ryco-cli 0.1.29 → 0.1.31

package/dist/AzureDevOpsSourceControlProvider-5giVYoNi.mjs

@@ -0,0 +1,2053 @@
+#!/usr/bin/env node
+
+import { Ds as SourceControlProviderError, Ur as CHANGE_REQUEST_FILE_CONTENTS_MAX_BYTES, ks as truncateSourceControlDetailContent } from "./src-VTj60bUm.mjs";
+import { t as decodeJsonResult } from "./schemaJson-CaG1bOvo.mjs";
+import { $r as withUnsupportedChangeRequestOptionGuards, Jr as AzureDevOpsCli, Qr as sourceControlRefFromInput, Xr as SourceControlProvider, Yr as AzureDevOpsCliError, ai as normalizeAzureDevOpsPullRequestRecord, ei as AzureDevOpsCommitRefSchema, ii as azureDevOpsReviewDecisionFromVotes, ni as AzureDevOpsPullRequestSchema, oi as normalizeAzureDevOpsRefName, ri as azureDevOpsIdentityLogin, ti as AzureDevOpsIdentityRefSchema, tr as azureDevOpsDiscovery } from "./bin.mjs";
+import { Clock, DateTime, Effect, Layer, Option, Result, Schema } from "effect";
+/** `GET .../iterations/{id}/changes?$top=` (the documented maximum). */
+const AZURE_DEVOPS_ITERATION_CHANGES_PAGE = 2e3;
+/** Pull request descriptions are capped by the host (Pull Requests - Update). */
+const AZURE_DEVOPS_DESCRIPTION_MAX_CHARS = 4e3;
+/** Git Repositories security namespace and the bits the viewer capabilities read. */
+const AZURE_DEVOPS_GIT_SECURITY_NAMESPACE = "2e9eb7ed-3c0a-47d4-87c1-0ffdd275fd87";
+const AZURE_DEVOPS_GIT_PERMISSION_PULL_REQUEST_CONTRIBUTE = 16384;
+/** Policy type ids from the official policy configuration examples. */
+const AZURE_DEVOPS_POLICY_TYPES = {
+	build: "0609b952-1397-4640-95ec-e00a01b2c241",
+	minimumApprovalCount: "fa4e907d-c16b-4a4c-9dfa-4906e5d171dd",
+	requiredReviewers: "fd2167ab-b0be-447a-8ec8-39368250530e",
+	mergeStrategy: "fa4e907d-c16b-4a4c-9dfa-4916e5d171ab"
+};
+const EMPTY_GUID = "00000000-0000-0000-0000-000000000000";
+const CommentPositionSchema = Schema.Struct({
+	line: Schema.Number,
+	offset: Schema.optional(Schema.NullOr(Schema.Number))
+});
+const NullablePosition = Schema.optional(Schema.NullOr(CommentPositionSchema));
+const AzureDevOpsCommentSchema = Schema.Struct({
+	id: Schema.Number,
+	parentCommentId: Schema.optional(Schema.NullOr(Schema.Number)),
+	author: Schema.optional(Schema.NullOr(AzureDevOpsIdentityRefSchema)),
+	content: Schema.optional(Schema.NullOr(Schema.String)),
+	publishedDate: Schema.optional(Schema.NullOr(Schema.String)),
+	lastUpdatedDate: Schema.optional(Schema.NullOr(Schema.String)),
+	lastContentUpdatedDate: Schema.optional(Schema.NullOr(Schema.String)),
+	/** `CommentType`: unknown, text, codeChange, system. */
+	commentType: Schema.optional(Schema.NullOr(Schema.Union([Schema.String, Schema.Number]))),
+	isDeleted: Schema.optional(Schema.NullOr(Schema.Boolean))
+});
+const AzureDevOpsThreadSchema = Schema.Struct({
+	id: Schema.Number,
+	publishedDate: Schema.optional(Schema.NullOr(Schema.String)),
+	lastUpdatedDate: Schema.optional(Schema.NullOr(Schema.String)),
+	comments: Schema.optional(Schema.NullOr(Schema.Array(AzureDevOpsCommentSchema))),
+	/** `CommentThreadStatus`: unknown, active, fixed, wontFix, closed, byDesign, pending. */
+	status: Schema.optional(Schema.NullOr(Schema.Union([Schema.String, Schema.Number]))),
+	threadContext: Schema.optional(Schema.NullOr(Schema.Struct({
+		filePath: Schema.optional(Schema.NullOr(Schema.String)),
+		leftFileStart: NullablePosition,
+		leftFileEnd: NullablePosition,
+		rightFileStart: NullablePosition,
+		rightFileEnd: NullablePosition
+	}))),
+	pullRequestThreadContext: Schema.optional(Schema.NullOr(Schema.Struct({
+		changeTrackingId: Schema.optional(Schema.NullOr(Schema.Number)),
+		iterationContext: Schema.optional(Schema.NullOr(Schema.Struct({
+			firstComparingIteration: Schema.optional(Schema.NullOr(Schema.Number)),
+			secondComparingIteration: Schema.optional(Schema.NullOr(Schema.Number))
+		}))),
+		trackingCriteria: Schema.optional(Schema.NullOr(Schema.Struct({
+			firstComparingIteration: Schema.optional(Schema.NullOr(Schema.Number)),
+			secondComparingIteration: Schema.optional(Schema.NullOr(Schema.Number)),
+			origFilePath: Schema.optional(Schema.NullOr(Schema.String)),
+			origLeftFileStart: NullablePosition,
+			origLeftFileEnd: NullablePosition,
+			origRightFileStart: NullablePosition,
+			origRightFileEnd: NullablePosition
+		})))
+	}))),
+	properties: Schema.optional(Schema.NullOr(Schema.Record(Schema.String, Schema.Unknown))),
+	identities: Schema.optional(Schema.NullOr(Schema.Record(Schema.String, AzureDevOpsIdentityRefSchema))),
+	isDeleted: Schema.optional(Schema.NullOr(Schema.Boolean))
+});
+const AzureDevOpsIterationSchema = Schema.Struct({
+	id: Schema.Number,
+	createdDate: Schema.optional(Schema.NullOr(Schema.String)),
+	updatedDate: Schema.optional(Schema.NullOr(Schema.String)),
+	/** `IterationReason`: push, forcePush, create, rebase, unknown, retarget, resolveConflicts. */
+	reason: Schema.optional(Schema.NullOr(Schema.String)),
+	author: Schema.optional(Schema.NullOr(AzureDevOpsIdentityRefSchema)),
+	sourceRefCommit: Schema.optional(Schema.NullOr(AzureDevOpsCommitRefSchema)),
+	targetRefCommit: Schema.optional(Schema.NullOr(AzureDevOpsCommitRefSchema)),
+	commonRefCommit: Schema.optional(Schema.NullOr(AzureDevOpsCommitRefSchema)),
+	newTargetRefName: Schema.optional(Schema.NullOr(Schema.String)),
+	oldTargetRefName: Schema.optional(Schema.NullOr(Schema.String)),
+	push: Schema.optional(Schema.NullOr(Schema.Struct({
+		date: Schema.optional(Schema.NullOr(Schema.String)),
+		pushedBy: Schema.optional(Schema.NullOr(AzureDevOpsIdentityRefSchema))
+	})))
+});
+const AzureDevOpsIterationChangesSchema = Schema.Struct({
+	changeEntries: Schema.Array(Schema.Struct({
+		changeTrackingId: Schema.optional(Schema.NullOr(Schema.Number)),
+		changeId: Schema.optional(Schema.NullOr(Schema.Number)),
+		changeType: Schema.optional(Schema.NullOr(Schema.String)),
+		originalPath: Schema.optional(Schema.NullOr(Schema.String)),
+		item: Schema.optional(Schema.NullOr(Schema.Struct({
+			path: Schema.optional(Schema.NullOr(Schema.String)),
+			objectId: Schema.optional(Schema.NullOr(Schema.String)),
+			originalObjectId: Schema.optional(Schema.NullOr(Schema.String))
+		})))
+	})),
+	nextSkip: Schema.optional(Schema.NullOr(Schema.Number)),
+	nextTop: Schema.optional(Schema.NullOr(Schema.Number))
+});
+const AzureDevOpsPolicyEvaluationSchema = Schema.Struct({
+	evaluationId: Schema.optional(Schema.NullOr(Schema.String)),
+	/** `PolicyEvaluationStatus`: queued, running, approved, rejected, notApplicable, broken. */
+	status: Schema.optional(Schema.NullOr(Schema.String)),
+	startedDate: Schema.optional(Schema.NullOr(Schema.String)),
+	completedDate: Schema.optional(Schema.NullOr(Schema.String)),
+	configuration: Schema.optional(Schema.NullOr(Schema.Struct({
+		id: Schema.optional(Schema.NullOr(Schema.Number)),
+		isBlocking: Schema.optional(Schema.NullOr(Schema.Boolean)),
+		isEnabled: Schema.optional(Schema.NullOr(Schema.Boolean)),
+		isDeleted: Schema.optional(Schema.NullOr(Schema.Boolean)),
+		settings: Schema.optional(Schema.NullOr(Schema.Record(Schema.String, Schema.Unknown))),
+		type: Schema.optional(Schema.NullOr(Schema.Struct({
+			id: Schema.optional(Schema.NullOr(Schema.String)),
+			displayName: Schema.optional(Schema.NullOr(Schema.String))
+		})))
+	})))
+});
+/** `GET _apis/connectionData` (`authenticatedUser` is the caller). */
+const AzureDevOpsConnectionDataSchema = Schema.Struct({ authenticatedUser: Schema.Struct({
+	id: Schema.String,
+	providerDisplayName: Schema.optional(Schema.NullOr(Schema.String)),
+	customDisplayName: Schema.optional(Schema.NullOr(Schema.String)),
+	properties: Schema.optional(Schema.NullOr(Schema.Struct({ Account: Schema.optional(Schema.NullOr(Schema.Struct({ $value: Schema.optional(Schema.NullOr(Schema.String)) }))) })))
+}) });
+/** `GET _apis/profile/profiles/me` (fallback identity source). */
+const AzureDevOpsProfileSchema = Schema.Struct({
+	id: Schema.String,
+	displayName: Schema.optional(Schema.NullOr(Schema.String)),
+	emailAddress: Schema.optional(Schema.NullOr(Schema.String))
+});
+const AzureDevOpsPermissionsSchema = Schema.Struct({ value: Schema.Array(Schema.Boolean) });
+const AzureDevOpsTeamMemberSchema = Schema.Struct({
+	identity: AzureDevOpsIdentityRefSchema,
+	isTeamAdmin: Schema.optional(Schema.NullOr(Schema.Boolean))
+});
+const AzureDevOpsTagSchema = Schema.Struct({
+	name: Schema.String,
+	active: Schema.optional(Schema.NullOr(Schema.Boolean))
+});
+const AzureDevOpsRefUpdateResultSchema = Schema.Struct({
+	name: Schema.optional(Schema.NullOr(Schema.String)),
+	success: Schema.optional(Schema.NullOr(Schema.Boolean)),
+	updateStatus: Schema.optional(Schema.NullOr(Schema.String)),
+	customMessage: Schema.optional(Schema.NullOr(Schema.String))
+});
+/** REST list responses are wrapped: `{ count, value }`; `az devops invoke` adds `continuation_token`. */
+function azureDevOpsCollection(item) {
+	return Schema.Struct({
+		value: Schema.Array(item),
+		count: Schema.optional(Schema.NullOr(Schema.Number)),
+		continuation_token: Schema.optional(Schema.NullOr(Schema.String))
+	});
+}
+function decodeAzureDevOpsJson(schema) {
+	return decodeJsonResult(schema);
+}
+function trimmed(value) {
+	const text = value?.trim() ?? "";
+	return text.length > 0 ? text : null;
+}
+function parseAzureDevOpsDate(value) {
+	const text = trimmed(value);
+	if (!text) return null;
+	const date = new Date(text);
+	return Number.isFinite(date.getTime()) && date.getUTCFullYear() > 1 ? DateTime.fromDateUnsafe(date) : null;
+}
+function epochMillis(value) {
+	return DateTime.toEpochMillis(value);
+}
+function isPositiveLine(value) {
+	return typeof value === "number" && Number.isInteger(value) && value >= 1;
+}
+function isGitObjectId(value) {
+	return /^[0-9a-f]{7,64}$/iu.test(value);
+}
+/** Normalizes Azure identity ids ("d6245f20-2af8-…" and "d6245f202af8…" both occur). */
+function identityKey(id) {
+	const key = id?.replace(/[-{}]/gu, "").trim().toLowerCase() ?? "";
+	return key.length > 0 && key !== EMPTY_GUID.replace(/-/gu, "") ? key : null;
+}
+function sameAzureDevOpsIdentity(left, right) {
+	const a = identityKey(left);
+	return a !== null && a === identityKey(right);
+}
+function toActor(identity) {
+	const login = azureDevOpsIdentityLogin(identity);
+	if (!login) return null;
+	const avatarUrl = trimmed(identity?.imageUrl);
+	return {
+		login,
+		...avatarUrl ? { avatarUrl } : {}
+	};
+}
+function threadProperty(thread, key) {
+	const entry = thread.properties?.[key];
+	if (entry === null || typeof entry !== "object" || !("$value" in entry)) return null;
+	const value = entry.$value;
+	if (typeof value === "string") return trimmed(value);
+	if (typeof value === "number" && Number.isFinite(value)) return String(value);
+	return null;
+}
+function isSystemComment(comment) {
+	const type = comment.commentType;
+	return type === "system" || type === 3;
+}
+function liveTextComments(thread) {
+	return (thread.comments ?? []).filter((comment) => comment.isDeleted !== true && !isSystemComment(comment));
+}
+/** Comment ids are per thread on Azure, so the page carries `threadId:commentId`. */
+function encodeAzureDevOpsCommentId(threadId, commentId) {
+	return `${threadId}:${commentId}`;
+}
+function decodeAzureDevOpsCommentId(value) {
+	const match = /^(\d+):(\d+)$/u.exec(value.trim());
+	if (!match) return null;
+	const threadId = Number(match[1]);
+	const commentId = Number(match[2]);
+	return threadId > 0 && commentId > 0 ? {
+		threadId,
+		commentId
+	} : null;
+}
+function decodeAzureDevOpsThreadId(value) {
+	const match = /^(\d+)$/u.exec(value.trim());
+	const id = match ? Number(match[1]) : NaN;
+	return Number.isSafeInteger(id) && id > 0 ? id : null;
+}
+/** Every identity the payloads mention, keyed by normalized id, for system-thread references. */
+function collectAzureDevOpsIdentities(input) {
+	const identities = /* @__PURE__ */ new Map();
+	const add = (identity) => {
+		const key = identityKey(identity?.id);
+		if (key && identity && !identities.has(key)) identities.set(key, identity);
+	};
+	add(input.pullRequest.createdBy);
+	add(input.pullRequest.closedBy);
+	add(input.pullRequest.autoCompleteSetBy);
+	for (const reviewer of input.pullRequest.reviewers ?? []) add(reviewer);
+	for (const thread of input.threads) {
+		for (const comment of thread.comments ?? []) add(comment.author);
+		for (const identity of Object.values(thread.identities ?? {})) add(identity);
+	}
+	return identities;
+}
+function referencedActor(identities, id, displayName) {
+	const key = identityKey(id);
+	return toActor(key ? identities.get(key) : void 0) ?? (displayName ? { login: displayName } : null);
+}
+/**
+* Viewer capabilities from the caller's identity and repository-level Git
+* permissions. Unknown permissions fall back to what authorship alone proves
+* (the author can edit and comment on their own pull request).
