@gitkraken/core-gitlens 0.10.7 → 0.11.1

package/dist/plus/integrations/reads/batchEtags.d.ts

@@ -24,6 +24,9 @@ import { BatchSlot } from "../models/integration.js";
  * Failure budget: the cheap check spends no strike toward disconnecting, and shows no notice, unless the credential
  * is refused. Only the full reads spend, each at most one, so a call spends at most two: in a total outage of a batch
  * whose every target carries an etag, one, for the full read every target falls through to.
+ *
+ * Every warning names the targets it concerns (see `ProviderWarning.targetKeys`): the one target a rejected slot
+ * belongs to, or every target of an integration call that failed as a whole.
  */
 /** One integration call's slots, as `runCaptured` captures them. */
 export interface CapturedBatch<T> {
@@ -60,10 +63,10 @@ export declare function readEtaggedBatch<Target extends {
 /**
  * Appends the warning for a batch target that could not be checked, shared by every batch read: for a refusal, the
  * scope failure it was recorded as (see `IntegrationBase.settleBatchRefusals`), published as an account-wide read
- * publishes one, scoped and with its cause; otherwise, the reason itself.
+ * publishes one, scoped and with its cause; otherwise, the reason itself. The warning names the target's key.
  */
 export declare function appendBatchSlotWarning(warnings: ProviderWarning[], providerId: IntegrationIds, domain: string | undefined, connectionId: string | undefined, slot: Extract<BatchSlot<unknown>, {
   status: 'rejected';
-}>): void;
+}>, targetKey: string): void;
 //#endregion
 //# sourceMappingURL=batchEtags.d.ts.map

package/dist/plus/integrations/reads/batchEtags.js

@@ -12,17 +12,24 @@ async function readEtaggedBatch(options) {
 	const warnings = [];
 	const rows = /* @__PURE__ */ new Map();
 	let fetchFailed = false;
+	const keysOf = (indices) => indices.map((i) => targets[i].key);
 	const settleFull = (indices, { value: slots, warning }) => {
-		if (warning != null) appendDedupedWarning(warnings, warning);
+		if (warning != null) appendDedupedWarning(warnings, {
+			...warning,
+			targetKeys: keysOf(indices)
+		});
 		if (slots == null) {
-			if (warning == null) appendDedupedWarning(warnings, options.unsupportedWarning());
+			if (warning == null) appendDedupedWarning(warnings, {
+				...options.unsupportedWarning(),
+				targetKeys: keysOf(indices)
+			});
 			fetchFailed = true;
 			return;
 		}
 		for (let i = 0; i < indices.length; i++) {
 			const slot = slots[i];
 			if (slot.status === "rejected") {
-				appendBatchSlotWarning(warnings, providerId, domain, connectionId, slot);
+				appendBatchSlotWarning(warnings, providerId, domain, connectionId, slot, targets[indices[i]].key);
 				fetchFailed = true;
 				continue;
 			}
@@ -45,7 +52,10 @@ async function readEtaggedBatch(options) {
 		const changed = [];
 		const { value: slots, warning } = await options.readEtagFields(select(cheap));
 		if (warning != null && noRetryKinds.includes(warning.kind)) {
-			appendDedupedWarning(warnings, warning);
+			appendDedupedWarning(warnings, {
+				...warning,
+				targetKeys: keysOf(cheap)
+			});
 			fetchFailed = true;
 		} else if (slots == null) changed.push(...cheap);
 		else for (let i = 0; i < cheap.length; i++) {
@@ -53,13 +63,16 @@ async function readEtaggedBatch(options) {
 			const slot = slots[i];
 			if (slot.status === "rejected") {
 				if (slot.failure != null) {
-					appendBatchSlotWarning(warnings, providerId, domain, connectionId, slot);
+					appendBatchSlotWarning(warnings, providerId, domain, connectionId, slot, targets[index].key);
 					fetchFailed = true;
 					continue;
 				}
 				const slotWarning = toProviderWarning(providerId, domain, connectionId, slot.reason);
 				if (noRetryKinds.includes(slotWarning.kind)) {
-					appendDedupedWarning(warnings, slotWarning);
+					appendDedupedWarning(warnings, {
+						...slotWarning,
+						targetKeys: [targets[index].key]
+					});
 					fetchFailed = true;
 				} else changed.push(index);
 				continue;
@@ -96,17 +109,25 @@ async function readEtaggedBatch(options) {
 /**
 * Appends the warning for a batch target that could not be checked, shared by every batch read: for a refusal, the
 * scope failure it was recorded as (see `IntegrationBase.settleBatchRefusals`), published as an account-wide read
-* publishes one, scoped and with its cause; otherwise, the reason itself.
+* publishes one, scoped and with its cause; otherwise, the reason itself. The warning names the target's key.
