@usepipr/runtime 0.4.1 → 0.4.3

package/dist/{commands-46Q2ZDt0.mjs → commands-B9qNW4pk.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveReadAtRefRequest, d as isRecord, l as unavailableReadAtRefResult, n as boundedLineSlice, r as parseManifestPath, u as createDiffRangeIndex } from "./runtime-tools-core-D8_WsbL_.mjs";
-import { a as officialInitRecipeWorkflowEnvSecrets, i as officialInitRecipeFiles, r as officialInitRecipeConfigTs, t as renderOfficialGithubWorkflow } from "./official-github-workflow-Cx-Yhh86.mjs";
+import { a as officialInitRecipeWorkflowEnvSecrets, i as officialInitRecipeFiles, r as officialInitRecipeConfigTs, t as renderOfficialGithubWorkflow } from "./official-github-workflow-Bjlu-FL3.mjs";
 import { t as isPublishableSuggestedFixSelection } from "./suggested-fix-publication-policy-B5Wwuudp.mjs";
 import { createRequire } from "node:module";
 import { chmod, chown, cp, lstat, mkdir, mkdtemp, readdir, rm } from "node:fs/promises";
@@ -597,7 +597,7 @@ function compareStableSemver(left, right) {
 }
 //#endregion
 //#region src/shared/version.ts
-const runtimeVersion = "0.4.1";
+const runtimeVersion = "0.4.3";
 //#endregion
 //#region src/config/version-compat.ts
 async function resolveConfigVersionCompatibility(options) {
@@ -928,10 +928,6 @@ function assertRequiredProviderEnv(providers, options) {
 	if (missing.length > 0) throw new Error(`Missing provider env vars: ${missing.map((provider) => provider.apiKeyEnv).join(", ")}`);
 }
 //#endregion
-//#region src/config/scaffold-versions.ts
-const defaultTypesBunVersion = "1.3.14";
-const defaultTypescriptVersion = "6.0.3";
-//#endregion
 //#region src/config/init.ts
 const supportedOfficialInitAdapters = [
 	"github",
@@ -939,8 +935,8 @@ const supportedOfficialInitAdapters = [
 	"azure-devops",
 	"bitbucket"
 ];
-const defaultGitLabImageRef = "ghcr.io/somus/pipr:v0.4.1";
-const defaultSdkVersion = "0.4.1";
+const defaultGitLabImageRef = "ghcr.io/somus/pipr:v0.4.3";
+const defaultSdkVersion = "0.4.3";
 function resolveOfficialInitAdapters(adapters) {
 	if (adapters === void 0) return ["github"];
 	if (adapters.length === 0) return [];
@@ -974,11 +970,7 @@ async function initOfficialMinimalProject(options) {
 	const result = await writeTargets(targets, existing, { skipExisting: false });
 	if (!minimal) {
 		await assertBunAvailable();
-		const install = Bun.spawn([
-			"bun",
-			"install",
-			"--ignore-scripts"
-		], {
+		const install = Bun.spawn(initInstallCommand(), {
 			cwd: projectDir,
 			env: process.env,
 			stdout: "pipe",
@@ -1000,6 +992,15 @@ async function initOfficialMinimalProject(options) {
 		...result
 	};
 }
+function initInstallCommand(env = process.env) {
+	const command = [
+		"bun",
+		"install",
+		"--ignore-scripts"
+	];
+	if (env.PIPR_INTERNAL_INIT_OFFLINE === "1") command.push("--offline");
+	return command;
+}
 async function starterFiles(relativeConfigDir, adapters, recipe, minimal = false) {
 	const files = [{
 		relativePath: path.join(relativeConfigDir, "config.ts"),
@@ -1086,15 +1087,18 @@ function starterBitbucketWebhookEnvironment(recipe) {
 	lines.push("");
 	return lines.join("\n");
 }
-function starterPackageJson() {
-	return `${JSON.stringify({
+function officialInitPackageManifest(env = process.env) {
+	return {
 		private: true,
-		dependencies: { "@usepipr/sdk": process.env.PIPR_INTERNAL_INIT_SDK_VERSION ?? defaultSdkVersion },
+		dependencies: { "@usepipr/sdk": env.PIPR_INTERNAL_INIT_SDK_VERSION ?? defaultSdkVersion },
 		devDependencies: {
-			"@types/bun": defaultTypesBunVersion,
-			typescript: defaultTypescriptVersion
+			"@types/bun": env.PIPR_INTERNAL_INIT_TYPES_BUN_VERSION ?? "1.3.14",
+			typescript: env.PIPR_INTERNAL_INIT_TYPESCRIPT_VERSION ?? "6.0.3"
 		}
-	}, null, 2)}\n`;
+	};
+}
+function starterPackageJson() {
+	return `${JSON.stringify(officialInitPackageManifest(), null, 2)}\n`;
 }
 async function writeTargets(targets, existing, options) {
 	const created = [];
@@ -1150,996 +1154,172 @@ async function maybeLstat(filePath) {
 	}
 }
 //#endregion
-//#region src/hosts/http.ts
-var CodeHostHttpError = class extends Error {
-	status;
-	constructor(message, status) {
-		super(message);
-		this.name = "CodeHostHttpError";
-		this.status = status;
+//#region src/diff/git.ts
+function runGit$1(args, cwd, maxBuffer) {
+	const result = Bun.spawnSync(["git", ...args], {
+		cwd,
+		env: process.env,
+		maxBuffer,
+		stderr: "pipe",
+		stdout: "pipe"
+	});
+	if (result.exitCode !== 0) {
+		const failure = result.stderr?.toString().trim() || "unknown error";
+		throw new Error(`git ${args.join(" ")} failed: ${failure}`);
 	}
-};
-function createCodeHostHttpClient(options) {
-	const fetchRequest = options.fetch ?? fetch;
-	const sleep = options.sleep ?? ((milliseconds) => Bun.sleep(milliseconds));
-	const successThrottle = options.successThrottle ?? createCodeHostSuccessThrottle(sleep);
-	const maxRetries = options.maxRetries ?? 2;
-	const requestTimeoutMilliseconds = options.requestTimeoutMilliseconds ?? 3e4;
-	const secrets = [...new Headers(options.headers).values()].flatMap((value) => [value, value.split(/\s+/).at(-1)].filter((candidate) => candidate !== void 0 && candidate.length >= 8));
-	return { async json(path, schema, init = {}) {
-		const method = init.method?.toUpperCase() ?? "GET";
-		for (let attempt = 0;; attempt += 1) {
-			await successThrottle.wait();
-			const timeoutSignal = AbortSignal.timeout(requestTimeoutMilliseconds);
-			const response = await fetchRequest(new URL(path, options.baseUrl), {
-				...init,
-				headers: {
-					...Object.fromEntries(new Headers(options.headers)),
-					...Object.fromEntries(new Headers(init.headers))
-				},
-				signal: init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
-			});
-			const retryAfter = retryAfterMilliseconds(response.headers.get("Retry-After"));
-			if (response.ok) {
-				successThrottle.update(response.headers.get("Retry-After"));
-				return schema.parse(await response.json());
-			}
-			if (shouldRetryCodeHostRequest({
-				method,
-				attempt,
-				maxRetries,
-				response,
-				retryStatuses: options.retryNonIdempotentStatuses
-			})) {
-				await sleep(retryAfter || 250 * 2 ** attempt);
-				continue;
-			}
-			const body = (await response.text()).slice(0, 1024);
-			throw new CodeHostHttpError(redact$1(`Code host request failed (${response.status} ${response.statusText}): ${body}`, secrets), response.status);
+	return result.stdout.toString();
+}
+//#endregion
+//#region src/diff/diff.ts
+const lockFilePattern = /(^|\/)(bun\.lock|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|Cargo\.lock)$/;
+const generatedPattern = /(^|\/)(dist|build|coverage|vendor)\//;
+const maxInlineChangedLines = 1e3;
+const maxCommentableRangeLines = 5e3;
+function buildDiffManifest(options) {
+	const mergeBaseSha = runGit$1([
+		"merge-base",
+		options.baseSha,
+		options.headSha
+	], options.cwd).trim();
+	const diffHead = options.includeWorkingTree ? void 0 : options.headSha;
+	const files = parseNameStatus(runGit$1(buildDiffArgs([
+		"--name-status",
+		"-z",
+		"--find-renames"
+	], mergeBaseSha, diffHead), options.cwd));
+	const diffStats = getDiffStats(options.cwd, mergeBaseSha, diffHead);
+	const rawPatch = parseRawPatch(runGit$1(buildUnifiedDiffArgs(mergeBaseSha, diffHead, getPreExcludedFiles(files, diffStats)), options.cwd));
+	const parsedDiff = parseUnifiedDiff(rawPatch.patch, rawPatch.filePaths);
+	for (const file of files) {
+		const stats = diffStats.get(file.path);
+		file.additions = stats?.additions ?? 0;
+		file.deletions = stats?.deletions ?? 0;
+		const preExcludedReason = stats?.excludedReason;
+		const parsedFile = parsedDiff.get(file.path);
+		file.hunks = preExcludedReason ? [] : parsedFile?.hunks ?? [];
+		file.commentableRanges = preExcludedReason ? [] : parsedFile?.commentableRanges ?? [];
+		const excludedReason = preExcludedReason ?? getExcludedReason(file);
+		if (excludedReason) {
+			file.hunks = [];
+			file.commentableRanges = [];
+			file.excludedReason = excludedReason;
 		}
-	} };
+	}
+	return parseDiffManifest({
+		baseSha: options.baseSha,
+		headSha: options.headSha,
+		mergeBaseSha,
+		files
+	});
 }
-function createCodeHostSuccessThrottle(sleep = (milliseconds) => Bun.sleep(milliseconds)) {
-	let notBefore = 0;
-	let waitInFlight;
-	const waitUntilReady = async () => {
-		while (true) {
-			const deadline = notBefore;
-			const remaining = deadline - Date.now();
-			if (remaining <= 0) {
-				if (notBefore === deadline) notBefore = 0;
-				return;
-			}
-			await sleep(remaining);
-			if (notBefore <= deadline) {
-				notBefore = 0;
-				return;
-			}
+function parseNameStatus(output) {
+	const fields = output.split("\0");
+	const files = [];
+	let index = 0;
+	while (index < fields.length) {
+		const rawStatus = fields[index++];
+		if (!rawStatus) continue;
+		const firstPath = fields[index++] ?? "";
+		const status = parseFileStatus(rawStatus);
+		if (status === "renamed") {
+			const secondPath = fields[index++] ?? "";
+			files.push(baseFile(secondPath || firstPath, status, firstPath));
+			continue;
 		}
-	};
-	return {
-		wait() {
-			if (waitInFlight) return waitInFlight;
-			const currentWait = waitUntilReady().finally(() => {
-				if (waitInFlight === currentWait) waitInFlight = void 0;
+		files.push(baseFile(firstPath, status));
+	}
+	return files;
+}
+function parseUnifiedDiff(diff, filePaths) {
+	const state = createDiffParserState(filePaths);
+	for (const line of diff.split("\n")) parseUnifiedDiffLine(state, line);
+	finishActiveHunk(state);
+	return state.filesByPath;
+}
+function getDiffStats(cwd, baseSha, headSha) {
+	const output = runGit$1(buildDiffArgs([
+		"--numstat",
+		"-z",
+		"--find-renames"
+	], baseSha, headSha), cwd);
+	const stats = /* @__PURE__ */ new Map();
+	for (const stat of parseNumstat(output)) {
+		if (stat.binary) {
+			stats.set(stat.path, {
+				additions: 0,
+				deletions: 0,
+				excludedReason: "binary diff"
 			});
-			waitInFlight = currentWait;
-			return waitInFlight;
-		},
-		update(retryAfter) {
-			const delay = retryAfterMilliseconds(retryAfter);
-			if (delay > 0) notBefore = Math.max(notBefore, Date.now() + delay);
+			continue;
 		}
-	};
+		stats.set(stat.path, {
+			additions: stat.additions,
+			deletions: stat.deletions,
+			excludedReason: stat.additions + stat.deletions > maxInlineChangedLines ? "oversized diff" : void 0
+		});
+	}
+	return stats;
 }
-function shouldRetryCodeHostRequest(options) {
-	return (options.method === "GET" || options.method === "HEAD" || options.retryStatuses?.includes(options.response.status) === true) && options.attempt < options.maxRetries && (options.response.status === 429 || options.response.status >= 500 || options.retryStatuses?.includes(options.response.status) === true);
+function getPreExcludedFiles(files, stats) {
+	const excluded = /* @__PURE__ */ new Map();
+	for (const [filePath, stat] of stats) if (stat.excludedReason) excluded.set(filePath, stat.excludedReason);
+	for (const file of files) {
+		const excludedReason = excluded.get(file.path) ?? getPathExcludedReason(file);
+		if (!excludedReason) continue;
+		excluded.set(file.path, excludedReason);
+		if (file.previousPath) excluded.set(file.previousPath, excludedReason);
+	}
+	return excluded;
 }
-function retryAfterMilliseconds(value) {
-	if (!value) return 0;
-	const seconds = Number(value);
-	if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
-	const date = Date.parse(value);
-	return Number.isFinite(date) ? Math.max(0, date - Date.now()) : 0;
+function buildUnifiedDiffArgs(baseSha, headSha, excludedFiles) {
+	const args = buildDiffArgs([
+		"--raw",
+		"-z",
+		"--patch",
+		"--submodule=short",
+		"--unified=80",
+		"--find-renames"
+	], baseSha, headSha);
+	if (excludedFiles.size === 0) return args;
+	return [
+		...args,
+		"--",
+		".",
+		...[...excludedFiles.keys()].map((filePath) => `:(exclude,literal)${filePath}`)
+	];
 }
-function redact$1(value, secrets) {
-	let redacted = value;
-	for (const secret of secrets) redacted = redacted.split(secret).join("***");
-	return redacted;
+function buildDiffArgs(options, baseSha, headSha) {
+	return headSha ? [
+		"diff",
+		...options,
+		baseSha,
+		headSha
+	] : [
+		"diff",
+		...options,
+		baseSha
+	];
 }
-//#endregion
-//#region src/hosts/azure-devops/coordinates.ts
-function azureOrganizationFromUrl(value) {
-	const url = new URL(value);
-	return url.hostname === "dev.azure.com" ? url.pathname.split("/").filter(Boolean)[0] : url.hostname.split(".")[0];
-}
-//#endregion
-//#region src/hosts/azure-devops/client.ts
-const identitySchema = z.looseObject({
-	displayName: z.string().optional(),
-	providerDisplayName: z.string().optional(),
-	uniqueName: z.string().optional(),
-	id: z.string().optional(),
-	properties: z.looseObject({ Account: z.looseObject({ $value: z.string().optional() }).optional() }).optional()
-}).transform((identity) => {
-	const displayName = identity.displayName ?? identity.providerDisplayName;
-	const uniqueName = identity.uniqueName ?? identity.properties?.Account?.$value;
-	return {
-		...identity,
-		...displayName ? { displayName } : {},
-		...uniqueName ? { uniqueName } : {}
-	};
-});
-const commitSchema = z.looseObject({ commitId: z.string().min(1) });
-const forkRepositorySchema = z.looseObject({ remoteUrl: z.string().min(1) });
-const pullRequestSchema$1 = z.looseObject({
-	pullRequestId: z.number().int().positive(),
-	isDraft: z.boolean().optional(),
-	title: z.string(),
-	description: z.string().nullish(),
-	url: z.string().optional(),
-	sourceRefName: z.string().min(1),
-	targetRefName: z.string().min(1),
-	createdBy: identitySchema.optional(),
-	lastMergeSourceCommit: commitSchema,
-	lastMergeTargetCommit: commitSchema,
-	forkSource: z.looseObject({ repository: forkRepositorySchema }).optional(),
-	repository: z.looseObject({
-		id: z.string().min(1),
-		name: z.string().min(1),
-		url: z.string().optional(),
-		project: z.looseObject({
-			id: z.string().min(1),
-			name: z.string().min(1)
-		})
-	})
-});
-const repositorySchema$1 = z.looseObject({
-	id: z.string().min(1),
-	name: z.string().min(1),
-	project: z.looseObject({
-		id: z.string().min(1),
-		name: z.string().min(1)
-	})
-});
-const iterationSchema = z.looseObject({
-	id: z.number().int().positive(),
-	sourceRefCommit: commitSchema
-});
-const iterationChangeSchema = z.looseObject({
-	changeTrackingId: z.number().int(),
-	changeType: z.string(),
-	item: z.looseObject({
-		path: z.string().min(1),
-		originalPath: z.string().min(1).optional()
-	})
-});
-const threadCommentSchema = z.looseObject({
-	id: z.union([z.number(), z.string()]).transform(String),
-	parentCommentId: z.number().int().optional(),
-	content: z.string().default(""),
-	author: identitySchema.optional(),
-	isDeleted: z.boolean().optional()
-});
-const pointSchema = z.looseObject({
-	line: z.number().int(),
-	offset: z.number().int()
-});
-const threadSchema = z.looseObject({
-	id: z.union([z.number(), z.string()]).transform(String),
-	status: z.string().optional(),
-	comments: z.array(threadCommentSchema).default([]),
-	threadContext: z.looseObject({
-		filePath: z.string().optional(),
-		leftFileStart: pointSchema.nullish(),
-		leftFileEnd: pointSchema.nullish(),
-		rightFileStart: pointSchema.nullish(),
-		rightFileEnd: pointSchema.nullish()
-	}).nullish(),
-	pullRequestThreadContext: z.looseObject({
-		changeTrackingId: z.number().int().optional(),
-		iterationContext: z.looseObject({
-			firstComparingIteration: z.number().int(),
-			secondComparingIteration: z.number().int()
-		}).optional()
-	}).nullish()
-});
-const statusSchema$1 = z.looseObject({ id: z.union([z.number(), z.string()]).transform(String) });
-const aclSchema = collectionSchema(z.looseObject({
-	inheritPermissions: z.boolean().default(true),
-	acesDictionary: z.record(z.string(), z.looseObject({
-		allow: z.number().int().default(0),
-		deny: z.number().int().default(0),
-		extendedInfo: z.looseObject({
-			effectiveAllow: z.number().int().default(0),
-			effectiveDeny: z.number().int().default(0)
-		}).optional()
-	}))
-}));
-function createAzureDevOpsClient(env = process.env, fetch = globalThis.fetch, options = {}) {
-	const organization = env.AZURE_DEVOPS_ORGANIZATION ?? organizationFromCollectionUri$1(env.SYSTEM_COLLECTIONURI);
-	const project = env.AZURE_DEVOPS_PROJECT ?? env.SYSTEM_TEAMPROJECT;
-	const pat = env.AZURE_DEVOPS_TOKEN;
-	const bearerToken = env.AZURE_DEVOPS_BEARER_TOKEN ?? env.SYSTEM_ACCESSTOKEN;
-	if (!organization) throw new Error("AZURE_DEVOPS_ORGANIZATION is required for Azure DevOps API calls");
-	if (!project) throw new Error("AZURE_DEVOPS_PROJECT or SYSTEM_TEAMPROJECT is required for Azure DevOps API calls");
-	if (!pat && !bearerToken) throw new Error("AZURE_DEVOPS_TOKEN, AZURE_DEVOPS_BEARER_TOKEN, or SYSTEM_ACCESSTOKEN is required for Azure DevOps API calls");
-	const headers = pat ? { Authorization: `Basic ${Buffer.from(`:${pat}`).toString("base64")}` } : { Authorization: `Bearer ${bearerToken}` };
-	const successThrottle = createCodeHostSuccessThrottle(options.sleep);
-	const api = createCodeHostHttpClient({
-		baseUrl: `https://dev.azure.com/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_apis/`,
-		headers,
-		fetch,
-		successThrottle
-	});
-	const organizationApi = createCodeHostHttpClient({
-		baseUrl: `https://dev.azure.com/${encodeURIComponent(organization)}/_apis/`,
-		headers,
-		fetch,
-		successThrottle
-	});
-	const identityApi = createCodeHostHttpClient({
-		baseUrl: `https://vssps.dev.azure.com/${encodeURIComponent(organization)}/_apis/`,
-		headers,
-		fetch,
-		successThrottle
-	});
-	const pullRequestPath = (repositoryId, changeNumber) => `git/repositories/${encodeURIComponent(repositoryId)}/pullRequests/${changeNumber}`;