+*/
+function toAzureDevOpsViewerCapabilities(input) {
+	const pullRequest = input.pullRequest;
+	const isAuthor = sameAzureDevOpsIdentity(pullRequest.createdBy?.id, input.viewer.id);
+	const isActive = pullRequest.status.trim().toLowerCase() === "active";
+	const contribute = input.permissions?.pullRequestContribute ?? isAuthor;
+	const canComplete = input.permissions?.genericContribute ?? false;
+	const autoCompleteOn = identityKey(pullRequest.autoCompleteSetBy?.id) !== null;
+	return {
+		login: input.viewer.login,
+		isAuthor,
+		canUpdate: isAuthor || contribute,
+		canMerge: isActive && canComplete,
+		canReview: contribute,
+		canUpdateBranch: false,
+		canEnableAutoMerge: isActive && canComplete && !autoCompleteOn,
+		canDisableAutoMerge: isActive && autoCompleteOn && (canComplete || sameAzureDevOpsIdentity(pullRequest.autoCompleteSetBy?.id, input.viewer.id))
+	};
+}
+/** Whether the viewer may comment, reply and change thread status. */
+function azureDevOpsViewerCanComment(viewer) {
+	return viewer?.canReview === true;
+}
+function toReviewComment(threadId, comment, viewerId) {
+	const createdAt = parseAzureDevOpsDate(comment.publishedDate);
+	if (!createdAt) return null;
+	const author = toActor(comment.author) ?? { login: "unknown" };
+	const edited = parseAzureDevOpsDate(comment.lastContentUpdatedDate);
+	const own = viewerId !== null && sameAzureDevOpsIdentity(comment.author?.id, viewerId);
+	return {
+		id: encodeAzureDevOpsCommentId(threadId, comment.id),
+		author,
+		body: comment.content ?? "",
+		createdAt,
+		...edited && epochMillis(edited) > epochMillis(createdAt) ? { updatedAt: edited } : {},
+		state: "submitted",
+		viewerCanUpdate: own,
+		viewerCanDelete: own
+	};
+}
+/** Flattened text comments for the composer detail (every live thread, oldest first). */
+function flattenAzureDevOpsThreadComments(threads) {
+	return threads.filter((thread) => thread.isDeleted !== true).flatMap((thread) => liveTextComments(thread).filter((comment) => (comment.content?.trim() ?? "").length > 0).map((comment) => ({
+		id: encodeAzureDevOpsCommentId(thread.id, comment.id),
+		author: azureDevOpsIdentityLogin(comment.author) ?? "unknown",
+		body: comment.content ?? "",
+		createdAt: comment.publishedDate ?? ""
+	}))).filter((comment) => parseAzureDevOpsDate(comment.createdAt) !== null).toSorted((left, right) => Date.parse(left.createdAt) - Date.parse(right.createdAt));
+}
+const RESOLVED_THREAD_STATUSES = /* @__PURE__ */ new Set([
+	"fixed",
+	"closed",
+	"wontfix",
+	"bydesign"
+]);
+const RESOLVED_THREAD_STATUS_NUMBERS = /* @__PURE__ */ new Set([
+	2,
+	3,
+	4,
+	5
+]);
+function isAzureDevOpsThreadResolved(status) {
+	if (typeof status === "number") return RESOLVED_THREAD_STATUS_NUMBERS.has(status);
+	return RESOLVED_THREAD_STATUSES.has(status?.trim().toLowerCase() ?? "");
+}
+function threadFilePath(thread) {
+	const path = trimmed(thread.threadContext?.filePath)?.replace(/^\/+/u, "");
+	return path && path.length > 0 ? path : null;
+}
+function anchorFrom(left, right) {
+	if (right.start || right.end) return {
+		side: "right",
+		start: right.start ?? right.end ?? null,
+		end: right.end ?? right.start ?? null
+	};
+	if (left.start || left.end) return {
+		side: "left",
+		start: left.start ?? left.end ?? null,
+		end: left.end ?? left.start ?? null
+	};
+	return null;
+}
+/**
+* One file thread on the page. Positions are read as the host tracked them to
+* `latestIterationId` (threads are listed with `$iteration=<latest>`): a thread
+* whose position still belongs to an older iteration could not be tracked and
+* is outdated (`line: null`, written position in `originalLine`).
+*/
+function toAzureDevOpsReviewThread(input) {
+	const thread = input.thread;
+	if (thread.isDeleted === true) return null;
+	const path = threadFilePath(thread);
+	if (!path) return null;
+	const comments = liveTextComments(thread).map((comment) => toReviewComment(thread.id, comment, input.viewerId)).filter((comment) => comment !== null);
+	if (comments.length === 0) return null;
+	const context = thread.threadContext;
+	const current = anchorFrom({
+		start: context?.leftFileStart,
+		end: context?.leftFileEnd
+	}, {
+		start: context?.rightFileStart,
+		end: context?.rightFileEnd
+	});
+	const tracking = thread.pullRequestThreadContext?.trackingCriteria ?? null;
+	const tracked = tracking !== null && (tracking.secondComparingIteration ?? 0) > 0;
+	const original = tracked ? anchorFrom({
+		start: tracking.origLeftFileStart,
+		end: tracking.origLeftFileEnd
+	}, {
+		start: tracking.origRightFileStart,
+		end: tracking.origRightFileEnd
+	}) : current;
+	const writtenIteration = thread.pullRequestThreadContext?.iterationContext?.secondComparingIteration ?? null;
+	const positionIteration = tracked ? tracking.secondComparingIteration ?? null : writtenIteration;
+	const latestIteration = input.iterations.reduce((latest, iteration) => latest === null || iteration.id > latest ? iteration.id : latest, null);
+	const isOutdated = current !== null && positionIteration !== null && latestIteration !== null && positionIteration < latestIteration;
+	const endLine = current?.end?.line;
+	const startLine = current?.start?.line;
+	const originalEnd = original?.end?.line;
+	const originalStart = original?.start?.line;
+	const originalCommitOid = trimmed(input.iterations.find((iteration) => iteration.id === writtenIteration)?.sourceRefCommit?.commitId);
+	const resolved = isAzureDevOpsThreadResolved(thread.status);
+	const canComment = azureDevOpsViewerCanComment(input.viewer);
+	const line = !isOutdated && isPositiveLine(endLine) ? endLine : null;
+	return {
+		id: String(thread.id),
+		path,
+		subjectType: current ? "line" : "file",
+		side: current?.side ?? "right",
+		...current && isPositiveLine(startLine) && startLine !== endLine && !isOutdated ? {
+			startLine,
+			startSide: current.side
+		} : {},
+		line,
+		...isPositiveLine(originalEnd) ? { originalLine: originalEnd } : {},
+		...isPositiveLine(originalStart) && originalStart !== originalEnd ? { originalStartLine: originalStart } : {},
+		...originalCommitOid ? { originalCommitOid } : {},
+		isResolved: resolved,
+		isOutdated,
+		viewerCanReply: canComment,
+		viewerCanResolve: canComment && !resolved,
+		viewerCanUnresolve: canComment && resolved,
+		comments,
+		totalComments: comments.length
+	};
+}
+function toAzureDevOpsReviewThreads(input) {
+	const mapped = input.threads.map((thread) => toAzureDevOpsReviewThread({
+		thread,
+		iterations: input.iterations,
+		viewer: input.viewer,
+		viewerId: input.viewerId
+	})).filter((thread) => thread !== null);
+	if (mapped.length <= 200) return {
+		threads: mapped,
+		truncated: false
+	};
+	const newest = mapped.toSorted((left, right) => epochMillis(right.comments[0].createdAt) - epochMillis(left.comments[0].createdAt)).slice(0, 200);
+	const kept = new Set(newest.map((thread) => thread.id));
+	return {
+		threads: mapped.filter((thread) => kept.has(thread.id)),
+		truncated: true
+	};
+}
+/** Vote value → review state (`IdentityRefWithVote.vote`). Reset votes (0) are not reviews. */
+function azureDevOpsVoteReviewState(vote) {
+	if (vote > 0) return "approved";
+	if (vote < 0) return "changes_requested";
+	return null;
+}
+function splitCommitMessage(message) {
+	const normalized = message.replace(/\r\n/gu, "\n");
+	const newline = normalized.indexOf("\n");
+	if (newline < 0) return {
+		headline: normalized.trim(),
+		body: null
+	};
+	const body = normalized.slice(newline + 1).trim();
+	return {
+		headline: normalized.slice(0, newline).trim(),
+		body: body.length > 0 ? body : null
+	};
+}
+function toAzureDevOpsChangeRequestCommit(commit) {
+	const { headline } = splitCommitMessage(commit.comment ?? "");
+	const author = trimmed(commit.author?.name) ?? trimmed(commit.author?.email);
+	const committedDate = trimmed(commit.committer?.date) ?? trimmed(commit.author?.date);
+	return {
+		oid: commit.commitId,
+		shortOid: commit.commitId.slice(0, 7),
+		messageHeadline: headline,
+		...committedDate ? { committedDate } : {},
+		...author ? { author } : {}
+	};
+}
+/**
+* Chronological timeline from what Azure records:
+* - text threads without a file (general discussion) → `comment` per comment;
+* - system threads (`properties.CodeReviewThreadType`): `VoteUpdate` → `review`,
+*   `ReviewersUpdate` → `review-requested` / `review-request-removed`,
+*   `StatusUpdate` → `merged` / `closed` / `reopened`;
+* - pull request commits → `commit`; iterations → `force-pushed` and
+*   `base-ref-changed`;
+* - the pull request's own completion / abandonment when no status thread
+*   recorded it.
