@usepipr/runtime 0.4.2 → 0.4.3

package/dist/{commands-EZV-Icbs.mjs → commands-B9qNW4pk.mjs}

@@ -1,5 +1,5 @@
 import { c as resolveReadAtRefRequest, d as isRecord, l as unavailableReadAtRefResult, n as boundedLineSlice, r as parseManifestPath, u as createDiffRangeIndex } from "./runtime-tools-core-D8_WsbL_.mjs";
-import { a as officialInitRecipeWorkflowEnvSecrets, i as officialInitRecipeFiles, r as officialInitRecipeConfigTs, t as renderOfficialGithubWorkflow } from "./official-github-workflow-BuZs6bOx.mjs";
+import { a as officialInitRecipeWorkflowEnvSecrets, i as officialInitRecipeFiles, r as officialInitRecipeConfigTs, t as renderOfficialGithubWorkflow } from "./official-github-workflow-Bjlu-FL3.mjs";
 import { t as isPublishableSuggestedFixSelection } from "./suggested-fix-publication-policy-B5Wwuudp.mjs";
 import { createRequire } from "node:module";
 import { chmod, chown, cp, lstat, mkdir, mkdtemp, readdir, rm } from "node:fs/promises";
@@ -597,7 +597,7 @@ function compareStableSemver(left, right) {
 }
 //#endregion
 //#region src/shared/version.ts
-const runtimeVersion = "0.4.2";
+const runtimeVersion = "0.4.3";
 //#endregion
 //#region src/config/version-compat.ts
 async function resolveConfigVersionCompatibility(options) {
@@ -928,10 +928,6 @@ function assertRequiredProviderEnv(providers, options) {
 	if (missing.length > 0) throw new Error(`Missing provider env vars: ${missing.map((provider) => provider.apiKeyEnv).join(", ")}`);
 }
 //#endregion
-//#region src/config/scaffold-versions.ts
-const defaultTypesBunVersion = "1.3.14";
-const defaultTypescriptVersion = "6.0.3";
-//#endregion
 //#region src/config/init.ts
 const supportedOfficialInitAdapters = [
 	"github",
@@ -939,8 +935,8 @@ const supportedOfficialInitAdapters = [
 	"azure-devops",
 	"bitbucket"
 ];
-const defaultGitLabImageRef = "ghcr.io/somus/pipr:v0.4.2";
-const defaultSdkVersion = "0.4.2";
+const defaultGitLabImageRef = "ghcr.io/somus/pipr:v0.4.3";
+const defaultSdkVersion = "0.4.3";
 function resolveOfficialInitAdapters(adapters) {
 	if (adapters === void 0) return ["github"];
 	if (adapters.length === 0) return [];
@@ -974,11 +970,7 @@ async function initOfficialMinimalProject(options) {
 	const result = await writeTargets(targets, existing, { skipExisting: false });
 	if (!minimal) {
 		await assertBunAvailable();
-		const install = Bun.spawn([
-			"bun",
-			"install",
-			"--ignore-scripts"
-		], {
+		const install = Bun.spawn(initInstallCommand(), {
 			cwd: projectDir,
 			env: process.env,
 			stdout: "pipe",
@@ -1000,6 +992,15 @@ async function initOfficialMinimalProject(options) {
 		...result
 	};
 }
+function initInstallCommand(env = process.env) {
+	const command = [
+		"bun",
+		"install",
+		"--ignore-scripts"
+	];
+	if (env.PIPR_INTERNAL_INIT_OFFLINE === "1") command.push("--offline");
+	return command;
+}
 async function starterFiles(relativeConfigDir, adapters, recipe, minimal = false) {
 	const files = [{
 		relativePath: path.join(relativeConfigDir, "config.ts"),
@@ -1086,15 +1087,18 @@ function starterBitbucketWebhookEnvironment(recipe) {
 	lines.push("");
 	return lines.join("\n");
 }
-function starterPackageJson() {
-	return `${JSON.stringify({
+function officialInitPackageManifest(env = process.env) {
+	return {
 		private: true,
-		dependencies: { "@usepipr/sdk": process.env.PIPR_INTERNAL_INIT_SDK_VERSION ?? defaultSdkVersion },
+		dependencies: { "@usepipr/sdk": env.PIPR_INTERNAL_INIT_SDK_VERSION ?? defaultSdkVersion },
 		devDependencies: {
-			"@types/bun": defaultTypesBunVersion,
-			typescript: defaultTypescriptVersion
+			"@types/bun": env.PIPR_INTERNAL_INIT_TYPES_BUN_VERSION ?? "1.3.14",
+			typescript: env.PIPR_INTERNAL_INIT_TYPESCRIPT_VERSION ?? "6.0.3"
 		}
-	}, null, 2)}\n`;
+	};
+}
+function starterPackageJson() {
+	return `${JSON.stringify(officialInitPackageManifest(), null, 2)}\n`;
 }
 async function writeTargets(targets, existing, options) {
 	const created = [];
@@ -1150,996 +1154,172 @@ async function maybeLstat(filePath) {
 	}
 }
 //#endregion
-//#region src/hosts/http.ts
-var CodeHostHttpError = class extends Error {
-	status;
-	constructor(message, status) {
-		super(message);
-		this.name = "CodeHostHttpError";
-		this.status = status;
+//#region src/diff/git.ts
+function runGit$1(args, cwd, maxBuffer) {
+	const result = Bun.spawnSync(["git", ...args], {
+		cwd,
+		env: process.env,
+		maxBuffer,
+		stderr: "pipe",
+		stdout: "pipe"
+	});
+	if (result.exitCode !== 0) {
+		const failure = result.stderr?.toString().trim() || "unknown error";
+		throw new Error(`git ${args.join(" ")} failed: ${failure}`);
 	}
-};
-function createCodeHostHttpClient(options) {
-	const fetchRequest = options.fetch ?? fetch;
-	const sleep = options.sleep ?? ((milliseconds) => Bun.sleep(milliseconds));
-	const successThrottle = options.successThrottle ?? createCodeHostSuccessThrottle(sleep);
-	const maxRetries = options.maxRetries ?? 2;
-	const requestTimeoutMilliseconds = options.requestTimeoutMilliseconds ?? 3e4;
-	const secrets = [...new Headers(options.headers).values()].flatMap((value) => [value, value.split(/\s+/).at(-1)].filter((candidate) => candidate !== void 0 && candidate.length >= 8));
-	return { async json(path, schema, init = {}) {
-		const method = init.method?.toUpperCase() ?? "GET";
-		for (let attempt = 0;; attempt += 1) {
-			await successThrottle.wait();
-			const timeoutSignal = AbortSignal.timeout(requestTimeoutMilliseconds);
-			const response = await fetchRequest(new URL(path, options.baseUrl), {
-				...init,
-				headers: {
-					...Object.fromEntries(new Headers(options.headers)),
-					...Object.fromEntries(new Headers(init.headers))
-				},
-				signal: init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
-			});
-			const retryAfter = retryAfterMilliseconds(response.headers.get("Retry-After"));
-			if (response.ok) {
-				successThrottle.update(response.headers.get("Retry-After"));
-				return schema.parse(await response.json());
-			}
-			if (shouldRetryCodeHostRequest({
-				method,
-				attempt,
-				maxRetries,
-				response,
-				retryStatuses: options.retryNonIdempotentStatuses
-			})) {
-				await sleep(retryAfter || 250 * 2 ** attempt);
-				continue;
-			}
-			const body = (await response.text()).slice(0, 1024);
-			throw new CodeHostHttpError(redact$1(`Code host request failed (${response.status} ${response.statusText}): ${body}`, secrets), response.status);
+	return result.stdout.toString();
+}
+//#endregion
+//#region src/diff/diff.ts
+const lockFilePattern = /(^|\/)(bun\.lock|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|Cargo\.lock)$/;
+const generatedPattern = /(^|\/)(dist|build|coverage|vendor)\//;
+const maxInlineChangedLines = 1e3;
+const maxCommentableRangeLines = 5e3;
+function buildDiffManifest(options) {
+	const mergeBaseSha = runGit$1([
+		"merge-base",
+		options.baseSha,
+		options.headSha
+	], options.cwd).trim();
+	const diffHead = options.includeWorkingTree ? void 0 : options.headSha;
+	const files = parseNameStatus(runGit$1(buildDiffArgs([
+		"--name-status",
+		"-z",
+		"--find-renames"
+	], mergeBaseSha, diffHead), options.cwd));
+	const diffStats = getDiffStats(options.cwd, mergeBaseSha, diffHead);
+	const rawPatch = parseRawPatch(runGit$1(buildUnifiedDiffArgs(mergeBaseSha, diffHead, getPreExcludedFiles(files, diffStats)), options.cwd));
+	const parsedDiff = parseUnifiedDiff(rawPatch.patch, rawPatch.filePaths);
+	for (const file of files) {
+		const stats = diffStats.get(file.path);
+		file.additions = stats?.additions ?? 0;
+		file.deletions = stats?.deletions ?? 0;
+		const preExcludedReason = stats?.excludedReason;
+		const parsedFile = parsedDiff.get(file.path);
+		file.hunks = preExcludedReason ? [] : parsedFile?.hunks ?? [];
+		file.commentableRanges = preExcludedReason ? [] : parsedFile?.commentableRanges ?? [];
+		const excludedReason = preExcludedReason ?? getExcludedReason(file);
+		if (excludedReason) {
+			file.hunks = [];
+			file.commentableRanges = [];
+			file.excludedReason = excludedReason;
 		}
-	} };
+	}
+	return parseDiffManifest({
+		baseSha: options.baseSha,
+		headSha: options.headSha,
+		mergeBaseSha,
+		files
+	});
 }
-function createCodeHostSuccessThrottle(sleep = (milliseconds) => Bun.sleep(milliseconds)) {
-	let notBefore = 0;
-	let waitInFlight;
-	const waitUntilReady = async () => {
-		while (true) {
-			const deadline = notBefore;
-			const remaining = deadline - Date.now();
-			if (remaining <= 0) {
-				if (notBefore === deadline) notBefore = 0;
-				return;
-			}
-			await sleep(remaining);
-			if (notBefore <= deadline) {
-				notBefore = 0;
-				return;
-			}
+function parseNameStatus(output) {
+	const fields = output.split("\0");
+	const files = [];
+	let index = 0;
+	while (index < fields.length) {
+		const rawStatus = fields[index++];
+		if (!rawStatus) continue;
+		const firstPath = fields[index++] ?? "";
+		const status = parseFileStatus(rawStatus);
+		if (status === "renamed") {
+			const secondPath = fields[index++] ?? "";
+			files.push(baseFile(secondPath || firstPath, status, firstPath));
+			continue;
 		}
-	};
-	return {
-		wait() {
-			if (waitInFlight) return waitInFlight;
-			const currentWait = waitUntilReady().finally(() => {
-				if (waitInFlight === currentWait) waitInFlight = void 0;
+		files.push(baseFile(firstPath, status));
+	}
+	return files;
+}
+function parseUnifiedDiff(diff, filePaths) {
+	const state = createDiffParserState(filePaths);
+	for (const line of diff.split("\n")) parseUnifiedDiffLine(state, line);
+	finishActiveHunk(state);
+	return state.filesByPath;
+}
+function getDiffStats(cwd, baseSha, headSha) {
+	const output = runGit$1(buildDiffArgs([
+		"--numstat",
+		"-z",
+		"--find-renames"
+	], baseSha, headSha), cwd);
+	const stats = /* @__PURE__ */ new Map();
+	for (const stat of parseNumstat(output)) {
+		if (stat.binary) {
+			stats.set(stat.path, {
+				additions: 0,
+				deletions: 0,
+				excludedReason: "binary diff"
 			});
-			waitInFlight = currentWait;
-			return waitInFlight;
-		},
-		update(retryAfter) {
-			const delay = retryAfterMilliseconds(retryAfter);
-			if (delay > 0) notBefore = Math.max(notBefore, Date.now() + delay);
+			continue;
 		}
-	};
+		stats.set(stat.path, {
+			additions: stat.additions,
+			deletions: stat.deletions,
+			excludedReason: stat.additions + stat.deletions > maxInlineChangedLines ? "oversized diff" : void 0
+		});
+	}
+	return stats;
 }
-function shouldRetryCodeHostRequest(options) {
-	return (options.method === "GET" || options.method === "HEAD" || options.retryStatuses?.includes(options.response.status) === true) && options.attempt < options.maxRetries && (options.response.status === 429 || options.response.status >= 500 || options.retryStatuses?.includes(options.response.status) === true);
+function getPreExcludedFiles(files, stats) {
+	const excluded = /* @__PURE__ */ new Map();
+	for (const [filePath, stat] of stats) if (stat.excludedReason) excluded.set(filePath, stat.excludedReason);
+	for (const file of files) {
+		const excludedReason = excluded.get(file.path) ?? getPathExcludedReason(file);
+		if (!excludedReason) continue;
+		excluded.set(file.path, excludedReason);
+		if (file.previousPath) excluded.set(file.previousPath, excludedReason);
+	}
+	return excluded;
 }
-function retryAfterMilliseconds(value) {
-	if (!value) return 0;
-	const seconds = Number(value);
-	if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
-	const date = Date.parse(value);
-	return Number.isFinite(date) ? Math.max(0, date - Date.now()) : 0;
+function buildUnifiedDiffArgs(baseSha, headSha, excludedFiles) {
+	const args = buildDiffArgs([
+		"--raw",
+		"-z",
+		"--patch",
+		"--submodule=short",
+		"--unified=80",
+		"--find-renames"
+	], baseSha, headSha);
+	if (excludedFiles.size === 0) return args;
+	return [
+		...args,
+		"--",
+		".",
+		...[...excludedFiles.keys()].map((filePath) => `:(exclude,literal)${filePath}`)
+	];
 }
-function redact$1(value, secrets) {
-	let redacted = value;
-	for (const secret of secrets) redacted = redacted.split(secret).join("***");
-	return redacted;
+function buildDiffArgs(options, baseSha, headSha) {
+	return headSha ? [
+		"diff",
+		...options,
+		baseSha,
+		headSha
+	] : [
+		"diff",
+		...options,
+		baseSha
+	];
 }
-//#endregion
-//#region src/hosts/azure-devops/coordinates.ts
-function azureOrganizationFromUrl(value) {
-	const url = new URL(value);
-	return url.hostname === "dev.azure.com" ? url.pathname.split("/").filter(Boolean)[0] : url.hostname.split(".")[0];
-}
-//#endregion
-//#region src/hosts/azure-devops/client.ts
-const identitySchema = z.looseObject({
-	displayName: z.string().optional(),
-	providerDisplayName: z.string().optional(),
-	uniqueName: z.string().optional(),
-	id: z.string().optional(),
-	properties: z.looseObject({ Account: z.looseObject({ $value: z.string().optional() }).optional() }).optional()
-}).transform((identity) => {
-	const displayName = identity.displayName ?? identity.providerDisplayName;
-	const uniqueName = identity.uniqueName ?? identity.properties?.Account?.$value;
-	return {
-		...identity,
-		...displayName ? { displayName } : {},
-		...uniqueName ? { uniqueName } : {}
-	};
-});
-const commitSchema = z.looseObject({ commitId: z.string().min(1) });
-const forkRepositorySchema = z.looseObject({ remoteUrl: z.string().min(1) });
-const pullRequestSchema$1 = z.looseObject({
-	pullRequestId: z.number().int().positive(),
-	isDraft: z.boolean().optional(),
-	title: z.string(),
-	description: z.string().nullish(),
-	url: z.string().optional(),
-	sourceRefName: z.string().min(1),
-	targetRefName: z.string().min(1),
-	createdBy: identitySchema.optional(),
-	lastMergeSourceCommit: commitSchema,
-	lastMergeTargetCommit: commitSchema,