-	return {
-		organization,
-		project,
-		async currentUser() {
-			return (await organizationApi.json("connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1", z.looseObject({ authenticatedUser: identitySchema }))).authenticatedUser;
-		},
-		async getRepository(repository) {
-			const value = await api.json(withApiVersion(`git/repositories/${encodeURIComponent(repository)}`), repositorySchema$1);
-			return {
-				id: value.id,
-				name: value.name,
-				projectId: value.project.id,
-				project: value.project.name
-			};
-		},
-		async getRepositoryPermission(actor, projectId, repositoryId) {
-			const candidates = (await identityApi.json(`identities?searchFilter=General&filterValue=${encodeURIComponent(actor)}&queryMembership=ExpandedUp&api-version=7.1`, collectionSchema(z.looseObject({
-				descriptor: z.string().min(1),
-				isActive: z.boolean().optional(),
-				isContainer: z.boolean().optional(),
-				memberOf: z.array(z.union([z.string().min(1), z.looseObject({ descriptor: z.string().min(1) })])).default([])
-			})))).value.filter((identity) => identity.isActive !== false && identity.isContainer !== true);
-			if (candidates.length !== 1) return "none";
-			const identity = candidates[0];
-			if (!identity) return "none";
-			const descriptors = [identity.descriptor, ...identity.memberOf.map((group) => typeof group === "string" ? group : group.descriptor)];
-			const loadAcls = (token) => {
-				const query = new URLSearchParams({
-					token,
-					descriptors: descriptors.join(","),
-					includeExtendedInfo: "true",
-					recurse: "false",
-					"api-version": "7.1"
-				});
-				return organizationApi.json(`accesscontrollists/2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87?${query}`, aclSchema);
-			};
-			const [projectAcls, repositoryAcls] = await Promise.all([loadAcls(`repoV2/${projectId}`), loadAcls(`repoV2/${projectId}/${repositoryId}`)]);
-			return azurePermissionFromAcls(repositoryAcls.value.every((acl) => acl.inheritPermissions) ? [...projectAcls.value, ...repositoryAcls.value] : repositoryAcls.value);
-		},
-		getPullRequest: (repositoryId, changeNumber) => api.json(withApiVersion(pullRequestPath(repositoryId, changeNumber)), pullRequestSchema$1),
-		async listIterations(repositoryId, changeNumber) {
-			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/iterations`), collectionSchema(iterationSchema))).value.map((iteration) => ({
-				id: iteration.id,
-				headSha: iteration.sourceRefCommit.commitId
-			}));
-		},
-		async loadChange(options) {
-			if (options.organization !== organization || options.project !== project) throw new Error("Azure DevOps client coordinates do not match its configured organization and project");
-			const pullRequest = await this.getPullRequest(options.repositoryId, options.changeNumber);
-			const iterations = await this.listIterations(options.repositoryId, options.changeNumber);
-			const headSha = pullRequest.lastMergeSourceCommit.commitId;
-			const iteration = iterations.findLast((candidate) => candidate.headSha === headSha);
-			if (!iteration) throw new Error(`Azure DevOps has no pull request iteration for head ${headSha}`);
-			const sourceRef = branchName(pullRequest.sourceRefName);
-			const targetRef = branchName(pullRequest.targetRefName);
-			return {
-				repository: {
-					slug: `${organization}/${pullRequest.repository.project.name}/${pullRequest.repository.name}`,
-					url: repositoryWebUrl(organization, pullRequest.repository.project.name, pullRequest.repository.name)
-				},
-				coordinates: {
-					provider: "azure-devops",
-					organization,
-					project: pullRequest.repository.project.name,
-					projectId: pullRequest.repository.project.id,
-					repositoryId: pullRequest.repository.id
-				},
-				change: {
-					number: pullRequest.pullRequestId,
-					isDraft: pullRequest.isDraft,
-					title: pullRequest.title,
-					description: pullRequest.description ?? "",
-					url: `${repositoryWebUrl(organization, pullRequest.repository.project.name, pullRequest.repository.name)}/pullrequest/${pullRequest.pullRequestId}`,
-					author: pullRequest.createdBy?.uniqueName ? { login: pullRequest.createdBy.uniqueName } : void 0,
-					base: {
-						sha: pullRequest.lastMergeTargetCommit.commitId,
-						ref: targetRef
-					},
-					head: {
-						sha: headSha,
-						ref: sourceRef,
-						...pullRequest.forkSource?.repository.remoteUrl ? { url: pullRequest.forkSource.repository.remoteUrl } : {}
-					},
-					...pullRequest.forkSource ? { isFork: true } : {}
-				},
-				iterationId: iteration.id
-			};
-		},
-		async listIterationChanges(repositoryId, changeNumber, iterationId) {
-			const changes = [];
-			let skip = 0;
-			let top = 2e3;
-			for (;;) {
-				const path = `${pullRequestPath(repositoryId, changeNumber)}/iterations/${iterationId}/changes?compareTo=0&$skip=${skip}&$top=${top}`;
-				const page = await api.json(withApiVersion(path), z.looseObject({
-					changeEntries: z.array(iterationChangeSchema),
-					nextSkip: z.number().int().nonnegative().optional(),
-					nextTop: z.number().int().nonnegative().max(2e3).optional()
-				}));
-				changes.push(...page.changeEntries.map((change) => ({
-					changeTrackingId: change.changeTrackingId,
-					changeType: change.changeType,
-					path: trimLeadingSlash(change.item.path),
-					...change.item.originalPath ? { originalPath: trimLeadingSlash(change.item.originalPath) } : {}
-				})));
-				if (!page.nextSkip) return changes;
-				skip = page.nextSkip;
-				if (page.nextTop) top = page.nextTop;
-			}
-		},
-		async listThreads(repositoryId, changeNumber) {
-			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads`), collectionSchema(threadSchema))).value;
-		},
-		createThread: (repositoryId, changeNumber, body) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads`), threadSchema, jsonRequest$2("POST", body)),
-		updateComment: (repositoryId, changeNumber, threadId, commentId, content) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}/comments/${encodeURIComponent(commentId)}`), threadCommentSchema, jsonRequest$2("PATCH", { content })),
-		createThreadComment: (repositoryId, changeNumber, threadId, body) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}/comments`), threadCommentSchema, jsonRequest$2("POST", body)),
-		updateThreadStatus: (repositoryId, changeNumber, threadId, status) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}`), threadSchema, jsonRequest$2("PATCH", { status })),
-		async createStatus(repositoryId, changeNumber, body) {
-			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/statuses`), statusSchema$1, jsonRequest$2("POST", body))).id;
-		}
-	};
-}
-function azureDevOpsStatusState(state) {
-	switch (state) {
-		case "pending": return "pending";
-		case "success": return "succeeded";
-		case "failure": return "failed";
-		case "neutral": return "notApplicable";
-	}
-}
-function azureRepositoryPermission(bits) {
-	if ((bits & 2) === 0) return "none";
-	if ((bits & 8192) !== 0) return "admin";
-	if ((bits & 2048) !== 0) return "maintain";
-	if ((bits & 4) !== 0) return "write";
-	if ((bits & 16384) !== 0) return "triage";
-	return "read";
-}
-function azurePermissionFromAcls(acls) {
-	let allow = 0;
-	let deny = 0;
-	for (const acl of acls) for (const ace of Object.values(acl.acesDictionary)) {
-		allow |= ace.extendedInfo?.effectiveAllow ?? ace.allow;
-		deny |= ace.extendedInfo?.effectiveDeny ?? ace.deny;
-	}
-	return azureRepositoryPermission(allow & ~deny);
-}
-function collectionSchema(item) {
-	return z.looseObject({
-		count: z.number().int().nonnegative(),
-		value: z.array(item)
-	});
-}
-function withApiVersion(path) {
-	return `${path}${path.includes("?") ? "&" : "?"}api-version=7.1`;
-}
-function jsonRequest$2(method, body) {
-	return {
-		method,
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(body)
-	};
-}
-function organizationFromCollectionUri$1(value) {
-	return value ? azureOrganizationFromUrl(value) : void 0;
-}
-function branchName(ref) {
-	return ref.replace(/^refs\/heads\//, "");
-}
-function repositoryWebUrl(organization, project, repository) {
-	return `https://dev.azure.com/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_git/${encodeURIComponent(repository)}`;
-}
-function trimLeadingSlash(value) {
-	return value.replace(/^\/+/, "");
-}
-//#endregion
-//#region src/hosts/bitbucket/schema.ts
-const bitbucketRepositorySchema = z.looseObject({
-	uuid: z.string().min(1),
-	name: z.string().min(1),
-	full_name: z.string().min(1),
-	slug: z.string().min(1).optional(),
-	links: z.looseObject({ html: z.looseObject({ href: z.string().url() }) })
-}).transform((repository) => ({
-	...repository,
-	slug: repository.slug ?? repository.full_name.split("/").at(-1) ?? repository.full_name
-}));
-//#endregion
-//#region src/hosts/bitbucket/client.ts
-const userSchema$1 = z.looseObject({
-	uuid: z.string().optional(),
-	nickname: z.string().optional(),
-	display_name: z.string().optional()
-});
-const endpointSchema = z.looseObject({
-	branch: z.looseObject({ name: z.string().min(1) }),
-	commit: z.looseObject({ hash: z.string().min(1) }),
-	repository: bitbucketRepositorySchema
-});
-const pullRequestSchema = z.looseObject({
-	id: z.number().int().positive(),
-	draft: z.boolean().optional(),
-	title: z.string(),
-	description: z.string().default(""),
-	author: userSchema$1.optional(),
-	source: endpointSchema,
-	destination: endpointSchema,
-	links: z.looseObject({ html: z.looseObject({ href: z.string().url() }) })
-});
-const inlineSchema = z.looseObject({
-	path: z.string().optional(),
-	from: z.number().int().nullable().optional(),
-	to: z.number().int().nullable().optional(),
-	start_from: z.number().int().nullable().optional(),
-	start_to: z.number().int().nullable().optional()
-});
-const commentSchema = z.looseObject({
-	id: z.union([z.number(), z.string()]).transform(String),
-	content: z.looseObject({ raw: z.string().default("") }),
-	user: userSchema$1.optional(),
-	parent: z.looseObject({ id: z.union([z.number(), z.string()]).transform(String) }).optional(),
-	inline: inlineSchema.optional(),
-	deleted: z.boolean().optional(),
-	resolution: z.looseObject({}).optional()
-});
-function createBitbucketClient(env = process.env, fetch = globalThis.fetch) {
-	const workspace = env.BITBUCKET_WORKSPACE;
-	const repository = env.BITBUCKET_REPO_SLUG;
-	const token = env.BITBUCKET_API_TOKEN;
-	const email = env.BITBUCKET_EMAIL;
-	if (!workspace) throw new Error("BITBUCKET_WORKSPACE is required for Bitbucket Cloud API calls");
-	if (!repository) throw new Error("BITBUCKET_REPO_SLUG is required for Bitbucket Cloud API calls");
-	if (!token || !email) throw new Error("BITBUCKET_EMAIL and BITBUCKET_API_TOKEN are required");
-	const authorization = `Basic ${Buffer.from(`${email}:${token}`).toString("base64")}`;
-	const repositoryApiPath = `/2.0/repositories/${encodeURIComponent(workspace)}/${encodeURIComponent(repository)}/`;
-	const api = createCodeHostHttpClient({
-		baseUrl: `https://api.bitbucket.org${repositoryApiPath}`,
-		headers: { Authorization: authorization },
-		fetch
-	});
-	const rootApi = createCodeHostHttpClient({
-		baseUrl: "https://api.bitbucket.org/2.0/",
-		headers: { Authorization: authorization },
-		fetch
-	});
-	const prPath = (id) => `pullrequests/${id}`;
-	return {
-		workspace,
-		repository,
-		async currentUser() {
-			const value = await rootApi.json("user", userSchema$1);
-			return {
-				uuid: value.uuid,
-				nickname: value.nickname,
-				displayName: value.display_name
-			};
-		},
-		async getRepository() {
-			const value = await api.json("", bitbucketRepositorySchema);
-			return {
-				uuid: value.uuid,
-				slug: value.slug,
-				fullName: value.full_name,
-				url: value.links.html.href
-			};
-		},
-		async getRepositoryPermission(actor, repositoryUuid) {
-			const permissionEmail = env.BITBUCKET_PERMISSION_EMAIL;
-			const permissionToken = env.BITBUCKET_PERMISSION_API_TOKEN;
-			if (!permissionEmail || !permissionToken) throw new Error("BITBUCKET_PERMISSION_EMAIL and BITBUCKET_PERMISSION_API_TOKEN are required for Bitbucket permission checks");
-			const permissionApi = createCodeHostHttpClient({
-				baseUrl: "https://api.bitbucket.org/2.0/",
-				headers: { Authorization: `Basic ${Buffer.from(`${permissionEmail}:${permissionToken}`).toString("base64")}` },
-				fetch
-			});
-			const query = encodeURIComponent(`repository.uuid="${escapeBitbucketQueryValue(repositoryUuid)}" AND user.nickname="${escapeBitbucketQueryValue(actor)}"`);
-			return (await permissionApi.json(`workspaces/${encodeURIComponent(workspace)}/permissions/repositories?q=${query}&pagelen=100`, pagedSchema(z.looseObject({
-				permission: z.enum([
-					"read",
-					"write",
-					"admin"
-				]),
-				user: userSchema$1
-			})))).values.find((entry) => entry.user.nickname === actor)?.permission ?? "none";
-		},
-		getPullRequest: (id) => api.json(prPath(id), pullRequestSchema),
-		async loadChange(options) {
-			if (options.workspace !== workspace || options.repository !== repository) throw new Error("Bitbucket client coordinates do not match the requested repository");
-			const pullRequest = await this.getPullRequest(options.changeNumber);
-			return {
-				repository: {
-					slug: pullRequest.destination.repository.full_name,
-					url: pullRequest.destination.repository.links.html.href
-				},
-				coordinates: {
-					provider: "bitbucket",
-					workspace,
-					repository,
-					repositoryUuid: pullRequest.destination.repository.uuid
-				},
-				change: {
-					number: pullRequest.id,
-					isDraft: pullRequest.draft,
-					title: pullRequest.title,
-					description: pullRequest.description,
-					url: pullRequest.links.html.href,
-					author: pullRequest.author?.nickname ? { login: pullRequest.author.nickname } : void 0,
-					base: {
-						sha: pullRequest.destination.commit.hash,
-						ref: pullRequest.destination.branch.name,
-						url: pullRequest.destination.repository.links.html.href
-					},
-					head: {
-						sha: pullRequest.source.commit.hash,
-						ref: pullRequest.source.branch.name,
-						url: pullRequest.source.repository.links.html.href
-					},
-					isFork: pullRequest.source.repository.uuid !== pullRequest.destination.repository.uuid
-				}
-			};
-		},
-		async listComments(id) {
-			return (await listAll(api, `${prPath(id)}/comments`, commentSchema, repositoryApiPath)).filter((comment) => !comment.deleted);
-		},
-		createComment: (id, body) => api.json(`${prPath(id)}/comments`, commentSchema, jsonRequest$1("POST", body)),
-		updateComment: (id, commentId, content) => api.json(`${prPath(id)}/comments/${encodeURIComponent(commentId)}`, commentSchema, jsonRequest$1("PUT", { content: { raw: content } })),
-		async replyToComment(id, commentId, content) {
-			const parentId = positiveCommentId(commentId);
-			return await api.json(`${prPath(id)}/comments`, commentSchema, jsonRequest$1("POST", {
-				content: { raw: content },
-				parent: { id: parentId }
-			}));
-		},
-		async resolveComment(id, commentId) {
-			positiveCommentId(commentId);
-			await api.json(`${prPath(id)}/comments/${encodeURIComponent(commentId)}/resolve`, z.unknown(), { method: "POST" });
-		},
-		async setStatus(sha, key, body) {
-			return (await api.json(`commit/${encodeURIComponent(sha)}/statuses/build`, z.looseObject({ key: z.string().default(key) }), jsonRequest$1("POST", {
-				...body,
-				key
-			}))).key;
-		}
-	};
-}
-function positiveCommentId(value) {
-	const id = Number(value);
-	if (!Number.isSafeInteger(id) || id <= 0) throw new Error("Bitbucket comment ID must be a positive integer");
-	return id;
-}
-function bitbucketStatusState(state) {
-	if (state === "pending") return "INPROGRESS";
-	if (state === "failure") return "FAILED";
-	if (state === "neutral") return "STOPPED";
-	return "SUCCESSFUL";
-}
-function escapeBitbucketQueryValue(value) {
-	return value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"");
-}
-function pagedSchema(item) {
-	return z.looseObject({
-		values: z.array(item),
-		next: z.string().url().optional()
-	});
-}
-async function listAll(api, path, schema, allowedPathPrefix) {
-	const values = [];
-	let next = path;
-	while (next) {
-		const page = await api.json(next, pagedSchema(schema));
-		values.push(...page.values);
-		if (page.next) {
-			const url = new URL(page.next);
-			if (url.origin !== "https://api.bitbucket.org" || !url.pathname.startsWith(allowedPathPrefix)) throw new Error("Bitbucket pagination URL must stay inside the configured repository API");
-		}
-		next = page.next;
-	}
-	return values;
-}
-function jsonRequest$1(method, body) {
-	return {
-		method,
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(body)
-	};
-}
-//#endregion
-//#region src/hosts/gitlab/client.ts
-const userSchema = z.looseObject({
-	id: z.number().int().positive(),
-	username: z.string().min(1)
-});
-const noteSchema = z.looseObject({
-	id: z.union([z.number(), z.string()]).transform(String),
-	body: z.string(),
-	author: userSchema.optional()
-});
-const positionSchema = z.looseObject({
-	new_path: z.string().optional(),
-	old_path: z.string().optional(),
-	new_line: z.number().int().positive().nullish().transform((value) => value ?? void 0),
-	old_line: z.number().int().positive().nullish().transform((value) => value ?? void 0),
-	line_range: z.looseObject({
-		start: z.looseObject({
-			new_line: z.number().int().positive().nullish(),
-			old_line: z.number().int().positive().nullish()
-		}),
-		end: z.looseObject({
-			new_line: z.number().int().positive().nullish(),
-			old_line: z.number().int().positive().nullish()
-		})
-	}).optional()
-});
-const discussionNoteSchema = noteSchema.extend({
-	resolvable: z.boolean().optional(),
-	resolved: z.boolean().optional(),
