
 		timing.mark("open repository");
 		const config = await UserConfigStore.open();
 		if (interrupted) {
 			await review.close();
 			return;
 		}
-		await serve(req, opts, review.repo, review.close, config, timing);
+		await serve(req, opts, review.repo, review.close, config, github, timing);
 	} catch (e) {
 		await review?.close();
 		throw e;
@@ -21556,11 +23004,12 @@ async function run(req, opts) {
 		process.off("SIGTERM", interrupt);
 	}
 }
-async function serve(req, opts, repo, closeRepo, config, timing) {
+async function serve(req, opts, repo, closeRepo, config, github, timing) {
 	const hub = new WsHub();
 	const session = new Session(repo, hub, {
 		watch: opts.watch,
-		context: opts.context ?? config.get().contextLines
+		context: opts.context ?? config.get().contextLines,
+		github: github.client ?? void 0
 	});
 	const named = Array.isArray(opts.lsp) ? opts.lsp : [];
 	const overrides = {
@@ -21600,6 +23049,9 @@ async function serve(req, opts, repo, closeRepo, config, timing) {
 	process.on("SIGTERM", shutdown);
 	stopBrowserWatch = watchBrowserLifetime(hub, opts.open && !opts.keepAlive, shutdown);
 	try {
+		const review = await session.resolve(req);
+		timing.mark("resolve");
+		if (closing) return;
 		const url = await server.listen();
 		timing.mark("listen");
 		if (opts.open) {
@@ -21609,7 +23061,9 @@ async function serve(req, opts, repo, closeRepo, config, timing) {
 		}
 		console.error(`🚀 diffle running at ${c.cyan(url.href)}`);
 		console.error(`📂 ${c.dim("repo")} ${repo.root}`);
-		const snap = await session.start(req);
+		if (github.client) console.error(`🐙 ${c.dim("github")} ${c.dim(`token from ${github.source}`)}`);
+		else console.error(`🐙 ${c.dim("github")} ${c.dim("off: no token in GITHUB_TOKEN, GH_TOKEN or gh auth token")}`);
+		const snap = await session.start(review);
 		timing.mark("snapshot");
 		const n = snap.changed.length;
 		const adds = snap.changed.reduce((a, f) => a + f.additions, 0);
@@ -21635,6 +23089,15 @@ async function serve(req, opts, repo, closeRepo, config, timing) {
 		throw e;
 	}
 }
+/** One token lookup per run; without one, GitHub features are off rather than failing later. */
+async function connectGithub() {
+	const found = await resolveToken();
+	if (!found) return { client: null };
+	return {
+		client: createGithubClient(found.token),
+		source: found.source
+	};
+}
 /**
 * The pool reads new-side text through the session, so the snapshot allowlist applies to
 * every LSP path. Each snapshot decides which languages run: it re-opens the diff's files