-	forkSource: z.looseObject({ repository: forkRepositorySchema }).optional(),
-	repository: z.looseObject({
-		id: z.string().min(1),
-		name: z.string().min(1),
-		url: z.string().optional(),
-		project: z.looseObject({
-			id: z.string().min(1),
-			name: z.string().min(1)
-		})
-	})
-});
-const repositorySchema$1 = z.looseObject({
-	id: z.string().min(1),
-	name: z.string().min(1),
-	project: z.looseObject({
-		id: z.string().min(1),
-		name: z.string().min(1)
-	})
-});
-const iterationSchema = z.looseObject({
-	id: z.number().int().positive(),
-	sourceRefCommit: commitSchema
-});
-const iterationChangeSchema = z.looseObject({
-	changeTrackingId: z.number().int(),
-	changeType: z.string(),
-	item: z.looseObject({
-		path: z.string().min(1),
-		originalPath: z.string().min(1).optional()
-	})
-});
-const threadCommentSchema = z.looseObject({
-	id: z.union([z.number(), z.string()]).transform(String),
-	parentCommentId: z.number().int().optional(),
-	content: z.string().default(""),
-	author: identitySchema.optional(),
-	isDeleted: z.boolean().optional()
-});
-const pointSchema = z.looseObject({
-	line: z.number().int(),
-	offset: z.number().int()
-});
-const threadSchema = z.looseObject({
-	id: z.union([z.number(), z.string()]).transform(String),
-	status: z.string().optional(),
-	comments: z.array(threadCommentSchema).default([]),
-	threadContext: z.looseObject({
-		filePath: z.string().optional(),
-		leftFileStart: pointSchema.nullish(),
-		leftFileEnd: pointSchema.nullish(),
-		rightFileStart: pointSchema.nullish(),
-		rightFileEnd: pointSchema.nullish()
-	}).nullish(),
-	pullRequestThreadContext: z.looseObject({
-		changeTrackingId: z.number().int().optional(),
-		iterationContext: z.looseObject({
-			firstComparingIteration: z.number().int(),
-			secondComparingIteration: z.number().int()
-		}).optional()
-	}).nullish()
-});
-const statusSchema$1 = z.looseObject({ id: z.union([z.number(), z.string()]).transform(String) });
-const aclSchema = collectionSchema(z.looseObject({
-	inheritPermissions: z.boolean().default(true),
-	acesDictionary: z.record(z.string(), z.looseObject({
-		allow: z.number().int().default(0),
-		deny: z.number().int().default(0),
-		extendedInfo: z.looseObject({
-			effectiveAllow: z.number().int().default(0),
-			effectiveDeny: z.number().int().default(0)
-		}).optional()
-	}))
-}));
-function createAzureDevOpsClient(env = process.env, fetch = globalThis.fetch, options = {}) {
-	const organization = env.AZURE_DEVOPS_ORGANIZATION ?? organizationFromCollectionUri$1(env.SYSTEM_COLLECTIONURI);
-	const project = env.AZURE_DEVOPS_PROJECT ?? env.SYSTEM_TEAMPROJECT;
-	const pat = env.AZURE_DEVOPS_TOKEN;
-	const bearerToken = env.AZURE_DEVOPS_BEARER_TOKEN ?? env.SYSTEM_ACCESSTOKEN;
-	if (!organization) throw new Error("AZURE_DEVOPS_ORGANIZATION is required for Azure DevOps API calls");
-	if (!project) throw new Error("AZURE_DEVOPS_PROJECT or SYSTEM_TEAMPROJECT is required for Azure DevOps API calls");
-	if (!pat && !bearerToken) throw new Error("AZURE_DEVOPS_TOKEN, AZURE_DEVOPS_BEARER_TOKEN, or SYSTEM_ACCESSTOKEN is required for Azure DevOps API calls");
-	const headers = pat ? { Authorization: `Basic ${Buffer.from(`:${pat}`).toString("base64")}` } : { Authorization: `Bearer ${bearerToken}` };
-	const successThrottle = createCodeHostSuccessThrottle(options.sleep);
-	const api = createCodeHostHttpClient({
-		baseUrl: `https://dev.azure.com/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_apis/`,
-		headers,
-		fetch,
-		successThrottle
-	});
-	const organizationApi = createCodeHostHttpClient({
-		baseUrl: `https://dev.azure.com/${encodeURIComponent(organization)}/_apis/`,
-		headers,
-		fetch,
-		successThrottle
-	});
-	const identityApi = createCodeHostHttpClient({
-		baseUrl: `https://vssps.dev.azure.com/${encodeURIComponent(organization)}/_apis/`,
-		headers,
-		fetch,
-		successThrottle
-	});
-	const pullRequestPath = (repositoryId, changeNumber) => `git/repositories/${encodeURIComponent(repositoryId)}/pullRequests/${changeNumber}`;
-	return {
-		organization,
-		project,
-		async currentUser() {
-			return (await organizationApi.json("connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1", z.looseObject({ authenticatedUser: identitySchema }))).authenticatedUser;
-		},
-		async getRepository(repository) {
-			const value = await api.json(withApiVersion(`git/repositories/${encodeURIComponent(repository)}`), repositorySchema$1);
-			return {
-				id: value.id,
-				name: value.name,
-				projectId: value.project.id,
-				project: value.project.name
-			};
-		},
-		async getRepositoryPermission(actor, projectId, repositoryId) {
-			const candidates = (await identityApi.json(`identities?searchFilter=General&filterValue=${encodeURIComponent(actor)}&queryMembership=ExpandedUp&api-version=7.1`, collectionSchema(z.looseObject({
-				descriptor: z.string().min(1),
-				isActive: z.boolean().optional(),
-				isContainer: z.boolean().optional(),
-				memberOf: z.array(z.union([z.string().min(1), z.looseObject({ descriptor: z.string().min(1) })])).default([])
-			})))).value.filter((identity) => identity.isActive !== false && identity.isContainer !== true);
-			if (candidates.length !== 1) return "none";
-			const identity = candidates[0];
-			if (!identity) return "none";
-			const descriptors = [identity.descriptor, ...identity.memberOf.map((group) => typeof group === "string" ? group : group.descriptor)];
-			const loadAcls = (token) => {
-				const query = new URLSearchParams({
-					token,
-					descriptors: descriptors.join(","),
-					includeExtendedInfo: "true",
-					recurse: "false",
-					"api-version": "7.1"
-				});
-				return organizationApi.json(`accesscontrollists/2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87?${query}`, aclSchema);
-			};
-			const [projectAcls, repositoryAcls] = await Promise.all([loadAcls(`repoV2/${projectId}`), loadAcls(`repoV2/${projectId}/${repositoryId}`)]);
-			return azurePermissionFromAcls(repositoryAcls.value.every((acl) => acl.inheritPermissions) ? [...projectAcls.value, ...repositoryAcls.value] : repositoryAcls.value);
-		},
-		getPullRequest: (repositoryId, changeNumber) => api.json(withApiVersion(pullRequestPath(repositoryId, changeNumber)), pullRequestSchema$1),
-		async listIterations(repositoryId, changeNumber) {
-			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/iterations`), collectionSchema(iterationSchema))).value.map((iteration) => ({
-				id: iteration.id,
-				headSha: iteration.sourceRefCommit.commitId
-			}));
-		},
-		async loadChange(options) {
-			if (options.organization !== organization || options.project !== project) throw new Error("Azure DevOps client coordinates do not match its configured organization and project");
-			const pullRequest = await this.getPullRequest(options.repositoryId, options.changeNumber);
-			const iterations = await this.listIterations(options.repositoryId, options.changeNumber);
-			const headSha = pullRequest.lastMergeSourceCommit.commitId;
-			const iteration = iterations.findLast((candidate) => candidate.headSha === headSha);
-			if (!iteration) throw new Error(`Azure DevOps has no pull request iteration for head ${headSha}`);
-			const sourceRef = branchName(pullRequest.sourceRefName);
-			const targetRef = branchName(pullRequest.targetRefName);
-			return {
-				repository: {
-					slug: `${organization}/${pullRequest.repository.project.name}/${pullRequest.repository.name}`,
-					url: repositoryWebUrl(organization, pullRequest.repository.project.name, pullRequest.repository.name)
-				},
-				coordinates: {
-					provider: "azure-devops",
-					organization,
-					project: pullRequest.repository.project.name,
-					projectId: pullRequest.repository.project.id,
-					repositoryId: pullRequest.repository.id
-				},
-				change: {
-					number: pullRequest.pullRequestId,
-					isDraft: pullRequest.isDraft,
-					title: pullRequest.title,
-					description: pullRequest.description ?? "",
-					url: `${repositoryWebUrl(organization, pullRequest.repository.project.name, pullRequest.repository.name)}/pullrequest/${pullRequest.pullRequestId}`,
-					author: pullRequest.createdBy?.uniqueName ? { login: pullRequest.createdBy.uniqueName } : void 0,
-					base: {
-						sha: pullRequest.lastMergeTargetCommit.commitId,
-						ref: targetRef
-					},
-					head: {
-						sha: headSha,
-						ref: sourceRef,
-						...pullRequest.forkSource?.repository.remoteUrl ? { url: pullRequest.forkSource.repository.remoteUrl } : {}
-					},
-					...pullRequest.forkSource ? { isFork: true } : {}
-				},
-				iterationId: iteration.id
-			};
-		},
-		async listIterationChanges(repositoryId, changeNumber, iterationId) {
-			const changes = [];
-			let skip = 0;
-			let top = 2e3;
-			for (;;) {
-				const path = `${pullRequestPath(repositoryId, changeNumber)}/iterations/${iterationId}/changes?compareTo=0&$skip=${skip}&$top=${top}`;
-				const page = await api.json(withApiVersion(path), z.looseObject({
-					changeEntries: z.array(iterationChangeSchema),
-					nextSkip: z.number().int().nonnegative().optional(),
-					nextTop: z.number().int().nonnegative().max(2e3).optional()
-				}));
-				changes.push(...page.changeEntries.map((change) => ({
-					changeTrackingId: change.changeTrackingId,
-					changeType: change.changeType,
-					path: trimLeadingSlash(change.item.path),
-					...change.item.originalPath ? { originalPath: trimLeadingSlash(change.item.originalPath) } : {}
-				})));
-				if (!page.nextSkip) return changes;
-				skip = page.nextSkip;
-				if (page.nextTop) top = page.nextTop;
-			}
-		},
-		async listThreads(repositoryId, changeNumber) {
-			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads`), collectionSchema(threadSchema))).value;
-		},
-		createThread: (repositoryId, changeNumber, body) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads`), threadSchema, jsonRequest$2("POST", body)),
-		updateComment: (repositoryId, changeNumber, threadId, commentId, content) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}/comments/${encodeURIComponent(commentId)}`), threadCommentSchema, jsonRequest$2("PATCH", { content })),
-		createThreadComment: (repositoryId, changeNumber, threadId, body) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}/comments`), threadCommentSchema, jsonRequest$2("POST", body)),
-		updateThreadStatus: (repositoryId, changeNumber, threadId, status) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}`), threadSchema, jsonRequest$2("PATCH", { status })),
-		async createStatus(repositoryId, changeNumber, body) {
-			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/statuses`), statusSchema$1, jsonRequest$2("POST", body))).id;
-		}
-	};
-}
-function azureDevOpsStatusState(state) {
-	switch (state) {
-		case "pending": return "pending";
-		case "success": return "succeeded";
-		case "failure": return "failed";
-		case "neutral": return "notApplicable";
-	}
-}
-function azureRepositoryPermission(bits) {
-	if ((bits & 2) === 0) return "none";
-	if ((bits & 8192) !== 0) return "admin";
-	if ((bits & 2048) !== 0) return "maintain";
-	if ((bits & 4) !== 0) return "write";
-	if ((bits & 16384) !== 0) return "triage";
-	return "read";
-}
-function azurePermissionFromAcls(acls) {
-	let allow = 0;
-	let deny = 0;
-	for (const acl of acls) for (const ace of Object.values(acl.acesDictionary)) {
-		allow |= ace.extendedInfo?.effectiveAllow ?? ace.allow;
-		deny |= ace.extendedInfo?.effectiveDeny ?? ace.deny;
-	}
-	return azureRepositoryPermission(allow & ~deny);
-}
-function collectionSchema(item) {
-	return z.looseObject({
-		count: z.number().int().nonnegative(),
-		value: z.array(item)
-	});
-}
-function withApiVersion(path) {
-	return `${path}${path.includes("?") ? "&" : "?"}api-version=7.1`;
-}
-function jsonRequest$2(method, body) {
-	return {
-		method,
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(body)
-	};
-}
-function organizationFromCollectionUri$1(value) {
-	return value ? azureOrganizationFromUrl(value) : void 0;
-}
-function branchName(ref) {
-	return ref.replace(/^refs\/heads\//, "");
-}
-function repositoryWebUrl(organization, project, repository) {
-	return `https://dev.azure.com/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_git/${encodeURIComponent(repository)}`;
-}
-function trimLeadingSlash(value) {
-	return value.replace(/^\/+/, "");
-}
-//#endregion
-//#region src/hosts/bitbucket/schema.ts
-const bitbucketRepositorySchema = z.looseObject({
-	uuid: z.string().min(1),
-	name: z.string().min(1),
-	full_name: z.string().min(1),
-	slug: z.string().min(1).optional(),
-	links: z.looseObject({ html: z.looseObject({ href: z.string().url() }) })
-}).transform((repository) => ({
-	...repository,
-	slug: repository.slug ?? repository.full_name.split("/").at(-1) ?? repository.full_name
-}));
-//#endregion
-//#region src/hosts/bitbucket/client.ts
-const userSchema$1 = z.looseObject({
-	uuid: z.string().optional(),
-	nickname: z.string().optional(),
-	display_name: z.string().optional()
-});
-const endpointSchema = z.looseObject({
-	branch: z.looseObject({ name: z.string().min(1) }),
-	commit: z.looseObject({ hash: z.string().min(1) }),
-	repository: bitbucketRepositorySchema
-});
-const pullRequestSchema = z.looseObject({
-	id: z.number().int().positive(),
-	draft: z.boolean().optional(),
-	title: z.string(),
-	description: z.string().default(""),
-	author: userSchema$1.optional(),
-	source: endpointSchema,
-	destination: endpointSchema,
-	links: z.looseObject({ html: z.looseObject({ href: z.string().url() }) })
-});
-const inlineSchema = z.looseObject({
-	path: z.string().optional(),
-	from: z.number().int().nullable().optional(),
-	to: z.number().int().nullable().optional(),
-	start_from: z.number().int().nullable().optional(),