-	position: positionSchema.nullable().optional()
-});
-const discussionSchema = z.looseObject({
-	id: z.string().min(1),
-	individual_note: z.boolean().optional(),
-	notes: z.array(discussionNoteSchema)
-});
-const diffRefsSchema = z.looseObject({
-	base_sha: z.string().min(1),
-	start_sha: z.string().min(1),
-	head_sha: z.string().min(1)
-});
-const mergeRequestResponseSchema = z.looseObject({
-	iid: z.number().int().positive(),
-	title: z.string().default(""),
-	description: z.string().nullable().optional(),
-	web_url: z.string().url().optional(),
-	source_branch: z.string().min(1),
-	target_branch: z.string().min(1),
-	source_project_id: z.number().int().positive(),
-	target_project_id: z.number().int().positive(),
-	sha: z.string().min(1),
-	draft: z.boolean().optional(),
-	author: userSchema.optional(),
-	references: z.looseObject({ full: z.string().optional() }).optional(),
-	diff_refs: diffRefsSchema.nullable().optional()
-});
-const mergeRequestSchema = mergeRequestResponseSchema.extend({ diff_refs: diffRefsSchema });
-const memberSchema = z.looseObject({ access_level: z.number().int().min(0) });
-const statusSchema = z.looseObject({ id: z.union([z.number(), z.string()]).optional() });
-function createGitLabClient(env = process.env, fetch = globalThis.fetch, sleep = (milliseconds) => Bun.sleep(milliseconds)) {
-	const token = env.GITLAB_TOKEN ?? env.CI_JOB_TOKEN;
-	if (!token) throw new Error("GITLAB_TOKEN or CI_JOB_TOKEN is required for GitLab API calls");
-	const headers = env.GITLAB_TOKEN ? { "PRIVATE-TOKEN": token } : { "JOB-TOKEN": token };
-	const clientOptions = {
-		baseUrl: `${(env.CI_API_V4_URL ?? "https://gitlab.com/api/v4").replace(/\/$/, "")}/`,
-		headers,
-		fetch,
-		sleep: async (milliseconds) => void await sleep(milliseconds)
-	};
-	const api = createCodeHostHttpClient(clientOptions);
-	const statusApi = createCodeHostHttpClient({
-		...clientOptions,
-		retryNonIdempotentStatuses: [409]
-	});
-	return {
-		async getProject(project) {
-			const value = await api.json(`projects/${encodeURIComponent(project)}`, z.looseObject({
-				id: z.union([z.number(), z.string()]).transform(String),
-				path_with_namespace: z.string().min(1)
-			}));
-			return {
-				id: value.id,
-				path: value.path_with_namespace
-			};
-		},
-		currentUser: () => api.json("user", userSchema),
-		async loadChange(options) {
-			const mergeRequest = await this.getMergeRequest(options.projectId, options.changeNumber);
-			return {
-				repository: {
-					slug: options.projectPath,
-					url: projectWebUrl(mergeRequest.web_url)
-				},
-				coordinates: {
-					provider: "gitlab",
-					projectId: String(mergeRequest.target_project_id),
-					projectPath: options.projectPath
-				},
-				change: {
-					number: mergeRequest.iid,
-					title: mergeRequest.title,
-					description: mergeRequest.description ?? "",
-					url: mergeRequest.web_url,
-					author: mergeRequest.author ? { login: mergeRequest.author.username } : void 0,
-					base: {
-						sha: mergeRequest.diff_refs.start_sha,
-						ref: mergeRequest.target_branch
-					},
-					head: {
-						sha: mergeRequest.diff_refs.head_sha,
-						ref: mergeRequest.source_branch
-					},
-					isFork: mergeRequest.source_project_id !== mergeRequest.target_project_id,
-					isDraft: mergeRequest.draft
-				}
-			};
-		},
-		async getMergeRequest(projectId, changeNumber) {
-			const requestPath = `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}`;
-			for (let attempt = 0;; attempt += 1) {
-				const response = await api.json(requestPath, mergeRequestResponseSchema);
-				const prepared = mergeRequestSchema.safeParse(response);
-				if (prepared.success) return prepared.data;
-				if (attempt >= 4) throw new Error("GitLab merge request diff refs were not prepared after 5 attempts");
-				await sleep(250 * 2 ** attempt);
-			}
-		},
-		async getRepositoryPermission(projectId, username) {
-			const user = (await api.json(`users?username=${encodeURIComponent(username)}`, z.array(userSchema))).find((candidate) => candidate.username === username);
-			if (!user) return "none";
-			try {
-				return accessLevelPermission((await api.json(`projects/${encodeURIComponent(projectId)}/members/all/${user.id}`, memberSchema)).access_level);
-			} catch (error) {
-				if (error instanceof CodeHostHttpError && error.status === 404) return "none";
-				throw error;
-			}
-		},
-		listNotes: (projectId, changeNumber) => paginated(api, `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes`, noteSchema),
-		createNote: (projectId, changeNumber, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes`, noteSchema, jsonRequest("POST", { body })),
-		updateNote: (projectId, changeNumber, noteId, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes/${encodeURIComponent(noteId)}`, noteSchema, jsonRequest("PUT", { body })),
-		listDiscussions: (projectId, changeNumber) => paginated(api, `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions`, discussionSchema),
-		getDiscussion: (projectId, changeNumber, discussionId) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}`, discussionSchema),
-		async findReplyParent(projectId, changeNumber, noteId, discussionId) {
-			if (!discussionId) return void 0;
-			const discussion = await this.getDiscussion(projectId, changeNumber, discussionId);
-			if (!discussion.notes.some((note) => note.id === noteId) || discussion.notes[0]?.id === noteId) return;
-			return discussion.notes[0]?.id;
-		},
-		createDiscussion: (projectId, changeNumber, body, position) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions`, discussionSchema, jsonRequest("POST", {
-			body,
-			position
-		})),
-		replyDiscussion: (projectId, changeNumber, discussionId, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}/notes`, noteSchema, jsonRequest("POST", { body })),
-		async resolveDiscussion(projectId, changeNumber, discussionId) {
-			await api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}`, discussionSchema, jsonRequest("PUT", { resolved: true }));
-		},
-		async setStatus(projectId, sha, name, state, description) {
-			const status = await statusApi.json(`projects/${encodeURIComponent(projectId)}/statuses/${encodeURIComponent(sha)}`, statusSchema, jsonRequest("POST", {
-				state: gitLabStatusState(state),
-				name,
-				description: boundedStatusDescription(description)
-			}));
-			return String(status.id ?? name);
-		}
-	};
-}
-const MAX_PAGINATION_PAGES = 100;
-async function paginated(client, path, schema) {
-	const values = [];
-	for (let page = 1; page <= MAX_PAGINATION_PAGES; page += 1) {
-		const separator = path.includes("?") ? "&" : "?";
-		const batch = await client.json(`${path}${separator}per_page=100&page=${page}`, z.array(schema));
-		values.push(...batch);
-		if (batch.length < 100) return values;
-	}
-	throw new Error(`GitLab pagination exceeded ${MAX_PAGINATION_PAGES} pages for ${path}`);
-}
-function jsonRequest(method, body) {
-	return {
-		method,
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(body)
-	};
-}
-function accessLevelPermission(level) {
-	if (level >= 50) return "admin";
-	if (level >= 40) return "maintain";
-	if (level >= 30) return "write";
-	if (level >= 15) return "triage";
-	if (level >= 10) return "read";
-	return "none";
-}
-function boundedStatusDescription(description) {
-	return description && description.length > 255 ? `${description.slice(0, 252).trimEnd()}...` : description;
-}
-function gitLabStatusState(state) {
-	switch (state) {
-		case "pending": return "pending";
-		case "success": return "success";
-		case "failure": return "failed";
-		case "neutral": return "skipped";
-	}
-}
-function projectWebUrl(mergeRequestUrl) {
-	return mergeRequestUrl?.replace(/\/-\/merge_requests\/\d+$/, "");
-}
-//#endregion
-//#region src/diff/git.ts
-function runGit$1(args, cwd, maxBuffer) {
-	const result = Bun.spawnSync(["git", ...args], {
-		cwd,
-		env: process.env,
-		maxBuffer,
-		stderr: "pipe",
-		stdout: "pipe"
-	});
-	if (result.exitCode !== 0) {
-		const failure = result.stderr?.toString().trim() || "unknown error";
-		throw new Error(`git ${args.join(" ")} failed: ${failure}`);
-	}
-	return result.stdout.toString();
-}
-//#endregion
-//#region src/diff/diff.ts
-const lockFilePattern = /(^|\/)(bun\.lock|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|Cargo\.lock)$/;
-const generatedPattern = /(^|\/)(dist|build|coverage|vendor)\//;
-const maxInlineChangedLines = 1e3;
-const maxCommentableRangeLines = 5e3;
-function buildDiffManifest(options) {
-	const mergeBaseSha = runGit$1([
-		"merge-base",
-		options.baseSha,
-		options.headSha
-	], options.cwd).trim();
-	const diffHead = options.includeWorkingTree ? void 0 : options.headSha;
-	const nameStatus = runGit$1(buildDiffArgs([
-		"--name-status",
-		"-z",
-		"--find-renames"
-	], mergeBaseSha, diffHead), options.cwd);
-	const diffStats = getDiffStats(options.cwd, mergeBaseSha, diffHead);
-	const rawPatch = parseRawPatch(runGit$1(buildUnifiedDiffArgs(mergeBaseSha, diffHead, getPreExcludedFiles(diffStats)), options.cwd));
-	const files = parseNameStatus(nameStatus);
-	const parsedDiff = parseUnifiedDiff(rawPatch.patch, rawPatch.filePaths);
-	for (const file of files) {
-		const stats = diffStats.get(file.path);
-		file.additions = stats?.additions ?? 0;
-		file.deletions = stats?.deletions ?? 0;
-		const preExcludedReason = stats?.excludedReason;
-		const parsedFile = parsedDiff.get(file.path);
-		file.hunks = preExcludedReason ? [] : parsedFile?.hunks ?? [];
-		file.commentableRanges = preExcludedReason ? [] : parsedFile?.commentableRanges ?? [];
-		const excludedReason = preExcludedReason ?? getExcludedReason(file);
-		if (excludedReason) {
-			file.hunks = [];
-			file.commentableRanges = [];
-			file.excludedReason = excludedReason;
-		}
-	}
-	return parseDiffManifest({
-		baseSha: options.baseSha,
-		headSha: options.headSha,
-		mergeBaseSha,
-		files
-	});
-}
-function parseNameStatus(output) {
-	const fields = output.split("\0");
-	const files = [];
-	let index = 0;
-	while (index < fields.length) {
-		const rawStatus = fields[index++];
-		if (!rawStatus) continue;
-		const firstPath = fields[index++] ?? "";
-		const status = parseFileStatus(rawStatus);
-		if (status === "renamed") {
-			const secondPath = fields[index++] ?? "";
-			files.push(baseFile(secondPath || firstPath, status, firstPath));
-			continue;
-		}
-		files.push(baseFile(firstPath, status));
-	}
-	return files;
-}
-function parseUnifiedDiff(diff, filePaths) {
-	const state = createDiffParserState(filePaths);
-	for (const line of diff.split("\n")) parseUnifiedDiffLine(state, line);
-	finishActiveHunk(state);
-	return state.filesByPath;
-}
-function getDiffStats(cwd, baseSha, headSha) {
-	const output = runGit$1(buildDiffArgs([
-		"--numstat",
-		"-z",
-		"--find-renames"
-	], baseSha, headSha), cwd);
-	const stats = /* @__PURE__ */ new Map();
-	for (const stat of parseNumstat(output)) {
-		if (stat.binary) {
-			stats.set(stat.path, {
-				additions: 0,
-				deletions: 0,
-				excludedReason: "binary diff"
-			});
-			continue;
-		}
-		stats.set(stat.path, {
-			additions: stat.additions,
-			deletions: stat.deletions,
-			excludedReason: stat.additions + stat.deletions > maxInlineChangedLines ? "oversized diff" : void 0
-		});
-	}
-	return stats;
-}
-function getPreExcludedFiles(stats) {
-	const excluded = /* @__PURE__ */ new Map();
-	for (const [filePath, stat] of stats) if (stat.excludedReason) excluded.set(filePath, stat.excludedReason);
-	return excluded;
-}
-function buildUnifiedDiffArgs(baseSha, headSha, excludedFiles) {
-	const args = buildDiffArgs([
-		"--raw",
-		"-z",
-		"--patch",
-		"--submodule=short",
-		"--unified=80",
-		"--find-renames"
-	], baseSha, headSha);
-	if (excludedFiles.size === 0) return args;
-	return [
-		...args,
-		"--",
-		".",
-		...[...excludedFiles.keys()].map((filePath) => `:(exclude,literal)${filePath}`)
-	];
-}
-function buildDiffArgs(options, baseSha, headSha) {
-	return headSha ? [
-		"diff",
-		...options,
-		baseSha,
-		headSha
-	] : [
-		"diff",
-		...options,
-		baseSha
-	];
-}
-function parseNumstat(output) {
-	const fields = output.split("\0");
-	const stats = [];
-	let index = 0;
-	while (index < fields.length) {
-		const header = parseNumstatHeader(fields[index++] ?? "");
-		if (!header) continue;
-		const resolvedPath = resolveNumstatPath(header.path, fields, index);
-		index = resolvedPath.nextIndex;
-		const filePath = resolvedPath.path;
-		if (!filePath) continue;
-		const binary = header.rawAdditions === "-" || header.rawDeletions === "-";
-		stats.push({
-			path: filePath,
-			additions: binary ? 0 : Number(header.rawAdditions),
-			deletions: binary ? 0 : Number(header.rawDeletions),
-			binary
-		});
-	}
-	return stats;
+function parseNumstat(output) {
+	const fields = output.split("\0");
+	const stats = [];
+	let index = 0;
+	while (index < fields.length) {
+		const header = parseNumstatHeader(fields[index++] ?? "");
+		if (!header) continue;
+		const resolvedPath = resolveNumstatPath(header.path, fields, index);
+		index = resolvedPath.nextIndex;
+		const filePath = resolvedPath.path;
+		if (!filePath) continue;
+		const binary = header.rawAdditions === "-" || header.rawDeletions === "-";
+		stats.push({
+			path: filePath,
+			additions: binary ? 0 : Number(header.rawAdditions),
+			deletions: binary ? 0 : Number(header.rawDeletions),
+			binary
+		});
+	}
+	return stats;
 }
 function resolveNumstatPath(path, fields, nextIndex) {
 	if (path) return {
@@ -2202,11 +1382,15 @@ function parseFileStatus(rawStatus) {
 	return "modified";
 }
 function getExcludedReason(file) {
+	const pathExcludedReason = getPathExcludedReason(file);
+	if (pathExcludedReason) return pathExcludedReason;
+	if (file.additions + file.deletions > maxInlineChangedLines) return "oversized diff";
+	if (commentableRangeLineCount(file.commentableRanges) > maxCommentableRangeLines) return "oversized diff";
+}
+function getPathExcludedReason(file) {
 	if (file.status === "removed") return "removed file";
 	if (lockFilePattern.test(file.path)) return "lock file";
 	if (generatedPattern.test(file.path)) return "generated or build output";
-	if (file.additions + file.deletions > maxInlineChangedLines) return "oversized diff";
-	if (commentableRangeLineCount(file.commentableRanges) > maxCommentableRangeLines) return "oversized diff";
 }
 function commentableRangeLineCount(ranges) {
 	return ranges.reduce((total, range) => total + range.endLine - range.startLine + 1, 0);
@@ -3693,7 +2877,7 @@ function createRuntimeLog(options) {
 		},
 		text(level, event, text) {
 			if (level === "debug" && !debugEnabled) return;
-			emitRecord(sink, secrets, level, event, void 0, redact(text, secrets));
+			emitRecord(sink, secrets, level, event, void 0, redact$1(text, secrets));
 		},
 		textSnippet(level, event, text, snippetOptions) {
 			if (level === "debug" && !debugEnabled) return;
@@ -3703,7 +2887,7 @@ function createRuntimeLog(options) {
 			return formatTextSnippet(text, secrets, snippetOptions);
 		},
 		async group(name, run) {
-			return await sink.group(redact(name, secrets), run);
+			return await sink.group(redact$1(name, secrets), run);
 		},
 		addSecret(value) {
 			addSecret(secrets, value);
@@ -3726,25 +2910,25 @@ function boundedLogSnippet(text, options) {
 function addSecret(secrets, value) {
 	if (value && value.length >= 4) secrets.add(value);
 }
-function redact(message, secrets) {
+function redact$1(message, secrets) {
 	let redacted = message;
 	for (const secret of secrets) redacted = redacted.split(secret).join("***");
 	return redacted;
 }
 function compactFields(fields, secrets) {
 	const compact = {};
-	for (const [key, value] of Object.entries(fields ?? {})) if (typeof value === "string") compact[key] = redact(value, secrets);
-	else if (Array.isArray(value)) compact[key] = value.map((item) => redact(item, secrets));
+	for (const [key, value] of Object.entries(fields ?? {})) if (typeof value === "string") compact[key] = redact$1(value, secrets);
+	else if (Array.isArray(value)) compact[key] = value.map((item) => redact$1(item, secrets));
 	else if (value !== void 0) compact[key] = value;
 	return compact;
 }
 function formatTextSnippet(text, secrets, options) {
-	return boundedLogSnippet(redact(text, secrets), options);
+	return boundedLogSnippet(redact$1(text, secrets), options);
 }
 function emitRecord(sink, secrets, level, event, fields, text) {
 	sink.log({
 		level,
-		event: redact(event, secrets),
+		event: redact$1(event, secrets),
 		fields: compactFields(fields, secrets),
 		text
 	});
@@ -3837,6 +3021,146 @@ function findingFingerprint(finding) {
 	return new Bun.CryptoHasher("sha256").update(basis).digest("hex").slice(0, 16);
 }
 //#endregion
+//#region src/review/agent/review-schema.ts
+const reviewFindingPropertyNames = [
+	"body",
+	"path",
+	"rangeId",
+	"side",
+	"startLine",
+	"endLine"
+];
+const completeReviewFindingPropertyMask = (1 << reviewFindingPropertyNames.length) - 1;
+const unresolvedSchemaReference = Symbol("unresolvedSchemaReference");
+const singleSchemaKeywords = [
+	"additionalItems",
+	"additionalProperties",
+	"contains",
+	"else",
+	"if",
+	"items",
+	"then",
+	"unevaluatedProperties"
+];
+const schemaArrayKeywords = [
+	"allOf",
+	"anyOf",
+	"oneOf",
+	"prefixItems"
+];
+const schemaMapKeywords = [
+	"dependentSchemas",
+	"patternProperties",
+	"properties"
+];
+const alternativeSchemaKeywords = ["anyOf", "oneOf"];
+function schemaContainsReviewFinding(value) {
+	if (!isRecord(value)) return false;
+	return reachableSchemaContainsReviewFinding(value, value, /* @__PURE__ */ new Set());
+}
+function reachableSchemaContainsReviewFinding(schema, rootSchema, visited) {