+*/
+function toAzureDevOpsTimeline(input) {
+	const identities = collectAzureDevOpsIdentities({
+		pullRequest: input.pullRequest,
+		threads: input.threads
+	});
+	const entries = [];
+	const push = (item) => entries.push({
+		order: entries.length,
+		item
+	});
+	let statusRecorded = false;
+	for (const thread of input.threads) {
+		if (thread.isDeleted === true) continue;
+		const threadType = threadProperty(thread, "CodeReviewThreadType");
+		const createdAt = parseAzureDevOpsDate(thread.publishedDate ?? thread.comments?.[0]?.publishedDate);
+		if (threadType) {
+			if (!createdAt) continue;
+			switch (threadType) {
+				case "VoteUpdate": {
+					const vote = Number(threadProperty(thread, "CodeReviewVoteResult"));
+					const state = Number.isFinite(vote) ? azureDevOpsVoteReviewState(vote) : null;
+					if (!state) break;
+					const actor = referencedActor(identities, threadProperty(thread, "CodeReviewVotedByTfId"), threadProperty(thread, "CodeReviewVotedByDisplayName"));
+					push({
+						kind: "review",
+						id: `vote:${thread.id}`,
+						createdAt,
+						...actor ? { actor } : {},
+						state,
+						body: "",
+						threadIds: []
+					});
+					break;
+				}
+				case "ReviewersUpdate": {
+					const actor = referencedActor(identities, threadProperty(thread, "CodeReviewReviewersUpdatedByTfId"), threadProperty(thread, "CodeReviewReviewersUpdatedByDisplayname") ?? threadProperty(thread, "CodeReviewReviewersUpdatedByDisplayName"));
+					for (const [kind, prefix] of [["review-requested", "CodeReviewReviewersUpdatedAdded"], ["review-request-removed", "CodeReviewReviewersUpdatedRemoved"]]) {
+						const tfId = threadProperty(thread, `${prefix}TfId`);
+						const reviewer = referencedActor(identities, tfId, threadProperty(thread, `${prefix}DisplayName`));
+						if (!reviewer) continue;
+						const known = identityKey(tfId);
+						const isTeam = known ? identities.get(known)?.isContainer === true : false;
+						push({
+							kind,
+							id: `${kind}:${thread.id}`,
+							createdAt,
+							...actor ? { actor } : {},
+							reviewer: reviewer.login,
+							reviewerKind: isTeam ? "team" : "user"
+						});
+					}
+					break;
+				}
+				case "StatusUpdate": {
+					const status = threadProperty(thread, "CodeReviewStatus")?.toLowerCase();
+					const actor = referencedActor(identities, threadProperty(thread, "CodeReviewStatusUpdatedByTfId"), threadProperty(thread, "CodeReviewStatusUpdatedByDisplayName"));
+					const actorField = actor ? { actor } : {};
+					if (status === "completed") {
+						statusRecorded = statusRecorded || input.pullRequest.status === "completed";
+						const commitOid = trimmed(input.pullRequest.lastMergeCommit?.commitId);
+						push({
+							kind: "merged",
+							id: `status:${thread.id}`,
+							createdAt,
+							...actorField,
+							...commitOid ? { commitOid } : {},
+							baseRefName: normalizeAzureDevOpsRefName(input.pullRequest.targetRefName)
+						});
+					} else if (status === "abandoned") {
+						statusRecorded = statusRecorded || input.pullRequest.status === "abandoned";
+						push({
+							kind: "closed",
+							id: `status:${thread.id}`,
+							createdAt,
+							...actorField
+						});
+					} else if (status === "active" || status === "reactivated") push({
+						kind: "reopened",
+						id: `status:${thread.id}`,
+						createdAt,
+						...actorField
+					});
+					break;
+				}
+			}
+			continue;
+		}
+		if (threadFilePath(thread)) continue;
+		for (const comment of liveTextComments(thread)) {
+			const reviewComment = toReviewComment(thread.id, comment, input.viewerId);
+			if (!reviewComment) continue;
+			push({
+				kind: "comment",
+				id: reviewComment.id,
+				createdAt: reviewComment.createdAt,
+				actor: reviewComment.author,
+				body: reviewComment.body,
+				...reviewComment.updatedAt ? { updatedAt: reviewComment.updatedAt } : {},
+				viewerCanUpdate: reviewComment.viewerCanUpdate === true,
+				viewerCanDelete: reviewComment.viewerCanDelete === true
+			});
+		}
+	}
+	for (const commit of input.commits) {
+		const createdAt = parseAzureDevOpsDate(commit.committer?.date ?? commit.author?.date);
+		if (!createdAt) continue;
+		const { headline, body } = splitCommitMessage(commit.comment ?? "");
+		const authorName = trimmed(commit.author?.name);
+		push({
+			kind: "commit",
+			id: `commit:${commit.commitId}`,
+			createdAt,
+			...authorName ? { actor: { login: authorName } } : {},
+			oid: commit.commitId,
+			shortOid: commit.commitId.slice(0, 7),
+			messageHeadline: headline,
+			...body ? { messageBody: body } : {}
+		});
+	}
+	const iterations = input.iterations.toSorted((left, right) => left.id - right.id);
+	iterations.forEach((iteration, index) => {
+		const createdAt = parseAzureDevOpsDate(iteration.createdDate);
+		if (!createdAt) return;
+		const actor = toActor(iteration.push?.pushedBy ?? iteration.author);
+		const reason = iteration.reason?.trim().toLowerCase();
+		if (reason === "forcepush" || reason === "rebase") {
+			const beforeOid = trimmed(iterations[index - 1]?.sourceRefCommit?.commitId);
+			const afterOid = trimmed(iteration.sourceRefCommit?.commitId);
+			push({
+				kind: "force-pushed",
+				id: `iteration:${iteration.id}`,
+				createdAt,
+				...actor ? { actor } : {},
+				...beforeOid ? { beforeOid } : {},
+				...afterOid ? { afterOid } : {}
+			});
+		} else if (reason === "retarget") {
+			const previousRefName = trimmed(iteration.oldTargetRefName);
+			const currentRefName = trimmed(iteration.newTargetRefName);
+			push({
+				kind: "base-ref-changed",
+				id: `iteration:${iteration.id}`,
+				createdAt,
+				...actor ? { actor } : {},
+				...previousRefName ? { previousRefName: normalizeAzureDevOpsRefName(previousRefName) } : {},
+				...currentRefName ? { currentRefName: normalizeAzureDevOpsRefName(currentRefName) } : {}
+			});
+		}
+	});
+	if (!statusRecorded) {
+		const status = input.pullRequest.status.trim().toLowerCase();
+		const actor = toActor(input.pullRequest.closedBy);
+		const closedDate = closedDateOf(input.pullRequest);
+		if (closedDate && status === "completed") {
+			const commitOid = trimmed(input.pullRequest.lastMergeCommit?.commitId);
+			push({
+				kind: "merged",
+				id: `pull-request:${input.pullRequest.pullRequestId}:merged`,
+				createdAt: closedDate,
+				...actor ? { actor } : {},
+				...commitOid ? { commitOid } : {},
+				baseRefName: normalizeAzureDevOpsRefName(input.pullRequest.targetRefName)
+			});
+		} else if (closedDate && status === "abandoned") push({
+			kind: "closed",
+			id: `pull-request:${input.pullRequest.pullRequestId}:closed`,
+			createdAt: closedDate,
+			...actor ? { actor } : {}
+		});
+	}
+	const sorted = entries.toSorted((left, right) => epochMillis(left.item.createdAt) - epochMillis(right.item.createdAt) || left.order - right.order).map((entry) => entry.item);
+	const truncated = sorted.length > 300;
+	return {
+		timeline: truncated ? sorted.slice(sorted.length - 300) : sorted,
+		truncated: truncated || input.commitsTruncated
+	};
+}
+function closedDateOf(pullRequest) {
+	return pullRequest.closedDate ? Option.getOrNull(pullRequest.closedDate) : null;
+}
+function evaluationTypeId(evaluation) {
+	return evaluation.configuration?.type?.id?.trim().toLowerCase() ?? "";
+}
+function applicableEvaluations(evaluations) {
+	return evaluations.filter((evaluation) => evaluation.configuration?.isEnabled !== false && evaluation.configuration?.isDeleted !== true && evaluation.status?.trim().toLowerCase() !== "notapplicable");
+}
+function statusOf(evaluation) {
+	return evaluation.status?.trim().toLowerCase() ?? "";
+}
+/**
+* Review verdict: votes say when changes were requested; blocking reviewer
+* policies (minimum approvals, required reviewers) say whether approval is
+* still missing. Without policy data only the votes decide.
+*/
+function azureDevOpsReviewDecision(input) {
+	const fromVotes = azureDevOpsReviewDecisionFromVotes(input.reviewers);
+	if (fromVotes === "changes_requested" || input.evaluations === null) return fromVotes;
+	const reviewerPolicies = applicableEvaluations(input.evaluations).filter((evaluation) => {
+		const type = evaluationTypeId(evaluation);
+		return evaluation.configuration?.isBlocking === true && (type === AZURE_DEVOPS_POLICY_TYPES.minimumApprovalCount || type === AZURE_DEVOPS_POLICY_TYPES.requiredReviewers);
+	});
+	if (reviewerPolicies.length === 0) return fromVotes;
+	if (reviewerPolicies.some((evaluation) => statusOf(evaluation) === "rejected")) return "changes_requested";
+	return reviewerPolicies.every((evaluation) => statusOf(evaluation) === "approved") ? "approved" : "review_required";
+}
+/**
+* Merge state from facts: draft, conflicts, blocking policies that have not
+* passed (`blocked`), optional policies that rejected (`unstable`), a
+* successful test merge with nothing blocking (`clean`); otherwise unknown.
+* Undefined when the policy evaluations could not be read.
+*/
+function azureDevOpsMergeStateStatus(input) {
+	const pullRequest = input.pullRequest;
+	if (pullRequest.status.trim().toLowerCase() !== "active") return void 0;
+	if (pullRequest.isDraft === true) return "draft";
+	const mergeStatus = pullRequest.mergeStatus?.trim().toLowerCase();
+	if (mergeStatus === "conflicts") return "dirty";
+	if (input.evaluations === null) return void 0;
+	const applicable = applicableEvaluations(input.evaluations);
+	if (applicable.filter((evaluation) => evaluation.configuration?.isBlocking === true).some((evaluation) => statusOf(evaluation) !== "approved")) return "blocked";
+	if (mergeStatus === "rejectedbypolicy") return "blocked";
+	if (mergeStatus !== "succeeded") return "unknown";
+	return applicable.some((evaluation) => statusOf(evaluation) === "rejected") ? "unstable" : "clean";
+}
+function booleanSetting(settings, key) {
+	const value = settings[key];
+	if (typeof value === "boolean") return value;
+	if (value === "true") return true;
+	if (value === "false") return false;
+}
+/**
+* Allowed strategies from an enabled "Require a merge strategy" policy
+* (`allowNoFastForward`, `allowSquash`, `allowRebase`, `allowRebaseMerge`, or
+* the legacy `useSquashMerge`); every strategy when no such policy applies.