-	start_to: z.number().int().nullable().optional()
-});
-const commentSchema = z.looseObject({
-	id: z.union([z.number(), z.string()]).transform(String),
-	content: z.looseObject({ raw: z.string().default("") }),
-	user: userSchema$1.optional(),
-	parent: z.looseObject({ id: z.union([z.number(), z.string()]).transform(String) }).optional(),
-	inline: inlineSchema.optional(),
-	deleted: z.boolean().optional(),
-	resolution: z.looseObject({}).optional()
-});
-function createBitbucketClient(env = process.env, fetch = globalThis.fetch) {
-	const workspace = env.BITBUCKET_WORKSPACE;
-	const repository = env.BITBUCKET_REPO_SLUG;
-	const token = env.BITBUCKET_API_TOKEN;
-	const email = env.BITBUCKET_EMAIL;
-	if (!workspace) throw new Error("BITBUCKET_WORKSPACE is required for Bitbucket Cloud API calls");
-	if (!repository) throw new Error("BITBUCKET_REPO_SLUG is required for Bitbucket Cloud API calls");
-	if (!token || !email) throw new Error("BITBUCKET_EMAIL and BITBUCKET_API_TOKEN are required");
-	const authorization = `Basic ${Buffer.from(`${email}:${token}`).toString("base64")}`;
-	const repositoryApiPath = `/2.0/repositories/${encodeURIComponent(workspace)}/${encodeURIComponent(repository)}/`;
-	const api = createCodeHostHttpClient({
-		baseUrl: `https://api.bitbucket.org${repositoryApiPath}`,
-		headers: { Authorization: authorization },
-		fetch
-	});
-	const rootApi = createCodeHostHttpClient({
-		baseUrl: "https://api.bitbucket.org/2.0/",
-		headers: { Authorization: authorization },
-		fetch
-	});
-	const prPath = (id) => `pullrequests/${id}`;
-	return {
-		workspace,
-		repository,
-		async currentUser() {
-			const value = await rootApi.json("user", userSchema$1);
-			return {
-				uuid: value.uuid,
-				nickname: value.nickname,
-				displayName: value.display_name
-			};
-		},
-		async getRepository() {
-			const value = await api.json("", bitbucketRepositorySchema);
-			return {
-				uuid: value.uuid,
-				slug: value.slug,
-				fullName: value.full_name,
-				url: value.links.html.href
-			};
-		},
-		async getRepositoryPermission(actor, repositoryUuid) {
-			const permissionEmail = env.BITBUCKET_PERMISSION_EMAIL;
-			const permissionToken = env.BITBUCKET_PERMISSION_API_TOKEN;
-			if (!permissionEmail || !permissionToken) throw new Error("BITBUCKET_PERMISSION_EMAIL and BITBUCKET_PERMISSION_API_TOKEN are required for Bitbucket permission checks");
-			const permissionApi = createCodeHostHttpClient({
-				baseUrl: "https://api.bitbucket.org/2.0/",
-				headers: { Authorization: `Basic ${Buffer.from(`${permissionEmail}:${permissionToken}`).toString("base64")}` },
-				fetch
-			});
-			const query = encodeURIComponent(`repository.uuid="${escapeBitbucketQueryValue(repositoryUuid)}" AND user.nickname="${escapeBitbucketQueryValue(actor)}"`);
-			return (await permissionApi.json(`workspaces/${encodeURIComponent(workspace)}/permissions/repositories?q=${query}&pagelen=100`, pagedSchema(z.looseObject({
-				permission: z.enum([
-					"read",
-					"write",
-					"admin"
-				]),
-				user: userSchema$1
-			})))).values.find((entry) => entry.user.nickname === actor)?.permission ?? "none";
-		},
-		getPullRequest: (id) => api.json(prPath(id), pullRequestSchema),
-		async loadChange(options) {
-			if (options.workspace !== workspace || options.repository !== repository) throw new Error("Bitbucket client coordinates do not match the requested repository");
-			const pullRequest = await this.getPullRequest(options.changeNumber);
-			return {
-				repository: {
-					slug: pullRequest.destination.repository.full_name,
-					url: pullRequest.destination.repository.links.html.href
-				},
-				coordinates: {
-					provider: "bitbucket",
-					workspace,
-					repository,
-					repositoryUuid: pullRequest.destination.repository.uuid
-				},
-				change: {
-					number: pullRequest.id,
-					isDraft: pullRequest.draft,
-					title: pullRequest.title,
-					description: pullRequest.description,
-					url: pullRequest.links.html.href,
-					author: pullRequest.author?.nickname ? { login: pullRequest.author.nickname } : void 0,
-					base: {
-						sha: pullRequest.destination.commit.hash,
-						ref: pullRequest.destination.branch.name,
-						url: pullRequest.destination.repository.links.html.href
-					},
-					head: {
-						sha: pullRequest.source.commit.hash,
-						ref: pullRequest.source.branch.name,
-						url: pullRequest.source.repository.links.html.href
-					},
-					isFork: pullRequest.source.repository.uuid !== pullRequest.destination.repository.uuid
-				}
-			};
-		},
-		async listComments(id) {
-			return (await listAll(api, `${prPath(id)}/comments`, commentSchema, repositoryApiPath)).filter((comment) => !comment.deleted);
-		},
-		createComment: (id, body) => api.json(`${prPath(id)}/comments`, commentSchema, jsonRequest$1("POST", body)),
-		updateComment: (id, commentId, content) => api.json(`${prPath(id)}/comments/${encodeURIComponent(commentId)}`, commentSchema, jsonRequest$1("PUT", { content: { raw: content } })),
-		async replyToComment(id, commentId, content) {
-			const parentId = positiveCommentId(commentId);
-			return await api.json(`${prPath(id)}/comments`, commentSchema, jsonRequest$1("POST", {
-				content: { raw: content },
-				parent: { id: parentId }
-			}));
-		},
-		async resolveComment(id, commentId) {
-			positiveCommentId(commentId);
-			await api.json(`${prPath(id)}/comments/${encodeURIComponent(commentId)}/resolve`, z.unknown(), { method: "POST" });
-		},
-		async setStatus(sha, key, body) {
-			return (await api.json(`commit/${encodeURIComponent(sha)}/statuses/build`, z.looseObject({ key: z.string().default(key) }), jsonRequest$1("POST", {
-				...body,
-				key
-			}))).key;
-		}
-	};
-}
-function positiveCommentId(value) {
-	const id = Number(value);
-	if (!Number.isSafeInteger(id) || id <= 0) throw new Error("Bitbucket comment ID must be a positive integer");
-	return id;
-}
-function bitbucketStatusState(state) {
-	if (state === "pending") return "INPROGRESS";
-	if (state === "failure") return "FAILED";
-	if (state === "neutral") return "STOPPED";
-	return "SUCCESSFUL";
-}
-function escapeBitbucketQueryValue(value) {
-	return value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"");
-}
-function pagedSchema(item) {
-	return z.looseObject({
-		values: z.array(item),
-		next: z.string().url().optional()
-	});
-}
-async function listAll(api, path, schema, allowedPathPrefix) {
-	const values = [];
-	let next = path;
-	while (next) {
-		const page = await api.json(next, pagedSchema(schema));
-		values.push(...page.values);
-		if (page.next) {
-			const url = new URL(page.next);
-			if (url.origin !== "https://api.bitbucket.org" || !url.pathname.startsWith(allowedPathPrefix)) throw new Error("Bitbucket pagination URL must stay inside the configured repository API");
-		}
-		next = page.next;
-	}
-	return values;
-}
-function jsonRequest$1(method, body) {
-	return {
-		method,
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(body)
-	};
-}
-//#endregion
-//#region src/hosts/gitlab/client.ts
-const userSchema = z.looseObject({
-	id: z.number().int().positive(),
-	username: z.string().min(1)
-});
-const noteSchema = z.looseObject({
-	id: z.union([z.number(), z.string()]).transform(String),
-	body: z.string(),
-	author: userSchema.optional()
-});
-const positionSchema = z.looseObject({
-	new_path: z.string().optional(),
-	old_path: z.string().optional(),
-	new_line: z.number().int().positive().nullish().transform((value) => value ?? void 0),
-	old_line: z.number().int().positive().nullish().transform((value) => value ?? void 0),
-	line_range: z.looseObject({
-		start: z.looseObject({
-			new_line: z.number().int().positive().nullish(),
-			old_line: z.number().int().positive().nullish()
-		}),
-		end: z.looseObject({
-			new_line: z.number().int().positive().nullish(),
-			old_line: z.number().int().positive().nullish()
-		})
-	}).optional()
-});
-const discussionNoteSchema = noteSchema.extend({
-	resolvable: z.boolean().optional(),
-	resolved: z.boolean().optional(),
-	position: positionSchema.nullable().optional()
-});
-const discussionSchema = z.looseObject({
-	id: z.string().min(1),
-	individual_note: z.boolean().optional(),
-	notes: z.array(discussionNoteSchema)
-});
-const diffRefsSchema = z.looseObject({
-	base_sha: z.string().min(1),
-	start_sha: z.string().min(1),
-	head_sha: z.string().min(1)
-});
-const mergeRequestResponseSchema = z.looseObject({
-	iid: z.number().int().positive(),
-	title: z.string().default(""),
-	description: z.string().nullable().optional(),
-	web_url: z.string().url().optional(),
-	source_branch: z.string().min(1),
-	target_branch: z.string().min(1),
-	source_project_id: z.number().int().positive(),
-	target_project_id: z.number().int().positive(),
-	sha: z.string().min(1),
-	draft: z.boolean().optional(),
-	author: userSchema.optional(),
-	references: z.looseObject({ full: z.string().optional() }).optional(),
-	diff_refs: diffRefsSchema.nullable().optional()
-});
-const mergeRequestSchema = mergeRequestResponseSchema.extend({ diff_refs: diffRefsSchema });
-const memberSchema = z.looseObject({ access_level: z.number().int().min(0) });
-const statusSchema = z.looseObject({ id: z.union([z.number(), z.string()]).optional() });
-function createGitLabClient(env = process.env, fetch = globalThis.fetch, sleep = (milliseconds) => Bun.sleep(milliseconds)) {
-	const token = env.GITLAB_TOKEN ?? env.CI_JOB_TOKEN;
-	if (!token) throw new Error("GITLAB_TOKEN or CI_JOB_TOKEN is required for GitLab API calls");
-	const headers = env.GITLAB_TOKEN ? { "PRIVATE-TOKEN": token } : { "JOB-TOKEN": token };
-	const clientOptions = {
-		baseUrl: `${(env.CI_API_V4_URL ?? "https://gitlab.com/api/v4").replace(/\/$/, "")}/`,
-		headers,
-		fetch,
-		sleep: async (milliseconds) => void await sleep(milliseconds)
-	};
-	const api = createCodeHostHttpClient(clientOptions);
-	const statusApi = createCodeHostHttpClient({
-		...clientOptions,
-		retryNonIdempotentStatuses: [409]
-	});
-	return {
-		async getProject(project) {
-			const value = await api.json(`projects/${encodeURIComponent(project)}`, z.looseObject({
-				id: z.union([z.number(), z.string()]).transform(String),
-				path_with_namespace: z.string().min(1)
-			}));
-			return {
-				id: value.id,
-				path: value.path_with_namespace
-			};
-		},
-		currentUser: () => api.json("user", userSchema),
-		async loadChange(options) {
-			const mergeRequest = await this.getMergeRequest(options.projectId, options.changeNumber);
-			return {
-				repository: {
-					slug: options.projectPath,
-					url: projectWebUrl(mergeRequest.web_url)
-				},
-				coordinates: {
-					provider: "gitlab",
-					projectId: String(mergeRequest.target_project_id),
-					projectPath: options.projectPath
-				},
-				change: {
-					number: mergeRequest.iid,
-					title: mergeRequest.title,
-					description: mergeRequest.description ?? "",
-					url: mergeRequest.web_url,
-					author: mergeRequest.author ? { login: mergeRequest.author.username } : void 0,
-					base: {
-						sha: mergeRequest.diff_refs.start_sha,
-						ref: mergeRequest.target_branch
-					},
-					head: {
-						sha: mergeRequest.diff_refs.head_sha,
-						ref: mergeRequest.source_branch
-					},
-					isFork: mergeRequest.source_project_id !== mergeRequest.target_project_id,
-					isDraft: mergeRequest.draft
-				}
-			};
-		},
-		async getMergeRequest(projectId, changeNumber) {
-			const requestPath = `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}`;
-			for (let attempt = 0;; attempt += 1) {
-				const response = await api.json(requestPath, mergeRequestResponseSchema);
-				const prepared = mergeRequestSchema.safeParse(response);
-				if (prepared.success) return prepared.data;
-				if (attempt >= 4) throw new Error("GitLab merge request diff refs were not prepared after 5 attempts");
-				await sleep(250 * 2 ** attempt);
-			}
-		},
-		async getRepositoryPermission(projectId, username) {
-			const user = (await api.json(`users?username=${encodeURIComponent(username)}`, z.array(userSchema))).find((candidate) => candidate.username === username);
-			if (!user) return "none";
-			try {
-				return accessLevelPermission((await api.json(`projects/${encodeURIComponent(projectId)}/members/all/${user.id}`, memberSchema)).access_level);
-			} catch (error) {
-				if (error instanceof CodeHostHttpError && error.status === 404) return "none";
-				throw error;
-			}
-		},
-		listNotes: (projectId, changeNumber) => paginated(api, `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes`, noteSchema),
-		createNote: (projectId, changeNumber, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes`, noteSchema, jsonRequest("POST", { body })),
-		updateNote: (projectId, changeNumber, noteId, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes/${encodeURIComponent(noteId)}`, noteSchema, jsonRequest("PUT", { body })),
-		listDiscussions: (projectId, changeNumber) => paginated(api, `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions`, discussionSchema),
-		getDiscussion: (projectId, changeNumber, discussionId) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}`, discussionSchema),
-		async findReplyParent(projectId, changeNumber, noteId, discussionId) {
-			if (!discussionId) return void 0;
-			const discussion = await this.getDiscussion(projectId, changeNumber, discussionId);
-			if (!discussion.notes.some((note) => note.id === noteId) || discussion.notes[0]?.id === noteId) return;
-			return discussion.notes[0]?.id;
-		},
-		createDiscussion: (projectId, changeNumber, body, position) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions`, discussionSchema, jsonRequest("POST", {
-			body,
-			position
-		})),