 */
-function appendBatchSlotWarning(warnings, providerId, domain, connectionId, slot) {
+function appendBatchSlotWarning(warnings, providerId, domain, connectionId, slot, targetKey) {
 	if (slot.failure != null) {
-		mergeAssessmentInto(warnings, providerId, domain, connectionId, {
+		const produced = [];
+		mergeAssessmentInto(produced, providerId, domain, connectionId, {
 			completeness: "partial",
 			failures: [slot.failure]
 		});
+		for (const warning of produced) appendDedupedWarning(warnings, {
+			...warning,
+			targetKeys: [targetKey]
+		});
 		return;
 	}
-	appendDedupedWarning(warnings, toProviderWarning(providerId, domain, connectionId, slot.reason));
+	appendDedupedWarning(warnings, {
+		...toProviderWarning(providerId, domain, connectionId, slot.reason),
+		targetKeys: [targetKey]
+	});
 }
 //#endregion
 export { appendBatchSlotWarning, readEtaggedBatch };

package/dist/plus/integrations/reads/batchEtags.js.map

@@ -1 +1 @@
-{"version":3,"file":"batchEtags.js","names":[],"sources":["../../../../../plus/integrations/src/reads/batchEtags.ts"],"sourcesContent":["import { mergeAssessmentInto } from '../collectionMetadata.js';\nimport type { IntegrationIds } from '../constants.js';\nimport type { BatchSlot } from '../models/integration.js';\nimport type { ProviderResult, ProviderWarning, ProviderWarningKind } from '../results.js';\nimport { appendDedupedWarning, toProviderWarning } from '../results.js';\n\n/**\n * The etag flow shared by the batch reads (`getPullRequestsBatch`, and both forms of `getIssuesBatch`): targets that\n * carry the etag of the caller's copy are first asked a cheap \"what is your change state\" question, and only the ones\n * that moved are read in full.\n *\n * - No target carries an etag, or the integration has no cheap check: ONE full read of every target, exactly as\n *   before etags existed, with an etag added to each row.\n * - Otherwise up to three integration calls: the full read of the targets with no etag starts at once, in parallel\n *   with the cheap check of the others, and the targets whose etag no longer matches get a second full read as soon\n *   as the check settles. A call takes the longer of the two paths, never their sum.\n *\n * The cheap check never answers for a target it couldn't check: a target it failed falls through to the full read,\n * which then has the final word (and supplies the warning, should it fail too) — except when the failure was a\n * refused credential or a spent rate limit, which the full read would only hit again; those targets are dropped with\n * the cheap check's warning, as a failed full read drops them. Each target is judged by its own slot's reason, so one\n * target's rate limit never drops another target the check merely failed to answer, nor sends a rate-limited target\n * to the full read; the check's wrappers return every slot as it settled, failing as a whole only on a refused\n * credential (or when the request itself failed).\n *\n * Failure budget: the cheap check spends no strike toward disconnecting, and shows no notice, unless the credential\n * is refused. Only the full reads spend, each at most one, so a call spends at most two: in a total outage of a batch\n * whose every target carries an etag, one, for the full read every target falls through to.\n */\n\n/** One integration call's slots, as `runCaptured` captures them. */\nexport interface CapturedBatch<T> {\n\tvalue?: BatchSlot<T | undefined>[];\n\twarning?: ProviderWarning;\n}\n\n/**\n * One target's answer: read in full (`value`, or proven absent without one), or `unchanged`, when the cheap check\n * proved the caller's copy current. Every row with a `value` carries its `etag`, as does every `unchanged` one.