+*/
+function azureDevOpsMergeCapabilities(evaluations) {
+	const policies = applicableEvaluations(evaluations ?? []).filter((evaluation) => evaluationTypeId(evaluation) === AZURE_DEVOPS_POLICY_TYPES.mergeStrategy && evaluation.configuration?.isBlocking !== false);
+	let capabilities = {
+		merge: true,
+		squash: true,
+		rebase: true
+	};
+	for (const policy of policies) {
+		const settings = policy.configuration?.settings ?? {};
+		const allowNoFastForward = booleanSetting(settings, "allowNoFastForward");
+		const allowSquash = booleanSetting(settings, "allowSquash");
+		const allowRebase = booleanSetting(settings, "allowRebase");
+		const allowed = [
+			allowNoFastForward,
+			allowSquash,
+			allowRebase,
+			booleanSetting(settings, "allowRebaseMerge")
+		].some((value) => value !== void 0) ? {
+			merge: allowNoFastForward === true,
+			squash: allowSquash === true,
+			rebase: allowRebase === true
+		} : booleanSetting(settings, "useSquashMerge") === true ? {
+			merge: false,
+			squash: true,
+			rebase: false
+		} : {
+			merge: true,
+			squash: true,
+			rebase: true
+		};
+		capabilities = {
+			merge: capabilities.merge && allowed.merge,
+			squash: capabilities.squash && allowed.squash,
+			rebase: capabilities.rebase && allowed.rebase
+		};
+	}
+	return capabilities;
+}
+function azureDevOpsReviewerStates(reviewers) {
+	return reviewers.flatMap((reviewer) => {
+		const login = azureDevOpsIdentityLogin(reviewer);
+		if (!login || reviewer.hasDeclined === true) return [];
+		const vote = reviewer.vote ?? 0;
+		const avatarUrl = trimmed(reviewer.imageUrl);
+		return [{
+			login,
+			kind: reviewer.isContainer === true ? "team" : "user",
+			state: vote > 0 ? "approved" : vote < 0 ? "changes_requested" : "requested",
+			...avatarUrl ? { avatarUrl } : {}
+		}];
+	});
+}
+const STRATEGY_TO_METHOD = {
+	nofastforward: "merge",
+	squash: "squash",
+	rebase: "rebase",
+	rebasemerge: "rebase"
+};
+function azureDevOpsAutoMerge(pullRequest) {
+	if (identityKey(pullRequest.autoCompleteSetBy?.id) === null) return null;
+	const strategy = pullRequest.completionOptions?.mergeStrategy?.trim().toLowerCase() ?? "";
+	const squash = pullRequest.completionOptions?.squashMerge;
+	const mergeMethod = STRATEGY_TO_METHOD[strategy] ?? (squash === true || squash === "true" ? "squash" : "merge");
+	const enabledBy = azureDevOpsIdentityLogin(pullRequest.autoCompleteSetBy);
+	return {
+		mergeMethod,
+		...enabledBy ? { enabledBy } : {}
+	};
+}
+/** `GitPullRequestMergeStrategy` for a page merge method. */
+function azureDevOpsMergeStrategy(method) {
+	switch (method) {
+		case "merge": return "noFastForward";
+		case "squash": return "squash";
+		case "rebase": return "rebase";
+	}
+}
+/** Pull Request Threads - Create, general discussion (official example shape). */
+function buildAzureDevOpsCommentThreadBody(content) {
+	return {
+		comments: [{
+			parentCommentId: 0,
+			content,
+			commentType: 1
+		}],
+		status: 1
+	};
+}
+/** Pull Request Thread Comments - Create (reply to the thread's first comment). */
+function buildAzureDevOpsReplyBody(input) {
+	return {
+		content: input.content,
+		parentCommentId: input.parentCommentId,
+		commentType: 1
+	};
+}
+/**
+* Pull Request Threads - Create on a file (official example shape). `left`
+* anchors on the base side (`leftFile*`), `right` on the head side
+* (`rightFile*`); a range spans `startLine`..`line`. Offsets are 1-based
+* character positions; the end offset covers the whole last line when its
+* length is known.
+*/
+function buildAzureDevOpsFileThreadBody(input) {
+	const comment = input.comment;
+	const filePath = `/${comment.path.replace(/^\/+/u, "")}`;
+	const isFile = comment.subjectType === "file" || comment.line === void 0;
+	const side = comment.side ?? "right";
+	const endLine = comment.line;
+	const startLine = comment.startLine !== void 0 && endLine !== void 0 && comment.startLine < endLine ? comment.startLine : endLine;
+	const endOffset = Math.max(1, (input.endLineLength ?? 0) + 1);
+	const positions = isFile || endLine === void 0 || startLine === void 0 ? {} : side === "left" ? {
+		leftFileStart: {
+			line: startLine,
+			offset: 1
+		},
+		leftFileEnd: {
+			line: endLine,
+			offset: endOffset
+		}
+	} : {
+		rightFileStart: {
+			line: startLine,
+			offset: 1
+		},
+		rightFileEnd: {
+			line: endLine,
+			offset: endOffset
+		}
+	};
+	return {
+		comments: [{
+			parentCommentId: 0,
+			content: comment.body,
+			commentType: 1
+		}],
+		status: 1,
+		threadContext: {
+			filePath,
+			...positions
+		},
+		pullRequestThreadContext: {
+			...input.changeTrackingId !== null ? { changeTrackingId: input.changeTrackingId } : {},
+			iterationContext: {
+				firstComparingIteration: 1,
+				secondComparingIteration: input.iterationId
+			}
+		}
+	};
+}
+/** `changeTrackingId` per repository path (no leading slash), including renamed-from paths. */
+function azureDevOpsChangeTrackingIds(changes) {
+	const ids = /* @__PURE__ */ new Map();
+	for (const entry of changes.changeEntries) {
+		const trackingId = entry.changeTrackingId;
+		if (typeof trackingId !== "number") continue;
+		for (const path of [entry.item?.path, entry.originalPath]) {
+			const normalized = trimmed(path)?.replace(/^\/+/u, "");
+			if (normalized && !ids.has(normalized)) ids.set(normalized, trackingId);
+		}
+	}
+	return ids;
+}
+function latestAzureDevOpsIteration(iterations) {
+	return iterations.reduce((latest, iteration) => latest === null || iteration.id > latest.id ? iteration : latest, null);
+}
+function azureDevOpsViewerFromConnectionData(data) {
+	const user = data.authenticatedUser;
+	if (identityKey(user.id) === null) return null;
+	const login = trimmed(user.properties?.Account?.$value) ?? trimmed(user.customDisplayName) ?? trimmed(user.providerDisplayName);
+	return login ? {
+		id: user.id,
+		login
+	} : null;
+}
+function azureDevOpsViewerFromProfile(profile) {
+	if (identityKey(profile.id) === null) return null;
+	const login = trimmed(profile.emailAddress) ?? trimmed(profile.displayName);
+	return login ? {
+		id: profile.id,
+		login
+	} : null;
+}
+//#endregion
+//#region src/sourceControl/azureDevOpsPullRequestOperations.ts
+/**
+* Pull request page operations for Azure DevOps, composed from `az repos`
+* commands, `az devops invoke` REST calls (Git REST 7.1) and local `git` for
+* diffs and file contents (Azure has no REST endpoint that returns hunks).
+* Mapping lives in `azureDevOpsPullRequestPage.ts`; this module only fetches,
+* sequences and guards.
+*/
+const AZURE_DEVOPS_DIFF_MAX_BYTES = 8388608;
+const VIEWER_CACHE_TTL_MS = 6e5;
+const ZERO_OBJECT_ID = "0".repeat(40);
+const AZURE_DEVOPS_HEAD_CHANGED_DETAIL = "The pull request's head changed since it was loaded. Refresh and review the new commits, then try again.";
+function cliError(operation, detail, cause) {
+	return new AzureDevOpsCliError({
+		operation,
+		detail,
+		...cause !== void 0 ? { cause } : {}
+	});
+}
+function scopeOf(operation, pullRequest) {
+	const repositoryId = pullRequest.repository?.id?.trim();
+	const projectId = pullRequest.repository?.project?.id?.trim() || null;
+	const project = projectId ?? pullRequest.repository?.project?.name?.trim();
+	return repositoryId && project ? Effect.succeed({
+		project,
+		projectId,
+		repositoryId,
+		pullRequestId: pullRequest.pullRequestId
+	}) : Effect.fail(cliError(operation, "Azure DevOps did not report the pull request's project and repository."));
+}
+function route(scope, extra = {}) {
+	return {
+		project: scope.project,
+		repositoryId: scope.repositoryId,
+		pullRequestId: scope.pullRequestId,
+		...extra
+	};
+}
+function decodeWith(operation, schema) {
+	const decode = decodeAzureDevOpsJson(schema);
+	return (raw) => {
+		const decoded = decode(raw);
+		return Result.isSuccess(decoded) ? Effect.succeed(decoded.success) : Effect.fail(cliError(operation, "Azure DevOps returned a response Ryco could not read.", decoded.failure));
+	};
+}
+function normalizeReference(reference) {
+	const trimmed = reference.trim().replace(/^#/u, "");
+	return /(?:pullrequest|pull-request|pull|_pulls?)\/(\d+)(?:\D.*)?$/iu.exec(trimmed)?.[1] ?? trimmed;
+}
+function stripHeads(refName) {
+	return refName.trim().replace(/^refs\/heads\//u, "");
+}
+function headOf(pullRequest) {
+	return pullRequest.lastMergeSourceCommit?.commitId?.trim() || null;
+}
+const ThreadCollection = azureDevOpsCollection(AzureDevOpsThreadSchema);
+const IterationCollection = azureDevOpsCollection(AzureDevOpsIterationSchema);
+const CommitCollection = azureDevOpsCollection(Schema.Struct({
+	commitId: Schema.String,
+	comment: Schema.optional(Schema.NullOr(Schema.String)),
+	author: Schema.optional(Schema.NullOr(Schema.Struct({
+		name: Schema.optional(Schema.NullOr(Schema.String)),
+		email: Schema.optional(Schema.NullOr(Schema.String)),
+		date: Schema.optional(Schema.NullOr(Schema.String))
+	}))),
+	committer: Schema.optional(Schema.NullOr(Schema.Struct({
+		name: Schema.optional(Schema.NullOr(Schema.String)),
+		email: Schema.optional(Schema.NullOr(Schema.String)),
+		date: Schema.optional(Schema.NullOr(Schema.String))
+	})))
+}));
+const PolicyEvaluationList = Schema.Array(AzureDevOpsPolicyEvaluationSchema);
+const TeamMemberList = Schema.Array(AzureDevOpsTeamMemberSchema);
+const TagCollection = azureDevOpsCollection(AzureDevOpsTagSchema);
+const RefUpdateCollection = azureDevOpsCollection(AzureDevOpsRefUpdateResultSchema);
+const ReviewerVoteSchema = Schema.Struct({
+	id: Schema.optional(Schema.NullOr(Schema.String)),
+	vote: Schema.optional(Schema.NullOr(Schema.Number))
+});
+const RepositorySchema = Schema.Struct({
+	id: Schema.optional(Schema.NullOr(Schema.String)),
+	project: Schema.optional(Schema.NullOr(Schema.Struct({
+		id: Schema.optional(Schema.NullOr(Schema.String)),
+		name: Schema.optional(Schema.NullOr(Schema.String))
+	})))
+});
+const ProjectSchema = Schema.Struct({
+	id: Schema.optional(Schema.NullOr(Schema.String)),
+	defaultTeam: Schema.optional(Schema.NullOr(Schema.Struct({
+		id: Schema.String,
+		name: Schema.optional(Schema.NullOr(Schema.String))
+	})))
+});
+function makeAzureDevOpsPullRequestOperations(azure) {
+	const viewerCache = /* @__PURE__ */ new Map();
+	const executeJson = (cwd, operation, args) => azure.execute({
+		cwd,
+		args: [
+			...args,
+			"--only-show-errors",
+			"--output",
+			"json"
+		]
+	}).pipe(Effect.map((output) => output.stdout.trim()), Effect.mapError((error) => cliError(operation, error.detail, error)));
+	const readPullRequest = (cwd, reference) => azure.getRawPullRequest({
+		cwd,
+		reference: normalizeReference(reference)
+	});
+	const listIterations = (cwd, scope) => azure.invoke({
+		cwd,
+		operation: "listPullRequestIterations",
+		area: "git",
+		resource: "pullRequestIterations",
+		routeParameters: route(scope)
+	}).pipe(Effect.flatMap(decodeWith("listPullRequestIterations", IterationCollection)), Effect.map((collection) => collection.value));
+	const listThreads = (cwd, scope, iterationId) => azure.invoke({
+		cwd,
+		operation: "listPullRequestThreads",
+		area: "git",