-		replyDiscussion: (projectId, changeNumber, discussionId, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}/notes`, noteSchema, jsonRequest("POST", { body })),
-		async resolveDiscussion(projectId, changeNumber, discussionId) {
-			await api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}`, discussionSchema, jsonRequest("PUT", { resolved: true }));
-		},
-		async setStatus(projectId, sha, name, state, description) {
-			const status = await statusApi.json(`projects/${encodeURIComponent(projectId)}/statuses/${encodeURIComponent(sha)}`, statusSchema, jsonRequest("POST", {
-				state: gitLabStatusState(state),
-				name,
-				description: boundedStatusDescription(description)
-			}));
-			return String(status.id ?? name);
-		}
-	};
-}
-const MAX_PAGINATION_PAGES = 100;
-async function paginated(client, path, schema) {
-	const values = [];
-	for (let page = 1; page <= MAX_PAGINATION_PAGES; page += 1) {
-		const separator = path.includes("?") ? "&" : "?";
-		const batch = await client.json(`${path}${separator}per_page=100&page=${page}`, z.array(schema));
-		values.push(...batch);
-		if (batch.length < 100) return values;
-	}
-	throw new Error(`GitLab pagination exceeded ${MAX_PAGINATION_PAGES} pages for ${path}`);
-}
-function jsonRequest(method, body) {
-	return {
-		method,
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify(body)
-	};
-}
-function accessLevelPermission(level) {
-	if (level >= 50) return "admin";
-	if (level >= 40) return "maintain";
-	if (level >= 30) return "write";
-	if (level >= 15) return "triage";
-	if (level >= 10) return "read";
-	return "none";
-}
-function boundedStatusDescription(description) {
-	return description && description.length > 255 ? `${description.slice(0, 252).trimEnd()}...` : description;
-}
-function gitLabStatusState(state) {
-	switch (state) {
-		case "pending": return "pending";
-		case "success": return "success";
-		case "failure": return "failed";
-		case "neutral": return "skipped";
-	}
-}
-function projectWebUrl(mergeRequestUrl) {
-	return mergeRequestUrl?.replace(/\/-\/merge_requests\/\d+$/, "");
-}
-//#endregion
-//#region src/diff/git.ts
-function runGit$1(args, cwd, maxBuffer) {
-	const result = Bun.spawnSync(["git", ...args], {
-		cwd,
-		env: process.env,
-		maxBuffer,
-		stderr: "pipe",
-		stdout: "pipe"
-	});
-	if (result.exitCode !== 0) {
-		const failure = result.stderr?.toString().trim() || "unknown error";
-		throw new Error(`git ${args.join(" ")} failed: ${failure}`);
-	}
-	return result.stdout.toString();
-}
-//#endregion
-//#region src/diff/diff.ts
-const lockFilePattern = /(^|\/)(bun\.lock|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|Cargo\.lock)$/;
-const generatedPattern = /(^|\/)(dist|build|coverage|vendor)\//;
-const maxInlineChangedLines = 1e3;
-const maxCommentableRangeLines = 5e3;
-function buildDiffManifest(options) {
-	const mergeBaseSha = runGit$1([
-		"merge-base",
-		options.baseSha,
-		options.headSha
-	], options.cwd).trim();
-	const diffHead = options.includeWorkingTree ? void 0 : options.headSha;
-	const nameStatus = runGit$1(buildDiffArgs([
-		"--name-status",
-		"-z",
-		"--find-renames"
-	], mergeBaseSha, diffHead), options.cwd);
-	const diffStats = getDiffStats(options.cwd, mergeBaseSha, diffHead);
-	const rawPatch = parseRawPatch(runGit$1(buildUnifiedDiffArgs(mergeBaseSha, diffHead, getPreExcludedFiles(diffStats)), options.cwd));
-	const files = parseNameStatus(nameStatus);
-	const parsedDiff = parseUnifiedDiff(rawPatch.patch, rawPatch.filePaths);
-	for (const file of files) {
-		const stats = diffStats.get(file.path);
-		file.additions = stats?.additions ?? 0;
-		file.deletions = stats?.deletions ?? 0;
-		const preExcludedReason = stats?.excludedReason;
-		const parsedFile = parsedDiff.get(file.path);
-		file.hunks = preExcludedReason ? [] : parsedFile?.hunks ?? [];
-		file.commentableRanges = preExcludedReason ? [] : parsedFile?.commentableRanges ?? [];
-		const excludedReason = preExcludedReason ?? getExcludedReason(file);
-		if (excludedReason) {
-			file.hunks = [];
-			file.commentableRanges = [];
-			file.excludedReason = excludedReason;
-		}
-	}
-	return parseDiffManifest({
-		baseSha: options.baseSha,
-		headSha: options.headSha,
-		mergeBaseSha,
-		files
-	});
-}
-function parseNameStatus(output) {
-	const fields = output.split("\0");
-	const files = [];
-	let index = 0;
-	while (index < fields.length) {
-		const rawStatus = fields[index++];
-		if (!rawStatus) continue;
-		const firstPath = fields[index++] ?? "";
-		const status = parseFileStatus(rawStatus);
-		if (status === "renamed") {
-			const secondPath = fields[index++] ?? "";
-			files.push(baseFile(secondPath || firstPath, status, firstPath));
-			continue;
-		}
-		files.push(baseFile(firstPath, status));
-	}
-	return files;
-}
-function parseUnifiedDiff(diff, filePaths) {
-	const state = createDiffParserState(filePaths);
-	for (const line of diff.split("\n")) parseUnifiedDiffLine(state, line);
-	finishActiveHunk(state);
-	return state.filesByPath;
-}
-function getDiffStats(cwd, baseSha, headSha) {
-	const output = runGit$1(buildDiffArgs([
-		"--numstat",
-		"-z",
-		"--find-renames"
-	], baseSha, headSha), cwd);
-	const stats = /* @__PURE__ */ new Map();
-	for (const stat of parseNumstat(output)) {
-		if (stat.binary) {
-			stats.set(stat.path, {
-				additions: 0,
-				deletions: 0,
-				excludedReason: "binary diff"
-			});
-			continue;
-		}
-		stats.set(stat.path, {
-			additions: stat.additions,
-			deletions: stat.deletions,
-			excludedReason: stat.additions + stat.deletions > maxInlineChangedLines ? "oversized diff" : void 0
-		});
-	}
-	return stats;
-}
-function getPreExcludedFiles(stats) {
-	const excluded = /* @__PURE__ */ new Map();
-	for (const [filePath, stat] of stats) if (stat.excludedReason) excluded.set(filePath, stat.excludedReason);
-	return excluded;
-}
-function buildUnifiedDiffArgs(baseSha, headSha, excludedFiles) {
-	const args = buildDiffArgs([
-		"--raw",
-		"-z",
-		"--patch",
-		"--submodule=short",
-		"--unified=80",
-		"--find-renames"
-	], baseSha, headSha);
-	if (excludedFiles.size === 0) return args;
-	return [
-		...args,
-		"--",
-		".",
-		...[...excludedFiles.keys()].map((filePath) => `:(exclude,literal)${filePath}`)
-	];
-}
-function buildDiffArgs(options, baseSha, headSha) {
-	return headSha ? [
-		"diff",
-		...options,
-		baseSha,
-		headSha
-	] : [
-		"diff",
-		...options,
-		baseSha
-	];
-}
-function parseNumstat(output) {
-	const fields = output.split("\0");
-	const stats = [];
-	let index = 0;
-	while (index < fields.length) {
-		const header = parseNumstatHeader(fields[index++] ?? "");
-		if (!header) continue;
-		const resolvedPath = resolveNumstatPath(header.path, fields, index);
-		index = resolvedPath.nextIndex;
-		const filePath = resolvedPath.path;
-		if (!filePath) continue;
-		const binary = header.rawAdditions === "-" || header.rawDeletions === "-";
-		stats.push({
-			path: filePath,
-			additions: binary ? 0 : Number(header.rawAdditions),
-			deletions: binary ? 0 : Number(header.rawDeletions),
-			binary
-		});
-	}
-	return stats;
+function parseNumstat(output) {
+	const fields = output.split("\0");
+	const stats = [];
+	let index = 0;
+	while (index < fields.length) {
+		const header = parseNumstatHeader(fields[index++] ?? "");
+		if (!header) continue;
+		const resolvedPath = resolveNumstatPath(header.path, fields, index);
+		index = resolvedPath.nextIndex;
+		const filePath = resolvedPath.path;
+		if (!filePath) continue;
+		const binary = header.rawAdditions === "-" || header.rawDeletions === "-";
+		stats.push({
+			path: filePath,
+			additions: binary ? 0 : Number(header.rawAdditions),
+			deletions: binary ? 0 : Number(header.rawDeletions),
+			binary
+		});
+	}
+	return stats;
 }
 function resolveNumstatPath(path, fields, nextIndex) {
 	if (path) return {
@@ -2202,11 +1382,15 @@ function parseFileStatus(rawStatus) {
 	return "modified";
 }
 function getExcludedReason(file) {
+	const pathExcludedReason = getPathExcludedReason(file);
+	if (pathExcludedReason) return pathExcludedReason;
+	if (file.additions + file.deletions > maxInlineChangedLines) return "oversized diff";
+	if (commentableRangeLineCount(file.commentableRanges) > maxCommentableRangeLines) return "oversized diff";
+}
+function getPathExcludedReason(file) {
 	if (file.status === "removed") return "removed file";
 	if (lockFilePattern.test(file.path)) return "lock file";
 	if (generatedPattern.test(file.path)) return "generated or build output";
-	if (file.additions + file.deletions > maxInlineChangedLines) return "oversized diff";
-	if (commentableRangeLineCount(file.commentableRanges) > maxCommentableRangeLines) return "oversized diff";
 }
 function commentableRangeLineCount(ranges) {
 	return ranges.reduce((total, range) => total + range.endLine - range.startLine + 1, 0);
@@ -3693,7 +2877,7 @@ function createRuntimeLog(options) {
 		},
 		text(level, event, text) {
 			if (level === "debug" && !debugEnabled) return;
-			emitRecord(sink, secrets, level, event, void 0, redact(text, secrets));
+			emitRecord(sink, secrets, level, event, void 0, redact$1(text, secrets));
 		},
 		textSnippet(level, event, text, snippetOptions) {
 			if (level === "debug" && !debugEnabled) return;
@@ -3703,7 +2887,7 @@ function createRuntimeLog(options) {
 			return formatTextSnippet(text, secrets, snippetOptions);
 		},
 		async group(name, run) {
-			return await sink.group(redact(name, secrets), run);
+			return await sink.group(redact$1(name, secrets), run);
 		},
 		addSecret(value) {
 			addSecret(secrets, value);
@@ -3726,25 +2910,25 @@ function boundedLogSnippet(text, options) {
 function addSecret(secrets, value) {
 	if (value && value.length >= 4) secrets.add(value);
 }
-function redact(message, secrets) {
+function redact$1(message, secrets) {
 	let redacted = message;
 	for (const secret of secrets) redacted = redacted.split(secret).join("***");
 	return redacted;
 }
 function compactFields(fields, secrets) {
 	const compact = {};
-	for (const [key, value] of Object.entries(fields ?? {})) if (typeof value === "string") compact[key] = redact(value, secrets);
-	else if (Array.isArray(value)) compact[key] = value.map((item) => redact(item, secrets));
+	for (const [key, value] of Object.entries(fields ?? {})) if (typeof value === "string") compact[key] = redact$1(value, secrets);
+	else if (Array.isArray(value)) compact[key] = value.map((item) => redact$1(item, secrets));
 	else if (value !== void 0) compact[key] = value;
 	return compact;
 }
 function formatTextSnippet(text, secrets, options) {
-	return boundedLogSnippet(redact(text, secrets), options);
+	return boundedLogSnippet(redact$1(text, secrets), options);
 }
 function emitRecord(sink, secrets, level, event, fields, text) {
 	sink.log({
 		level,
-		event: redact(event, secrets),
+		event: redact$1(event, secrets),
 		fields: compactFields(fields, secrets),
 		text
 	});
@@ -5981,300 +5165,711 @@ async function runTaskRuntime(options) {
 	const verifier = await runSynchronizeVerifier({
 		options,
 		config,
-		provider,
-		diffManifest,
-		priorReviewState,
-		runId,
-		piRunSink: runtimeOptions.piRunSink
+		provider,
+		diffManifest,
+		priorReviewState,
+		runId,
+		piRunSink: runtimeOptions.piRunSink
+	});
+	const stats = reviewStatsForRuns(piRuns, Date.now() - runtimeStarted);
+	const redactedPublication = redactReviewPublication({
+		main,
+		validated,
+		threadActions: verifier.threadActions,
+		taskChecks,
+		redactor: options.secretRedactor
+	});
+	const publishing = buildCommentPublishingPlan({
+		event: options.event,
+		main: redactedPublication.main,
+		validated: redactedPublication.validated,
+		manifest: diffManifest,
+		maxInlineComments: config.publication.maxInlineComments,
+		maxStoredFindings: config.publication.maxStoredFindings,
+		showHeader: config.publication.showHeader,
+		showFooter: config.publication.showFooter,
+		showStats: config.publication.showStats,
+		priorReviewState: verifier.priorReviewState,
+		threadActions: redactedPublication.threadActions,
+		metadata: {
+			runtimeVersion,
+			configVersion: options.versionCompatibility?.configVersion,
+			trustedConfigSha: options.trustedConfigSha,
+			trustedConfigHash: options.trustedConfigHash,
+			reviewedHeadSha: options.event.change.head.sha,
+			providerModels: output.providerModels.length + verifier.providerModels.length > 0 ? uniq([...output.providerModels, ...verifier.providerModels]) : [provider.model],
+			selectedTasks,
+			failedTasks: [],
+			validFindings: validated.validFindings.length,
+			droppedFindings: validated.droppedFindings.length,
+			...stats ? { stats } : {}
+		}
+	});
+	const publicationPlan = publishing.publicationPlan;
+	publishTaskChecks(options.checkSink, redactedPublication.taskChecks);
+	options.log?.info("review validated", {
+		validFindings: validated.validFindings.length,
+		droppedFindings: validated.droppedFindings.length,
+		inlineDrafts: publishing.inlineCommentDrafts.length,
+		threadActions: verifier.threadActions.length
+	});
+	return {
+		kind: "review",
+		provider,
+		diffManifest,
+		review: redactedPublication.validated.review,
+		validated: redactedPublication.validated,
+		publicationPlan,
+		mainComment: publicationPlan.mainComment,
+		inlineCommentDrafts: publishing.inlineCommentDrafts,
+		taskChecks: redactedPublication.taskChecks,
+		repairAttempted: output.repairAttempted
+	};
+}
+function publishFailedRunTaskChecks(options, taskChecks) {
+	const redacted = redactCommandPublication({
+		body: "",
+		taskChecks,
+		redactor: options.secretRedactor
+	});
+	publishTaskChecks(options.checkSink, redacted.taskChecks);
+}
+function commandResponseResultFromOutput(options) {
+	const commandResponse = options.output.commandResponse;