+	if (Array.isArray(schema)) return schema.some((child) => reachableSchemaContainsReviewFinding(child, rootSchema, visited));
+	if (!isRecord(schema) || visited.has(schema)) return false;
+	visited.add(schema);
+	return schemaObjectPropertyMasks(schema, rootSchema, /* @__PURE__ */ new Set()).has(completeReviewFindingPropertyMask) || reachableChildSchemas(schema, rootSchema).some((child) => reachableSchemaContainsReviewFinding(child, rootSchema, visited));
+}
+function reachableChildSchemas(schema, rootSchema) {
+	const referencedSchema = resolveLocalSchemaReference(rootSchema, schema.$ref);
+	return [
+		...referencedSchema === void 0 ? [] : [referencedSchema],
+		...singleSchemaKeywords.map((keyword) => schema[keyword]),
+		...schemaArrayKeywords.flatMap((keyword) => Array.isArray(schema[keyword]) ? schema[keyword] : []),
+		...schemaMapKeywords.flatMap((keyword) => {
+			const children = schema[keyword];
+			return isRecord(children) ? Object.values(children) : [];
+		})
+	];
+}
+function schemaObjectPropertyMasks(schema, rootSchema, visited) {
+	if (schema === true || visited.has(schema)) return /* @__PURE__ */ new Set([0]);
+	if (!isRecord(schema) || !schemaAllowsObject(schema, rootSchema, /* @__PURE__ */ new Set())) return /* @__PURE__ */ new Set();
+	visited.add(schema);
+	const conjunctiveMasks = conjunctiveSchemas(schema, rootSchema).reduce((masks, child) => combinePropertyMasks(masks, schemaObjectPropertyMasks(child, rootSchema, new Set(visited))), /* @__PURE__ */ new Set([reviewFindingPropertyMask(schema)]));
+	return alternativeSchemaGroups(schema).reduce((masks, alternatives) => combinePropertyMasks(masks, alternativePropertyMasks(alternatives, rootSchema, visited)), conjunctiveMasks);
+}
+function conjunctiveSchemas(schema, rootSchema) {
+	const referencedSchema = resolveLocalSchemaReference(rootSchema, schema.$ref);
+	const allOf = Array.isArray(schema.allOf) ? schema.allOf : [];
+	return referencedSchema === void 0 ? allOf : [referencedSchema, ...allOf];
+}
+function alternativeSchemaGroups(schema) {
+	return alternativeSchemaKeywords.map((keyword) => schema[keyword]).filter((alternatives) => Array.isArray(alternatives));
+}
+function alternativePropertyMasks(alternatives, rootSchema, visited) {
+	return new Set(alternatives.flatMap((child) => [...schemaObjectPropertyMasks(child, rootSchema, new Set(visited))]));
+}
+function reviewFindingPropertyMask(schema) {
+	let mask = 0;
+	const properties = isRecord(schema.properties) ? schema.properties : {};
+	const patternProperties = isRecord(schema.patternProperties) ? schema.patternProperties : {};
+	const propertyPatterns = Object.keys(patternProperties).flatMap((pattern) => {
+		try {
+			return [new RegExp(pattern)];
+		} catch {
+			return [];
+		}
+	});
+	const required = new Set(Array.isArray(schema.required) ? schema.required.filter((propertyName) => typeof propertyName === "string") : []);
+	for (const [index, propertyName] of reviewFindingPropertyNames.entries()) if (propertyName in properties || required.has(propertyName) || propertyPatterns.some((pattern) => pattern.test(propertyName))) mask |= 1 << index;
+	return mask;
+}
+function combinePropertyMasks(left, right) {
+	const combined = /* @__PURE__ */ new Set();
+	for (const leftMask of left) for (const rightMask of right) {
+		combined.add(leftMask | rightMask);
+		if (combined.has(completeReviewFindingPropertyMask)) return /* @__PURE__ */ new Set([completeReviewFindingPropertyMask]);
+	}
+	return combined;
+}
+function schemaAllowsObject(schema, rootSchema, visited) {
+	if (schema === false) return false;
+	if (schema === true || !isRecord(schema) || visited.has(schema)) return true;
+	visited.add(schema);
+	return directSchemaAllowsObject(schema) && conjunctiveSchemas(schema, rootSchema).every((child) => schemaAllowsObject(child, rootSchema, new Set(visited))) && alternativeSchemaGroups(schema).every((alternatives) => alternatives.some((child) => schemaAllowsObject(child, rootSchema, new Set(visited))));
+}
+function directSchemaAllowsObject(schema) {
+	const type = schema.type;
+	if (typeof type === "string") return type === "object";
+	if (Array.isArray(type) && !type.includes("object")) return false;
+	if ("const" in schema && !isRecord(schema.const)) return false;
+	return !Array.isArray(schema.enum) || schema.enum.some(isRecord);
+}
+function resolveLocalSchemaReference(rootSchema, reference) {
+	if (reference === "#") return rootSchema;
+	if (typeof reference !== "string" || !reference.startsWith("#/")) return;
+	let current = rootSchema;
+	for (const encodedSegment of reference.slice(2).split("/")) {
+		const segment = decodePointerSegment(encodedSegment);
+		if (segment === void 0) return;
+		current = resolvePointerSegment(current, segment);
+		if (current === unresolvedSchemaReference) return;
+	}
+	return current;
+}
+function decodePointerSegment(encodedSegment) {
+	try {
+		return decodeURIComponent(encodedSegment).replaceAll("~1", "/").replaceAll("~0", "~");
+	} catch {
+		return;
+	}
+}
+function resolvePointerSegment(current, segment) {
+	if (Array.isArray(current)) return resolveArrayPointerSegment(current, segment);
+	if (!isRecord(current) || !(segment in current)) return unresolvedSchemaReference;
+	return current[segment];
+}
+function resolveArrayPointerSegment(current, segment) {
+	if (!/^(0|[1-9]\d*)$/.test(segment)) return unresolvedSchemaReference;
+	const index = Number(segment);
+	if (!Number.isSafeInteger(index) || index >= current.length) return unresolvedSchemaReference;
+	return current[index];
+}
+//#endregion
 //#region src/review/agent/agent-prompt.ts
 async function renderAgentPrompt(options) {
 	const prompt = await renderAgentDefinitionPrompt(options.agent, options.input, options.agentRunContext.prompt);
@@ -3893,12 +3217,12 @@ function outputPrompt(schema) {
 	]);
 	if (schema.id === reviewResultSchemaId) {
 		lines.splice(2, 0, `Example:\n${JSON.stringify(reviewSchemaExample$1(), null, 2)}`, ...suggestedFixRules);
-		lines.push("For inlineFindings, use only fields shown in the schema. Each finding's path, rangeId, and side must identify one Diff Manifest commentable range, and its startLine and endLine must select a valid span within that range. If no valid span applies, omit the finding.", ...inlineSelectionPromptLines(), `For inlineFindings.body, write the exact inline comment body. Use one short paragraph, at most two sentences, and at most 700 characters. Treat 700 as a hard ceiling, not a target; prefer 250-450 characters when possible.`);
+		lines.push("For inlineFindings, use only fields shown in the schema. Each finding's path, rangeId, and side must identify one Diff Manifest commentable range, and its startLine and endLine must select a valid span within that range. If no valid span applies, omit the finding.", ...inlineSelectionPromptLines(), "For inlineFindings.body, write the exact inline comment body.");
 	} else if (schemaMentionsField(schema.jsonSchema, "suggestedFix")) lines.splice(2, 0, ...suggestedFixRules);
 	return lines.join("\n\n");
 }
 function customInlineSelectionPrompt(schema, diffManifest) {
-	if (!diffManifest || schema.id === reviewResultSchemaId) return;
+	if (!diffManifest || schema.id === reviewResultSchemaId || !schemaContainsReviewFinding(schema.jsonSchema)) return;
 	return promptSection("Inline Review Selection Policy", inlineSelectionPromptLines().join("\n"));
 }
 function inlineSelectionPromptLines() {
@@ -3922,16 +3246,16 @@ function schemaMentionsField(value, fieldName) {
 	return Object.entries(value).some(([key, child]) => key === fieldName || schemaMentionsField(child, fieldName));
 }
 function reviewPolicyPrompt(schema) {
-	if (schema.id !== reviewResultSchemaId) return;
+	if (schema.id !== reviewResultSchemaId && !schemaContainsReviewFinding(schema.jsonSchema)) return;
 	return promptSection("Review Policy", [
 		"Review only changed behavior.",
 		"Report only actionable defects, security risks, regressions, or meaningful test gaps.",
 		"Before emitting a finding, verify that the changed code introduces or exposes the issue, repository evidence supports it, and the impact is concrete. If any part is uncertain, omit it.",
 		"When changed behavior crosses a function, type, API, configuration, or data boundary, inspect relevant callers, callees, and tests before deciding whether the change is defective or intentionally coordinated.",
-		"Put each actionable issue in inlineFindings. Do not leave actionable defects or test gaps only in the summary.",
-		"Base the summary only on changed behavior and evidence available in the Diff Manifest or read tools. Do not claim tests or checks ran, passed, or failed unless their output is present.",
-		"Inline finding bodies are final code-review comments, not analysis notes.",
-		`State the concrete defect and user-visible or runtime impact directly. Keep each body to one short paragraph, at most two sentences, and at most 700 characters.`,
+		"Put each actionable issue in the schema's finding collection. Do not leave actionable defects or test gaps only in the summary.",
+		"When the output includes a summary, base it only on changed behavior and evidence available in the Diff Manifest or read tools. Do not claim tests or checks ran, passed, or failed unless their output is present.",
+		"Finding bodies must be publication-ready review prose, not analysis notes.",
+		`State the concrete defect and user-visible or runtime impact directly. Keep each body to one short paragraph, at most two sentences, and at most 700 characters. Treat 700 as a hard ceiling, not a target; prefer 250-450 characters when possible.`,
 		"Do not include step-by-step reasoning, broad context, praise, restated diff, alternatives, or code snippets unless they are necessary to identify the defect.",
 		"Never copy a secret-looking literal from changed code into the review summary, inline finding body, or suggestedFix. Describe only the secret kind and location.",
 		"Omit speculative, style-only, broad refactor, external-fact, and out-of-diff findings.",
@@ -3950,14 +3274,15 @@ function pathScopePrompt(paths) {
 	].join("\n");
 }
 function priorFindingsPrompt(state) {
-	const openFindings = state?.findings.filter((finding) => finding.status === "open") ?? [];
-	if (openFindings.length === 0) return;
+	const findings = state?.findings.filter((finding) => finding.status === "open") ?? [];
+	if (findings.length === 0) return;
 	return [
 		"Prior pipr findings:",
 		JSON.stringify({
 			reviewedHeadSha: state?.reviewedHeadSha,
-			findings: openFindings.map((finding) => ({
+			findings: findings.map((finding) => ({
 				id: finding.id,
+				status: finding.status,
 				path: finding.path,
 				rangeId: finding.rangeId,
 				side: finding.side,
@@ -4446,6 +3771,8 @@ const findingIdSchema = z.string().min(1).regex(/^[A-Za-z0-9_.-]+$/);
 const priorFindingStatusSchema = z.enum(["open", "resolved"]);
 const priorFindingRecordSchema = z.strictObject({
 	id: findingIdSchema,
+	anchorFingerprint: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+	issueFingerprint: z.string().regex(/^[a-f0-9]{64}$/).optional(),
 	status: priorFindingStatusSchema,
 	path: z.string().min(1),
 	rangeId: z.string().min(1),
@@ -4469,33 +3796,23 @@ function buildPriorReviewState(options) {
 	const nextFindings = /* @__PURE__ */ new Map();
 	const usedPriorIds = /* @__PURE__ */ new Set();
 	const stats = accumulateReviewStats(scopedPriorState?.stats, options.stats);
-	for (const finding of options.findings) {
-		const id = selectFindingId({
+	const findings = options.findings.map((item) => item.finding);
+	const fingerprintCounts = countFindingFingerprints(options.findings);
+	for (const { finding, anchorFingerprint, issueFingerprint, previousPath } of options.findings) {
+		const record = buildFindingRecord({
 			finding,
-			findings: options.findings,
+			findings,
 			priorFindings,
-			usedPriorIds
+			usedPriorIds,
+			reviewedHeadSha: options.reviewedHeadSha,
+			anchorFingerprint,
+			issueFingerprint,
+			previousPath,
+			fingerprintCounts
 		});
-		const prior = priorFindings.get(id);
-		if (prior) usedPriorIds.add(prior.id);
-		const record = {
-			id,
-			status: "open",
-			path: finding.path,
-			rangeId: finding.rangeId,
-			side: finding.side,
-			startLine: finding.startLine,
-			endLine: finding.endLine,
-			firstSeenHeadSha: prior?.firstSeenHeadSha ?? options.reviewedHeadSha,
-			lastSeenHeadSha: options.reviewedHeadSha,
-			...prior?.lastCommentedHeadSha ? { lastCommentedHeadSha: prior.lastCommentedHeadSha } : {}
-		};
-		nextFindings.set(id, record);
-	}
-	for (const prior of priorFindings.values()) {
-		if (nextFindings.has(prior.id)) continue;
-		nextFindings.set(prior.id, prior);
+		nextFindings.set(record.id, record);
 	}
+	addHistoricalFindings(nextFindings, priorFindings.values());
 	return {
 		version: 1,
 		reviewedHeadSha: options.reviewedHeadSha,
@@ -4504,6 +3821,57 @@ function buildPriorReviewState(options) {
 		...stats ? { stats } : {}
 	};
 }
+function buildFindingRecord(options) {
+	const selection = selectPriorFindingRecord(options);
+	const prior = options.priorFindings.get(selection.id);
+	markPriorFindingUsed(options.usedPriorIds, prior);
+	return {
+		id: selection.id,
+		...findingIdentity(options.anchorFingerprint, options.issueFingerprint),
+		status: selection.status,
+		path: options.finding.path,
+		rangeId: options.finding.rangeId,
+		side: options.finding.side,
+		startLine: options.finding.startLine,
+		endLine: options.finding.endLine,
+		...findingHistory(prior, options.reviewedHeadSha)
+	};
+}
+function selectPriorFindingRecord(options) {
+	const resolvedMatch = matchResolvedFindingRecord([...options.priorFindings.values()], options.finding, options.anchorFingerprint, options.issueFingerprint, options.fingerprintCounts, options.previousPath);
+	if (resolvedMatch) return {
+		id: resolvedMatch.id,
+		status: "resolved"
+	};
+	return {
+		id: selectFindingId({
+			finding: options.finding,
+			findings: options.findings,
+			priorFindings: options.priorFindings,
+			usedPriorIds: options.usedPriorIds
+		}),
+		status: "open"
+	};
+}
+function markPriorFindingUsed(usedPriorIds, prior) {
+	if (prior) usedPriorIds.add(prior.id);
+}
+function findingIdentity(anchorFingerprint, issueFingerprint) {
+	return {
+		...anchorFingerprint ? { anchorFingerprint } : {},
+		...issueFingerprint ? { issueFingerprint } : {}
+	};
+}
+function findingHistory(prior, reviewedHeadSha) {
+	return {
+		firstSeenHeadSha: prior?.firstSeenHeadSha ?? reviewedHeadSha,
+		lastSeenHeadSha: reviewedHeadSha,
+		...prior?.lastCommentedHeadSha ? { lastCommentedHeadSha: prior.lastCommentedHeadSha } : {}
+	};
+}
+function addHistoricalFindings(findings, historicalFindings) {
+	for (const finding of historicalFindings) if (!findings.has(finding.id)) findings.set(finding.id, finding);
+}
 function resolvePriorFindings(state, findingIds) {
 	const resolved = new Set(findingIds);
 	return {
@@ -4523,6 +3891,22 @@ function matchFindingRecord(state, finding) {
 	if (deterministic) return deterministic;
 	return findOpenOverlappingFinding(state.findings, finding);
 }
+function matchResolvedFindingRecord(records, finding, anchorFingerprint, issueFingerprint, currentFingerprintCounts, previousPath) {
+	if (!anchorFingerprint || !issueFingerprint || (currentFingerprintCounts?.get(findingFingerprintKey(finding.path, anchorFingerprint, issueFingerprint)) ?? 1) !== 1) return;
+	const candidates = records.filter((record) => record.anchorFingerprint === anchorFingerprint && record.issueFingerprint === issueFingerprint && (record.path === finding.path || record.path === previousPath));
+	return candidates.length === 1 && candidates[0]?.status === "resolved" ? candidates[0] : void 0;
+}
+function countFindingFingerprints(findings) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const { finding, anchorFingerprint, issueFingerprint } of findings) if (anchorFingerprint && issueFingerprint) {
+		const key = findingFingerprintKey(finding.path, anchorFingerprint, issueFingerprint);
+		counts.set(key, (counts.get(key) ?? 0) + 1);
+	}
+	return counts;
+}
+function findingFingerprintKey(path, anchorFingerprint, issueFingerprint) {
+	return `${path}\0${anchorFingerprint}\0${issueFingerprint}`;
+}
 function renderMainCommentMarker(options) {
 	return `<!-- ${options.marker} change=${options.changeNumber} version=1 state=${encodeReviewState({
 		...options.reviewState,
@@ -4587,6 +3971,20 @@ function applyResolvedFindingMarkers(state, commentBodies) {
 		}))
 	};
 }
+function applyNativeThreadResolutions(state, resolutions) {
+	const resolutionByFinding = new Map(resolutions.map((resolution) => [`${resolution.findingId}:${resolution.findingHeadSha}`, resolution.resolved]));
+	return {
+		...state,
+		findings: state.findings.map((finding) => {
+			if (!finding.lastCommentedHeadSha) return finding;
+			const resolved = resolutionByFinding.get(`${finding.id}:${finding.lastCommentedHeadSha}`);
+			return resolved === void 0 ? finding : {
+				...finding,
+				status: resolved ? "resolved" : "open"
+			};
+		})
+	};
+}
 function extractVerifierResponseMarkers(commentBodies) {
 	return new Set(extractMarkerRecords(commentBodies, verifierResponseMarkerPrefix).map((record) => record.marker));
 }
@@ -4782,7 +4180,7 @@ function publicationPlanForHostCapabilities(plan, capabilities) {
 }
 function buildPublicationPlan(options) {
 	const reviewState = options.reviewState ?? buildPriorReviewState({
-		findings: options.inlineItems.map((item) => item.finding),
+		findings: options.inlineItems.map((item) => ({ finding: item.finding })),
 		reviewedHeadSha: options.metadata.reviewedHeadSha,
 		selectedTasks: options.metadata.selectedTasks
 	});
@@ -4827,10 +4225,12 @@ function preparePublishableInlineFindings(options) {