\n */\nexport interface EtaggedBatchRow<T> {\n\tkey: string;\n\tvalue?: T;\n\tetag?: string;\n\tunchanged?: true;\n}\n\n/** Failures a full read would only hit again: a refused credential, a spent rate limit, a connection that's gone. */\nconst noRetryKinds: readonly ProviderWarningKind[] = ['auth', 'rate-limit', 'no-connection'];\n\nexport async function readEtaggedBatch<Target extends { key: string; etag?: string }, Item, Fields>(options: {\n\tproviderId: IntegrationIds;\n\tdomain: string | undefined;\n\tconnectionId: string | undefined;\n\ttargets: readonly Target[];\n\t/** Whether the integration has a cheap check. Decided up front, so a host without one makes one call. */\n\tsupportsEtags: boolean;\n\treadFull: (targets: readonly Target[]) => Promise<CapturedBatch<Item>>;\n\treadEtagFields: (targets: readonly Target[]) => Promise<CapturedBatch<Fields>>;\n\titemEtag: (item: Item) => string;\n\tfieldsEtag: (fields: Fields) => string;\n\t/** The warning for a full read that answered neither slots nor an error: the provider can't batch at all. */\n\tunsupportedWarning: () => ProviderWarning;\n}): Promise<ProviderResult<EtaggedBatchRow<Item>>> {\n\tconst { providerId, domain, connectionId, targets } = options;\n\tconst warnings: ProviderWarning[] = [];\n\tconst rows = new Map<number, EtaggedBatchRow<Item>>();\n\tlet fetchFailed = false;\n\n\tconst settleFull = (indices: readonly number[], { value: slots, warning }: CapturedBatch<Item>): void => {\n\t\tif (warning != null) {\n\t\t\tappendDedupedWarning(warnings, warning);\n\t\t}\n\n\t\tif (slots == null) {\n\t\t\t// Dropped, never reported absent: \"unknown\" and \"proven absent\" must stay distinguishable.\n\t\t\tif (warning == null) {\n\t\t\t\tappendDedupedWarning(warnings, options.unsupportedWarning());\n\t\t\t}\n\t\t\tfetchFailed = true;\n\t\t\treturn;\n\t\t}\n\n\t\tfor (let i = 0; i < indices.length; i++) {\n\t\t\tconst slot = slots[i];\n\t\t\tif (slot.status === 'rejected') {\n\t\t\t\t// Dropped, never reported absent, like a whole-call failure: only THIS target failed.\n\t\t\t\tappendBatchSlotWarning(warnings, providerId, domain, connectionId, slot);\n\t\t\t\tfetchFailed = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst item = slot.value;\n\t\t\tconst key = targets[indices[i]].key;\n\t\t\trows.set(indices[i], item != null ? { key: key, value: item, etag: options.itemEtag(item) } : { key: key });\n\t\t}\n\t};\n\n\tconst cheap: number[] = [];\n\tconst full: number[] = [];\n\tfor (let i = 0; i < targets.length; i++) {\n\t\t(options.supportsEtags && targets[i].etag ? cheap : full).push(i);\n\t}\n\n\tconst select = (indices: readonly number[]): Target[] => indices.map(i => targets[i]);\n\n\tif (!cheap.length) {\n\t\tsettleFull(full, await options.readFull(targets));\n\t} else {\n\t\t// Started before the cheap check is even sent, so the targets it can't answer never wait on it.\n\t\tconst fullRead = full.length ? options.readFull(select(full)) : undefined;\n\n\t\tconst changed: number[] = [];\n\t\tconst { value: slots, warning } = await options.readEtagFields(select(cheap));\n\t\tif (warning != null && noRetryKinds.includes(warning.kind)) {\n\t\t\tappendDedupedWarning(warnings, warning);\n\t\t\tfetchFailed = true;\n\t\t} else if (slots == null) {\n\t\t\t// The check failed some other way, or the provider declined it; the full read decides instead.\n\t\t\tchanged.push(...cheap);\n\t\t} else {\n\t\t\tfor (let i = 0; i < cheap.length; i++) {\n\t\t\t\tconst index = cheap[i];\n\t\t\t\tconst slot = slots[i];\n\t\t\t\tif (slot.status === 'rejected') {\n\t\t\t\t\t// A scoped refusal (`failure`) is the credential refused for that target's scope, which a full read\n\t\t\t\t\t// would hit as well.