+	if (!commandResponse) return;
+	if (!options.commandInvocation) throw new Error("ctx.command.reply(...) is only available for command-triggered tasks");
+	return commandResponseRuntimeResult({
+		...options,
+		commandResponse,
+		commandInvocation: options.commandInvocation
+	});
+}
+function assertReviewCommentOutput(output, hasCommandInvocation) {
+	if (output.comment) return;
+	throw new Error(hasCommandInvocation ? "ctx.comment(...) or ctx.command.reply(...) must be called exactly once per selected run" : "ctx.comment(...) must be called exactly once per selected run");
+}
+async function runSynchronizeVerifier(options) {
+	if (options.options.event.rawAction !== "synchronize") return {
+		priorReviewState: options.priorReviewState,
+		threadActions: [],
+		providerModels: []
+	};
+	const config = options.config;
+	return await runInternalVerifier({
+		workspace: options.options.workspace,
+		config,
+		event: options.options.event,
+		provider: options.provider,
+		verifierProvider: resolveProvider(config, config.publication.autoResolve.model ?? config.defaultProvider),
+		plan: options.options.plan,
+		env: options.options.env,
+		piExecutable: options.options.piExecutable,
+		piRunner: options.options.piRunner,
+		log: options.options.log,
+		diffManifest: options.diffManifest,
+		priorReviewState: options.priorReviewState,
+		threadContexts: await options.options.loadInlineThreadContexts?.() ?? [],
+		mode: { kind: "synchronize" },
+		runId: options.runId,
+		piRunSink: options.piRunSink
 	});
-	const stats = reviewStatsForRuns(piRuns, Date.now() - runtimeStarted);
-	const redactedPublication = redactReviewPublication({
-		main,
-		validated,
-		threadActions: verifier.threadActions,
-		taskChecks,
+}
+function createTaskContext(options) {
+	const repositorySlugParts = options.event.repository.slug.split("/");
+	let taskContext;
+	taskContext = {
+		run: { id: options.runId },
+		repository: {
+			root: options.workspace,
+			owner: repositorySlugParts.length > 1 ? repositorySlugParts[0] : void 0,
+			name: repositorySlugParts.at(-1) ?? "repo"
+		},
+		change: {
+			number: options.event.change.number,
+			title: options.event.change.title,
+			description: options.event.change.description,
+			url: options.event.change.url,
+			author: options.event.change.author,
+			base: options.event.change.base,
+			head: options.event.change.head,
+			isFork: options.event.change.isFork,
+			async diffManifest(manifestOptions) {
+				const key = JSON.stringify(manifestOptions ?? {});
+				const cached = options.manifestCache.get(key);
+				if (cached) return cloneDiffManifest(cached);
+				const manifest = projectDiffManifest(options.diffManifest, manifestOptions);
+				options.manifestCache.set(key, manifest);
+				return cloneDiffManifest(manifest);
+			},
+			async changedFiles() {
+				return options.diffManifest.files.map((file) => ({
+					path: file.path,
+					previousPath: file.previousPath,
+					status: file.status
+				}));
+			},
+			async currentHeadSha() {
+				return options.event.change.head.sha;
+			}
+		},
+		platform: { id: options.event.platform.id },
+		command: options.commandInvocation ? {
+			name: options.commandInvocation.name,
+			line: options.commandInvocation.line,
+			arguments: { ...options.commandInvocation.arguments },
+			async reply(markdown) {
+				collectCommandResponse(options.output, markdown, options.taskName);
+			}
+		} : void 0,
+		secret(secret) {
+			return resolveTaskSecret(secret, options);
+		},
+		pi: { async run(agent, input, runOptions) {
+			const result = await runReviewAgent({
+				agent,
+				input,
+				runOptions,
+				runtime: {
+					...options,
+					taskContext,
+					runId: options.runId,
+					piRunSink: options.piRunSink
+				}
+			});
+			options.output.providerModels.push(...result.providerModels);
+			if (result.repairAttempted) options.output.repairAttempted = true;
+			trackResultFindingScope(options.output, result.value, runOptions?.paths);
+			return agentOutputForTaskContext(agent, result.value);
+		} },
+		review: { async prior() {
+			return priorReviewForTask(options.priorMainComment, options.priorReviewState);
+		} },
+		check: createCheckHandle(options.output),
+		async comment(value) {
+			collectComment(options.output, value, options.taskName);
+		},
+		log: options.taskLog ?? console
+	};
+	return taskContext;
+}
+function agentOutputForTaskContext(_agent, value) {
+	return value;
+}
+function resolveTaskSecret(secret, options) {
+	if (secret.kind !== "pipr.secret" || typeof secret.name !== "string") throw new Error("ctx.secret(...) requires a pipr.secret reference");
+	const value = (options.env ?? process.env)[secret.name];
+	if (!value) throw new Error(`Missing secret env var: ${secret.name}`);
+	options.log?.addSecret(value);
+	options.secretRedactor?.addSecret(value);
+	return value;
+}
+function commandResponseRuntimeResult(options) {
+	const redacted = redactCommandPublication({
+		body: options.commandResponse.value,
+		taskChecks: options.taskChecks,
 		redactor: options.secretRedactor
 	});
-	const publishing = buildCommentPublishingPlan({
+	return {
+		kind: "command-response",
+		provider: options.provider,
+		diffManifest: options.diffManifest,
+		taskChecks: redacted.taskChecks,
+		repairAttempted: options.output.repairAttempted,
+		commandResponse: {
+			commandName: options.commandInvocation.name,
+			line: options.commandInvocation.line,
+			arguments: options.commandInvocation.arguments,
+			body: redacted.body
+		}
+	};
+}
+function publishTaskChecks(sink, checks) {
+	for (const check of checks) sink?.setTaskResult(check);
+}
+function skippedTaskRuntimeResult(options) {
+	const reason = options.reason ?? (options.taskName ? `Task '${options.taskName}' was not registered` : "No tasks matched the change request event");
+	const review = {
+		summary: { body: reason },
+		inlineFindings: []
+	};
+	const validated = {
+		review,
+		validFindings: [],
+		droppedFindings: []
+	};
+	const publicationPlan = buildCommentPublishingPlan({
 		event: options.event,
-		main: redactedPublication.main,
-		validated: redactedPublication.validated,
-		manifest: diffManifest,
-		maxInlineComments: config.publication.maxInlineComments,
-		maxStoredFindings: config.publication.maxStoredFindings,
-		showHeader: config.publication.showHeader,
-		showFooter: config.publication.showFooter,
-		showStats: config.publication.showStats,
-		priorReviewState: verifier.priorReviewState,
-		threadActions: redactedPublication.threadActions,
+		main: reason,
+		validated,
+		manifest: options.diffManifest,
+		maxInlineComments: options.config.publication.maxInlineComments,
+		maxStoredFindings: options.config.publication.maxStoredFindings,
+		showHeader: options.config.publication.showHeader,
+		showFooter: options.config.publication.showFooter,
+		showStats: options.config.publication.showStats,
 		metadata: {
 			runtimeVersion,
 			configVersion: options.versionCompatibility?.configVersion,
 			trustedConfigSha: options.trustedConfigSha,
 			trustedConfigHash: options.trustedConfigHash,
 			reviewedHeadSha: options.event.change.head.sha,
-			providerModels: output.providerModels.length + verifier.providerModels.length > 0 ? uniq([...output.providerModels, ...verifier.providerModels]) : [provider.model],
-			selectedTasks,
+			providerModels: [options.provider.model],
+			selectedTasks: [],
 			failedTasks: [],
-			validFindings: validated.validFindings.length,
-			droppedFindings: validated.droppedFindings.length,
-			...stats ? { stats } : {}
+			validFindings: 0,
+			droppedFindings: 0
+		}
+	}).publicationPlan;
+	return {
+		kind: "skipped",
+		skipReason: reason,
+		provider: options.provider,
+		diffManifest: options.diffManifest,
+		review,
+		validated,
+		publicationPlan,
+		mainComment: publicationPlan.mainComment,
+		inlineCommentDrafts: [],
+		taskChecks: [],
+		repairAttempted: false
+	};
+}
+//#endregion
+//#region src/shared/secret-redactor-core.ts
+const redactedSecret = "[redacted secret]";
+const minimumSecretLength = 4;
+function createSecretRedactor(initialSecrets) {
+	const secrets = new Set(initialSecrets.filter((value) => value.length >= minimumSecretLength));
+	return {
+		addSecret(value) {
+			if (value && value.length >= minimumSecretLength) secrets.add(value);
+		},
+		redact(value) {
+			const ordered = [...secrets].sort((left, right) => right.length - left.length);
+			let next = value;
+			for (const secret of ordered) next = next.replaceAll(secret, redactedSecret);
+			return {
+				value: next,
+				detected: next !== value
+			};
+		}
+	};
+}
+//#endregion
+//#region src/shared/secret-redactor.ts
+function createKnownSecretRedactor(options) {
+	return createSecretRedactor(sensitiveEnvironmentValues(options?.env ?? process.env));
+}
+//#endregion
+//#region src/hosts/http.ts
+var CodeHostHttpError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.name = "CodeHostHttpError";
+		this.status = status;
+	}
+};
+function createCodeHostHttpClient(options) {
+	const fetchRequest = options.fetch ?? fetch;
+	const sleep = options.sleep ?? ((milliseconds) => Bun.sleep(milliseconds));
+	const successThrottle = options.successThrottle ?? createCodeHostSuccessThrottle(sleep);
+	const maxRetries = options.maxRetries ?? 2;
+	const requestTimeoutMilliseconds = options.requestTimeoutMilliseconds ?? 3e4;
+	const secrets = [...new Headers(options.headers).values()].flatMap((value) => [value, value.split(/\s+/).at(-1)].filter((candidate) => candidate !== void 0 && candidate.length >= 8));
+	return { async json(path, schema, init = {}) {
+		const method = init.method?.toUpperCase() ?? "GET";
+		for (let attempt = 0;; attempt += 1) {
+			await successThrottle.wait();
+			const timeoutSignal = AbortSignal.timeout(requestTimeoutMilliseconds);
+			const response = await fetchRequest(new URL(path, options.baseUrl), {
+				...init,
+				headers: {
+					...Object.fromEntries(new Headers(options.headers)),
+					...Object.fromEntries(new Headers(init.headers))
+				},
+				signal: init.signal ? AbortSignal.any([init.signal, timeoutSignal]) : timeoutSignal
+			});
+			const retryAfter = retryAfterMilliseconds(response.headers.get("Retry-After"));
+			if (response.ok) {
+				successThrottle.update(response.headers.get("Retry-After"));
+				return schema.parse(await response.json());
+			}
+			if (shouldRetryCodeHostRequest({
+				method,
+				attempt,
+				maxRetries,
+				response,
+				retryStatuses: options.retryNonIdempotentStatuses
+			})) {
+				await sleep(retryAfter || 250 * 2 ** attempt);
+				continue;
+			}
+			const body = (await response.text()).slice(0, 1024);
+			throw new CodeHostHttpError(redact(`Code host request failed (${response.status} ${response.statusText}): ${body}`, secrets), response.status);
 		}
-	});
-	const publicationPlan = publishing.publicationPlan;
-	publishTaskChecks(options.checkSink, redactedPublication.taskChecks);
-	options.log?.info("review validated", {
-		validFindings: validated.validFindings.length,
-		droppedFindings: validated.droppedFindings.length,
-		inlineDrafts: publishing.inlineCommentDrafts.length,
-		threadActions: verifier.threadActions.length
-	});
+	} };
+}
+function createCodeHostSuccessThrottle(sleep = (milliseconds) => Bun.sleep(milliseconds)) {
+	let notBefore = 0;
+	let waitInFlight;
+	const waitUntilReady = async () => {
+		while (true) {
+			const deadline = notBefore;
+			const remaining = deadline - Date.now();
+			if (remaining <= 0) {
+				if (notBefore === deadline) notBefore = 0;
+				return;
+			}
+			await sleep(remaining);
+			if (notBefore <= deadline) {
+				notBefore = 0;
+				return;
+			}
+		}
+	};
 	return {
-		kind: "review",
-		provider,
-		diffManifest,
-		review: redactedPublication.validated.review,
-		validated: redactedPublication.validated,
-		publicationPlan,
-		mainComment: publicationPlan.mainComment,
-		inlineCommentDrafts: publishing.inlineCommentDrafts,
-		taskChecks: redactedPublication.taskChecks,
-		repairAttempted: output.repairAttempted
+		wait() {
+			if (waitInFlight) return waitInFlight;
+			const currentWait = waitUntilReady().finally(() => {
+				if (waitInFlight === currentWait) waitInFlight = void 0;
+			});
+			waitInFlight = currentWait;
+			return waitInFlight;
+		},
+		update(retryAfter) {
+			const delay = retryAfterMilliseconds(retryAfter);
+			if (delay > 0) notBefore = Math.max(notBefore, Date.now() + delay);
+		}
 	};
 }
-function publishFailedRunTaskChecks(options, taskChecks) {
-	const redacted = redactCommandPublication({
-		body: "",
-		taskChecks,
-		redactor: options.secretRedactor
-	});
-	publishTaskChecks(options.checkSink, redacted.taskChecks);
+function shouldRetryCodeHostRequest(options) {
+	return (options.method === "GET" || options.method === "HEAD" || options.retryStatuses?.includes(options.response.status) === true) && options.attempt < options.maxRetries && (options.response.status === 429 || options.response.status >= 500 || options.retryStatuses?.includes(options.response.status) === true);
 }
-function commandResponseResultFromOutput(options) {
-	const commandResponse = options.output.commandResponse;
-	if (!commandResponse) return;
-	if (!options.commandInvocation) throw new Error("ctx.command.reply(...) is only available for command-triggered tasks");
-	return commandResponseRuntimeResult({
-		...options,
-		commandResponse,
-		commandInvocation: options.commandInvocation
-	});
+function retryAfterMilliseconds(value) {
+	if (!value) return 0;
+	const seconds = Number(value);
+	if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
+	const date = Date.parse(value);
+	return Number.isFinite(date) ? Math.max(0, date - Date.now()) : 0;
 }
-function assertReviewCommentOutput(output, hasCommandInvocation) {