 }
 function prepareInlinePublicationItemsForPublishableFindings(options) {
 	const seenFindingIds = /* @__PURE__ */ new Set();
-	return inlinePublicationItemsSchema.parse(options.publishableFindings.flatMap(({ finding: publishableFinding, range, previousPath }) => {
+	const fingerprintCounts = countFindingFingerprints(options.publishableFindings);
+	return inlinePublicationItemsSchema.parse(options.publishableFindings.flatMap(({ finding: publishableFinding, range, previousPath, anchorFingerprint, issueFingerprint }) => {
 		const findingId = findingIdFor(publishableFinding, options.reviewState);
 		const stateRecord = options.reviewState ? matchFindingRecord(options.reviewState, publishableFinding) : void 0;
-		if (seenFindingIds.has(findingId) || stateRecord?.lastCommentedHeadSha === options.reviewedHeadSha) return [];
+		const resolvedRecord = options.reviewState ? matchResolvedFindingRecord(options.reviewState.findings, publishableFinding, anchorFingerprint, issueFingerprint, fingerprintCounts, previousPath) : void 0;
+		if (seenFindingIds.has(findingId) || resolvedRecord !== void 0 || stateRecord?.lastCommentedHeadSha === options.reviewedHeadSha) return [];
 		seenFindingIds.add(findingId);
 		const marker = inlineFindingMarker(findingId, options.reviewedHeadSha);
 		return [inlinePublicationItemSchema.parse({
@@ -4977,10 +4377,17 @@ function buildCommentPublishingPlan(options) {
 	const publishableInlineFindings = preparePublishableInlineFindings({
 		validated: options.validated,
 		manifest: options.manifest
+	}).map((item) => {
+		const fingerprint = selectedCodeFingerprint(item.finding, item.range);
+		return fingerprint ? {
+			...item,
+			anchorFingerprint: fingerprint,
+			issueFingerprint: findingIssueFingerprint(item.finding)
+		} : item;
 	});
 	const reviewState = buildPriorReviewState({
 		priorState: options.priorReviewState,
-		findings: publishableInlineFindings.map((item) => item.finding),
+		findings: publishableInlineFindings,
 		reviewedHeadSha: options.event.change.head.sha,
 		selectedTasks: options.metadata.selectedTasks,
 		stats: options.metadata.stats
@@ -5011,6 +4418,20 @@ function buildCommentPublishingPlan(options) {
 		inlineCommentDrafts: publicationPlan.inlineItems
 	};
 }
+function selectedCodeFingerprint(finding, range) {
+	if (range.preview === void 0) return;
+	const lines = range.preview.replaceAll("\r\n", "\n").replaceAll("\r", "\n").split("\n");
+	const startOffset = finding.startLine - range.startLine;
+	const endOffset = finding.endLine - range.startLine + 1;
+	if (startOffset < 0 || endOffset > lines.length) return;
+	const selected = lines.slice(startOffset, endOffset).map((line) => line.trimEnd()).join("\n");
+	return new Bun.CryptoHasher("sha256").update(selected).digest("hex");
+}
+function findingIssueFingerprint(finding) {
+	const identity = finding.body.normalize("NFKC").toLowerCase().replace(/<[^>]*>/g, " ").replace(/\[([^\]]+)\]\([^)]*\)/g, "$1").replace(/[^\p{L}\p{N}_]+/gu, " ").trim().replace(/\s+/g, " ") || finding.body.normalize("NFKC").toLowerCase().trim();
+	if (!identity) return;
+	return new Bun.CryptoHasher("sha256").update(identity).digest("hex");
+}
 //#endregion
 //#region src/review/publication-redaction.ts
 function redactReviewPublication(options) {
@@ -5700,344 +5121,755 @@ async function runTaskRuntime(options) {
 				durationMs: Date.now() - started,
 				error: error instanceof Error ? error.message : String(error)
 			});
-			if (options.log?.debugEnabled && error instanceof Error && error.stack) options.log.text("debug", "error stack", error.stack);
-			return {
-				taskName: task.name,
-				output: {
-					...output,
-					check
-				},
-				error
-			};
-		}
-	}));
-	const taskChecks = taskResults.map((result) => runtimeTaskCheckResult(result.taskName, result.output.check ?? { conclusion: "success" }));
-	const failedTask = taskResults.find((result) => result.error !== void 0);
-	if (failedTask) {
-		publishFailedRunTaskChecks(options, taskChecks);
-		throw failedTask.error instanceof Error ? failedTask.error : new Error(String(failedTask.error));
-	}
-	const output = mergeTaskOutputs(taskResults);
-	options.log?.info("task runtime collected", {
-		findings: output.findings.length,
-		providerModels: output.providerModels,
-		repairAttempted: output.repairAttempted
-	});
-	const commandResponse = commandResponseResultFromOutput({
-		provider,
-		diffManifest,
-		output,
-		taskChecks,
-		commandInvocation: options.commandInvocation,
-		secretRedactor: options.secretRedactor
-	});
-	if (commandResponse) {
-		publishTaskChecks(options.checkSink, commandResponse.taskChecks);
-		return commandResponse;
-	}
-	assertReviewCommentOutput(output, options.commandInvocation !== void 0);
-	const main = typeof output.comment.value === "string" ? output.comment.value : output.comment.value.main ?? "Review completed.";
-	const validated = validateReviewResult(collectedReview(output, main), diffManifest, {
-		expectedHeadSha: options.event.change.head.sha,
-		pathScopeForFinding: (_finding, index) => output.findings[index]?.paths
-	});
-	const verifier = await runSynchronizeVerifier({
-		options,
-		config,
-		provider,
-		diffManifest,
-		priorReviewState,
-		runId,
-		piRunSink: runtimeOptions.piRunSink
-	});
-	const stats = reviewStatsForRuns(piRuns, Date.now() - runtimeStarted);
-	const redactedPublication = redactReviewPublication({
-		main,
-		validated,
-		threadActions: verifier.threadActions,
-		taskChecks,
+			if (options.log?.debugEnabled && error instanceof Error && error.stack) options.log.text("debug", "error stack", error.stack);
+			return {
+				taskName: task.name,
+				output: {
+					...output,
+					check
+				},
+				error
+			};
+		}
+	}));
+	const taskChecks = taskResults.map((result) => runtimeTaskCheckResult(result.taskName, result.output.check ?? { conclusion: "success" }));
+	const failedTask = taskResults.find((result) => result.error !== void 0);
+	if (failedTask) {
+		publishFailedRunTaskChecks(options, taskChecks);
+		throw failedTask.error instanceof Error ? failedTask.error : new Error(String(failedTask.error));
+	}
+	const output = mergeTaskOutputs(taskResults);
+	options.log?.info("task runtime collected", {
+		findings: output.findings.length,
+		providerModels: output.providerModels,
+		repairAttempted: output.repairAttempted
+	});
+	const commandResponse = commandResponseResultFromOutput({
+		provider,
+		diffManifest,
+		output,
+		taskChecks,
+		commandInvocation: options.commandInvocation,
+		secretRedactor: options.secretRedactor
+	});
+	if (commandResponse) {
+		publishTaskChecks(options.checkSink, commandResponse.taskChecks);
+		return commandResponse;
+	}
+	assertReviewCommentOutput(output, options.commandInvocation !== void 0);
+	const main = typeof output.comment.value === "string" ? output.comment.value : output.comment.value.main ?? "Review completed.";
+	const validated = validateReviewResult(collectedReview(output, main), diffManifest, {
+		expectedHeadSha: options.event.change.head.sha,
+		pathScopeForFinding: (_finding, index) => output.findings[index]?.paths
+	});
+	const verifier = await runSynchronizeVerifier({
+		options,
+		config,
+		provider,
+		diffManifest,
+		priorReviewState,
+		runId,
+		piRunSink: runtimeOptions.piRunSink
+	});
+	const stats = reviewStatsForRuns(piRuns, Date.now() - runtimeStarted);
+	const redactedPublication = redactReviewPublication({
+		main,
+		validated,
+		threadActions: verifier.threadActions,
+		taskChecks,
+		redactor: options.secretRedactor
+	});
+	const publishing = buildCommentPublishingPlan({
+		event: options.event,
+		main: redactedPublication.main,
+		validated: redactedPublication.validated,
+		manifest: diffManifest,
+		maxInlineComments: config.publication.maxInlineComments,
+		maxStoredFindings: config.publication.maxStoredFindings,
+		showHeader: config.publication.showHeader,
+		showFooter: config.publication.showFooter,
+		showStats: config.publication.showStats,
+		priorReviewState: verifier.priorReviewState,
+		threadActions: redactedPublication.threadActions,
+		metadata: {
+			runtimeVersion,
+			configVersion: options.versionCompatibility?.configVersion,
+			trustedConfigSha: options.trustedConfigSha,
+			trustedConfigHash: options.trustedConfigHash,
+			reviewedHeadSha: options.event.change.head.sha,
+			providerModels: output.providerModels.length + verifier.providerModels.length > 0 ? uniq([...output.providerModels, ...verifier.providerModels]) : [provider.model],
+			selectedTasks,
+			failedTasks: [],
+			validFindings: validated.validFindings.length,
+			droppedFindings: validated.droppedFindings.length,
+			...stats ? { stats } : {}
+		}
+	});
+	const publicationPlan = publishing.publicationPlan;
+	publishTaskChecks(options.checkSink, redactedPublication.taskChecks);
+	options.log?.info("review validated", {
+		validFindings: validated.validFindings.length,
+		droppedFindings: validated.droppedFindings.length,
+		inlineDrafts: publishing.inlineCommentDrafts.length,
+		threadActions: verifier.threadActions.length
+	});
+	return {
+		kind: "review",
+		provider,
+		diffManifest,
+		review: redactedPublication.validated.review,
+		validated: redactedPublication.validated,
+		publicationPlan,
+		mainComment: publicationPlan.mainComment,
+		inlineCommentDrafts: publishing.inlineCommentDrafts,
+		taskChecks: redactedPublication.taskChecks,
+		repairAttempted: output.repairAttempted
+	};
+}
+function publishFailedRunTaskChecks(options, taskChecks) {
+	const redacted = redactCommandPublication({
+		body: "",
+		taskChecks,
+		redactor: options.secretRedactor
+	});
+	publishTaskChecks(options.checkSink, redacted.taskChecks);
+}
+function commandResponseResultFromOutput(options) {
+	const commandResponse = options.output.commandResponse;
+	if (!commandResponse) return;
+	if (!options.commandInvocation) throw new Error("ctx.command.reply(...) is only available for command-triggered tasks");
+	return commandResponseRuntimeResult({
+		...options,
+		commandResponse,
+		commandInvocation: options.commandInvocation
+	});
+}
+function assertReviewCommentOutput(output, hasCommandInvocation) {
+	if (output.comment) return;
+	throw new Error(hasCommandInvocation ? "ctx.comment(...) or ctx.command.reply(...) must be called exactly once per selected run" : "ctx.comment(...) must be called exactly once per selected run");
+}
+async function runSynchronizeVerifier(options) {
+	if (options.options.event.rawAction !== "synchronize") return {
+		priorReviewState: options.priorReviewState,
+		threadActions: [],
+		providerModels: []
+	};
+	const config = options.config;
+	return await runInternalVerifier({
+		workspace: options.options.workspace,
+		config,
+		event: options.options.event,
+		provider: options.provider,
+		verifierProvider: resolveProvider(config, config.publication.autoResolve.model ?? config.defaultProvider),
+		plan: options.options.plan,
+		env: options.options.env,
+		piExecutable: options.options.piExecutable,
+		piRunner: options.options.piRunner,
+		log: options.options.log,
+		diffManifest: options.diffManifest,
+		priorReviewState: options.priorReviewState,
+		threadContexts: await options.options.loadInlineThreadContexts?.() ?? [],
+		mode: { kind: "synchronize" },
+		runId: options.runId,
+		piRunSink: options.piRunSink
+	});
+}
+function createTaskContext(options) {
+	const repositorySlugParts = options.event.repository.slug.split("/");
+	let taskContext;
+	taskContext = {
+		run: { id: options.runId },
+		repository: {
+			root: options.workspace,
+			owner: repositorySlugParts.length > 1 ? repositorySlugParts[0] : void 0,
+			name: repositorySlugParts.at(-1) ?? "repo"
+		},
+		change: {
+			number: options.event.change.number,
+			title: options.event.change.title,
+			description: options.event.change.description,
+			url: options.event.change.url,
+			author: options.event.change.author,
+			base: options.event.change.base,
+			head: options.event.change.head,
+			isFork: options.event.change.isFork,
+			async diffManifest(manifestOptions) {
+				const key = JSON.stringify(manifestOptions ?? {});
+				const cached = options.manifestCache.get(key);
+				if (cached) return cloneDiffManifest(cached);
+				const manifest = projectDiffManifest(options.diffManifest, manifestOptions);
+				options.manifestCache.set(key, manifest);
+				return cloneDiffManifest(manifest);
+			},
+			async changedFiles() {
+				return options.diffManifest.files.map((file) => ({
+					path: file.path,
+					previousPath: file.previousPath,
+					status: file.status
+				}));
+			},
+			async currentHeadSha() {
+				return options.event.change.head.sha;
+			}
+		},
+		platform: { id: options.event.platform.id },
+		command: options.commandInvocation ? {
+			name: options.commandInvocation.name,
+			line: options.commandInvocation.line,
+			arguments: { ...options.commandInvocation.arguments },
+			async reply(markdown) {
+				collectCommandResponse(options.output, markdown, options.taskName);
+			}
+		} : void 0,
+		secret(secret) {
+			return resolveTaskSecret(secret, options);
+		},
+		pi: { async run(agent, input, runOptions) {
+			const result = await runReviewAgent({
+				agent,
+				input,
+				runOptions,
+				runtime: {
+					...options,
+					taskContext,
+					runId: options.runId,
+					piRunSink: options.piRunSink
+				}
+			});
+			options.output.providerModels.push(...result.providerModels);
+			if (result.repairAttempted) options.output.repairAttempted = true;
+			trackResultFindingScope(options.output, result.value, runOptions?.paths);
+			return agentOutputForTaskContext(agent, result.value);
+		} },
+		review: { async prior() {
+			return priorReviewForTask(options.priorMainComment, options.priorReviewState);
+		} },
+		check: createCheckHandle(options.output),
+		async comment(value) {
+			collectComment(options.output, value, options.taskName);
+		},
+		log: options.taskLog ?? console
+	};
+	return taskContext;
+}
+function agentOutputForTaskContext(_agent, value) {
+	return value;
+}
+function resolveTaskSecret(secret, options) {
+	if (secret.kind !== "pipr.secret" || typeof secret.name !== "string") throw new Error("ctx.secret(...) requires a pipr.secret reference");
+	const value = (options.env ?? process.env)[secret.name];
+	if (!value) throw new Error(`Missing secret env var: ${secret.name}`);
+	options.log?.addSecret(value);
+	options.secretRedactor?.addSecret(value);
+	return value;
+}
+function commandResponseRuntimeResult(options) {
+	const redacted = redactCommandPublication({
+		body: options.commandResponse.value,
+		taskChecks: options.taskChecks,
 		redactor: options.secretRedactor
 	});
-	const publishing = buildCommentPublishingPlan({
+	return {
+		kind: "command-response",
+		provider: options.provider,
+		diffManifest: options.diffManifest,
+		taskChecks: redacted.taskChecks,
+		repairAttempted: options.output.repairAttempted,
+		commandResponse: {
+			commandName: options.commandInvocation.name,
+			line: options.commandInvocation.line,
+			arguments: options.commandInvocation.arguments,
+			body: redacted.body
+		}
+	};
+}
+function publishTaskChecks(sink, checks) {
+	for (const check of checks) sink?.setTaskResult(check);
+}
+function skippedTaskRuntimeResult(options) {
+	const reason = options.reason ?? (options.taskName ? `Task '${options.taskName}' was not registered` : "No tasks matched the change request event");
+	const review = {
+		summary: { body: reason },
+		inlineFindings: []
+	};
+	const validated = {
+		review,
+		validFindings: [],
+		droppedFindings: []
+	};
+	const publicationPlan = buildCommentPublishingPlan({
 		event: options.event,
-		main: redactedPublication.main,
-		validated: redactedPublication.validated,
-		manifest: diffManifest,
-		maxInlineComments: config.publication.maxInlineComments,
-		maxStoredFindings: config.publication.maxStoredFindings,
-		showHeader: config.publication.showHeader,
-		showFooter: config.publication.showFooter,
-		showStats: config.publication.showStats,
-		priorReviewState: verifier.priorReviewState,
-		threadActions: redactedPublication.threadActions,
+		main: reason,
+		validated,
+		manifest: options.diffManifest,
+		maxInlineComments: options.config.publication.maxInlineComments,
+		maxStoredFindings: options.config.publication.maxStoredFindings,
+		showHeader: options.config.publication.showHeader,
+		showFooter: options.config.publication.showFooter,
+		showStats: options.config.publication.showStats,
 		metadata: {
 			runtimeVersion,
 			configVersion: options.versionCompatibility?.configVersion,
 			trustedConfigSha: options.trustedConfigSha,
 			trustedConfigHash: options.trustedConfigHash,
 			reviewedHeadSha: options.event.change.head.sha,
-			providerModels: output.providerModels.length + verifier.providerModels.length > 0 ? uniq([...output.providerModels, ...verifier.providerModels]) : [provider.model],
-			selectedTasks,
+			providerModels: [options.provider.model],
+			selectedTasks: [],
 			failedTasks: [],
-			validFindings: validated.validFindings.length,
-			droppedFindings: validated.droppedFindings.length,
-			...stats ? { stats } : {}
+			validFindings: 0,
+			droppedFindings: 0
 		}
-	});
-	const publicationPlan = publishing.publicationPlan;
-	publishTaskChecks(options.checkSink, redactedPublication.taskChecks);
-	options.log?.info("review validated", {
-		validFindings: validated.validFindings.length,
-		droppedFindings: validated.droppedFindings.length,
-		inlineDrafts: publishing.inlineCommentDrafts.length,
-		threadActions: verifier.threadActions.length
-	});
+	}).publicationPlan;
+	return {
+		kind: "skipped",
+		skipReason: reason,
+		provider: options.provider,
+		diffManifest: options.diffManifest,
+		review,
+		validated,
+		publicationPlan,