\n\t\t\t\t\tif (slot.failure != null) {\n\t\t\t\t\t\tappendBatchSlotWarning(warnings, providerId, domain, connectionId, slot);\n\t\t\t\t\t\tfetchFailed = true;\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\n\t\t\t\t\tconst slotWarning = toProviderWarning(providerId, domain, connectionId, slot.reason);\n\t\t\t\t\tif (noRetryKinds.includes(slotWarning.kind)) {\n\t\t\t\t\t\tappendDedupedWarning(warnings, slotWarning);\n\t\t\t\t\t\tfetchFailed = true;\n\t\t\t\t\t} else {\n\t\t\t\t\t\tchanged.push(index);\n\t\t\t\t\t}\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst key = targets[index].key;\n\t\t\t\tconst fields = slot.value;\n\t\t\t\tif (fields == null) {\n\t\t\t\t\trows.set(index, { key: key });\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst etag = options.fieldsEtag(fields);\n\t\t\t\tif (etag === targets[index].etag) {\n\t\t\t\t\trows.set(index, { key: key, unchanged: true, etag: etag });\n\t\t\t\t} else {\n\t\t\t\t\tchanged.push(index);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst changedRead = changed.length ? options.readFull(select(changed)) : undefined;\n\t\tif (fullRead != null) {\n\t\t\tsettleFull(full, await fullRead);\n\t\t}\n\t\tif (changedRead != null) {\n\t\t\tsettleFull(changed, await changedRead);\n\t\t}\n\t}\n\n\tconst items: EtaggedBatchRow<Item>[] = [];\n\tfor (let i = 0; i < targets.length; i++) {\n\t\tconst row = rows.get(i);\n\t\tif (row != null) {\n\t\t\titems.push(row);\n\t\t}\n\t}\n\treturn { items: items, warnings: warnings, fetchFailed: fetchFailed || undefined };\n}\n\n/**\n * Appends the warning for a batch target that could not be checked, shared by every batch read: for a refusal, the\n * scope failure it was recorded as (see `IntegrationBase.settleBatchRefusals`), published as an account-wide read\n * publishes one, scoped and with its cause; otherwise, the reason itself.\n */\nexport function appendBatchSlotWarning(\n\twarnings: ProviderWarning[],\n\tproviderId: IntegrationIds,\n\tdomain: string | undefined,\n\tconnectionId: string | undefined,\n\tslot: Extract<BatchSlot<unknown>, { status: 'rejected' }>,\n): void {\n\tif (slot.failure != null) {\n\t\tmergeAssessmentInto(warnings, providerId, domain, connectionId, {\n\t\t\tcompleteness: 'partial',\n\t\t\tfailures: [slot.failure],\n\t\t});\n\t\treturn;\n\t}\n\n\tappendDedupedWarning(warnings, toProviderWarning(providerId, domain, connectionId, slot.reason));\n}\n"],"mappings":";;;;AAgDA,MAAM,eAA+C;CAAC;CAAQ;CAAc;AAAe;AAE3F,eAAsB,iBAA8E,SAajD;CAClD,MAAM,EAAE,YAAY,QAAQ,cAAc,YAAY;CACtD,MAAM,WAA8B,CAAC;CACrC,MAAM,uBAAO,IAAI,IAAmC;CACpD,IAAI,cAAc;CAElB,MAAM,cAAc,SAA4B,EAAE,OAAO,OAAO,cAAyC;EACxG,IAAI,WAAW,MACd,qBAAqB,UAAU,OAAO;EAGvC,IAAI,SAAS,MAAM;GAElB,IAAI,WAAW,MACd,qBAAqB,UAAU,QAAQ,mBAAmB,CAAC;GAE5D,cAAc;GACd;EACD;EAEA,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;GACxC,MAAM,OAAO,MAAM;GACnB,IAAI,KAAK,WAAW,YAAY;IAE/B,uBAAuB,UAAU,YAAY,QAAQ,cAAc,IAAI;IACvE,cAAc;IACd;GACD;GAEA,MAAM,OAAO,KAAK;GAClB,MAAM,MAAM,QAAQ,QAAQ,GAAG,CAAC;GAChC,KAAK,IAAI,QAAQ,IAAI,QAAQ,OAAO;IAAO;IAAK,OAAO;IAAM,MAAM,QAAQ,SAAS,IAAI;GAAE,IAAI,EAAO,IAAI,CAAC;EAC3G;CACD;CAEA,MAAM,QAAkB,CAAC;CACzB,MAAM,OAAiB,CAAC;CACxB,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KACnC,CAAC,QAAQ,iBAAiB,QAAQ,EAAE,CAAC,OAAO,QAAQ,KAAA,CAAM,KAAK,CAAC;CAGjE,MAAM,UAAU,YAAyC,QAAQ,KAAI,MAAK,QAAQ,EAAE;CAEpF,IAAI,CAAC,MAAM,QACV,WAAW,MAAM,MAAM,QAAQ,SAAS,OAAO,CAAC;MAC1C;EAEN,MAAM,WAAW,KAAK,SAAS,QAAQ,SAAS,OAAO,IAAI,CAAC,IAAI,KAAA;EAEhE,MAAM,UAAoB,CAAC;EAC3B,MAAM,EAAE,OAAO,OAAO,YAAY,MAAM,QAAQ,eAAe,OAAO,KAAK,CAAC;EAC5E,IAAI,WAAW,QAAQ,aAAa,SAAS,QAAQ,IAAI,GAAG;GAC3D,qBAAqB,UAAU,OAAO;GACtC,cAAc;EACf,OAAO,IAAI,SAAS,MAEnB,QAAQ,KAAK,GAAG,KAAK;OAErB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;GACtC,MAAM,QAAQ,MAAM;GACpB,MAAM,OAAO,MAAM;GACnB,IAAI,KAAK,WAAW,YAAY;IAG/B,IAAI,KAAK,WAAW,MAAM;KACzB,uBAAuB,UAAU,YAAY,QAAQ,cAAc,IAAI;KACvE,cAAc;KACd;IACD;IAEA,MAAM,cAAc,kBAAkB,YAAY,QAAQ,cAAc,KAAK,MAAM;IACnF,IAAI,aAAa,SAAS,YAAY,IAAI,GAAG;KAC