-	if (output.comment) return;
-	throw new Error(hasCommandInvocation ? "ctx.comment(...) or ctx.command.reply(...) must be called exactly once per selected run" : "ctx.comment(...) must be called exactly once per selected run");
+function redact(value, secrets) {
+	let redacted = value;
+	for (const secret of secrets) redacted = redacted.split(secret).join("***");
+	return redacted;
 }
-async function runSynchronizeVerifier(options) {
-	if (options.options.event.rawAction !== "synchronize") return {
-		priorReviewState: options.priorReviewState,
-		threadActions: [],
-		providerModels: []
+//#endregion
+//#region src/hosts/azure-devops/coordinates.ts
+function azureOrganizationFromUrl(value) {
+	const url = new URL(value);
+	return url.hostname === "dev.azure.com" ? url.pathname.split("/").filter(Boolean)[0] : url.hostname.split(".")[0];
+}
+//#endregion
+//#region src/hosts/azure-devops/client.ts
+const identitySchema = z.looseObject({
+	displayName: z.string().optional(),
+	providerDisplayName: z.string().optional(),
+	uniqueName: z.string().optional(),
+	id: z.string().optional(),
+	properties: z.looseObject({ Account: z.looseObject({ $value: z.string().optional() }).optional() }).optional()
+}).transform((identity) => {
+	const displayName = identity.displayName ?? identity.providerDisplayName;
+	const uniqueName = identity.uniqueName ?? identity.properties?.Account?.$value;
+	return {
+		...identity,
+		...displayName ? { displayName } : {},
+		...uniqueName ? { uniqueName } : {}
 	};
-	const config = options.config;
-	return await runInternalVerifier({
-		workspace: options.options.workspace,
-		config,
-		event: options.options.event,
-		provider: options.provider,
-		verifierProvider: resolveProvider(config, config.publication.autoResolve.model ?? config.defaultProvider),
-		plan: options.options.plan,
-		env: options.options.env,
-		piExecutable: options.options.piExecutable,
-		piRunner: options.options.piRunner,
-		log: options.options.log,
-		diffManifest: options.diffManifest,
-		priorReviewState: options.priorReviewState,
-		threadContexts: await options.options.loadInlineThreadContexts?.() ?? [],
-		mode: { kind: "synchronize" },
-		runId: options.runId,
-		piRunSink: options.piRunSink
+});
+const commitSchema = z.looseObject({ commitId: z.string().min(1) });
+const forkRepositorySchema = z.looseObject({ remoteUrl: z.string().min(1) });
+const pullRequestSchema$1 = z.looseObject({
+	pullRequestId: z.number().int().positive(),
+	isDraft: z.boolean().optional(),
+	title: z.string(),
+	description: z.string().nullish(),
+	url: z.string().optional(),
+	sourceRefName: z.string().min(1),
+	targetRefName: z.string().min(1),
+	createdBy: identitySchema.optional(),
+	lastMergeSourceCommit: commitSchema,
+	lastMergeTargetCommit: commitSchema,
+	forkSource: z.looseObject({ repository: forkRepositorySchema }).optional(),
+	repository: z.looseObject({
+		id: z.string().min(1),
+		name: z.string().min(1),
+		url: z.string().optional(),
+		project: z.looseObject({
+			id: z.string().min(1),
+			name: z.string().min(1)
+		})
+	})
+});
+const repositorySchema$1 = z.looseObject({
+	id: z.string().min(1),
+	name: z.string().min(1),
+	project: z.looseObject({
+		id: z.string().min(1),
+		name: z.string().min(1)
+	})
+});
+const iterationSchema = z.looseObject({
+	id: z.number().int().positive(),
+	sourceRefCommit: commitSchema
+});
+const iterationChangeSchema = z.looseObject({
+	changeTrackingId: z.number().int(),
+	changeType: z.string(),
+	item: z.looseObject({
+		path: z.string().min(1),
+		originalPath: z.string().min(1).optional()
+	})
+});
+const threadCommentSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	parentCommentId: z.number().int().optional(),
+	content: z.string().default(""),
+	author: identitySchema.optional(),
+	isDeleted: z.boolean().optional()
+});
+const pointSchema = z.looseObject({
+	line: z.number().int(),
+	offset: z.number().int()
+});
+const threadSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	status: z.string().optional(),
+	comments: z.array(threadCommentSchema).default([]),
+	threadContext: z.looseObject({
+		filePath: z.string().optional(),
+		leftFileStart: pointSchema.nullish(),
+		leftFileEnd: pointSchema.nullish(),
+		rightFileStart: pointSchema.nullish(),
+		rightFileEnd: pointSchema.nullish()
+	}).nullish(),
+	pullRequestThreadContext: z.looseObject({
+		changeTrackingId: z.number().int().optional(),
+		iterationContext: z.looseObject({
+			firstComparingIteration: z.number().int(),
+			secondComparingIteration: z.number().int()
+		}).optional()
+	}).nullish()
+});
+const statusSchema$1 = z.looseObject({ id: z.union([z.number(), z.string()]).transform(String) });
+const aclSchema = collectionSchema(z.looseObject({
+	inheritPermissions: z.boolean().default(true),
+	acesDictionary: z.record(z.string(), z.looseObject({
+		allow: z.number().int().default(0),
+		deny: z.number().int().default(0),
+		extendedInfo: z.looseObject({
+			effectiveAllow: z.number().int().default(0),
+			effectiveDeny: z.number().int().default(0)
+		}).optional()
+	}))
+}));
+function createAzureDevOpsClient(env = process.env, fetch = globalThis.fetch, options = {}) {
+	const organization = env.AZURE_DEVOPS_ORGANIZATION ?? organizationFromCollectionUri$1(env.SYSTEM_COLLECTIONURI);
+	const project = env.AZURE_DEVOPS_PROJECT ?? env.SYSTEM_TEAMPROJECT;
+	const pat = env.AZURE_DEVOPS_TOKEN;
+	const bearerToken = env.AZURE_DEVOPS_BEARER_TOKEN ?? env.SYSTEM_ACCESSTOKEN;
+	if (!organization) throw new Error("AZURE_DEVOPS_ORGANIZATION is required for Azure DevOps API calls");
+	if (!project) throw new Error("AZURE_DEVOPS_PROJECT or SYSTEM_TEAMPROJECT is required for Azure DevOps API calls");
+	if (!pat && !bearerToken) throw new Error("AZURE_DEVOPS_TOKEN, AZURE_DEVOPS_BEARER_TOKEN, or SYSTEM_ACCESSTOKEN is required for Azure DevOps API calls");
+	const headers = pat ? { Authorization: `Basic ${Buffer.from(`:${pat}`).toString("base64")}` } : { Authorization: `Bearer ${bearerToken}` };
+	const successThrottle = createCodeHostSuccessThrottle(options.sleep);
+	const api = createCodeHostHttpClient({
+		baseUrl: `https://dev.azure.com/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_apis/`,
+		headers,
+		fetch,
+		successThrottle
 	});
-}
-function createTaskContext(options) {
-	const repositorySlugParts = options.event.repository.slug.split("/");
-	let taskContext;
-	taskContext = {
-		run: { id: options.runId },
-		repository: {
-			root: options.workspace,
-			owner: repositorySlugParts.length > 1 ? repositorySlugParts[0] : void 0,
-			name: repositorySlugParts.at(-1) ?? "repo"
+	const organizationApi = createCodeHostHttpClient({
+		baseUrl: `https://dev.azure.com/${encodeURIComponent(organization)}/_apis/`,
+		headers,
+		fetch,
+		successThrottle
+	});
+	const identityApi = createCodeHostHttpClient({
+		baseUrl: `https://vssps.dev.azure.com/${encodeURIComponent(organization)}/_apis/`,
+		headers,
+		fetch,
+		successThrottle
+	});
+	const pullRequestPath = (repositoryId, changeNumber) => `git/repositories/${encodeURIComponent(repositoryId)}/pullRequests/${changeNumber}`;
+	return {
+		organization,
+		project,
+		async currentUser() {
+			return (await organizationApi.json("connectionData?connectOptions=1&lastChangeId=-1&lastChangeId64=-1", z.looseObject({ authenticatedUser: identitySchema }))).authenticatedUser;
 		},
-		change: {
-			number: options.event.change.number,
-			title: options.event.change.title,
-			description: options.event.change.description,
-			url: options.event.change.url,
-			author: options.event.change.author,
-			base: options.event.change.base,
-			head: options.event.change.head,
-			isFork: options.event.change.isFork,
-			async diffManifest(manifestOptions) {
-				const key = JSON.stringify(manifestOptions ?? {});
-				const cached = options.manifestCache.get(key);
-				if (cached) return cloneDiffManifest(cached);
-				const manifest = projectDiffManifest(options.diffManifest, manifestOptions);
-				options.manifestCache.set(key, manifest);
-				return cloneDiffManifest(manifest);
-			},
-			async changedFiles() {
-				return options.diffManifest.files.map((file) => ({
-					path: file.path,
-					previousPath: file.previousPath,
-					status: file.status
-				}));
-			},
-			async currentHeadSha() {
-				return options.event.change.head.sha;
-			}
+		async getRepository(repository) {
+			const value = await api.json(withApiVersion(`git/repositories/${encodeURIComponent(repository)}`), repositorySchema$1);
+			return {
+				id: value.id,
+				name: value.name,
+				projectId: value.project.id,
+				project: value.project.name
+			};
 		},
-		platform: { id: options.event.platform.id },
-		command: options.commandInvocation ? {
-			name: options.commandInvocation.name,
-			line: options.commandInvocation.line,
-			arguments: { ...options.commandInvocation.arguments },
-			async reply(markdown) {
-				collectCommandResponse(options.output, markdown, options.taskName);
+		async getRepositoryPermission(actor, projectId, repositoryId) {
+			const candidates = (await identityApi.json(`identities?searchFilter=General&filterValue=${encodeURIComponent(actor)}&queryMembership=ExpandedUp&api-version=7.1`, collectionSchema(z.looseObject({
+				descriptor: z.string().min(1),
+				isActive: z.boolean().optional(),
+				isContainer: z.boolean().optional(),
+				memberOf: z.array(z.union([z.string().min(1), z.looseObject({ descriptor: z.string().min(1) })])).default([])
+			})))).value.filter((identity) => identity.isActive !== false && identity.isContainer !== true);
+			if (candidates.length !== 1) return "none";
+			const identity = candidates[0];
+			if (!identity) return "none";
+			const descriptors = [identity.descriptor, ...identity.memberOf.map((group) => typeof group === "string" ? group : group.descriptor)];
+			const loadAcls = (token) => {
+				const query = new URLSearchParams({
+					token,
+					descriptors: descriptors.join(","),
+					includeExtendedInfo: "true",
+					recurse: "false",
+					"api-version": "7.1"
+				});
+				return organizationApi.json(`accesscontrollists/2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87?${query}`, aclSchema);
+			};
+			const [projectAcls, repositoryAcls] = await Promise.all([loadAcls(`repoV2/${projectId}`), loadAcls(`repoV2/${projectId}/${repositoryId}`)]);
+			return azurePermissionFromAcls(repositoryAcls.value.every((acl) => acl.inheritPermissions) ? [...projectAcls.value, ...repositoryAcls.value] : repositoryAcls.value);
+		},
+		getPullRequest: (repositoryId, changeNumber) => api.json(withApiVersion(pullRequestPath(repositoryId, changeNumber)), pullRequestSchema$1),
+		async listIterations(repositoryId, changeNumber) {
+			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/iterations`), collectionSchema(iterationSchema))).value.map((iteration) => ({
+				id: iteration.id,
+				headSha: iteration.sourceRefCommit.commitId
+			}));
+		},
+		async loadChange(options) {
+			if (options.organization !== organization || options.project !== project) throw new Error("Azure DevOps client coordinates do not match its configured organization and project");
+			const pullRequest = await this.getPullRequest(options.repositoryId, options.changeNumber);
+			const iterations = await this.listIterations(options.repositoryId, options.changeNumber);
+			const headSha = pullRequest.lastMergeSourceCommit.commitId;
+			const iteration = iterations.findLast((candidate) => candidate.headSha === headSha);
+			if (!iteration) throw new Error(`Azure DevOps has no pull request iteration for head ${headSha}`);
+			const sourceRef = branchName(pullRequest.sourceRefName);
+			const targetRef = branchName(pullRequest.targetRefName);
+			return {
+				repository: {
+					slug: `${organization}/${pullRequest.repository.project.name}/${pullRequest.repository.name}`,
+					url: repositoryWebUrl(organization, pullRequest.repository.project.name, pullRequest.repository.name)
+				},
+				coordinates: {
+					provider: "azure-devops",
+					organization,
+					project: pullRequest.repository.project.name,
+					projectId: pullRequest.repository.project.id,
+					repositoryId: pullRequest.repository.id
+				},
+				change: {
+					number: pullRequest.pullRequestId,
+					isDraft: pullRequest.isDraft,
+					title: pullRequest.title,
+					description: pullRequest.description ?? "",
+					url: `${repositoryWebUrl(organization, pullRequest.repository.project.name, pullRequest.repository.name)}/pullrequest/${pullRequest.pullRequestId}`,
+					author: pullRequest.createdBy?.uniqueName ? { login: pullRequest.createdBy.uniqueName } : void 0,
+					base: {
+						sha: pullRequest.lastMergeTargetCommit.commitId,
+						ref: targetRef
+					},
+					head: {
+						sha: headSha,
+						ref: sourceRef,
+						...pullRequest.forkSource?.repository.remoteUrl ? { url: pullRequest.forkSource.repository.remoteUrl } : {}
+					},
+					...pullRequest.forkSource ? { isFork: true } : {}
+				},
+				iterationId: iteration.id
+			};
+		},
+		async listIterationChanges(repositoryId, changeNumber, iterationId) {
+			const changes = [];
+			let skip = 0;
+			let top = 2e3;
+			for (;;) {
+				const path = `${pullRequestPath(repositoryId, changeNumber)}/iterations/${iterationId}/changes?compareTo=0&$skip=${skip}&$top=${top}`;
+				const page = await api.json(withApiVersion(path), z.looseObject({
+					changeEntries: z.array(iterationChangeSchema),
+					nextSkip: z.number().int().nonnegative().optional(),
+					nextTop: z.number().int().nonnegative().max(2e3).optional()
+				}));
+				changes.push(...page.changeEntries.map((change) => ({
+					changeTrackingId: change.changeTrackingId,
+					changeType: change.changeType,