+		resource: "pullRequestThreads",
+		routeParameters: route(scope),
+		...iterationId !== null ? { queryParameters: { $iteration: iterationId } } : {}
+	}).pipe(Effect.flatMap(decodeWith("listPullRequestThreads", ThreadCollection)), Effect.map((collection) => collection.value));
+	const getThread = (cwd, scope, threadId, iterationId) => azure.invoke({
+		cwd,
+		operation: "getPullRequestThread",
+		area: "git",
+		resource: "pullRequestThreads",
+		routeParameters: route(scope, { threadId }),
+		...iterationId !== null ? { queryParameters: { $iteration: iterationId } } : {}
+	}).pipe(Effect.flatMap(decodeWith("getPullRequestThread", AzureDevOpsThreadSchema)));
+	const listCommits = (cwd, scope) => azure.invoke({
+		cwd,
+		operation: "listPullRequestCommits",
+		area: "git",
+		resource: "pullRequestCommits",
+		routeParameters: route(scope),
+		queryParameters: { $top: 250 }
+	}).pipe(Effect.flatMap(decodeWith("listPullRequestCommits", CommitCollection)), Effect.map((collection) => ({
+		commits: collection.value.filter((commit) => commit.commitId.trim().length > 0),
+		truncated: Boolean(collection.continuation_token) || collection.value.length >= 250
+	})));
+	const listPolicyEvaluations = (cwd, pullRequestId) => executeJson(cwd, "listPolicyEvaluations", [
+		"repos",
+		"pr",
+		"policy",
+		"list",
+		"--detect",
+		"true",
+		"--id",
+		String(pullRequestId)
+	]).pipe(Effect.flatMap((raw) => raw.length === 0 ? Effect.succeed([]) : decodeWith("listPolicyEvaluations", PolicyEvaluationList)(raw)), Effect.map((evaluations) => evaluations), Effect.catch((error) => Effect.logWarning("Azure DevOps: could not read pull request policies.", {
+		pullRequestId,
+		detail: error.detail
+	}).pipe(Effect.as(null))));
+	/** The signed-in identity: connection data, else the profile; cached per checkout. */
+	const resolveViewer = (cwd) => Effect.gen(function* () {
+		const now = yield* Clock.currentTimeMillis;
+		const cached = viewerCache.get(cwd);
+		if (cached && cached.expiresAt > now) return cached.viewer;
+		const fromConnection = azure.invoke({
+			cwd,
+			operation: "getConnectionData",
+			area: "Location",
+			resource: "connectionData",
+			routeParameters: {},
+			apiVersion: "7.1-preview"
+		}).pipe(Effect.flatMap(decodeWith("getConnectionData", AzureDevOpsConnectionDataSchema)), Effect.map(azureDevOpsViewerFromConnectionData));
+		const fromProfile = azure.invoke({
+			cwd,
+			operation: "getProfile",
+			area: "Profile",
+			resource: "Profiles",
+			routeParameters: { id: "me" }
+		}).pipe(Effect.flatMap(decodeWith("getProfile", AzureDevOpsProfileSchema)), Effect.map(azureDevOpsViewerFromProfile));
+		const viewer = yield* fromConnection.pipe(Effect.flatMap((found) => found ? Effect.succeed(found) : fromProfile), Effect.catch(() => fromProfile), Effect.catch((error) => Effect.logWarning("Azure DevOps: could not resolve the signed-in identity.", { detail: error.detail }).pipe(Effect.as(null))));
+		viewerCache.set(cwd, {
+			viewer,
+			expiresAt: now + VIEWER_CACHE_TTL_MS
+		});
+		return viewer;
+	});
+	/** Repository-level Git permissions of the caller (Security - Has Permissions). */
+	const readPermissions = (cwd, scope) => {
+		if (!scope.projectId) return Effect.succeed(null);
+		const has = (permission) => azure.invoke({
+			cwd,
+			operation: "hasPermissions",
+			area: "Security",
+			resource: "Permissions",
+			routeParameters: {
+				securityNamespaceId: AZURE_DEVOPS_GIT_SECURITY_NAMESPACE,
+				permissions: permission
+			},
+			queryParameters: {
+				tokens: `repoV2/${scope.projectId}/${scope.repositoryId}`,
+				alwaysAllowAdministrators: true
+			}
+		}).pipe(Effect.flatMap(decodeWith("hasPermissions", AzureDevOpsPermissionsSchema)), Effect.map((result) => result.value[0] === true));
+		return Effect.all({
+			pullRequestContribute: has(AZURE_DEVOPS_GIT_PERMISSION_PULL_REQUEST_CONTRIBUTE),
+			genericContribute: has(4)
+		}, { concurrency: 2 }).pipe(Effect.map((permissions) => permissions), Effect.catch((error) => Effect.logWarning("Azure DevOps: could not read repository permissions.", { detail: error.detail }).pipe(Effect.as(null))));
+	};
+	const viewerCapabilities = (cwd, scope, pullRequest) => Effect.all([resolveViewer(cwd), readPermissions(cwd, scope)], { concurrency: 2 }).pipe(Effect.map(([viewer, permissions]) => ({
+		viewerId: viewer?.id ?? null,
+		viewer: viewer ? toAzureDevOpsViewerCapabilities({
+			viewer,
+			permissions,
+			pullRequest
+		}) : null
+	})));
+	const hasCommit = (cwd, sha) => azure.runGit({
+		cwd,
+		operation: "hasCommit",
+		args: [
+			"cat-file",
+			"-e",
+			`${sha}^{commit}`
+		],
+		allowNonZeroExit: true
+	}).pipe(Effect.map((output) => output.exitCode === 0));
+	/**
+	* Make `shas` available in the checkout: fetch them by id, then fall back
+	* to the pull request's refs (`refs/pull/<id>/merge` carries the last test
+	* merge's parents) for servers that refuse unadvertised objects.
+	*/
+	const ensureCommits = (input) => Effect.gen(function* () {
+		for (const sha of input.shas) if (!isGitObjectId(sha)) return yield* cliError(input.operation, `Invalid commit id: ${sha}`);
+		const missing = yield* Effect.filter(input.shas, (sha) => hasCommit(input.cwd, sha).pipe(Effect.map((present) => !present)));
+		if (missing.length === 0) return;
+		yield* azure.runGit({
+			cwd: input.cwd,
+			operation: input.operation,
+			args: [
+				"fetch",
+				"--quiet",
+				"--no-tags",
+				input.remoteName,
+				...missing
+			],
+			allowNonZeroExit: true,
+			timeoutMs: 12e4
+		});
+		const stillMissing = yield* Effect.filter(missing, (sha) => hasCommit(input.cwd, sha).pipe(Effect.map((present) => !present)));
+		if (stillMissing.length === 0) return;
+		const pullRequest = input.pullRequest;
+		if (pullRequest) for (const ref of [
+			`refs/pull/${pullRequest.pullRequestId}/merge`,
+			pullRequest.sourceRefName,
+			pullRequest.targetRefName
+		]) yield* azure.runGit({
+			cwd: input.cwd,
+			operation: input.operation,
+			args: [
+				"fetch",
+				"--quiet",
+				"--no-tags",
+				input.remoteName,
+				ref
+			],
+			allowNonZeroExit: true,
+			timeoutMs: 12e4
+		});
+		const unavailable = yield* Effect.filter(stillMissing, (sha) => hasCommit(input.cwd, sha).pipe(Effect.map((present) => !present)));
+		if (unavailable.length > 0) return yield* cliError(input.operation, `Could not fetch commit ${unavailable[0].slice(0, 7)} from ${input.remoteName}.`);
+	});
+	const gitDiff = (cwd, operation, args) => azure.runGit({
+		cwd,
+		operation,
+		args: [
+			"diff",
+			"--no-color",
+			"--no-ext-diff",
+			"--no-textconv",
+			"--find-renames",
+			"--src-prefix=a/",
+			"--dst-prefix=b/",
+			"--no-relative",
+			"--submodule=short",
+			...args
+		],
+		maxOutputBytes: AZURE_DEVOPS_DIFF_MAX_BYTES,
+		timeoutMs: 12e4
+	}).pipe(Effect.flatMap((output) => output.stdoutTruncated ? Effect.fail(cliError(operation, "This diff is too large to display.")) : Effect.succeed(output.stdout)));
+	const readBlob = (cwd, revision, path) => azure.runGit({
+		cwd,
+		operation: "getChangeRequestFileContents",
+		args: [
+			"cat-file",
+			"blob",
+			`${revision}:${path}`
+		],
+		allowNonZeroExit: true,
+		maxOutputBytes: CHANGE_REQUEST_FILE_CONTENTS_MAX_BYTES
+	}).pipe(Effect.map((output) => {
+		if (output.exitCode !== 0 || output.stdout.includes("\0")) return {
+			contents: null,
+			truncated: false
+		};
+		return {
+			contents: output.stdout,
+			truncated: output.stdoutTruncated
+		};
+	}));
+	const verifyHead = (operation, pullRequest, expected) => {
+		const head = headOf(pullRequest);
+		return head !== null && head.toLowerCase() === expected.trim().toLowerCase() ? Effect.void : Effect.fail(cliError(operation, AZURE_DEVOPS_HEAD_CHANGED_DETAIL));
+	};
+	const findPullRequestCommit = (operation, commits, commitSha, pullRequestId) => {
+		const wanted = commitSha.trim().toLowerCase();
+		const matches = commits.filter((commit) => wanted.length >= 7 ? commit.commitId.toLowerCase().startsWith(wanted) : commit.commitId.toLowerCase() === wanted);
+		return matches.length === 1 ? Effect.succeed(matches[0].commitId) : Effect.fail(cliError(operation, `Commit ${commitSha} is not part of pull request #${pullRequestId}.`));
+	};
+	const getDetail = (input) => Effect.gen(function* () {
+		const pullRequest = yield* readPullRequest(input.cwd, input.reference);
+		const scope = yield* scopeOf("getChangeRequestDetail", pullRequest);
+		const [threads, commits, evaluations] = yield* Effect.all([
+			listThreads(input.cwd, scope, null).pipe(Effect.catch((error) => Effect.logWarning("Azure DevOps: could not read pull request threads.", {
+				pullRequestId: scope.pullRequestId,
+				detail: error.detail
+			}).pipe(Effect.as([])))),
+			listCommits(input.cwd, scope).pipe(Effect.map((page) => page.commits), Effect.catch((error) => Effect.logWarning("Azure DevOps: could not read pull request commits.", {
+				pullRequestId: scope.pullRequestId,
+				detail: error.detail
+			}).pipe(Effect.as([])))),
+			listPolicyEvaluations(input.cwd, scope.pullRequestId)
+		], { concurrency: 3 });
+		return toDetail({
+			pullRequest,
+			threads,
+			commits,
+			evaluations
+		});
+	});
+	const getActivity = (input) => Effect.gen(function* () {
+		const pullRequest = yield* readPullRequest(input.cwd, input.reference);
+		const scope = yield* scopeOf("getChangeRequestActivity", pullRequest);
+		const [iterations, commitPage, access] = yield* Effect.all([
+			listIterations(input.cwd, scope),
+			listCommits(input.cwd, scope),
+			viewerCapabilities(input.cwd, scope, pullRequest)
+		], { concurrency: 3 });
+		const latest = latestAzureDevOpsIteration(iterations);
+		const threads = yield* listThreads(input.cwd, scope, latest?.id ?? null);
+		const timeline = toAzureDevOpsTimeline({
+			pullRequest,
+			threads,
+			iterations,
+			commits: commitPage.commits,
+			commitsTruncated: commitPage.truncated,
+			viewerId: access.viewerId
+		});
+		const reviewThreads = toAzureDevOpsReviewThreads({
+			threads,
+			iterations,
+			viewer: access.viewer,
+			viewerId: access.viewerId
+		});
+		const headSha = headOf(pullRequest) ?? latest?.sourceRefCommit?.commitId?.trim() ?? null;
+		return {
+			provider: "azure-devops",
+			number: pullRequest.pullRequestId,
+			headSha: headSha && headSha.length > 0 ? headSha : null,
+			viewer: access.viewer,
+			timeline: timeline.timeline,
+			timelineTruncated: timeline.truncated,
+			reviewThreads: reviewThreads.threads,
+			reviewThreadsTruncated: reviewThreads.truncated,
+			pendingReview: null
+		};
+	});
+	const getDiff = (input) => Effect.gen(function* () {
+		const operation = "getChangeRequestDiff";
+		const pullRequest = yield* readPullRequest(input.cwd, input.reference);
+		if (input.expectedHeadSha) yield* verifyHead(operation, pullRequest, input.expectedHeadSha).pipe(Effect.mapError(() => cliError(operation, "Pull request changed while loading the diff. Refresh and try again.")));
+		const commitSha = input.commitSha?.trim();
+		if (commitSha) {
+			const scope = yield* scopeOf(operation, pullRequest);
+			const page = yield* listCommits(input.cwd, scope);