5C,qBAAqB,UAAU,WAAW;KAC1C,cAAc;IACf,OACC,QAAQ,KAAK,KAAK;IAEnB;GACD;GAEA,MAAM,MAAM,QAAQ,MAAM,CAAC;GAC3B,MAAM,SAAS,KAAK;GACpB,IAAI,UAAU,MAAM;IACnB,KAAK,IAAI,OAAO,EAAO,IAAI,CAAC;IAC5B;GACD;GAEA,MAAM,OAAO,QAAQ,WAAW,MAAM;GACtC,IAAI,SAAS,QAAQ,MAAM,CAAC,MAC3B,KAAK,IAAI,OAAO;IAAO;IAAK,WAAW;IAAY;GAAK,CAAC;QAEzD,QAAQ,KAAK,KAAK;EAEpB;EAGD,MAAM,cAAc,QAAQ,SAAS,QAAQ,SAAS,OAAO,OAAO,CAAC,IAAI,KAAA;EACzE,IAAI,YAAY,MACf,WAAW,MAAM,MAAM,QAAQ;EAEhC,IAAI,eAAe,MAClB,WAAW,SAAS,MAAM,WAAW;CAEvC;CAEA,MAAM,QAAiC,CAAC;CACxC,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;EACxC,MAAM,MAAM,KAAK,IAAI,CAAC;EACtB,IAAI,OAAO,MACV,MAAM,KAAK,GAAG;CAEhB;CACA,OAAO;EAAS;EAAiB;EAAU,aAAa,eAAe,KAAA;CAAU;AAClF;;;;;;AAOA,SAAgB,uBACf,UACA,YACA,QACA,cACA,MACO;CACP,IAAI,KAAK,WAAW,MAAM;EACzB,oBAAoB,UAAU,YAAY,QAAQ,cAAc;GAC/D,cAAc;GACd,UAAU,CAAC,KAAK,OAAO;EACxB,CAAC;EACD;CACD;CAEA,qBAAqB,UAAU,kBAAkB,YAAY,QAAQ,cAAc,KAAK,MAAM,CAAC;AAChG"}
+{"version":3,"file":"batchEtags.js","names":[],"sources":["../../../../../plus/integrations/src/reads/batchEtags.ts"],"sourcesContent":["import { mergeAssessmentInto } from '../collectionMetadata.js';\nimport type { IntegrationIds } from '../constants.js';\nimport type { BatchSlot } from '../models/integration.js';\nimport type { ProviderResult, ProviderWarning, ProviderWarningKind } from '../results.js';\nimport { appendDedupedWarning, toProviderWarning } from '../results.js';\n\n/**\n * The etag flow shared by the batch reads (`getPullRequestsBatch`, and both forms of `getIssuesBatch`): targets that\n * carry the etag of the caller's copy are first asked a cheap \"what is your change state\" question, and only the ones\n * that moved are read in full.\n *\n * - No target carries an etag, or the integration has no cheap check: ONE full read of every target, exactly as\n *   before etags existed, with an etag added to each row.\n * - Otherwise up to three integration calls: the full read of the targets with no etag starts at once, in parallel\n *   with the cheap check of the others, and the targets whose etag no longer matches get a second full read as soon\n *   as the check settles. A call takes the longer of the two paths, never their sum.\n *\n * The cheap check never answers for a target it couldn't check: a target it failed falls through to the full read,\n * which then has the final word (and supplies the warning, should it fail too) — except when the failure was a\n * refused credential or a spent rate limit, which the full read would only hit again; those targets are dropped with\n * the cheap check's warning, as a failed full read drops them. Each target is judged by its own slot's reason, so one\n * target's rate limit never drops another target the check merely failed to answer, nor sends a rate-limited target\n * to the full read; the check's wrappers return every slot as it settled, failing as a whole only on a refused\n * credential (or when the request itself failed).\n *\n * Failure budget: the cheap check spends no strike toward disconnecting, and shows no notice, unless the credential\n * is refused. Only the full reads spend, each at most one, so a call spends at most two: in a total outage of a batch\n * whose every target carries an etag, one, for the full read every target falls through to.\n *\n * Every warning names the targets it concerns (see `ProviderWarning.targetKeys`): the one target a rejected slot\n * belongs to, or every target of an integration call that failed as a whole.\n */\n\n/** One integration call's slots, as `runCaptured` captures them. */\nexport interface CapturedBatch<T> {\n\tvalue?: BatchSlot<T | undefined>[];\n\twarning?: ProviderWarning;\n}\n\n/**\n * One target's answer: read in full (`value`, or proven absent without one), or `unchanged`, when the cheap check\n * proved the caller's copy current. Every row with a `value` carries its `etag`, as does every `unchanged` one.