+		mainComment: publicationPlan.mainComment,
+		inlineCommentDrafts: [],
+		taskChecks: [],
+		repairAttempted: false
+	};
+}
+//#endregion
+//#region src/shared/secret-redactor-core.ts
+const redactedSecret = "[redacted secret]";
+const minimumSecretLength = 4;
+function createSecretRedactor(initialSecrets) {
+	const secrets = new Set(initialSecrets.filter((value) => value.length >= minimumSecretLength));
+	return {
+		addSecret(value) {
+			if (value && value.length >= minimumSecretLength) secrets.add(value);
+		},
+		redact(value) {
+			const ordered = [...secrets].sort((left, right) => right.length - left.length);
+			let next = value;
+			for (const secret of ordered) next = next.replaceAll(secret, redactedSecret);
+			return {
+				value: next,
+				detected: next !== value
+			};
+		}
+	};
+}
+//#endregion
+//#region src/shared/secret-redactor.ts
+function createKnownSecretRedactor(options) {
+	return createSecretRedactor(sensitiveEnvironmentValues(options?.env ?? process.env));
+}
+//#endregion
+//#region src/hosts/http.ts
+var CodeHostHttpError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.name = "CodeHostHttpError";
+		this.status = status;
+	}
+};
+function createCodeHostHttpClient(options) {
+	const fetchRequest = options.fetch ?? fetch;
+	const sleep = options.sleep ?? ((milliseconds) => Bun.sleep(milliseconds));
+	const successThrottle = options.successThrottle ?? createCodeHostSuccessThrottle(sleep);
+	const maxRetries = options.maxRetries ?? 2;
+	const requestTimeoutMilliseconds = options.requestTimeoutMilliseconds ?? 3e4;
+	const secrets = [...new Headers(options.headers).values()].flatMap((value) => [value, value.split(/\s+/).at(-1)].filter((candidate) => candidate !== void 0 && candidate.length >= 8));
+	return { async json(path, schema, init = {}) {
+		const method = init.method?.toUpperCase() ?? "GET";
+		for (let attempt = 0;; attempt += 1) {
+			await successThrottle.wait();
+			const timeoutSignal = AbortSignal.timeout(requestTimeoutMilliseconds);
+			const response = await fetchRequest(new URL(path, options.baseUrl), {
+				...init,
+				headers: {
+					...Object.fromEntries(new Headers(options.headers)),
+					...Object.fromEntries(new Headers(init.headers))
+				},
+				signal: init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
+			});
+			const retryAfter = retryAfterMilliseconds(response.headers.get("Retry-After"));
+			if (response.ok) {
+				successThrottle.update(response.headers.get("Retry-After"));
+				return schema.parse(await response.json());
+			}
+			if (shouldRetryCodeHostRequest({
+				method,
+				attempt,
+				maxRetries,
+				response,
+				retryStatuses: options.retryNonIdempotentStatuses
+			})) {
+				await sleep(retryAfter || 250 * 2 ** attempt);
+				continue;
+			}
+			const body = (await response.text()).slice(0, 1024);
+			throw new CodeHostHttpError(redact(`Code host request failed (${response.status} ${response.statusText}): ${body}`, secrets), response.status);
+		}
+	} };
+}
+function createCodeHostSuccessThrottle(sleep = (milliseconds) => Bun.sleep(milliseconds)) {
+	let notBefore = 0;
+	let waitInFlight;
+	const waitUntilReady = async () => {
+		while (true) {
+			const deadline = notBefore;
+			const remaining = deadline - Date.now();
+			if (remaining <= 0) {
+				if (notBefore === deadline) notBefore = 0;
+				return;
+			}
+			await sleep(remaining);
+			if (notBefore <= deadline) {
+				notBefore = 0;
+				return;
+			}
+		}
+	};
 	return {
-		kind: "review",
-		provider,
-		diffManifest,
-		review: redactedPublication.validated.review,
-		validated: redactedPublication.validated,
-		publicationPlan,
-		mainComment: publicationPlan.mainComment,
-		inlineCommentDrafts: publishing.inlineCommentDrafts,
-		taskChecks: redactedPublication.taskChecks,
-		repairAttempted: output.repairAttempted
+		wait() {
+			if (waitInFlight) return waitInFlight;
+			const currentWait = waitUntilReady().finally(() => {
+				if (waitInFlight === currentWait) waitInFlight = void 0;
+			});
+			waitInFlight = currentWait;
+			return waitInFlight;
+		},
+		update(retryAfter) {
+			const delay = retryAfterMilliseconds(retryAfter);
+			if (delay > 0) notBefore = Math.max(notBefore, Date.now() + delay);
+		}
 	};
 }
-function publishFailedRunTaskChecks(options, taskChecks) {
-	const redacted = redactCommandPublication({
-		body: "",
-		taskChecks,
-		redactor: options.secretRedactor
-	});
-	publishTaskChecks(options.checkSink, redacted.taskChecks);
+function shouldRetryCodeHostRequest(options) {
+	return (options.method === "GET" || options.method === "HEAD" || options.retryStatuses?.includes(options.response.status) === true) && options.attempt < options.maxRetries && (options.response.status === 429 || options.response.status >= 500 || options.retryStatuses?.includes(options.response.status) === true);
 }
-function commandResponseResultFromOutput(options) {
-	const commandResponse = options.output.commandResponse;
-	if (!commandResponse) return;
-	if (!options.commandInvocation) throw new Error("ctx.command.reply(...) is only available for command-triggered tasks");
-	return commandResponseRuntimeResult({
-		...options,
-		commandResponse,
-		commandInvocation: options.commandInvocation
-	});
+function retryAfterMilliseconds(value) {
+	if (!value) return 0;
+	const seconds = Number(value);
+	if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
+	const date = Date.parse(value);
+	return Number.isFinite(date) ? Math.max(0, date - Date.now()) : 0;
 }
-function assertReviewCommentOutput(output, hasCommandInvocation) {
-	if (output.comment) return;
-	throw new Error(hasCommandInvocation ? "ctx.comment(...) or ctx.command.reply(...) must be called exactly once per selected run" : "ctx.comment(...) must be called exactly once per selected run");
+function redact(value, secrets) {
+	let redacted = value;
+	for (const secret of secrets) redacted = redacted.split(secret).join("***");
+	return redacted;
 }
-async function runSynchronizeVerifier(options) {
-	if (options.options.event.rawAction !== "synchronize") return {
-		priorReviewState: options.priorReviewState,
-		threadActions: [],
-		providerModels: []
+//#endregion
+//#region src/hosts/azure-devops/coordinates.ts
+function azureOrganizationFromUrl(value) {
+	const url = new URL(value);
+	return url.hostname === "dev.azure.com" ? url.pathname.split("/").filter(Boolean)[0] : url.hostname.split(".")[0];
+}
+//#endregion
+//#region src/hosts/azure-devops/client.ts
+const identitySchema = z.looseObject({
+	displayName: z.string().optional(),
+	providerDisplayName: z.string().optional(),
+	uniqueName: z.string().optional(),
+	id: z.string().optional(),
+	properties: z.looseObject({ Account: z.looseObject({ $value: z.string().optional() }).optional() }).optional()
+}).transform((identity) => {
+	const displayName = identity.displayName ?? identity.providerDisplayName;
+	const uniqueName = identity.uniqueName ?? identity.properties?.Account?.$value;
+	return {
+		...identity,
+		...displayName ? { displayName } : {},
+		...uniqueName ? { uniqueName } : {}
 	};
-	const config = options.config;
-	return await runInternalVerifier({
-		workspace: options.options.workspace,
-		config,
-		event: options.options.event,
-		provider: options.provider,
-		verifierProvider: resolveProvider(config, config.publication.autoResolve.model ?? config.defaultProvider),
-		plan: options.options.plan,
-		env: options.options.env,
-		piExecutable: options.options.piExecutable,
-		piRunner: options.options.piRunner,
-		log: options.options.log,
-		diffManifest: options.diffManifest,
-		priorReviewState: options.priorReviewState,
-		threadContexts: await options.options.loadInlineThreadContexts?.() ?? [],
-		mode: { kind: "synchronize" },
-		runId: options.runId,
-		piRunSink: options.piRunSink
+});
+const commitSchema = z.looseObject({ commitId: z.string().min(1) });
+const forkRepositorySchema = z.looseObject({ remoteUrl: z.string().min(1) });
+const pullRequestSchema$1 = z.looseObject({
+	pullRequestId: z.number().int().positive(),
+	isDraft: z.boolean().optional(),
+	title: z.string(),
+	description: z.string().nullish(),
+	url: z.string().optional(),
+	sourceRefName: z.string().min(1),
+	targetRefName: z.string().min(1),
+	createdBy: identitySchema.optional(),
+	lastMergeSourceCommit: commitSchema,
+	lastMergeTargetCommit: commitSchema,
+	forkSource: z.looseObject({ repository: forkRepositorySchema }).optional(),
+	repository: z.looseObject({
+		id: z.string().min(1),
+		name: z.string().min(1),
+		url: z.string().optional(),
+		project: z.looseObject({
+			id: z.string().min(1),
+			name: z.string().min(1)
+		})
+	})
+});
+const repositorySchema$1 = z.looseObject({
+	id: z.string().min(1),
+	name: z.string().min(1),
+	project: z.looseObject({
+		id: z.string().min(1),
+		name: z.string().min(1)
+	})
+});
+const iterationSchema = z.looseObject({
+	id: z.number().int().positive(),
+	sourceRefCommit: commitSchema
+});
+const iterationChangeSchema = z.looseObject({
+	changeTrackingId: z.number().int(),
+	changeType: z.string(),
+	item: z.looseObject({
+		path: z.string().min(1),
+		originalPath: z.string().min(1).optional()
+	})
+});
+const threadCommentSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	parentCommentId: z.number().int().optional(),
+	content: z.string().default(""),
+	author: identitySchema.optional(),
+	isDeleted: z.boolean().optional()
+});
+const pointSchema = z.looseObject({
+	line: z.number().int(),
+	offset: z.number().int()
+});
+const threadSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	status: z.string().optional(),
+	comments: z.array(threadCommentSchema).default([]),
+	threadContext: z.looseObject({
+		filePath: z.string().optional(),
+		leftFileStart: pointSchema.nullish(),
+		leftFileEnd: pointSchema.nullish(),
+		rightFileStart: pointSchema.nullish(),
+		rightFileEnd: pointSchema.nullish()
+	}).nullish(),
+	pullRequestThreadContext: z.looseObject({
+		changeTrackingId: z.number().int().optional(),
+		iterationContext: z.looseObject({
+			firstComparingIteration: z.number().int(),
+			secondComparingIteration: z.number().int()
+		}).optional()
+	}).nullish()
+});
+const statusSchema$1 = z.looseObject({ id: z.union([z.number(), z.string()]).transform(String) });
+const aclSchema = collectionSchema(z.looseObject({
+	inheritPermissions: z.boolean().default(true),
+	acesDictionary: z.record(z.string(), z.looseObject({
+		allow: z.number().int().default(0),
+		deny: z.number().int().default(0),
+		extendedInfo: z.looseObject({
+			effectiveAllow: z.number().int().default(0),
+			effectiveDeny: z.number().int().default(0)
+		}).optional()
+	}))
+}));
+function createAzureDevOpsClient(env = process.env, fetch = globalThis.fetch, options = {}) {
+	const organization = env.AZURE_DEVOPS_ORGANIZATION ?? organizationFromCollectionUri$1(env.SYSTEM_COLLECTIONURI);
+	const project = env.AZURE_DEVOPS_PROJECT ?? env.SYSTEM_TEAMPROJECT;
+	const pat = env.AZURE_DEVOPS_TOKEN;
+	const bearerToken = env.AZURE_DEVOPS_BEARER_TOKEN ?? env.SYSTEM_ACCESSTOKEN;
+	if (!organization) throw new Error("AZURE_DEVOPS_ORGANIZATION is required for Azure DevOps API calls");
+	if (!project) throw new Error("AZURE_DEVOPS_PROJECT or SYSTEM_TEAMPROJECT is required for Azure DevOps API calls");
+	if (!pat && !bearerToken) throw new Error("AZURE_DEVOPS_TOKEN, AZURE_DEVOPS_BEARER_TOKEN, or SYSTEM_ACCESSTOKEN is required for Azure DevOps API calls");
+	const headers = pat ? { Authorization: `Basic ${Buffer.from(`:${pat}`).toString("base64")}` } : { Authorization: `Bearer ${bearerToken}` };
+	const successThrottle = createCodeHostSuccessThrottle(options.sleep);
+	const api = createCodeHostHttpClient({
+		baseUrl: `https://dev.azure.com/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_apis/`,
+		headers,
+		fetch,
+		successThrottle
 	});
-}
-function createTaskContext(options) {
-	const repositorySlugParts = options.event.repository.slug.split("/");
-	let taskContext;
-	taskContext = {
-		run: { id: options.runId },
-		repository: {
-			root: options.workspace,
-			owner: repositorySlugParts.length > 1 ? repositorySlugParts[0] : void 0,
-			name: repositorySlugParts.at(-1) ?? "repo"
+	const organizationApi = createCodeHostHttpClient({
+		baseUrl: `https://dev.azure.com/${encodeURIComponent(organization)}/_apis/`,
+		headers,
+		fetch,
+		successThrottle
+	});
+	const identityApi = createCodeHostHttpClient({
+		baseUrl: `https://vssps.dev.azure.com/${encodeURIComponent(organization)}/_apis/`,
+		headers,
+		fetch,
+		successThrottle
+	});
+	const pullRequestPath = (repositoryId, changeNumber) => `git/repositories/${encodeURIComponent(repositoryId)}/pullRequests/${changeNumber}`;
+	return {
+		organization,
+		project,
+		async currentUser() {
+			return (await organizationApi.json("connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1", z.looseObject({ authenticatedUser: identitySchema }))).authenticatedUser;
+		},
+		async getRepository(repository) {
+			const value = await api.json(withApiVersion(`git/repositories/${encodeURIComponent(repository)}`), repositorySchema$1);
+			return {
+				id: value.id,
+				name: value.name,
+				projectId: value.project.id,
+				project: value.project.name
+			};
+		},
+		async getRepositoryPermission(actor, projectId, repositoryId) {
+			const candidates = (await identityApi.json(`identities?searchFilter=General&filterValue=${encodeURIComponent(actor)}&queryMembership=ExpandedUp&api-version=7.1`, collectionSchema(z.looseObject({
+				descriptor: z.string().min(1),
+				isActive: z.boolean().optional(),
+				isContainer: z.boolean().optional(),
+				memberOf: z.array(z.union([z.string().min(1), z.looseObject({ descriptor: z.string().min(1) })])).default([])
+			})))).value.filter((identity) => identity.isActive !== false && identity.isContainer !== true);
+			if (candidates.length !== 1) return "none";
+			const identity = candidates[0];
+			if (!identity) return "none";
+			const descriptors = [identity.descriptor, ...identity.memberOf.map((group) => typeof group === "string" ? group : group.descriptor)];
+			const loadAcls = (token) => {
+				const query = new URLSearchParams({
+					token,
+					descriptors: descriptors.join(","),
+					includeExtendedInfo: "true",
+					recurse: "false",
+					"api-version": "7.1"
+				});
+				return organizationApi.json(`accesscontrollists/2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87?${query}`, aclSchema);
+			};
+			const [projectAcls, repositoryAcls] = await Promise.all([loadAcls(`repoV2/${projectId}`), loadAcls(`repoV2/${projectId}/${repositoryId}`)]);
+			return azurePermissionFromAcls(repositoryAcls.value.every((acl) => acl.inheritPermissions) ? [...projectAcls.value, ...repositoryAcls.value] : repositoryAcls.value);
 		},
-		change: {
-			number: options.event.change.number,
-			title: options.event.change.title,
-			description: options.event.change.description,
-			url: options.event.change.url,
-			author: options.event.change.author,
-			base: options.event.change.base,
-			head: options.event.change.head,
-			isFork: options.event.change.isFork,
-			async diffManifest(manifestOptions) {
-				const key = JSON.stringify(manifestOptions ?? {});
-				const cached = options.manifestCache.get(key);
-				if (cached) return cloneDiffManifest(cached);
-				const manifest = projectDiffManifest(options.diffManifest, manifestOptions);
-				options.manifestCache.set(key, manifest);
-				return cloneDiffManifest(manifest);
-			},
-			async changedFiles() {
-				return options.diffManifest.files.map((file) => ({
-					path: file.path,
-					previousPath: file.previousPath,
-					status: file.status
-				}));
-			},
-			async currentHeadSha() {
-				return options.event.change.head.sha;
-			}
+		getPullRequest: (repositoryId, changeNumber) => api.json(withApiVersion(pullRequestPath(repositoryId, changeNumber)), pullRequestSchema$1),
+		async listIterations(repositoryId, changeNumber) {
+			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/iterations`), collectionSchema(iterationSchema))).value.map((iteration) => ({
+				id: iteration.id,
+				headSha: iteration.sourceRefCommit.commitId
+			}));
 		},
-		platform: { id: options.event.platform.id },
-		command: options.commandInvocation ? {
-			name: options.commandInvocation.name,
-			line: options.commandInvocation.line,
-			arguments: { ...options.commandInvocation.arguments },
-			async reply(markdown) {
-				collectCommandResponse(options.output, markdown, options.taskName);
+		async loadChange(options) {
+			if (options.organization !== organization || options.project !== project) throw new Error("Azure DevOps client coordinates do not match its configured organization and project");
+			const pullRequest = await this.getPullRequest(options.repositoryId, options.changeNumber);
+			const iterations = await this.listIterations(options.repositoryId, options.changeNumber);
+			const headSha = pullRequest.lastMergeSourceCommit.commitId;
+			const iteration = iterations.findLast((candidate) => candidate.headSha === headSha);
+			if (!iteration) throw new Error(`Azure DevOps has no pull request iteration for head ${headSha}`);
+			const sourceRef = branchName(pullRequest.sourceRefName);
+			const targetRef = branchName(pullRequest.targetRefName);
+			return {
+				repository: {
+					slug: `${organization}/${pullRequest.repository.project.name}/${pullRequest.repository.name}`,
+					url: repositoryWebUrl(organization, pullRequest.repository.project.name, pullRequest.repository.name)
+				},
+				coordinates: {
+					provider: "azure-devops",
+					organization,
+					project: pullRequest.repository.project.name,
+					projectId: pullRequest.repository.project.id,
+					repositoryId: pullRequest.repository.id
+				},
+				change: {