+			const sha = yield* findPullRequestCommit(operation, page.commits, commitSha, pullRequest.pullRequestId);
+			yield* ensureCommits({
+				cwd: input.cwd,
+				operation,
+				remoteName: input.remoteName,
+				shas: [sha],
+				pullRequest
+			});
+			return yield* gitDiff(input.cwd, operation, [`${sha}^1`, sha]);
+		}
+		const head = headOf(pullRequest);
+		const target = pullRequest.lastMergeTargetCommit?.commitId?.trim();
+		if (!head || !target) return yield* cliError(operation, "Azure DevOps has not prepared this pull request's merge yet. Try again shortly.");
+		yield* ensureCommits({
+			cwd: input.cwd,
+			operation,
+			remoteName: input.remoteName,
+			shas: [target, head],
+			pullRequest
+		});
+		return yield* gitDiff(input.cwd, operation, [`${target}...${head}`]);
+	});
+	const getFileContents = (input) => Effect.gen(function* () {
+		const operation = "getChangeRequestFileContents";
+		for (const path of [input.path, input.previousPath]) if (path !== void 0 && !isRepositoryPath(path)) return yield* cliError(operation, `Invalid repository file path: ${path}`);
+		for (const sha of [input.headSha, input.baseSha]) if (sha !== void 0 && !isGitObjectId(sha)) return yield* cliError(operation, `Invalid commit id: ${sha}`);
+		const pullRequest = yield* readPullRequest(input.cwd, input.reference);
+		const target = pullRequest.lastMergeTargetCommit?.commitId?.trim();
+		const baseRevision = input.baseSha ?? target;
+		if (!baseRevision) return yield* cliError(operation, "Azure DevOps has not prepared this pull request's merge yet. Try again shortly.");
+		yield* ensureCommits({
+			cwd: input.cwd,
+			operation,
+			remoteName: input.remoteName,
+			shas: [input.headSha, baseRevision],
+			pullRequest
+		});
+		const baseSha = input.baseSha ? input.baseSha : yield* azure.runGit({
+			cwd: input.cwd,
+			operation,
+			args: [
+				"merge-base",
+				baseRevision,
+				input.headSha
+			]
+		}).pipe(Effect.flatMap((output) => {
+			const sha = output.stdout.trim();
+			return isGitObjectId(sha) ? Effect.succeed(sha) : Effect.fail(cliError(operation, "No merge base for this pull request."));
+		}));
+		const [oldSide, newSide] = yield* Effect.all([readBlob(input.cwd, baseSha, input.previousPath ?? input.path), readBlob(input.cwd, input.headSha, input.path)], { concurrency: 2 });
+		return {
+			path: input.path,
+			oldContents: oldSide.contents,
+			newContents: newSide.contents,
+			truncated: oldSide.truncated || newSide.truncated
+		};
+	});
+	const listChangeRequests = (input) => Effect.gen(function* () {
+		const limit = input.limit ?? 20;
+		const query = input.query?.trim().toLowerCase() ?? "";
+		const top = query.length > 0 ? Math.max(limit * 5, 100) : limit;
+		const base = {
+			cwd: input.cwd,
+			headSelector: input.headSelector,
+			...input.source ? { source: input.source } : {},
+			state: input.state,
+			limit: top
+		};
+		let rows;
+		switch (input.involvement) {
+			case void 0:
+				rows = yield* azure.listPullRequests(base);
+				break;
+			case "authored":
+				rows = yield* azure.listPullRequests({
+					...base,
+					creator: "me"
+				});
+				break;
+			case "review-requested":
+				rows = yield* azure.listPullRequests({
+					...base,
+					reviewer: "me"
+				});
+				break;
+			case "involved": {
+				const [authored, reviewing] = yield* Effect.all([azure.listPullRequests({
+					...base,
+					creator: "me"
+				}), azure.listPullRequests({
+					...base,
+					reviewer: "me"
+				})], { concurrency: 2 });
+				const seen = /* @__PURE__ */ new Set();
+				rows = [...authored, ...reviewing].filter((row) => seen.has(row.number) ? false : (seen.add(row.number), true)).toSorted((left, right) => right.number - left.number);
+				break;
+			}
+			case "assigned":
+			case "mentioned": return yield* cliError("listChangeRequests", `Azure DevOps has no ${input.involvement === "assigned" ? "assignees" : "mentions"} on pull requests to filter by.`);
+		}
+		return (query.length === 0 ? rows : rows.filter((row) => row.title.toLowerCase().includes(query) || `#${row.number}` === query || String(row.number) === query)).slice(0, limit);
+	});
+	const addComment = (input) => Effect.gen(function* () {
+		const scope = yield* scopeOf("addChangeRequestComment", yield* readPullRequest(input.cwd, input.reference));
+		yield* azure.invoke({
+			cwd: input.cwd,
+			operation: "addChangeRequestComment",
+			area: "git",
+			resource: "pullRequestThreads",
+			routeParameters: route(scope),
+			httpMethod: "POST",
+			body: buildAzureDevOpsCommentThreadBody(input.body)
+		});
+	});
+	const readReviewThread = (cwd, scope, pullRequest, threadId) => Effect.gen(function* () {
+		const [iterations, access] = yield* Effect.all([listIterations(cwd, scope), viewerCapabilities(cwd, scope, pullRequest)], { concurrency: 2 });
+		const latest = latestAzureDevOpsIteration(iterations);
+		return toAzureDevOpsReviewThread({
+			thread: yield* getThread(cwd, scope, threadId, latest?.id ?? null),
+			iterations,
+			viewer: access.viewer,
+			viewerId: access.viewerId
+		});
+	});
+	const replyToThread = (input) => Effect.gen(function* () {
+		const operation = "replyToReviewThread";
+		const threadId = decodeAzureDevOpsThreadId(input.threadId);
+		if (threadId === null) return yield* cliError(operation, `Invalid review thread id: ${input.threadId}`);
+		const pullRequest = yield* readPullRequest(input.cwd, input.reference);
+		const scope = yield* scopeOf(operation, pullRequest);
+		const parent = ((yield* getThread(input.cwd, scope, threadId, null)).comments ?? []).find((comment) => comment.isDeleted !== true && (comment.parentCommentId ?? 0) === 0)?.id ?? 1;
+		yield* azure.invoke({
+			cwd: input.cwd,
+			operation,
+			area: "git",
+			resource: "pullRequestThreadComments",
+			routeParameters: route(scope, { threadId }),
+			httpMethod: "POST",
+			body: buildAzureDevOpsReplyBody({
+				content: input.body,
+				parentCommentId: parent
+			})
+		}).pipe(Effect.flatMap(decodeWith(operation, AzureDevOpsCommentSchema)));
+		const updated = yield* readReviewThread(input.cwd, scope, pullRequest, threadId);
+		if (!updated) return yield* cliError(operation, `Thread ${threadId} is not a review thread on a file.`);
+		return updated;
+	});
+	const setThreadResolved = (input) => Effect.gen(function* () {
+		const operation = "setReviewThreadResolved";
+		const threadId = decodeAzureDevOpsThreadId(input.threadId);
+		if (threadId === null) return yield* cliError(operation, `Invalid review thread id: ${input.threadId}`);
+		const scope = yield* scopeOf(operation, yield* readPullRequest(input.cwd, input.reference));
+		const thread = yield* azure.invoke({
+			cwd: input.cwd,
+			operation,
+			area: "git",
+			resource: "pullRequestThreads",
+			routeParameters: route(scope, { threadId }),
+			httpMethod: "PATCH",
+			body: { status: input.resolved ? "fixed" : "active" }
+		}).pipe(Effect.flatMap(decodeWith(operation, AzureDevOpsThreadSchema)));
+		return {
+			threadId: String(thread.id),
+			isResolved: isAzureDevOpsThreadResolved(thread.status)
+		};
+	});
+	const updateComment = (input) => Effect.gen(function* () {
+		const operation = "updateChangeRequestComment";
+		if (input.commentKind === "review") return yield* cliError(operation, "Azure DevOps votes have no body to edit.");
+		const ids = decodeAzureDevOpsCommentId(input.commentId);
+		if (!ids) return yield* cliError(operation, `Invalid comment id: ${input.commentId}`);
+		const routeParameters = route(yield* scopeOf(operation, yield* readPullRequest(input.cwd, input.reference)), {
+			threadId: ids.threadId,
+			commentId: ids.commentId
+		});
+		if (input.action === "delete") {
+			yield* azure.invoke({
+				cwd: input.cwd,
+				operation,
+				area: "git",
+				resource: "pullRequestThreadComments",
+				routeParameters,
+				httpMethod: "DELETE"
+			});
+			return {
+				commentId: input.commentId,
+				deleted: true
+			};
+		}
+		yield* azure.invoke({
+			cwd: input.cwd,
+			operation,
+			area: "git",
+			resource: "pullRequestThreadComments",
+			routeParameters,
+			httpMethod: "PATCH",
+			body: { content: input.body }
+		}).pipe(Effect.flatMap(decodeWith(operation, AzureDevOpsCommentSchema)));
+		return {
+			commentId: input.commentId,
+			deleted: false
+		};
+	});
+	const submitReview = (input) => Effect.gen(function* () {
+		const operation = "submitChangeRequestReview";
+		const body = input.body?.trim() ?? "";
+		if (input.event === "comment" && body.length === 0 && input.comments.length === 0) return yield* cliError(operation, "Write a comment or add line comments before submitting.");
+		const scope = yield* scopeOf(operation, yield* readPullRequest(input.cwd, input.reference));
+		const latest = latestAzureDevOpsIteration(yield* listIterations(input.cwd, scope));
+		const iterationHead = latest?.sourceRefCommit?.commitId?.trim().toLowerCase();
+		if (!latest || iterationHead !== input.expectedHeadSha.trim().toLowerCase()) return yield* cliError(operation, AZURE_DEVOPS_HEAD_CHANGED_DETAIL);
+		const trackingIds = input.comments.length > 0 ? yield* azure.invoke({
+			cwd: input.cwd,
+			operation,
+			area: "git",
+			resource: "pullRequestIterationChanges",
+			routeParameters: route(scope, { iterationId: latest.id }),
+			queryParameters: {
+				$top: AZURE_DEVOPS_ITERATION_CHANGES_PAGE,
+				$compareTo: 0
+			}
+		}).pipe(Effect.flatMap(decodeWith(operation, AzureDevOpsIterationChangesSchema)), Effect.map(azureDevOpsChangeTrackingIds)) : /* @__PURE__ */ new Map();
+		const createdThreadIds = [];
+		const postThread = (threadBody) => azure.invoke({
+			cwd: input.cwd,
+			operation,
+			area: "git",
+			resource: "pullRequestThreads",
+			routeParameters: route(scope),
+			httpMethod: "POST",
+			body: threadBody
+		}).pipe(Effect.flatMap(decodeWith(operation, AzureDevOpsThreadSchema)), Effect.tap((thread) => Effect.sync(() => createdThreadIds.push(thread.id))));
+		if (body.length > 0) yield* postThread(buildAzureDevOpsCommentThreadBody(body));
+		for (const comment of input.comments) yield* postThread(buildAzureDevOpsFileThreadBody({
+			comment,
+			iterationId: latest.id,
+			changeTrackingId: trackingIds.get(comment.path.replace(/^\/+/u, "")) ?? null
+		}));
+		const vote = input.event === "approve" ? "approve" : input.event === "request_changes" ? "wait-for-author" : null;
+		const url = input.webUrl ?? "";
+		if (vote === null) return {
+			reviewId: `thread:${createdThreadIds[0] ?? 0}`,
+			state: "commented",
+			...url ? { url } : {}
+		};
+		const reviewer = yield* executeJson(input.cwd, operation, [
+			"repos",
+			"pr",
+			"set-vote",
+			"--detect",
+			"true",
+			"--id",
+			String(scope.pullRequestId),
+			"--vote",
+			vote
+		]).pipe(Effect.flatMap(decodeWith(operation, ReviewerVoteSchema)));
+		return {
+			reviewId: `vote:${reviewer.id ?? "me"}:${reviewer.vote ?? (vote === "approve" ? 10 : -5)}`,
+			state: input.event === "approve" ? "approved" : "changes_requested",
+			...url ? { url } : {}
+		};
+	});
+	const patchPullRequest = (cwd, operation, scope, body) => azure.invoke({
+		cwd,