\n */\nexport interface EtaggedBatchRow<T> {\n\tkey: string;\n\tvalue?: T;\n\tetag?: string;\n\tunchanged?: true;\n}\n\n/** Failures a full read would only hit again: a refused credential, a spent rate limit, a connection that's gone. */\nconst noRetryKinds: readonly ProviderWarningKind[] = ['auth', 'rate-limit', 'no-connection'];\n\nexport async function readEtaggedBatch<Target extends { key: string; etag?: string }, Item, Fields>(options: {\n\tproviderId: IntegrationIds;\n\tdomain: string | undefined;\n\tconnectionId: string | undefined;\n\ttargets: readonly Target[];\n\t/** Whether the integration has a cheap check. Decided up front, so a host without one makes one call. */\n\tsupportsEtags: boolean;\n\treadFull: (targets: readonly Target[]) => Promise<CapturedBatch<Item>>;\n\treadEtagFields: (targets: readonly Target[]) => Promise<CapturedBatch<Fields>>;\n\titemEtag: (item: Item) => string;\n\tfieldsEtag: (fields: Fields) => string;\n\t/** The warning for a full read that answered neither slots nor an error: the provider can't batch at all. */\n\tunsupportedWarning: () => ProviderWarning;\n}): Promise<ProviderResult<EtaggedBatchRow<Item>>> {\n\tconst { providerId, domain, connectionId, targets } = options;\n\tconst warnings: ProviderWarning[] = [];\n\tconst rows = new Map<number, EtaggedBatchRow<Item>>();\n\tlet fetchFailed = false;\n\n\tconst keysOf = (indices: readonly number[]): string[] => indices.map(i => targets[i].key);\n\n\tconst settleFull = (indices: readonly number[], { value: slots, warning }: CapturedBatch<Item>): void => {\n\t\tif (warning != null) {\n\t\t\tappendDedupedWarning(warnings, { ...warning, targetKeys: keysOf(indices) });\n\t\t}\n\n\t\tif (slots == null) {\n\t\t\t// Dropped, never reported absent: \"unknown\" and \"proven absent\" must stay distinguishable.\n\t\t\tif (warning == null) {\n\t\t\t\tappendDedupedWarning(warnings, { ...options.unsupportedWarning(), targetKeys: keysOf(indices) });\n\t\t\t}\n\t\t\tfetchFailed = true;\n\t\t\treturn;\n\t\t}\n\n\t\tfor (let i = 0; i < indices.length; i++) {\n\t\t\tconst slot = slots[i];\n\t\t\tif (slot.status === 'rejected') {\n\t\t\t\t// Dropped, never reported absent, like a whole-call failure: only THIS target failed.\n\t\t\t\tappendBatchSlotWarning(warnings, providerId, domain, connectionId, slot, targets[indices[i]].key);\n\t\t\t\tfetchFailed = true;\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst item = slot.value;\n\t\t\tconst key = targets[indices[i]].key;\n\t\t\trows.set(indices[i], item != null ? { key: key, value: item, etag: options.itemEtag(item) } : { key: key });\n\t\t}\n\t};\n\n\tconst cheap: number[] = [];\n\tconst full: number[] = [];\n\tfor (let i = 0; i < targets.length; i++) {\n\t\t(options.supportsEtags && targets[i].etag ? cheap : full).push(i);\n\t}\n\n\tconst select = (indices: readonly number[]): Target[] => indices.map(i => targets[i]);\n\n\tif (!cheap.length) {\n\t\tsettleFull(full, await options.readFull(targets));\n\t} else {\n\t\t// Started before the cheap check is even sent, so the targets it can't answer never wait on it.\n\t\tconst fullRead = full.length ? options.readFull(select(full)) : undefined;\n\n\t\tconst changed: number[] = [];\n\t\tconst { value: slots, warning } = await options.readEtagFields(select(cheap));\n\t\tif (warning != null && noRetryKinds.includes(warning.kind)) {\n\t\t\tappendDedupedWarning(warnings, { ...warning, targetKeys: keysOf(cheap) });\n\t\t\tfetchFailed = true;\n\t\t} else if (slots == null) {\n\t\t\t// The check failed some other way, or the provider declined it; the full read decides instead.