+					path: trimLeadingSlash(change.item.path),
+					...change.item.originalPath ? { originalPath: trimLeadingSlash(change.item.originalPath) } : {}
+				})));
+				if (!page.nextSkip) return changes;
+				skip = page.nextSkip;
+				if (page.nextTop) top = page.nextTop;
 			}
-		} : void 0,
-		secret(secret) {
-			return resolveTaskSecret(secret, options);
 		},
-		pi: { async run(agent, input, runOptions) {
-			const result = await runReviewAgent({
-				agent,
-				input,
-				runOptions,
-				runtime: {
-					...options,
-					taskContext,
-					runId: options.runId,
-					piRunSink: options.piRunSink
-				}
-			});
-			options.output.providerModels.push(...result.providerModels);
-			if (result.repairAttempted) options.output.repairAttempted = true;
-			trackResultFindingScope(options.output, result.value, runOptions?.paths);
-			return agentOutputForTaskContext(agent, result.value);
-		} },
-		review: { async prior() {
-			return priorReviewForTask(options.priorMainComment, options.priorReviewState);
-		} },
-		check: createCheckHandle(options.output),
-		async comment(value) {
-			collectComment(options.output, value, options.taskName);
+		async listThreads(repositoryId, changeNumber) {
+			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads`), collectionSchema(threadSchema))).value;
 		},
-		log: options.taskLog ?? console
-	};
-	return taskContext;
-}
-function agentOutputForTaskContext(_agent, value) {
-	return value;
-}
-function resolveTaskSecret(secret, options) {
-	if (secret.kind !== "pipr.secret" || typeof secret.name !== "string") throw new Error("ctx.secret(...) requires a pipr.secret reference");
-	const value = (options.env ?? process.env)[secret.name];
-	if (!value) throw new Error(`Missing secret env var: ${secret.name}`);
-	options.log?.addSecret(value);
-	options.secretRedactor?.addSecret(value);
-	return value;
-}
-function commandResponseRuntimeResult(options) {
-	const redacted = redactCommandPublication({
-		body: options.commandResponse.value,
-		taskChecks: options.taskChecks,
-		redactor: options.secretRedactor
-	});
-	return {
-		kind: "command-response",
-		provider: options.provider,
-		diffManifest: options.diffManifest,
-		taskChecks: redacted.taskChecks,
-		repairAttempted: options.output.repairAttempted,
-		commandResponse: {
-			commandName: options.commandInvocation.name,
-			line: options.commandInvocation.line,
-			arguments: options.commandInvocation.arguments,
-			body: redacted.body
-		}
-	};
-}
-function publishTaskChecks(sink, checks) {
-	for (const check of checks) sink?.setTaskResult(check);
-}
-function skippedTaskRuntimeResult(options) {
-	const reason = options.reason ?? (options.taskName ? `Task '${options.taskName}' was not registered` : "No tasks matched the change request event");
-	const review = {
-		summary: { body: reason },
-		inlineFindings: []
-	};
-	const validated = {
-		review,
-		validFindings: [],
-		droppedFindings: []
-	};
-	const publicationPlan = buildCommentPublishingPlan({
-		event: options.event,
-		main: reason,
-		validated,
-		manifest: options.diffManifest,
-		maxInlineComments: options.config.publication.maxInlineComments,
-		maxStoredFindings: options.config.publication.maxStoredFindings,
-		showHeader: options.config.publication.showHeader,
-		showFooter: options.config.publication.showFooter,
-		showStats: options.config.publication.showStats,
-		metadata: {
-			runtimeVersion,
-			configVersion: options.versionCompatibility?.configVersion,
-			trustedConfigSha: options.trustedConfigSha,
-			trustedConfigHash: options.trustedConfigHash,
-			reviewedHeadSha: options.event.change.head.sha,
-			providerModels: [options.provider.model],
-			selectedTasks: [],
-			failedTasks: [],
-			validFindings: 0,
-			droppedFindings: 0
-		}
-	}).publicationPlan;
-	return {
-		kind: "skipped",
-		skipReason: reason,
-		provider: options.provider,
-		diffManifest: options.diffManifest,
-		review,
-		validated,
-		publicationPlan,
-		mainComment: publicationPlan.mainComment,
-		inlineCommentDrafts: [],
-		taskChecks: [],
-		repairAttempted: false
+		createThread: (repositoryId, changeNumber, body) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads`), threadSchema, jsonRequest$2("POST", body)),
+		updateComment: (repositoryId, changeNumber, threadId, commentId, content) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}/comments/${encodeURIComponent(commentId)}`), threadCommentSchema, jsonRequest$2("PATCH", { content })),
+		createThreadComment: (repositoryId, changeNumber, threadId, body) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}/comments`), threadCommentSchema, jsonRequest$2("POST", body)),
+		updateThreadStatus: (repositoryId, changeNumber, threadId, status) => api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/threads/${encodeURIComponent(threadId)}`), threadSchema, jsonRequest$2("PATCH", { status })),
+		async createStatus(repositoryId, changeNumber, body) {
+			return (await api.json(withApiVersion(`${pullRequestPath(repositoryId, changeNumber)}/statuses`), statusSchema$1, jsonRequest$2("POST", body))).id;
+		}
 	};
 }
-//#endregion
-//#region src/shared/secret-redactor-core.ts
-const redactedSecret = "[redacted secret]";
-const minimumSecretLength = 4;
-function createSecretRedactor(initialSecrets) {
-	const secrets = new Set(initialSecrets.filter((value) => value.length >= minimumSecretLength));
+function azureDevOpsStatusState(state) {
+	switch (state) {
+		case "pending": return "pending";
+		case "success": return "succeeded";
+		case "failure": return "failed";
+		case "neutral": return "notApplicable";
+	}
+}
+function azureRepositoryPermission(bits) {
+	if ((bits & 2) === 0) return "none";
+	if ((bits & 8192) !== 0) return "admin";
+	if ((bits & 2048) !== 0) return "maintain";
+	if ((bits & 4) !== 0) return "write";
+	if ((bits & 16384) !== 0) return "triage";
+	return "read";
+}
+function azurePermissionFromAcls(acls) {
+	let allow = 0;
+	let deny = 0;
+	for (const acl of acls) for (const ace of Object.values(acl.acesDictionary)) {
+		allow |= ace.extendedInfo?.effectiveAllow ?? ace.allow;
+		deny |= ace.extendedInfo?.effectiveDeny ?? ace.deny;
+	}
+	return azureRepositoryPermission(allow & ~deny);
+}
+function collectionSchema(item) {
+	return z.looseObject({
+		count: z.number().int().nonnegative(),
+		value: z.array(item)
+	});
+}
+function withApiVersion(path) {
+	return `${path}${path.includes("?") ? "&" : "?"}api-version=7.1`;
+}
+function jsonRequest$2(method, body) {
 	return {
-		addSecret(value) {
-			if (value && value.length >= minimumSecretLength) secrets.add(value);
-		},
-		redact(value) {
-			const ordered = [...secrets].sort((left, right) => right.length - left.length);
-			let next = value;
-			for (const secret of ordered) next = next.replaceAll(secret, redactedSecret);
-			return {
-				value: next,
-				detected: next !== value
-			};
-		}
+		method,
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
 	};
 }
-//#endregion
-//#region src/shared/secret-redactor.ts
-function createKnownSecretRedactor(options) {
-	return createSecretRedactor(sensitiveEnvironmentValues(options?.env ?? process.env));
+function organizationFromCollectionUri$1(value) {
+	return value ? azureOrganizationFromUrl(value) : void 0;
+}
+function branchName(ref) {
+	return ref.replace(/^refs\/heads\//, "");
+}
+function repositoryWebUrl(organization, project, repository) {
+	return `https://dev.azure.com/${encodeURIComponent(organization)}/${encodeURIComponent(project)}/_git/${encodeURIComponent(repository)}`;
+}
+function trimLeadingSlash(value) {
+	return value.replace(/^\/+/, "");
 }
 //#endregion
 //#region src/hosts/env.ts
@@ -7013,17 +6608,228 @@ function createAzureDevOpsHostAdapter(options = {}) {
 		}
 	};
 }
-function azureCoordinates(change) {
-	if (change.coordinates?.provider !== "azure-devops") throw new Error("Azure DevOps adapter requires Azure DevOps coordinates");
-	return change.coordinates;
+function azureCoordinates(change) {
+	if (change.coordinates?.provider !== "azure-devops") throw new Error("Azure DevOps adapter requires Azure DevOps coordinates");
+	return change.coordinates;
+}
+function azureCoordinatesFromRepository(client, slug) {
+	const repositoryId = slug.split("/").at(-1);
+	if (!repositoryId) throw new Error("Azure DevOps repository slug must identify a repository");
+	return {
+		organization: client.organization,
+		project: client.project,
+		repositoryId
+	};
+}
+//#endregion
+//#region src/hosts/bitbucket/schema.ts
+const bitbucketRepositorySchema = z.looseObject({
+	uuid: z.string().min(1),
+	name: z.string().min(1),
+	full_name: z.string().min(1),
+	slug: z.string().min(1).optional(),
+	links: z.looseObject({ html: z.looseObject({ href: z.string().url() }) })
+}).transform((repository) => ({
+	...repository,
+	slug: repository.slug ?? repository.full_name.split("/").at(-1) ?? repository.full_name
+}));
+//#endregion
+//#region src/hosts/bitbucket/client.ts
+const userSchema$1 = z.looseObject({
+	uuid: z.string().optional(),
+	nickname: z.string().optional(),
+	display_name: z.string().optional()
+});
+const endpointSchema = z.looseObject({
+	branch: z.looseObject({ name: z.string().min(1) }),
+	commit: z.looseObject({ hash: z.string().min(1) }),
+	repository: bitbucketRepositorySchema
+});
+const pullRequestSchema = z.looseObject({
+	id: z.number().int().positive(),
+	draft: z.boolean().optional(),
+	title: z.string(),
+	description: z.string().default(""),
+	author: userSchema$1.optional(),
+	source: endpointSchema,
+	destination: endpointSchema,
+	links: z.looseObject({ html: z.looseObject({ href: z.string().url() }) })
+});
+const inlineSchema = z.looseObject({
+	path: z.string().optional(),
+	from: z.number().int().nullable().optional(),
+	to: z.number().int().nullable().optional(),
+	start_from: z.number().int().nullable().optional(),
+	start_to: z.number().int().nullable().optional()
+});
+const commentSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	content: z.looseObject({ raw: z.string().default("") }),
+	user: userSchema$1.optional(),
+	parent: z.looseObject({ id: z.union([z.number(), z.string()]).transform(String) }).optional(),
+	inline: inlineSchema.optional(),
+	deleted: z.boolean().optional(),
+	resolution: z.looseObject({}).optional()
+});
+function createBitbucketClient(env = process.env, fetch = globalThis.fetch) {
+	const workspace = env.BITBUCKET_WORKSPACE;
+	const repository = env.BITBUCKET_REPO_SLUG;
+	const token = env.BITBUCKET_API_TOKEN;
+	const email = env.BITBUCKET_EMAIL;
+	if (!workspace) throw new Error("BITBUCKET_WORKSPACE is required for Bitbucket Cloud API calls");
+	if (!repository) throw new Error("BITBUCKET_REPO_SLUG is required for Bitbucket Cloud API calls");
+	if (!token || !email) throw new Error("BITBUCKET_EMAIL and BITBUCKET_API_TOKEN are required");
+	const authorization = `Basic ${Buffer.from(`${email}:${token}`).toString("base64")}`;
+	const repositoryApiPath = `/2.0/repositories/${encodeURIComponent(workspace)}/${encodeURIComponent(repository)}/`;
+	const api = createCodeHostHttpClient({
+		baseUrl: `https://api.bitbucket.org${repositoryApiPath}`,
+		headers: { Authorization: authorization },
+		fetch
+	});
+	const rootApi = createCodeHostHttpClient({
+		baseUrl: "https://api.bitbucket.org/2.0/",
+		headers: { Authorization: authorization },
+		fetch
+	});
+	const prPath = (id) => `pullrequests/${id}`;
+	return {
+		workspace,
+		repository,
+		async currentUser() {
+			const value = await rootApi.json("user", userSchema$1);
+			return {
+				uuid: value.uuid,
+				nickname: value.nickname,
+				displayName: value.display_name
+			};
+		},
+		async getRepository() {
+			const value = await api.json("", bitbucketRepositorySchema);
+			return {
+				uuid: value.uuid,
+				slug: value.slug,
+				fullName: value.full_name,
+				url: value.links.html.href
+			};
+		},
+		async getRepositoryPermission(actor, repositoryUuid) {
+			const permissionEmail = env.BITBUCKET_PERMISSION_EMAIL;
+			const permissionToken = env.BITBUCKET_PERMISSION_API_TOKEN;
+			if (!permissionEmail || !permissionToken) throw new Error("BITBUCKET_PERMISSION_EMAIL and BITBUCKET_PERMISSION_API_TOKEN are required for Bitbucket permission checks");
+			const permissionApi = createCodeHostHttpClient({
+				baseUrl: "https://api.bitbucket.org/2.0/",
+				headers: { Authorization: `Basic ${Buffer.from(`${permissionEmail}:${permissionToken}`).toString("base64")}` },
+				fetch
+			});
+			const query = encodeURIComponent(`repository.uuid="${escapeBitbucketQueryValue(repositoryUuid)}" AND user.nickname="${escapeBitbucketQueryValue(actor)}"`);
+			return (await permissionApi.json(`workspaces/${encodeURIComponent(workspace)}/permissions/repositories?q=${query}&pagelen=100`, pagedSchema(z.looseObject({
+				permission: z.enum([
+					"read",
+					"write",
+					"admin"
+				]),
+				user: userSchema$1
+			})))).values.find((entry) => entry.user.nickname === actor)?.permission ?? "none";
+		},
+		getPullRequest: (id) => api.json(prPath(id), pullRequestSchema),
+		async loadChange(options) {
+			if (options.workspace !== workspace || options.repository !== repository) throw new Error("Bitbucket client coordinates do not match the requested repository");
+			const pullRequest = await this.getPullRequest(options.changeNumber);
+			return {
+				repository: {
+					slug: pullRequest.destination.repository.full_name,
+					url: pullRequest.destination.repository.links.html.href
+				},
+				coordinates: {
+					provider: "bitbucket",
+					workspace,
+					repository,
+					repositoryUuid: pullRequest.destination.repository.uuid
+				},
+				change: {
+					number: pullRequest.id,
+					isDraft: pullRequest.draft,
+					title: pullRequest.title,