+		operation,
+		area: "git",
+		resource: "pullRequests",
+		routeParameters: route(scope),
+		httpMethod: "PATCH",
+		body
+	}).pipe(Effect.flatMap(decodeWith(operation, AzureDevOpsPullRequestSchema)));
+	const updatePullRequestCli = (cwd, pullRequestId, args) => executeJson(cwd, "updateChangeRequest", [
+		"repos",
+		"pr",
+		"update",
+		"--detect",
+		"true",
+		"--id",
+		String(pullRequestId),
+		...args
+	]);
+	const deleteSourceBranch = (cwd, scope, pullRequest) => Effect.gen(function* () {
+		const operation = "deleteSourceBranch";
+		const head = headOf(pullRequest);
+		if (!head) return yield* cliError(operation, "The head branch's commit is unknown.");
+		const result = (yield* azure.invoke({
+			cwd,
+			operation,
+			area: "git",
+			resource: "refs",
+			routeParameters: {
+				project: scope.project,
+				repositoryId: scope.repositoryId
+			},
+			httpMethod: "POST",
+			body: [{
+				name: pullRequest.sourceRefName,
+				oldObjectId: head,
+				newObjectId: ZERO_OBJECT_ID
+			}]
+		}).pipe(Effect.flatMap(decodeWith(operation, RefUpdateCollection)))).value[0];
+		if (result?.success !== true) return yield* cliError(operation, result?.customMessage?.trim() || `Could not delete ${stripHeads(pullRequest.sourceRefName)} (${result?.updateStatus ?? "unknown status"}).`);
+	});
+	const updatePullRequest = (input) => Effect.gen(function* () {
+		const operation = "updateChangeRequest";
+		const action = input.action;
+		const pullRequest = yield* readPullRequest(input.cwd, input.reference);
+		const scope = yield* scopeOf(operation, pullRequest);
+		const id = scope.pullRequestId;
+		switch (action.kind) {
+			case "edit":
+				if (action.body !== void 0 && action.body.length > 4e3) return yield* cliError(operation, `Azure DevOps descriptions are limited to ${AZURE_DEVOPS_DESCRIPTION_MAX_CHARS} characters.`);
+				if (action.title !== void 0 || action.body !== void 0) {
+					const titleArgs = action.title !== void 0 ? ["--title", action.title] : [];
+					if (action.body !== void 0) yield* azure.executeWithFile({
+						cwd: input.cwd,
+						operation,
+						contents: action.body,
+						suffix: ".md",
+						args: (file) => [
+							"repos",
+							"pr",
+							"update",
+							"--detect",
+							"true",
+							"--id",
+							String(id),
+							...titleArgs,
+							"--description",
+							`@${file}`
+						]
+					});
+					else yield* updatePullRequestCli(input.cwd, id, titleArgs);
+				}
+				if (action.baseRefName !== void 0) yield* patchPullRequest(input.cwd, operation, scope, { targetRefName: `refs/heads/${stripHeads(action.baseRefName)}` });
+				return;
+			case "set-draft":
+				yield* updatePullRequestCli(input.cwd, id, ["--draft", action.draft ? "true" : "false"]);
+				return;
+			case "close":
+				yield* updatePullRequestCli(input.cwd, id, ["--status", "abandoned"]);
+				if (action.deleteBranch === true) yield* deleteSourceBranch(input.cwd, scope, pullRequest);
+				return;
+			case "reopen":
+				yield* updatePullRequestCli(input.cwd, id, ["--status", "active"]);
+				return;
+			case "reviewers":
+				for (const [verb, reviewers] of [["add", action.add], ["remove", action.remove]]) {
+					if (reviewers.length === 0) continue;
+					yield* executeJson(input.cwd, operation, [
+						"repos",
+						"pr",
+						"reviewer",
+						verb,
+						"--detect",
+						"true",
+						"--id",
+						String(id),
+						"--reviewers",
+						...reviewers
+					]);
+				}
+				return;
+			case "labels":
+				for (const name of action.add) yield* azure.invoke({
+					cwd: input.cwd,
+					operation,
+					area: "git",
+					resource: "pullRequestLabels",
+					routeParameters: route(scope),
+					httpMethod: "POST",
+					body: { name }
+				});
+				for (const name of action.remove) yield* azure.invoke({
+					cwd: input.cwd,
+					operation,
+					area: "git",
+					resource: "pullRequestLabels",
+					routeParameters: route(scope, { labelIdOrName: name }),
+					httpMethod: "DELETE"
+				});
+				return;
+			case "auto-merge": {
+				if (!action.enabled) {
+					yield* updatePullRequestCli(input.cwd, id, ["--auto-complete", "false"]);
+					return;
+				}
+				if (action.expectedHeadSha) yield* verifyHead(operation, pullRequest, action.expectedHeadSha);
+				const viewer = yield* resolveViewer(input.cwd);
+				if (!viewer) return yield* cliError(operation, "Could not resolve your Azure DevOps identity.");
+				const deleteSourceBranchOption = pullRequest.completionOptions?.deleteSourceBranch;
+				yield* patchPullRequest(input.cwd, operation, scope, {
+					autoCompleteSetBy: { id: viewer.id },
+					completionOptions: {
+						mergeStrategy: azureDevOpsMergeStrategy(action.mergeMethod ?? "merge"),
+						...deleteSourceBranchOption === true || deleteSourceBranchOption === "true" ? { deleteSourceBranch: true } : {}
+					}
+				});
+				return;
+			}
+			case "delete-branch":
+				yield* deleteSourceBranch(input.cwd, scope, pullRequest);
+				return;
+			case "assignees":
+			case "update-branch": return yield* cliError(operation, action.kind === "assignees" ? "Azure DevOps pull requests have no assignees." : "Azure DevOps cannot update a branch from its base.");
+		}
+	});
+	const merge = (input) => Effect.gen(function* () {
+		const operation = "mergeChangeRequest";
+		const pullRequest = yield* readPullRequest(input.cwd, input.reference);
+		const scope = yield* scopeOf(operation, pullRequest);
+		if (pullRequest.status.trim().toLowerCase() !== "active") return yield* cliError(operation, "Only active pull requests can be completed.");
+		if (input.expectedHeadSha) yield* verifyHead(operation, pullRequest, input.expectedHeadSha);
+		const head = input.expectedHeadSha?.trim() ?? headOf(pullRequest);
+		if (!head) return yield* cliError(operation, "Azure DevOps has not prepared this pull request's merge yet. Try again shortly.");
+		return { outcome: (yield* patchPullRequest(input.cwd, operation, scope, {
+			status: "completed",
+			lastMergeSourceCommit: { commitId: head },
+			completionOptions: {
+				mergeStrategy: azureDevOpsMergeStrategy(input.mergeMethod),
+				deleteSourceBranch: input.deleteBranch === true
+			}
+		})).status.trim().toLowerCase() === "completed" ? "merged" : "enqueued" };
+	});
+	const readRepositoryProject = (cwd, operation) => executeJson(cwd, operation, [
+		"repos",
+		"show",
+		"--detect",
+		"true"
+	]).pipe(Effect.flatMap(decodeWith(operation, RepositorySchema)), Effect.flatMap((repository) => {
+		const project = repository.project?.id?.trim() || repository.project?.name?.trim();
+		return project ? Effect.succeed(project) : Effect.fail(cliError(operation, "Azure DevOps did not report the repository's project."));
+	}));
+	/** Members of the project's default team: the reviewer picker's candidates. */
+	const listAssignees = (input) => Effect.gen(function* () {
+		const operation = "listAssignees";
+		const project = yield* readRepositoryProject(input.cwd, operation);
+		const team = (yield* executeJson(input.cwd, operation, [
+			"devops",
+			"project",
+			"show",
+			"--detect",
+			"true",
+			"--project",
+			project
+		]).pipe(Effect.flatMap(decodeWith(operation, ProjectSchema)))).defaultTeam?.id;
+		if (!team) return [];
+		return (yield* executeJson(input.cwd, operation, [
+			"devops",
+			"team",
+			"list-member",
+			"--detect",
+			"true",
+			"--project",
+			project,
+			"--team",
+			team,
+			"--top",
+			"500"
+		]).pipe(Effect.flatMap(decodeWith(operation, TeamMemberList)))).flatMap((member) => {
+			const login = azureDevOpsIdentityLogin(member.identity);
+			if (!login || member.identity.isContainer === true) return [];
+			const displayName = member.identity.displayName?.trim();
+			const avatarUrl = member.identity.imageUrl?.trim();
+			return [{
+				login,
+				...displayName && displayName !== login ? { displayName } : {},
+				...avatarUrl ? { avatarUrl } : {}
+			}];
+		});
+	});
+	/** Active project tags (pull request labels share the project's tag definitions). */
+	const listLabels = (input) => Effect.gen(function* () {
+		const operation = "listLabels";
+		const project = yield* readRepositoryProject(input.cwd, operation);
+		return (yield* azure.invoke({
+			cwd: input.cwd,
+			operation,
+			area: "wit",
+			resource: "tags",
+			routeParameters: { project }
+		}).pipe(Effect.flatMap(decodeWith(operation, TagCollection)))).value.filter((tag) => tag.active !== false && tag.name.trim().length > 0).map((tag) => ({ name: tag.name.trim() }));
+	});
+	return {
+		getDetail,
+		getActivity,
+		getDiff,
+		getFileContents,
+		listChangeRequests,
+		addComment,
+		replyToThread,
+		setThreadResolved,
+		updateComment,
+		submitReview,
+		updatePullRequest,
+		merge,
+		listAssignees,
+		listLabels
+	};
+}
+/** Repository-relative path Ryco may read from git (no option or traversal injection). */
+function isRepositoryPath(path) {
+	if (path.length === 0 || path.startsWith("/") || path.includes("\0")) return false;
+	return path.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
+function toDetail(input) {
+	const pullRequest = input.pullRequest;
+	const record = normalizeAzureDevOpsPullRequestRecord(pullRequest);
+	const reviewers = pullRequest.reviewers ?? [];
+	const closedAt = pullRequest.closedDate && pullRequest.closedDate._tag === "Some" ? pullRequest.closedDate.value : null;
+	const merged = record.state === "merged";
+	const mergedBy = merged ? azureDevOpsIdentityLogin(pullRequest.closedBy) : null;
+	const mergeStateStatus = azureDevOpsMergeStateStatus({
+		pullRequest,
+		evaluations: input.evaluations
+	});
+	const reviewerStates = azureDevOpsReviewerStates(reviewers);
+	return {
+		...record,
+		body: pullRequest.description ?? "",
+		comments: flattenAzureDevOpsThreadComments(input.threads),
+		commits: input.commits.map(toAzureDevOpsChangeRequestCommit).toReversed(),
+		reviewers: reviewerStates.map((reviewer) => reviewer.login),
+		reviewerStates,
+		reviewDecision: record.state === "open" ? azureDevOpsReviewDecision({
+			reviewers,
+			evaluations: input.evaluations
+		}) : null,
+		...mergeStateStatus ? { mergeStateStatus } : {},
+		...record.state === "open" ? { mergeCapabilities: azureDevOpsMergeCapabilities(input.evaluations) } : {},
+		autoMerge: record.state === "open" ? azureDevOpsAutoMerge(pullRequest) : null,
+		...closedAt && record.state === "closed" ? { closedAt } : {},
+		...closedAt && merged ? {
+			mergedAt: closedAt,
+			closedAt
+		} : {},
+		...mergedBy ? { mergedBy } : {}
+	};
+}
+//#endregion
+//#region src/sourceControl/AzureDevOpsSourceControlProvider.ts
+function providerError(operation, cause) {
+	return new SourceControlProviderError({
+		provider: "azure-devops",
+		operation,
+		detail: cause.detail,
+		cause
+	});
+}
+function toChangeRequest(summary) {
+	return {
+		provider: "azure-devops",
+		number: summary.number,
+		title: summary.title,
+		url: summary.url,
+		baseRefName: summary.baseRefName,
+		headRefName: summary.headRefName,
+		state: summary.state,
+		updatedAt: summary.updatedAt,
+		isCrossRepository: summary.isCrossRepository ?? false,