+					number: pullRequest.pullRequestId,
+					isDraft: pullRequest.isDraft,
+					title: pullRequest.title,
+					description: pullRequest.description ?? "",
+					url: `${repositoryWebUrl(organization, pullRequest.repository.project.name, pullRequest.repository.name)}/pullrequest/${pullRequest.pullRequestId}`,
+					author: pullRequest.createdBy?.uniqueName ? { login: pullRequest.createdBy.uniqueName } : void 0,
+					base: {
+						sha: pullRequest.lastMergeTargetCommit.commitId,
+						ref: targetRef
+					},
+					head: {
+						sha: headSha,
+						ref: sourceRef,
+						...pullRequest.forkSource?.repository.remoteUrl ? { url: pullRequest.forkSource.repository.remoteUrl } : {}
+					},
+					...pullRequest.forkSource ? { isFork: true } : {}
+				},
+				iterationId: iteration.id
+			};
+		},
+		async listIterationChanges(repositoryId, changeNumber, iterationId) {
+			const changes = [];
+			let skip = 0;
+			let top = 2e3;
+			for (;;) {
+				const path = `${pullRequestPath(repositoryId, changeNumber)}/iterations/${iterationId}/changes?compareTo=0&$skip=${skip}&$top=${top}`;
+				const page = await api.json(withApiVersion(path), z.looseObject({
+					changeEntries: z.array(iterationChangeSchema),
+					nextSkip: z.number().int().nonnegative().optional(),
+					nextTop: z.number().int().nonnegative().max(2e3).optional()
+				}));
+				changes.push(...page.changeEntries.map((change) => ({
+					changeTrackingId: change.changeTrackingId,
+					changeType: change.changeType,
+					path: trimLeadingSlash(change.item.path),
+					...change.item.originalPath ? { originalPath: trimLeadingSlash(change.item.originalPath) } : {}
+				})));
+				if (!page.nextSkip) return changes;
+				skip = page.nextSkip;
+				if (page.nextTop) top = page.nextTop;
 			}
-		} : void 0,
-		secret(secret) {
-			return resolveTaskSecret(secret, options);
 		},
-		pi: { async run(agent, input, runOptions) {
-			const result = await runReviewAgent({
-				agent,
-				input,
-				runOptions,
-				runtime: {
-					...options,
-					taskContext,
-					runId: options.runId,
-					piRunSink: options.piRunSink
-				}
-			});
-			options.output.providerModels.push(...result.providerModels);
-			if (result.repairAttempted) options.output.repairAttempted = true;
-			trackResultFindingScope(options.output, result.value, runOptions?.paths);
-			return agentOutputForTaskContext(agent, result.value);
-		} },
-		review: { async prior() {
-			return priorReviewForTask(options.priorMainComment, options.priorReviewState);
-		} },
-		check: createCheckHandle(options.output),
-		async comment(value) {
-			collectComment(options.output, value, options.taskName);
+		async listThreads(repositoryId, changeNumber) {
+			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads`), collectionSchema(threadSchema))).value;
 		},
-		log: options.taskLog ?? console
+		createThread: (repositoryId, changeNumber, body) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads`), threadSchema, jsonRequest$2("POST", body)),
+		updateComment: (repositoryId, changeNumber, threadId, commentId, content) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}/comments/${encodeURIComponent(commentId)}`), threadCommentSchema, jsonRequest$2("PATCH", { content })),
+		createThreadComment: (repositoryId, changeNumber, threadId, body) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}/comments`), threadCommentSchema, jsonRequest$2("POST", body)),
+		updateThreadStatus: (repositoryId, changeNumber, threadId, status) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}`), threadSchema, jsonRequest$2("PATCH", { status })),
+		async createStatus(repositoryId, changeNumber, body) {
+			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/statuses`), statusSchema$1, jsonRequest$2("POST", body))).id;
+		}
 	};
-	return taskContext;
 }
-function agentOutputForTaskContext(_agent, value) {
-	return value;
+function azureDevOpsStatusState(state) {
+	switch (state) {
+		case "pending": return "pending";
+		case "success": return "succeeded";
+		case "failure": return "failed";
+		case "neutral": return "notApplicable";
+	}
 }
-function resolveTaskSecret(secret, options) {
-	if (secret.kind !== "pipr.secret" || typeof secret.name !== "string") throw new Error("ctx.secret(...) requires a pipr.secret reference");
-	const value = (options.env ?? process.env)[secret.name];
-	if (!value) throw new Error(`Missing secret env var: ${secret.name}`);
-	options.log?.addSecret(value);
-	options.secretRedactor?.addSecret(value);
-	return value;
+function azureRepositoryPermission(bits) {
+	if ((bits & 2) === 0) return "none";
+	if ((bits & 8192) !== 0) return "admin";
+	if ((bits & 2048) !== 0) return "maintain";
+	if ((bits & 4) !== 0) return "write";
+	if ((bits & 16384) !== 0) return "triage";
+	return "read";
 }
-function commandResponseRuntimeResult(options) {
-	const redacted = redactCommandPublication({
-		body: options.commandResponse.value,
-		taskChecks: options.taskChecks,
-		redactor: options.secretRedactor
-	});
-	return {
-		kind: "command-response",
-		provider: options.provider,
-		diffManifest: options.diffManifest,
-		taskChecks: redacted.taskChecks,
-		repairAttempted: options.output.repairAttempted,
-		commandResponse: {
-			commandName: options.commandInvocation.name,
-			line: options.commandInvocation.line,
-			arguments: options.commandInvocation.arguments,
-			body: redacted.body
-		}
-	};
+function azurePermissionFromAcls(acls) {
+	let allow = 0;
+	let deny = 0;
+	for (const acl of acls) for (const ace of Object.values(acl.acesDictionary)) {
+		allow |= ace.extendedInfo?.effectiveAllow ?? ace.allow;
+		deny |= ace.extendedInfo?.effectiveDeny ?? ace.deny;
+	}
+	return azureRepositoryPermission(allow & ~deny);
 }
-function publishTaskChecks(sink, checks) {
-	for (const check of checks) sink?.setTaskResult(check);
+function collectionSchema(item) {
+	return z.looseObject({
+		count: z.number().int().nonnegative(),
+		value: z.array(item)
+	});
 }
-function skippedTaskRuntimeResult(options) {
-	const reason = options.reason ?? (options.taskName ? `Task '${options.taskName}' was not registered` : "No tasks matched the change request event");
-	const review = {
-		summary: { body: reason },
-		inlineFindings: []
-	};
-	const validated = {
-		review,
-		validFindings: [],
-		droppedFindings: []
-	};
-	const publicationPlan = buildCommentPublishingPlan({
-		event: options.event,
-		main: reason,
-		validated,
-		manifest: options.diffManifest,
-		maxInlineComments: options.config.publication.maxInlineComments,
-		maxStoredFindings: options.config.publication.maxStoredFindings,
-		showHeader: options.config.publication.showHeader,
-		showFooter: options.config.publication.showFooter,
-		showStats: options.config.publication.showStats,
-		metadata: {
-			runtimeVersion,
-			configVersion: options.versionCompatibility?.configVersion,
-			trustedConfigSha: options.trustedConfigSha,
-			trustedConfigHash: options.trustedConfigHash,
-			reviewedHeadSha: options.event.change.head.sha,
-			providerModels: [options.provider.model],
-			selectedTasks: [],
-			failedTasks: [],
-			validFindings: 0,
-			droppedFindings: 0
-		}
-	}).publicationPlan;
-	return {
-		kind: "skipped",
-		skipReason: reason,
-		provider: options.provider,
-		diffManifest: options.diffManifest,
-		review,
-		validated,
-		publicationPlan,
-		mainComment: publicationPlan.mainComment,
-		inlineCommentDrafts: [],
-		taskChecks: [],
-		repairAttempted: false
-	};
+function withApiVersion(path) {
+	return `${path}${path.includes("?") ? "&" : "?"}api-version=7.1`;
 }
-//#endregion
-//#region src/shared/secret-redactor-core.ts
-const redactedSecret = "[redacted secret]";
-const minimumSecretLength = 4;
-function createSecretRedactor(initialSecrets) {
-	const secrets = new Set(initialSecrets.filter((value) => value.length >= minimumSecretLength));
+function jsonRequest$2(method, body) {
 	return {
-		addSecret(value) {
-			if (value && value.length >= minimumSecretLength) secrets.add(value);
-		},
-		redact(value) {
-			const ordered = [...secrets].sort((left, right) => right.length - left.length);
-			let next = value;
-			for (const secret of ordered) next = next.replaceAll(secret, redactedSecret);
-			return {
-				value: next,
-				detected: next !== value
-			};
-		}
+		method,
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
 	};
 }
-//#endregion
-//#region src/shared/secret-redactor.ts
-function createKnownSecretRedactor(options) {
-	return createSecretRedactor(sensitiveEnvironmentValues(options?.env ?? process.env));
+function organizationFromCollectionUri$1(value) {
+	return value ? azureOrganizationFromUrl(value) : void 0;
+}
+function branchName(ref) {
+	return ref.replace(/^refs\/heads\//, "");
+}
+function repositoryWebUrl(organization, project, repository) {
+	return `https://dev.azure.com/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_git/${encodeURIComponent(repository)}`;
+}
+function trimLeadingSlash(value) {
+	return value.replace(/^\/+/, "");
 }
 //#endregion
 //#region src/hosts/env.ts
@@ -6417,8 +6249,17 @@ async function loadAzureDevOpsPriorReviewState(options) {
 	const state = extractPriorReviewState(await loadAzureDevOpsPriorMainComment(options), options.change.change.number);
 	if (!state) return void 0;
 	const owner = await authenticatedAzureOwner(options.client);
-	const bodies = ownedThreadComments(await options.client.listThreads(azureCoordinates$1(options.change).repositoryId, options.change.change.number), owner.uniqueName).map((comment) => comment.content);
-	return applyResolvedFindingMarkers(applyInlineFindingMarkers(state, bodies), bodies);
+	const threads = await options.client.listThreads(azureCoordinates$1(options.change).repositoryId, options.change.change.number);
+	const bodies = ownedThreadComments(threads, owner.uniqueName).map((comment) => comment.content);
+	return applyNativeThreadResolutions(applyResolvedFindingMarkers(applyInlineFindingMarkers(state, bodies), bodies), threads.flatMap((thread) => {
+		const root = thread.comments[0];
+		const marker = root ? extractInlineFindingMarkerRecords([root.content])[0] : void 0;
+		return root && marker && root.author?.uniqueName === owner.uniqueName ? [{
+			findingId: marker.id,
+			findingHeadSha: marker.head,
+			resolved: isResolved(thread)
+		}] : [];
+	}));
 }
 async function loadAzureDevOpsPriorMainComment(options) {
 	const owner = await authenticatedAzureOwner(options.client);
@@ -6765,19 +6606,230 @@ function createAzureDevOpsHostAdapter(options = {}) {
 				};
 			}
 		}
-	};
-}
-function azureCoordinates(change) {
-	if (change.coordinates?.provider !== "azure-devops") throw new Error("Azure DevOps adapter requires Azure DevOps coordinates");
-	return change.coordinates;
+	};
+}
+function azureCoordinates(change) {
+	if (change.coordinates?.provider !== "azure-devops") throw new Error("Azure DevOps adapter requires Azure DevOps coordinates");
+	return change.coordinates;
+}
+function azureCoordinatesFromRepository(client, slug) {
+	const repositoryId = slug.split("/").at(-1);
+	if (!repositoryId) throw new Error("Azure DevOps repository slug must identify a repository");
+	return {
+		organization: client.organization,
+		project: client.project,
+		repositoryId
+	};
+}
+//#endregion
+//#region src/hosts/bitbucket/schema.ts
+const bitbucketRepositorySchema = z.looseObject({
+	uuid: z.string().min(1),
+	name: z.string().min(1),
+	full_name: z.string().min(1),
+	slug: z.string().min(1).optional(),
+	links: z.looseObject({ html: z.looseObject({ href: z.string().url() }) })
+}).transform((repository) => ({
+	...repository,
+	slug: repository.slug ?? repository.full_name.split("/").at(-1) ?? repository.full_name
+}));
+//#endregion
+//#region src/hosts/bitbucket/client.ts
+const userSchema$1 = z.looseObject({
+	uuid: z.string().optional(),
+	nickname: z.string().optional(),
+	display_name: z.string().optional()
+});
+const endpointSchema = z.looseObject({
+	branch: z.looseObject({ name: z.string().min(1) }),
+	commit: z.looseObject({ hash: z.string().min(1) }),
+	repository: bitbucketRepositorySchema
+});
+const pullRequestSchema = z.looseObject({
+	id: z.number().int().positive(),
+	draft: z.boolean().optional(),
+	title: z.string(),
+	description: z.string().default(""),
+	author: userSchema$1.optional(),
+	source: endpointSchema,
+	destination: endpointSchema,
+	links: z.looseObject({ html: z.looseObject({ href: z.string().url() }) })
+});
+const inlineSchema = z.looseObject({
+	path: z.string().optional(),
+	from: z.number().int().nullable().optional(),
+	to: z.number().int().nullable().optional(),
+	start_from: z.number().int().nullable().optional(),
+	start_to: z.number().int().nullable().optional()
+});
+const commentSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	content: z.looseObject({ raw: z.string().default("") }),
+	user: userSchema$1.optional(),
+	parent: z.looseObject({ id: z.union([z.number(), z.string()]).transform(String) }).optional(),
+	inline: inlineSchema.optional(),
+	deleted: z.boolean().optional(),
+	resolution: z.looseObject({}).optional()
+});
+function createBitbucketClient(env = process.env, fetch = globalThis.fetch) {
+	const workspace = env.BITBUCKET_WORKSPACE;
+	const repository = env.BITBUCKET_REPO_SLUG;
+	const token = env.BITBUCKET_API_TOKEN;
+	const email = env.BITBUCKET_EMAIL;
+	if (!workspace) throw new Error("BITBUCKET_WORKSPACE is required for Bitbucket Cloud API calls");
+	if (!repository) throw new Error("BITBUCKET_REPO_SLUG is required for Bitbucket Cloud API calls");
+	if (!token || !email) throw new Error("BITBUCKET_EMAIL and BITBUCKET_API_TOKEN are required");
+	const authorization = `Basic ${Buffer.from(`${email}:${token}`).toString("base64")}`;
+	const repositoryApiPath = `/2.0/repositories/${encodeURIComponent(workspace)}/${encodeURIComponent(repository)}/`;
+	const api = createCodeHostHttpClient({
+		baseUrl: `https://api.bitbucket.org${repositoryApiPath}`,
+		headers: { Authorization: authorization },
+		fetch
+	});
+	const rootApi = createCodeHostHttpClient({
+		baseUrl: "https://api.bitbucket.org/2.0/",
+		headers: { Authorization: authorization },
+		fetch
+	});
+	const prPath = (id) => `pullrequests/${id}`;
+	return {
+		workspace,
+		repository,
+		async currentUser() {
+			const value = await rootApi.json("user", userSchema$1);
+			return {
+				uuid: value.uuid,
+				nickname: value.nickname,
+				displayName: value.display_name
+			};
+		},
+		async getRepository() {
+			const value = await api.json("", bitbucketRepositorySchema);
+			return {
+				uuid: value.uuid,
+				slug: value.slug,
+				fullName: value.full_name,
+				url: value.links.html.href
+			};
+		},
+		async getRepositoryPermission(actor, repositoryUuid) {
+			const permissionEmail = env.BITBUCKET_PERMISSION_EMAIL;
+			const permissionToken = env.BITBUCKET_PERMISSION_API_TOKEN;
+			if (!permissionEmail || !permissionToken) throw new Error("BITBUCKET_PERMISSION_EMAIL and BITBUCKET_PERMISSION_API_TOKEN are required for Bitbucket permission checks");
+			const permissionApi = createCodeHostHttpClient({
+				baseUrl: "https://api.bitbucket.org/2.0/",
+				headers: { Authorization: `Basic ${Buffer.from(`${permissionEmail}:${permissionToken}`).toString("base64")}` },
+				fetch
+			});
+			const query = encodeURIComponent(`repository.uuid="${escapeBitbucketQueryValue(repositoryUuid)}" AND user.nickname="${escapeBitbucketQueryValue(actor)}"`);
+			return (await permissionApi.json(`workspaces/${encodeURIComponent(workspace)}/permissions/repositories?q=${query}&pagelen=100`, pagedSchema(z.looseObject({
+				permission: z.enum([
+					"read",
+					"write",
+					"admin"
+				]),
+				user: userSchema$1
+			})))).values.find((entry) => entry.user.nickname === actor)?.permission ?? "none";
+		},
+		getPullRequest: (id) => api.json(prPath(id), pullRequestSchema),
+		async loadChange(options) {
+			if (options.workspace !== workspace || options.repository !== repository) throw new Error("Bitbucket client coordinates do not match the requested repository");
+			const pullRequest = await this.getPullRequest(options.changeNumber);
+			return {
+				repository: {
+					slug: pullRequest.destination.repository.full_name,
+					url: pullRequest.destination.repository.links.html.href
+				},
+				coordinates: {
+					provider: "bitbucket",
+					workspace,
+					repository,
+					repositoryUuid: pullRequest.destination.repository.uuid
+				},
+				change: {
+					number: pullRequest.id,
+					isDraft: pullRequest.draft,
+					title: pullRequest.title,
+					description: pullRequest.description,
+					url: pullRequest.links.html.href,
+					author: pullRequest.author?.nickname ? { login: pullRequest.author.nickname } : void 0,
+					base: {
+						sha: pullRequest.destination.commit.hash,
+						ref: pullRequest.destination.branch.name,
+						url: pullRequest.destination.repository.links.html.href
+					},
+					head: {
+						sha: pullRequest.source.commit.hash,
+						ref: pullRequest.source.branch.name,
+						url: pullRequest.source.repository.links.html.href
+					},
+					isFork: pullRequest.source.repository.uuid !== pullRequest.destination.repository.uuid
+				}
+			};
+		},
+		async listComments(id) {
+			return (await listAll(api, `${prPath(id)}/comments`, commentSchema, repositoryApiPath)).filter((comment) => !comment.deleted);
+		},
+		createComment: (id, body) => api.json(`${prPath(id)}/comments`, commentSchema, jsonRequest$1("POST", body)),
+		updateComment: (id, commentId, content) => api.json(`${prPath(id)}/comments/${encodeURIComponent(commentId)}`, commentSchema, jsonRequest$1("PUT", { content: { raw: content } })),
+		async replyToComment(id, commentId, content) {
+			const parentId = positiveCommentId(commentId);