+					description: pullRequest.description,
+					url: pullRequest.links.html.href,
+					author: pullRequest.author?.nickname ? { login: pullRequest.author.nickname } : void 0,
+					base: {
+						sha: pullRequest.destination.commit.hash,
+						ref: pullRequest.destination.branch.name,
+						url: pullRequest.destination.repository.links.html.href
+					},
+					head: {
+						sha: pullRequest.source.commit.hash,
+						ref: pullRequest.source.branch.name,
+						url: pullRequest.source.repository.links.html.href
+					},
+					isFork: pullRequest.source.repository.uuid !== pullRequest.destination.repository.uuid
+				}
+			};
+		},
+		async listComments(id) {
+			return (await listAll(api, `${prPath(id)}/comments`, commentSchema, repositoryApiPath)).filter((comment) => !comment.deleted);
+		},
+		createComment: (id, body) => api.json(`${prPath(id)}/comments`, commentSchema, jsonRequest$1("POST", body)),
+		updateComment: (id, commentId, content) => api.json(`${prPath(id)}/comments/${encodeURIComponent(commentId)}`, commentSchema, jsonRequest$1("PUT", { content: { raw: content } })),
+		async replyToComment(id, commentId, content) {
+			const parentId = positiveCommentId(commentId);
+			return await api.json(`${prPath(id)}/comments`, commentSchema, jsonRequest$1("POST", {
+				content: { raw: content },
+				parent: { id: parentId }
+			}));
+		},
+		async resolveComment(id, commentId) {
+			positiveCommentId(commentId);
+			await api.json(`${prPath(id)}/comments/${encodeURIComponent(commentId)}/resolve`, z.unknown(), { method: "POST" });
+		},
+		async setStatus(sha, key, body) {
+			return (await api.json(`commit/${encodeURIComponent(sha)}/statuses/build`, z.looseObject({ key: z.string().default(key) }), jsonRequest$1("POST", {
+				...body,
+				key
+			}))).key;
+		}
+	};
+}
+function positiveCommentId(value) {
+	const id = Number(value);
+	if (!Number.isSafeInteger(id) || id <= 0) throw new Error("Bitbucket comment ID must be a positive integer");
+	return id;
 }
-function azureCoordinatesFromRepository(client, slug) {
-	const repositoryId = slug.split("/").at(-1);
-	if (!repositoryId) throw new Error("Azure DevOps repository slug must identify a repository");
+function bitbucketStatusState(state) {
+	if (state === "pending") return "INPROGRESS";
+	if (state === "failure") return "FAILED";
+	if (state === "neutral") return "STOPPED";
+	return "SUCCESSFUL";
+}
+function escapeBitbucketQueryValue(value) {
+	return value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"");
+}
+function pagedSchema(item) {
+	return z.looseObject({
+		values: z.array(item),
+		next: z.string().url().optional()
+	});
+}
+async function listAll(api, path, schema, allowedPathPrefix) {
+	const values = [];
+	let next = path;
+	while (next) {
+		const page = await api.json(next, pagedSchema(schema));
+		values.push(...page.values);
+		if (page.next) {
+			const url = new URL(page.next);
+			if (url.origin !== "https://api.bitbucket.org" || !url.pathname.startsWith(allowedPathPrefix)) throw new Error("Bitbucket pagination URL must stay inside the configured repository API");
+		}
+		next = page.next;
+	}
+	return values;
+}
+function jsonRequest$1(method, body) {
 	return {
-		organization: client.organization,
-		project: client.project,
-		repositoryId
+		method,
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
 	};
 }
 //#endregion
@@ -8740,6 +8546,213 @@ function createGitHubHostAdapter(options = {}) {
 	};
 }
 //#endregion
+//#region src/hosts/gitlab/client.ts
+const userSchema = z.looseObject({
+	id: z.number().int().positive(),
+	username: z.string().min(1)
+});
+const noteSchema = z.looseObject({
+	id: z.union([z.number(), z.string()]).transform(String),
+	body: z.string(),
+	author: userSchema.optional()
+});
+const positionSchema = z.looseObject({
+	new_path: z.string().optional(),
+	old_path: z.string().optional(),
+	new_line: z.number().int().positive().nullish().transform((value) => value ?? void 0),
+	old_line: z.number().int().positive().nullish().transform((value) => value ?? void 0),
+	line_range: z.looseObject({
+		start: z.looseObject({
+			new_line: z.number().int().positive().nullish(),
+			old_line: z.number().int().positive().nullish()
+		}),
+		end: z.looseObject({
+			new_line: z.number().int().positive().nullish(),
+			old_line: z.number().int().positive().nullish()
+		})
+	}).optional()
+});
+const discussionNoteSchema = noteSchema.extend({
+	resolvable: z.boolean().optional(),
+	resolved: z.boolean().optional(),
+	position: positionSchema.nullable().optional()
+});
+const discussionSchema = z.looseObject({
+	id: z.string().min(1),
+	individual_note: z.boolean().optional(),
+	notes: z.array(discussionNoteSchema)
+});
+const diffRefsSchema = z.looseObject({
+	base_sha: z.string().min(1),
+	start_sha: z.string().min(1),
+	head_sha: z.string().min(1)
+});
+const mergeRequestResponseSchema = z.looseObject({
+	iid: z.number().int().positive(),
+	title: z.string().default(""),
+	description: z.string().nullable().optional(),
+	web_url: z.string().url().optional(),
+	source_branch: z.string().min(1),
+	target_branch: z.string().min(1),
+	source_project_id: z.number().int().positive(),
+	target_project_id: z.number().int().positive(),
+	sha: z.string().min(1),
+	draft: z.boolean().optional(),
+	author: userSchema.optional(),
+	references: z.looseObject({ full: z.string().optional() }).optional(),
+	diff_refs: diffRefsSchema.nullable().optional()
+});
+const mergeRequestSchema = mergeRequestResponseSchema.extend({ diff_refs: diffRefsSchema });
+const memberSchema = z.looseObject({ access_level: z.number().int().min(0) });
+const statusSchema = z.looseObject({ id: z.union([z.number(), z.string()]).optional() });
+function createGitLabClient(env = process.env, fetch = globalThis.fetch, sleep = (milliseconds) => Bun.sleep(milliseconds)) {
+	const token = env.GITLAB_TOKEN ?? env.CI_JOB_TOKEN;
+	if (!token) throw new Error("GITLAB_TOKEN or CI_JOB_TOKEN is required for GitLab API calls");
+	const headers = env.GITLAB_TOKEN ? { "PRIVATE-TOKEN": token } : { "JOB-TOKEN": token };
+	const clientOptions = {
+		baseUrl: `${(env.CI_API_V4_URL ?? "https://gitlab.com/api/v4").replace(/\/$/, "")}/`,
+		headers,
+		fetch,
+		sleep: async (milliseconds) => void await sleep(milliseconds)
+	};
+	const api = createCodeHostHttpClient(clientOptions);
+	const statusApi = createCodeHostHttpClient({
+		...clientOptions,
+		retryNonIdempotentStatuses: [409]
+	});
+	return {
+		async getProject(project) {
+			const value = await api.json(`projects/${encodeURIComponent(project)}`, z.looseObject({
+				id: z.union([z.number(), z.string()]).transform(String),
+				path_with_namespace: z.string().min(1)
+			}));
+			return {
+				id: value.id,
+				path: value.path_with_namespace
+			};
+		},
+		currentUser: () => api.json("user", userSchema),
+		async loadChange(options) {
+			const mergeRequest = await this.getMergeRequest(options.projectId, options.changeNumber);
+			return {
+				repository: {
+					slug: options.projectPath,
+					url: projectWebUrl(mergeRequest.web_url)
+				},
+				coordinates: {
+					provider: "gitlab",
+					projectId: String(mergeRequest.target_project_id),
+					projectPath: options.projectPath
+				},
+				change: {
+					number: mergeRequest.iid,
+					title: mergeRequest.title,
+					description: mergeRequest.description ?? "",
+					url: mergeRequest.web_url,
+					author: mergeRequest.author ? { login: mergeRequest.author.username } : void 0,
+					base: {
+						sha: mergeRequest.diff_refs.start_sha,
+						ref: mergeRequest.target_branch
+					},
+					head: {
+						sha: mergeRequest.diff_refs.head_sha,
+						ref: mergeRequest.source_branch
+					},
+					isFork: mergeRequest.source_project_id !== mergeRequest.target_project_id,
+					isDraft: mergeRequest.draft
+				}
+			};
+		},
+		async getMergeRequest(projectId, changeNumber) {
+			const requestPath = `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}`;
+			for (let attempt = 0;; attempt += 1) {
+				const response = await api.json(requestPath, mergeRequestResponseSchema);
+				const prepared = mergeRequestSchema.safeParse(response);
+				if (prepared.success) return prepared.data;
+				if (attempt >= 4) throw new Error("GitLab merge request diff refs were not prepared after 5 attempts");
+				await sleep(250 * 2 ** attempt);
+			}
+		},
+		async getRepositoryPermission(projectId, username) {
+			const user = (await api.json(`users?username=${encodeURIComponent(username)}`, z.array(userSchema))).find((candidate) => candidate.username === username);
+			if (!user) return "none";
+			try {
+				return accessLevelPermission((await api.json(`projects/${encodeURIComponent(projectId)}/members/all/${user.id}`, memberSchema)).access_level);
+			} catch (error) {
+				if (error instanceof CodeHostHttpError && error.status === 404) return "none";
+				throw error;
+			}
+		},
+		listNotes: (projectId, changeNumber) => paginated(api, `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes`, noteSchema),
+		createNote: (projectId, changeNumber, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes`, noteSchema, jsonRequest("POST", { body })),
+		updateNote: (projectId, changeNumber, noteId, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/notes/${encodeURIComponent(noteId)}`, noteSchema, jsonRequest("PUT", { body })),
+		listDiscussions: (projectId, changeNumber) => paginated(api, `projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions`, discussionSchema),
+		getDiscussion: (projectId, changeNumber, discussionId) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}`, discussionSchema),
+		async findReplyParent(projectId, changeNumber, noteId, discussionId) {
+			if (!discussionId) return void 0;
+			const discussion = await this.getDiscussion(projectId, changeNumber, discussionId);
+			if (!discussion.notes.some((note) => note.id === noteId) || discussion.notes[0]?.id === noteId) return;
+			return discussion.notes[0]?.id;
+		},
+		createDiscussion: (projectId, changeNumber, body, position) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions`, discussionSchema, jsonRequest("POST", {
+			body,
+			position
+		})),
+		replyDiscussion: (projectId, changeNumber, discussionId, body) => api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}/notes`, noteSchema, jsonRequest("POST", { body })),
+		async resolveDiscussion(projectId, changeNumber, discussionId) {
+			await api.json(`projects/${encodeURIComponent(projectId)}/merge_requests/${changeNumber}/discussions/${encodeURIComponent(discussionId)}`, discussionSchema, jsonRequest("PUT", { resolved: true }));
+		},
+		async setStatus(projectId, sha, name, state, description) {
+			const status = await statusApi.json(`projects/${encodeURIComponent(projectId)}/statuses/${encodeURIComponent(sha)}`, statusSchema, jsonRequest("POST", {
+				state: gitLabStatusState(state),
+				name,
+				description: boundedStatusDescription(description)
+			}));
+			return String(status.id ?? name);
+		}
+	};
+}
+const MAX_PAGINATION_PAGES = 100;
+async function paginated(client, path, schema) {
+	const values = [];
+	for (let page = 1; page <= MAX_PAGINATION_PAGES; page += 1) {
+		const separator = path.includes("?") ? "&" : "?";
+		const batch = await client.json(`${path}${separator}per_page=100&page=${page}`, z.array(schema));
+		values.push(...batch);
+		if (batch.length < 100) return values;
+	}
+	throw new Error(`GitLab pagination exceeded ${MAX_PAGINATION_PAGES} pages for ${path}`);
+}
+function jsonRequest(method, body) {
+	return {
+		method,
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
+	};
+}
+function accessLevelPermission(level) {
+	if (level >= 50) return "admin";
+	if (level >= 40) return "maintain";
+	if (level >= 30) return "write";
+	if (level >= 15) return "triage";
+	if (level >= 10) return "read";
+	return "none";
+}
+function boundedStatusDescription(description) {
+	return description && description.length > 255 ? `${description.slice(0, 252).trimEnd()}...` : description;
+}
+function gitLabStatusState(state) {
+	switch (state) {
+		case "pending": return "pending";
+		case "success": return "success";
+		case "failure": return "failed";
+		case "neutral": return "skipped";
+	}
+}
+function projectWebUrl(mergeRequestUrl) {
+	return mergeRequestUrl?.replace(/\/-\/merge_requests\/\d+$/, "");
+}
+//#endregion
 //#region src/hosts/gitlab/event.ts
 const projectSchema = z.looseObject({
 	id: z.union([z.number(), z.string()]),
@@ -10252,6 +10265,6 @@ async function runHostRunCommandWithDependencies(options) {
 	});
 }
 //#endregion
-export { piReadOnlyToolNames as _, runInspectCommand as a, createGitHubHostAdapter as c, createGitLabClient as d, createBitbucketClient as f, piBuiltinToolNames as g, supportedOfficialInitAdapters as h, runInitCommand as i, PublicationError as l, azureOrganizationFromUrl as m, runHostRunCommand as n, runLocalReviewCommand as o, createAzureDevOpsClient as p, runHostRunCommandWithDependencies as r, runValidateCommand as s, runDryRunCommand as t, createKnownSecretRedactor as u, piRequiredCliFlags as v, piThinkingLevels as y };
+export { piReadOnlyToolNames as _, runInspectCommand as a, createGitLabClient as c, PublicationError as d, createAzureDevOpsClient as f, piBuiltinToolNames as g, supportedOfficialInitAdapters as h, runInitCommand as i, createGitHubHostAdapter as l, createKnownSecretRedactor as m, runHostRunCommand as n, runLocalReviewCommand as o, azureOrganizationFromUrl as p, runHostRunCommandWithDependencies as r, runValidateCommand as s, runDryRunCommand as t, createBitbucketClient as u, piRequiredCliFlags as v, piThinkingLevels as y };
 
-//# sourceMappingURL=commands-EZV-Icbs.mjs.map
+//# sourceMappingURL=commands-B9qNW4pk.mjs.map