+		...summary.isDraft !== void 0 ? { isDraft: summary.isDraft } : {},
+		...summary.author ? { author: summary.author } : {},
+		...summary.labels && summary.labels.length > 0 ? { labels: summary.labels } : {},
+		...summary.headSha ? { headSha: summary.headSha } : {},
+		...summary.mergeability ? { mergeability: summary.mergeability } : {},
+		...summary.createdAt ? { createdAt: summary.createdAt } : {},
+		...summary.reviewDecision !== void 0 ? { reviewDecision: summary.reviewDecision } : {}
+	};
+}
+function toIssueSummary(raw) {
+	return {
+		provider: "azure-devops",
+		number: raw.number,
+		title: raw.title,
+		url: raw.url,
+		state: raw.state,
+		...raw.author ? { author: raw.author } : {},
+		updatedAt: raw.updatedAt.pipe(Option.map((s) => DateTime.fromDateUnsafe(new Date(s)))),
+		labels: raw.labels.map((name) => ({ name }))
+	};
+}
+function toIssueDetail(raw, options) {
+	const content = options.fullContent ? {
+		body: raw.body,
+		comments: raw.comments,
+		truncated: false
+	} : truncateSourceControlDetailContent({
+		body: raw.body,
+		comments: raw.comments
+	});
+	return {
+		...toIssueSummary(raw),
+		body: content.body,
+		comments: content.comments.map((c) => ({
+			author: c.author,
+			body: c.body,
+			createdAt: DateTime.fromDateUnsafe(new Date(c.createdAt))
+		})),
+		truncated: content.truncated
+	};
+}
+function toChangeRequestDetail(raw, options) {
+	const content = options.fullContent ? {
+		body: raw.body,
+		comments: raw.comments,
+		truncated: false
+	} : truncateSourceControlDetailContent({
+		body: raw.body,
+		comments: raw.comments
+	});
+	return {
+		...toChangeRequest(raw),
+		body: content.body,
+		comments: content.comments.map((c) => ({
+			id: c.id,
+			author: c.author,
+			body: c.body,
+			createdAt: DateTime.fromDateUnsafe(new Date(c.createdAt))
+		})),
+		truncated: content.truncated,
+		...raw.commits.length > 0 ? { commits: raw.commits } : {},
+		...raw.reviewers.length > 0 ? { reviewers: raw.reviewers } : {},
+		reviewerStates: raw.reviewerStates,
+		reviewDecision: raw.reviewDecision,
+		...raw.mergeStateStatus ? { mergeStateStatus: raw.mergeStateStatus } : {},
+		...raw.mergeCapabilities ? { mergeCapabilities: raw.mergeCapabilities } : {},
+		autoMerge: raw.autoMerge,
+		...raw.closedAt ? { closedAt: raw.closedAt } : {},
+		...raw.mergedAt ? { mergedAt: raw.mergedAt } : {},
+		...raw.mergedBy ? { mergedBy: raw.mergedBy } : {}
+	};
+}
+function remoteNameOf(context) {
+	return context?.remoteName ?? "origin";
+}
+const make = Effect.fn("makeAzureDevOpsSourceControlProvider")(function* () {
+	const azure = yield* AzureDevOpsCli;
+	const page = makeAzureDevOpsPullRequestOperations(azure);
+	const getChangeRequestDetail = (input) => page.getDetail({
+		cwd: input.cwd,
+		reference: input.reference
+	}).pipe(Effect.map((raw) => toChangeRequestDetail(raw, { fullContent: input.fullContent ?? false })), Effect.mapError((error) => providerError("getChangeRequestDetail", error)));
+	const freshDetail = (operation, input) => page.getDetail(input).pipe(Effect.map((raw) => toChangeRequestDetail(raw, { fullContent: true })), Effect.mapError((error) => providerError(operation, error)));
+	const provider = SourceControlProvider.of({
+		kind: "azure-devops",
+		listChangeRequests: (input) => {
+			const source = sourceControlRefFromInput(input);
+			return page.listChangeRequests({
+				cwd: input.cwd,
+				headSelector: input.headSelector,
+				...source ? { source } : {},
+				state: input.state,
+				...input.limit !== void 0 ? { limit: input.limit } : {},
+				...input.involvement !== void 0 ? { involvement: input.involvement } : {},
+				...input.query !== void 0 ? { query: input.query } : {}
+			}).pipe(Effect.map((items) => items.map(toChangeRequest)), Effect.mapError((error) => providerError("listChangeRequests", error)));
+		},
+		getChangeRequest: (input) => azure.getPullRequest(input).pipe(Effect.map(toChangeRequest), Effect.mapError((error) => providerError("getChangeRequest", error))),
+		createChangeRequest: (input) => {
+			const source = sourceControlRefFromInput(input);
+			return azure.createPullRequest({
+				cwd: input.cwd,
+				baseBranch: input.baseRefName,
+				headSelector: input.headSelector,
+				...source ? { source } : {},
+				...input.target ? { target: input.target } : {},
+				title: input.title,
+				bodyFile: input.bodyFile,
+				...input.draft ? { draft: true } : {}
+			}).pipe(Effect.mapError((error) => providerError("createChangeRequest", error)));
+		},
+		getRepositoryCloneUrls: (input) => azure.getRepositoryCloneUrls(input).pipe(Effect.mapError((error) => providerError("getRepositoryCloneUrls", error))),
+		createRepository: (input) => azure.createRepository(input).pipe(Effect.mapError((error) => providerError("createRepository", error))),
+		getDefaultBranch: (input) => azure.getDefaultBranch({ cwd: input.cwd }).pipe(Effect.mapError((error) => providerError("getDefaultBranch", error))),
+		checkoutChangeRequest: (input) => azure.checkoutPullRequest({
+			cwd: input.cwd,
+			reference: input.reference,
+			...input.context ? { remoteName: input.context.remoteName } : {}
+		}).pipe(Effect.mapError((error) => providerError("checkoutChangeRequest", error))),
+		listIssues: (input) => azure.listWorkItems({
+			cwd: input.cwd,
+			state: input.state,
+			...input.limit !== void 0 ? { limit: input.limit } : {}
+		}).pipe(Effect.map((items) => items.map(toIssueSummary)), Effect.mapError((error) => providerError("listIssues", error))),
+		getIssue: (input) => azure.getWorkItem({
+			cwd: input.cwd,
+			reference: input.reference
+		}).pipe(Effect.map((raw) => toIssueDetail(raw, { fullContent: input.fullContent ?? false })), Effect.mapError((error) => providerError("getIssue", error))),
+		addIssueComment: () => Effect.fail(new SourceControlProviderError({
+			provider: "azure-devops",
+			operation: "addIssueComment",
+			detail: "Not implemented for azure-devops"
+		})),
+		addIssueCommentReaction: () => Effect.fail(new SourceControlProviderError({
+			provider: "azure-devops",
+			operation: "addIssueCommentReaction",
+			detail: "Not implemented for azure-devops"
+		})),
+		searchIssues: (input) => azure.searchWorkItems({
+			cwd: input.cwd,
+			query: input.query,
+			...input.limit !== void 0 ? { limit: input.limit } : {}
+		}).pipe(Effect.map((items) => items.map(toIssueSummary)), Effect.mapError((error) => providerError("searchIssues", error))),
+		searchChangeRequests: (input) => azure.searchPullRequests({
+			cwd: input.cwd,
+			query: input.query,
+			...input.limit !== void 0 ? { limit: input.limit } : {}
+		}).pipe(Effect.map((items) => items.map(toChangeRequest)), Effect.mapError((error) => providerError("searchChangeRequests", error))),
+		getChangeRequestDetail,
+		addChangeRequestComment: (input) => page.addComment({
+			cwd: input.cwd,
+			reference: input.reference,
+			body: input.body
+		}).pipe(Effect.mapError((error) => providerError("addChangeRequestComment", error)), Effect.flatMap(() => freshDetail("addChangeRequestComment", input))),
+		addChangeRequestCommentReaction: () => Effect.fail(new SourceControlProviderError({
+			provider: "azure-devops",
+			operation: "addChangeRequestCommentReaction",
+			detail: "Azure DevOps does not support comment reactions."
+		})),
+		getChangeRequestDiff: (input) => page.getDiff({
+			cwd: input.cwd,
+			reference: input.reference,
+			remoteName: remoteNameOf(input.context),
+			...input.expectedHeadSha ? { expectedHeadSha: input.expectedHeadSha } : {},
+			...input.commitSha ? { commitSha: input.commitSha } : {}
+		}).pipe(Effect.mapError((error) => providerError("getChangeRequestDiff", error))),
+		getChangeRequestActivity: (input) => page.getActivity({
+			cwd: input.cwd,
+			reference: input.reference
+		}).pipe(Effect.mapError((error) => providerError("getChangeRequestActivity", error))),
+		getChangeRequestFileContents: (input) => page.getFileContents({
+			cwd: input.cwd,
+			reference: input.reference,
+			remoteName: remoteNameOf(input.context),
+			path: input.path,
+			...input.previousPath ? { previousPath: input.previousPath } : {},
+			...input.baseSha ? { baseSha: input.baseSha } : {},
+			headSha: input.headSha
+		}).pipe(Effect.mapError((error) => providerError("getChangeRequestFileContents", error))),
+		submitChangeRequestReview: ({ context: _context, ...input }) => page.submitReview(input).pipe(Effect.mapError((error) => providerError("submitChangeRequestReview", error))),
+		replyToReviewThread: (input) => page.replyToThread({
+			cwd: input.cwd,
+			reference: input.reference,
+			threadId: input.threadId,
+			body: input.body
+		}).pipe(Effect.map((thread) => ({ thread })), Effect.mapError((error) => providerError("replyToReviewThread", error))),
+		setReviewThreadResolved: (input) => page.setThreadResolved({
+			cwd: input.cwd,
+			reference: input.reference,
+			threadId: input.threadId,
+			resolved: input.resolved
+		}).pipe(Effect.mapError((error) => providerError("setReviewThreadResolved", error))),
+		updateChangeRequestComment: ({ context: _context, ...input }) => page.updateComment(input).pipe(Effect.mapError((error) => providerError("updateChangeRequestComment", error))),
+		updateChangeRequest: (input) => page.updatePullRequest({
+			cwd: input.cwd,
+			reference: input.reference,
+			action: input.action
+		}).pipe(Effect.mapError((error) => providerError("updateChangeRequest", error)), Effect.flatMap(() => freshDetail("updateChangeRequest", input)), Effect.map((detail) => ({ detail }))),
+		mergeChangeRequest: (input) => page.merge({
+			cwd: input.cwd,
+			reference: input.reference,
+			mergeMethod: input.mergeMethod,
+			...input.deleteBranch !== void 0 ? { deleteBranch: input.deleteBranch } : {},
+			...input.expectedHeadSha ? { expectedHeadSha: input.expectedHeadSha } : {}
+		}).pipe(Effect.mapError((error) => providerError("mergeChangeRequest", error))),
+		createIssue: () => Effect.fail(new SourceControlProviderError({
+			provider: "azure-devops",
+			operation: "createIssue",
+			detail: "Not implemented in Phase 1"
+		})),
+		listLabels: (input) => page.listLabels({ cwd: input.cwd }).pipe(Effect.mapError((error) => providerError("listLabels", error))),
+		listAssignees: (input) => page.listAssignees({ cwd: input.cwd }).pipe(Effect.mapError((error) => providerError("listAssignees", error))),
+		getPullRequestState: (input) => azure.getPullRequest({
+			cwd: input.cwd,
+			reference: String(input.number)
+		}).pipe(Effect.map((summary) => ({
+			state: summary.state,
+			isDraft: summary.isDraft ?? false,
+			terminalAt: summary.state === "open" ? null : summary.closedAt ?? null
+		})), Effect.mapError((error) => providerError("getPullRequestState", error))),
+		getIssueState: () => Effect.fail(new SourceControlProviderError({
+			provider: "azure-devops",
+			operation: "getIssueState",
+			detail: "Not implemented for azure-devops"
+		}))
+	});
+	return withUnsupportedChangeRequestOptionGuards(provider);
+});
+const layer = Layer.effect(SourceControlProvider, make());
+//#endregion
+export { azureDevOpsDiscovery as discovery, layer, make };