+			return await api.json(`${prPath(id)}/comments`, commentSchema, jsonRequest$1("POST", {
+				content: { raw: content },
+				parent: { id: parentId }
+			}));
+		},
+		async resolveComment(id, commentId) {
+			positiveCommentId(commentId);
+			await api.json(`${prPath(id)}/comments/${encodeURIComponent(commentId)}/resolve`, z.unknown(), { method: "POST" });
+		},
+		async setStatus(sha, key, body) {
+			return (await api.json(`commit/${encodeURIComponent(sha)}/statuses/build`, z.looseObject({ key: z.string().default(key) }), jsonRequest$1("POST", {
+				...body,
+				key
+			}))).key;
+		}
+	};
+}
+function positiveCommentId(value) {
+	const id = Number(value);
+	if (!Number.isSafeInteger(id) || id <= 0) throw new Error("Bitbucket comment ID must be a positive integer");
+	return id;
+}
+function bitbucketStatusState(state) {
+	if (state === "pending") return "INPROGRESS";
+	if (state === "failure") return "FAILED";
+	if (state === "neutral") return "STOPPED";
+	return "SUCCESSFUL";
+}
+function escapeBitbucketQueryValue(value) {
+	return value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"");
+}
+function pagedSchema(item) {
+	return z.looseObject({
+		values: z.array(item),
+		next: z.string().url().optional()
+	});
+}
+async function listAll(api, path, schema, allowedPathPrefix) {
+	const values = [];
+	let next = path;
+	while (next) {
+		const page = await api.json(next, pagedSchema(schema));
+		values.push(...page.values);
+		if (page.next) {
+			const url = new URL(page.next);
+			if (url.origin !== "https://api.bitbucket.org" || !url.pathname.startsWith(allowedPathPrefix)) throw new Error("Bitbucket pagination URL must stay inside the configured repository API");
+		}
+		next = page.next;
+	}
+	return values;
 }
-function azureCoordinatesFromRepository(client, slug) {
-	const repositoryId = slug.split("/").at(-1);
-	if (!repositoryId) throw new Error("Azure DevOps repository slug must identify a repository");
+function jsonRequest$1(method, body) {
 	return {
-		organization: client.organization,
-		project: client.project,
-		repositoryId
+		method,
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
 	};
 }
 //#endregion
@@ -7027,7 +7079,14 @@ async function loadBitbucketPriorReviewState(options) {
 	const state = extractPriorReviewState(body ? normalizeBitbucketMarkdown(body) : void 0, options.change.change.number);
 	if (!state) return void 0;
 	const bodies = comments.map((comment) => normalizeBitbucketMarkdown(comment.content.raw));
-	return applyResolvedFindingMarkers(applyInlineFindingMarkers(state, bodies), bodies);
+	return applyNativeThreadResolutions(applyResolvedFindingMarkers(applyInlineFindingMarkers(state, bodies), bodies), comments.flatMap((comment) => {
+		const marker = !comment.parent ? extractInlineFindingMarkerRecords([normalizeBitbucketMarkdown(comment.content.raw)])[0] : void 0;
+		return marker ? [{
+			findingId: marker.id,
+			findingHeadSha: marker.head,
+			resolved: comment.resolution !== void 0
+		}] : [];
+	}));
 }
 async function loadBitbucketPriorMainComment(options) {
 	const body = (await loadBitbucketOwnedComments(options)).find((comment) => normalizeBitbucketMarkdown(comment.content.raw).includes(mainMarker$1(options.change.change.number)))?.content.raw;
@@ -7893,23 +7952,20 @@ async function loadGitHubPriorReviewState(options) {
 		ownerLogin
 	}), options.change.change.number);
 	if (!state) return;
-	const inlineBodies = (await options.client.listReviewComments({
-		repo: options.change.repository.slug,
-		pullRequestNumber: options.change.change.number
-	})).filter((comment) => comment.authorLogin === ownerLogin).map((comment) => comment.body ?? "");
-	return applyResolvedFindingMarkers(applyInlineFindingMarkers(state, inlineBodies), inlineBodies);
+	const { ownerComments, threadByCommentId } = await loadOwnedReviewThreads(options, ownerLogin);
+	const inlineBodies = ownerComments.map((comment) => comment.body ?? "");
+	return applyNativeThreadResolutions(applyResolvedFindingMarkers(applyInlineFindingMarkers(state, inlineBodies), inlineBodies), ownerComments.flatMap((comment) => {
+		const marker = extractInlineFindingMarkerRecords([comment.body ?? ""])[0];
+		const thread = threadByCommentId.get(comment.id);
+		return marker && thread ? [{
+			findingId: marker.id,
+			findingHeadSha: marker.head,
+			resolved: thread.isResolved
+		}] : [];
+	}));
 }
 async function loadGitHubInlineThreadContexts(options) {
-	const ownerLogin = await options.client.getAuthenticatedUserLogin();
-	const comments = await options.client.listReviewComments({
-		repo: options.change.repository.slug,
-		pullRequestNumber: options.change.change.number
-	});
-	const ownerComments = comments.filter((comment) => comment.authorLogin === ownerLogin);
-	const threadByCommentId = reviewThreadByCommentId(await options.client.listReviewThreads({
-		repo: options.change.repository.slug,
-		pullRequestNumber: options.change.change.number
-	}));
+	const { comments, ownerComments, threadByCommentId } = await loadOwnedReviewThreads(options, await options.client.getAuthenticatedUserLogin());
 	const commentById = new Map(comments.map((comment) => [comment.id, comment]));
 	return ownerComments.flatMap((comment) => {
 		const marker = extractInlineFindingMarkerRecords([comment.body ?? ""])[0];
@@ -7933,6 +7989,19 @@ async function loadGitHubInlineThreadContexts(options) {
 		}];
 	});
 }
+async function loadOwnedReviewThreads(options, ownerLogin) {
+	const coordinates = {
+		repo: options.change.repository.slug,
+		pullRequestNumber: options.change.change.number
+	};
+	const comments = await options.client.listReviewComments(coordinates);
+	const threads = await options.client.listReviewThreads(coordinates);
+	return {
+		comments,
+		ownerComments: comments.filter((comment) => comment.authorLogin === ownerLogin),
+		threadByCommentId: reviewThreadByCommentId(threads)
+	};
+}
 async function loadGitHubPriorMainComment(options) {
 	const ownerLogin = options.ownerLogin ?? await options.client.getAuthenticatedUserLogin();
 	return findMainComment(await options.client.listIssueComments({
@@ -8477,6 +8546,213 @@ function createGitHubHostAdapter(options = {}) {
 	};
 }
 //#endregion
+//#region src/hosts/gitlab/client.ts
+const userSchema = z.looseObject({
+	id: z.number().int().positive(),
+	username: z.string().min(1)
+});
+const noteSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	body: z.string(),
+	author: userSchema.optional()
+});
+const positionSchema = z.looseObject({
+	new_path: z.string().optional(),
+	old_path: z.string().optional(),
+	new_line: z.number().int().positive().nullish().transform((value) => value ?? void 0),
+	old_line: z.number().int().positive().nullish().transform((value) => value ?? void 0),
+	line_range: z.looseObject({
+		start: z.looseObject({
+			new_line: z.number().int().positive().nullish(),
+			old_line: z.number().int().positive().nullish()
+		}),
+		end: z.looseObject({
+			new_line: z.number().int().positive().nullish(),
+			old_line: z.number().int().positive().nullish()
+		})
+	}).optional()
+});
+const discussionNoteSchema = noteSchema.extend({
+	resolvable: z.boolean().optional(),
+	resolved: z.boolean().optional(),
+	position: positionSchema.nullable().optional()
+});
+const discussionSchema = z.looseObject({
+	id: z.string().min(1),
+	individual_note: z.boolean().optional(),
+	notes: z.array(discussionNoteSchema)
+});
+const diffRefsSchema = z.looseObject({
+	base_sha: z.string().min(1),
+	start_sha: z.string().min(1),
+	head_sha: z.string().min(1)
+});
+const mergeRequestResponseSchema = z.looseObject({
+	iid: z.number().int().positive(),
+	title: z.string().default(""),
+	description: z.string().nullable().optional(),
+	web_url: z.string().url().optional(),
+	source_branch: z.string().min(1),
+	target_branch: z.string().min(1),
+	source_project_id: z.number().int().positive(),
+	target_project_id: z.number().int().positive(),
+	sha: z.string().min(1),
+	draft: z.boolean().optional(),
+	author: userSchema.optional(),
+	references: z.looseObject({ full: z.string().optional() }).optional(),
+	diff_refs: diffRefsSchema.nullable().optional()
+});
+const mergeRequestSchema = mergeRequestResponseSchema.extend({ diff_refs: diffRefsSchema });
+const memberSchema = z.looseObject({ access_level: z.number().int().min(0) });
+const statusSchema = z.looseObject({ id: z.union([z.number(), z.string()]).optional() });
+function createGitLabClient(env = process.env, fetch = globalThis.fetch, sleep = (milliseconds) => Bun.sleep(milliseconds)) {
+	const token = env.GITLAB_TOKEN ?? env.CI_JOB_TOKEN;
+	if (!token) throw new Error("GITLAB_TOKEN or CI_JOB_TOKEN is required for GitLab API calls");
+	const headers = env.GITLAB_TOKEN ? { "PRIVATE-TOKEN": token } : { "JOB-TOKEN": token };
+	const clientOptions = {
+		baseUrl: `${(env.CI_API_V4_URL ?? "https://gitlab.com/api/v4").replace(/\/$/, "")}/`,
+		headers,
+		fetch,
+		sleep: async (milliseconds) => void await sleep(milliseconds)
+	};
+	const api = createCodeHostHttpClient(clientOptions);
+	const statusApi = createCodeHostHttpClient({
+		...clientOptions,
+		retryNonIdempotentStatuses: [409]
+	});
+	return {
+		async getProject(project) {
+			const value = await api.json(`projects/${encodeURIComponent(project)}`, z.looseObject({
+				id: z.union([z.number(), z.string()]).transform(String),
+				path_with_namespace: z.string().min(1)
+			}));
+			return {
+				id: value.id,
+				path: value.path_with_namespace
+			};
+		},
+		currentUser: () => api.json("user", userSchema),
+		async loadChange(options) {
+			const mergeRequest = await this.getMergeRequest(options.projectId, options.changeNumber);
+			return {
+				repository: {
+					slug: options.projectPath,
+					url: projectWebUrl(mergeRequest.web_url)
+				},
+				coordinates: {
+					provider: "gitlab",
+					projectId: String(mergeRequest.target_project_id),
+					projectPath: options.projectPath
+				},
+				change: {
+					number: mergeRequest.iid,
+					title: mergeRequest.title,
+					description: mergeRequest.description ?? "",
+					url: mergeRequest.web_url,
+					author: mergeRequest.author ? { login: mergeRequest.author.username } : void 0,
+					base: {
+						sha: mergeRequest.diff_refs.start_sha,
+						ref: mergeRequest.target_branch
+					},
+					head: {
+						sha: mergeRequest.diff_refs.head_sha,
+						ref: mergeRequest.source_branch
+					},
+					isFork: mergeRequest.source_project_id !== mergeRequest.target_project_id,
+					isDraft: mergeRequest.draft
+				}
+			};
+		},
+		async getMergeRequest(projectId, changeNumber) {
+			const requestPath = `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}`;
+			for (let attempt = 0;; attempt += 1) {
+				const response = await api.json(requestPath, mergeRequestResponseSchema);
+				const prepared = mergeRequestSchema.safeParse(response);
+				if (prepared.success) return prepared.data;
+				if (attempt >= 4) throw new Error("GitLab merge request diff refs were not prepared after 5 attempts");
+				await sleep(250 * 2 ** attempt);
+			}
+		},
+		async getRepositoryPermission(projectId, username) {
+			const user = (await api.json(`users?username=${encodeURIComponent(username)}`, z.array(userSchema))).find((candidate) => candidate.username === username);
+			if (!user) return "none";
+			try {
+				return accessLevelPermission((await api.json(`projects/${encodeURIComponent(projectId)}/members/all/${user.id}`, memberSchema)).access_level);
+			} catch (error) {
+				if (error instanceof CodeHostHttpError && error.status === 404) return "none";
+				throw error;
+			}
+		},
+		listNotes: (projectId, changeNumber) => paginated(api, `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes`, noteSchema),
+		createNote: (projectId, changeNumber, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes`, noteSchema, jsonRequest("POST", { body })),
+		updateNote: (projectId, changeNumber, noteId, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes/${encodeURIComponent(noteId)}`, noteSchema, jsonRequest("PUT", { body })),
+		listDiscussions: (projectId, changeNumber) => paginated(api, `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions`, discussionSchema),
+		getDiscussion: (projectId, changeNumber, discussionId) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}`, discussionSchema),
+		async findReplyParent(projectId, changeNumber, noteId, discussionId) {
+			if (!discussionId) return void 0;
+			const discussion = await this.getDiscussion(projectId, changeNumber, discussionId);
+			if (!discussion.notes.some((note) => note.id === noteId) || discussion.notes[0]?.id === noteId) return;
+			return discussion.notes[0]?.id;
+		},
+		createDiscussion: (projectId, changeNumber, body, position) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions`, discussionSchema, jsonRequest("POST", {
+			body,
+			position
+		})),
+		replyDiscussion: (projectId, changeNumber, discussionId, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}/notes`, noteSchema, jsonRequest("POST", { body })),
+		async resolveDiscussion(projectId, changeNumber, discussionId) {
+			await api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}`, discussionSchema, jsonRequest("PUT", { resolved: true }));
+		},
+		async setStatus(projectId, sha, name, state, description) {
+			const status = await statusApi.json(`projects/${encodeURIComponent(projectId)}/statuses/${encodeURIComponent(sha)}`, statusSchema, jsonRequest("POST", {
+				state: gitLabStatusState(state),
+				name,
+				description: boundedStatusDescription(description)
+			}));
+			return String(status.id ?? name);
+		}
+	};
+}
+const MAX_PAGINATION_PAGES = 100;
+async function paginated(client, path, schema) {
+	const values = [];
+	for (let page = 1; page <= MAX_PAGINATION_PAGES; page += 1) {
+		const separator = path.includes("?") ? "&" : "?";
+		const batch = await client.json(`${path}${separator}per_page=100&page=${page}`, z.array(schema));
+		values.push(...batch);
+		if (batch.length < 100) return values;
+	}
+	throw new Error(`GitLab pagination exceeded ${MAX_PAGINATION_PAGES} pages for ${path}`);
+}
+function jsonRequest(method, body) {
+	return {
+		method,
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
+	};
+}
+function accessLevelPermission(level) {
+	if (level >= 50) return "admin";
+	if (level >= 40) return "maintain";
+	if (level >= 30) return "write";
+	if (level >= 15) return "triage";
+	if (level >= 10) return "read";
+	return "none";
+}
+function boundedStatusDescription(description) {
+	return description && description.length > 255 ? `${description.slice(0, 252).trimEnd()}...` : description;
+}
+function gitLabStatusState(state) {
+	switch (state) {
+		case "pending": return "pending";
+		case "success": return "success";
+		case "failure": return "failed";
+		case "neutral": return "skipped";
+	}
+}
+function projectWebUrl(mergeRequestUrl) {
+	return mergeRequestUrl?.replace(/\/-\/merge_requests\/\d+$/, "");
+}
+//#endregion
 //#region src/hosts/gitlab/event.ts
 const projectSchema = z.looseObject({
 	id: z.union([z.number(), z.string()]),
@@ -8723,8 +8999,17 @@ async function loadGitLabPriorReviewState(options) {
 	const state = extractPriorReviewState(await loadGitLabPriorMainComment(options), options.change.change.number);
 	if (!state) return void 0;
 	const owner = await options.client.currentUser();
-	const bodies = discussionNotes(await options.client.listDiscussions(gitLabCoordinates$1(options.change).projectId, options.change.change.number)).filter((note) => note.author?.username === owner.username).map((note) => note.body);
-	return applyResolvedFindingMarkers(applyInlineFindingMarkers(state, bodies), bodies);
+	const discussions = await options.client.listDiscussions(gitLabCoordinates$1(options.change).projectId, options.change.change.number);
+	const bodies = discussionNotes(discussions).filter((note) => note.author?.username === owner.username).map((note) => note.body);
+	return applyNativeThreadResolutions(applyResolvedFindingMarkers(applyInlineFindingMarkers(state, bodies), bodies), discussions.flatMap((discussion) => {
+		const root = discussion.notes[0];
+		const marker = root ? extractInlineFindingMarkerRecords([root.body])[0] : void 0;
+		return root && marker && root.author?.username === owner.username ? [{
+			findingId: marker.id,
+			findingHeadSha: marker.head,
+			resolved: root.resolved ?? false
+		}] : [];
+	}));
 }
 async function loadGitLabPriorMainComment(options) {
 	const owner = await options.client.currentUser();
@@ -9980,6 +10265,6 @@ async function runHostRunCommandWithDependencies(options) {
 	});
 }
 //#endregion
-export { piReadOnlyToolNames as _, runInspectCommand as a, createGitHubHostAdapter as c, createGitLabClient as d, createBitbucketClient as f, piBuiltinToolNames as g, supportedOfficialInitAdapters as h, runInitCommand as i, PublicationError as l, azureOrganizationFromUrl as m, runHostRunCommand as n, runLocalReviewCommand as o, createAzureDevOpsClient as p, runHostRunCommandWithDependencies as r, runValidateCommand as s, runDryRunCommand as t, createKnownSecretRedactor as u, piRequiredCliFlags as v, piThinkingLevels as y };
+export { piReadOnlyToolNames as _, runInspectCommand as a, createGitLabClient as c, PublicationError as d, createAzureDevOpsClient as f, piBuiltinToolNames as g, supportedOfficialInitAdapters as h, runInitCommand as i, createGitHubHostAdapter as l, createKnownSecretRedactor as m, runHostRunCommand as n, runLocalReviewCommand as o, azureOrganizationFromUrl as p, runHostRunCommandWithDependencies as r, runValidateCommand as s, runDryRunCommand as t, createBitbucketClient as u, piRequiredCliFlags as v, piThinkingLevels as y };
 
-//# sourceMappingURL=commands-46Q2ZDt0.mjs.map
+//# sourceMappingURL=commands-B9qNW4pk.mjs.map