\n\t\t\tchanged.push(...cheap);\n\t\t} else {\n\t\t\tfor (let i = 0; i < cheap.length; i++) {\n\t\t\t\tconst index = cheap[i];\n\t\t\t\tconst slot = slots[i];\n\t\t\t\tif (slot.status === 'rejected') {\n\t\t\t\t\t// A scoped refusal (`failure`) is the credential refused for that target's scope, which a full read\n\t\t\t\t\t// would hit as well.\n\t\t\t\t\tif (slot.failure != null) {\n\t\t\t\t\t\tappendBatchSlotWarning(warnings, providerId, domain, connectionId, slot, targets[index].key);\n\t\t\t\t\t\tfetchFailed = true;\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\n\t\t\t\t\tconst slotWarning = toProviderWarning(providerId, domain, connectionId, slot.reason);\n\t\t\t\t\tif (noRetryKinds.includes(slotWarning.kind)) {\n\t\t\t\t\t\tappendDedupedWarning(warnings, { ...slotWarning, targetKeys: [targets[index].key] });\n\t\t\t\t\t\tfetchFailed = true;\n\t\t\t\t\t} else {\n\t\t\t\t\t\tchanged.push(index);\n\t\t\t\t\t}\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst key = targets[index].key;\n\t\t\t\tconst fields = slot.value;\n\t\t\t\tif (fields == null) {\n\t\t\t\t\trows.set(index, { key: key });\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tconst etag = options.fieldsEtag(fields);\n\t\t\t\tif (etag === targets[index].etag) {\n\t\t\t\t\trows.set(index, { key: key, unchanged: true, etag: etag });\n\t\t\t\t} else {\n\t\t\t\t\tchanged.push(index);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst changedRead = changed.length ? options.readFull(select(changed)) : undefined;\n\t\tif (fullRead != null) {\n\t\t\tsettleFull(full, await fullRead);\n\t\t}\n\t\tif (changedRead != null) {\n\t\t\tsettleFull(changed, await changedRead);\n\t\t}\n\t}\n\n\tconst items: EtaggedBatchRow<Item>[] = [];\n\tfor (let i = 0; i < targets.length; i++) {\n\t\tconst row = rows.get(i);\n\t\tif (row != null) {\n\t\t\titems.push(row);\n\t\t}\n\t}\n\treturn { items: items, warnings: warnings, fetchFailed: fetchFailed || undefined };\n}\n\n/**\n * Appends the warning for a batch target that could not be checked, shared by every batch read: for a refusal, the\n * scope failure it was recorded as (see `IntegrationBase.settleBatchRefusals`), published as an account-wide read\n * publishes one, scoped and with its cause; otherwise, the reason itself. The warning names the target's key.\n */\nexport function appendBatchSlotWarning(\n\twarnings: ProviderWarning[],\n\tproviderId: IntegrationIds,\n\tdomain: string | undefined,\n\tconnectionId: string | undefined,\n\tslot: Extract<BatchSlot<unknown>, { status: 'rejected' }>,\n\ttargetKey: string,\n): void {\n\tif (slot.failure != null) {\n\t\tconst produced: ProviderWarning[] = [];\n\t\tmergeAssessmentInto(produced, providerId, domain, connectionId, {\n\t\t\tcompleteness: 'partial',\n\t\t\tfailures: [slot.failure],\n\t\t});\n\t\tfor (const warning of produced) {\n\t\t\tappendDedupedWarning(warnings, { ...warning, targetKeys: [targetKey] });\n\t\t}\n\t\treturn;\n\t}\n\n\tappendDedupedWarning(warnings, {\n\t\t...toProviderWarning(providerId, domain, connectionId, slot.reason),\n\t\ttargetKeys: [targetKey],\n\t});\n}\n"],"mappings":";;;;AAmDA,MAAM,eAA+C;CAAC;CAAQ;CAAc;AAAe;AAE3F,eAAsB,iBAA8E,SAajD;CAClD,MAAM,EAAE,YAAY,QAAQ,cAAc,YAAY;CACtD,MAAM,WAA8B,CAAC;CACrC,MAAM,uBAAO,IAAI,IAAmC;CACpD,IAAI,cAAc;CAElB,MAAM,UAAU,YAAyC,QAAQ,KAAI,MAAK,QAAQ,EAAE,CAAC,GAAG;CAExF,MAAM,cAAc,SAA4B,EAAE,OAAO,OAAO,cAAyC;EACxG,IAAI,WAAW,MACd,qBAAqB,UAAU;GAAE,GAAG;GAAS,YAAY,OAAO,OAAO;EAAE,CAAC;EAG3E,IAAI,SAAS,MAAM;GAElB,IAAI,WAAW,MACd,qBAAqB,UAAU;IAAE,GAAG,QAAQ,mBAAmB;IAAG,YAAY,OAAO,OAAO;GAAE,CAAC;GAEhG,cAAc;GACd;EACD;EAEA,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;GACxC,MAAM,OAAO,MAAM;GACnB,IAAI,KAAK,WAAW,YAAY;IAE/B,uBAAuB,UAAU,YAAY,QAAQ,cAAc,MAAM,QAAQ,QAAQ,GAAG,CAAC,GAAG;IAChG,cAAc;IACd;GACD;GAEA,MAAM,OAAO,KAAK;GAClB,MAAM,MAAM,QAAQ,QAAQ,GAAG,CAAC;GAChC,KAAK,IAAI,QAAQ,IAAI,QAAQ,OAAO;IAAO;IAAK,OAAO;IAAM,MAAM,QAAQ,SAAS,IAAI;GAAE,IAAI,EAAO,IAAI,CAAC;EAC3G;CACD;CAEA,MAAM,QAAkB,CAAC;CACzB,MAAM,OAAiB,CAAC;CACxB,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KACnC,CAAC,QAAQ,iBAAiB,QAAQ,EAAE,CAAC,OAAO,QAAQ,KAAA,CAAM,KAAK,CAAC;CAGjE,MAAM,UAAU,YAAyC,QAAQ,KAAI,MAAK,QAAQ,EAAE;CAEpF,IAAI,CAAC,MAAM,QACV,WAAW,MAAM,MAAM,QAAQ,SAAS,OAAO,CAAC;MAC1C;EAEN,MAAM,WAAW,KAAK,SAAS,QAAQ,SAAS,OAAO,IAAI,CAAC,IAAI,KAAA;EAEhE,MAAM,UAAoB,CAAC;EAC3B,MAAM,EAAE,OAAO,OAAO,YAAY,MAAM,QAAQ,eAAe,OAAO,KAAK,CAAC;EAC5E,IAAI,WAAW,QAAQ,aAAa,SAAS,QAAQ,IAAI,GAAG;GAC3D,qBAAqB,UAAU;IAAE,GAAG;IAAS,YAAY,OAAO,KAAK;GAAE,CAAC;GACxE,cAAc;EACf,OAAO,IAAI,SAAS,MAEnB,QAAQ,KAAK,GAAG,KAAK;OAErB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;GACtC,MAAM,QAAQ,MAAM;GACpB,MAAM,OAAO,MAAM;GACnB,IAAI,KAAK,WAAW,YAAY;IAG/B,IAAI,KAAK,WAAW,MAAM;KACzB,uBAAuB,UAAU,YAAY,QAAQ,cAAc,MAAM,QAAQ,MAAM,CAAC,GAAG;KAC3F,cAAc;KACd;IACD;IAEA,MAAM,cAAc,kBAAkB,YAAY,QAAQ,cAAc,KAAK,MAAM;IACnF,IAAI,aAAa,SAAS,YAAY,IAAI,GAAG;KAC5C,qBAAqB,UAAU;MAAE,GAAG;MAAa,YAAY,CAAC,QAAQ,MAAM,CAAC,GAAG;KAAE,CAAC;KACnF,cAAc;IACf,OACC,QAAQ,KAAK,KAAK;IAEnB;GACD;GAEA,MAAM,MAAM,QAAQ,MAAM,CAAC;GAC3B,MAAM,SAAS,KAAK;GACpB,IAAI,UAAU,MAAM;IACnB,KAAK,IAAI,OAAO,EAAO,IAAI,CAAC;IAC5B;GACD;GAEA,MAAM,OAAO,QAAQ,WAAW,MAAM;GACtC,IAAI,SAAS,QAAQ,MAAM,CAAC,MAC3B,KAAK,IAAI,OAAO;IAAO;IAAK,WAAW;IAAY;GAAK,CAAC;QAEzD,QAAQ,KAAK,KAAK;EAEpB;EAGD,MAAM,cAAc,QAAQ,SAAS,QAAQ,SAAS,OAAO,OAAO,CAAC,IAAI,KAAA;EACzE,IAAI,YAAY,MACf,WAAW,MAAM,MAAM,QAAQ;EAEhC,IAAI,eAAe,MAClB,WAAW,SAAS,MAAM,WAAW;CAEvC;CAEA,MAAM,QAAiC,CAAC;CACxC,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;EACxC,MAAM,MAAM,KAAK,IAAI,CAAC;EACtB,IAAI,OAAO,MACV,MAAM,KAAK,GAAG;CAEhB;CACA,OAAO;EAAS;EAAiB;EAAU,aAAa,eAAe,KAAA;CAAU;AAClF;;;;;;AAOA,SAAgB,uBACf,UACA,YACA,QACA,cACA,MACA,WACO;CACP,IAAI,KAAK,WAAW,MAAM;EACzB,MAAM,WAA8B,CAAC;EACrC,oBAAoB,UAAU,YAAY,QAAQ,cAAc;GAC/D,cAAc;GACd,UAAU,CAAC,KAAK,OAAO;EACxB,CAAC;EACD,KAAK,MAAM,WAAW,UACrB,qBAAqB,UAAU;GAAE,GAAG;GAAS,YAAY,CAAC,SAAS;EAAE,CAAC;EAEvE;CACD;CAEA,qBAAqB,UAAU;EAC9B,GAAG,kBAAkB,YAAY,QAAQ,cAAc,KAAK,MAAM;EAClE,YAAY,CAAC,SAAS;CACvB,CAAC;AACF"}

package/dist/plus/integrations/reads/pullRequestBranches.js

@@ -57,9 +57,16 @@ async function getPullRequestsForBranches(ctx, options) {
 		currentAccount,
 		limit: pullRequestsForBranchLimit
 	}, void 0, options.connectionId), { warnOnMissingSession: true });
-	if (warning != null) appendDedupedWarning(warnings, warning);
+	const allKeys = targets.map((t) => t.key);
+	if (warning != null) appendDedupedWarning(warnings, {
+		...warning,
+		targetKeys: allKeys
+	});
 	if (slots == null) {
-		if (warning == null) appendDedupedWarning(warnings, unsupportedWarning(options.providerId, domain, options.connectionId, `${surface} is not supported by '${options.providerId}'.`));
+		if (warning == null) appendDedupedWarning(warnings, {
+			...unsupportedWarning(options.providerId, domain, options.connectionId, `${surface} is not supported by '${options.providerId}'.`),
+			targetKeys: allKeys
+		});
 		return {
 			items: [],
 			warnings,
@@ -70,7 +77,7 @@ async function getPullRequestsForBranches(ctx, options) {
 	for (let i = 0; i < targets.length; i++) {
 		const slot = slots[i];
 		if (slot.status === "rejected") {
-			appendBatchSlotWarning(warnings, options.providerId, domain, options.connectionId, slot);
+			appendBatchSlotWarning(warnings, options.providerId, domain, options.connectionId, slot, targets[i].key);
 			fetchFailed = true;
 			continue;
 		}

package/dist/plus/integrations/reads/pullRequestBranches.js.map

@@ -1 +1 @@
-{"version":3,"file":"pullRequestBranches.js","names":[],"sources":["../../../../../plus/integrations/src/reads/pullRequestBranches.ts"],"sourcesContent":["import type { PullRequestShape } from '@gitlens/git/models/pullRequest.js';\nimport { equalsIgnoreCase } from '@gitlens/utils/string.js';\nimport type { IntegrationIds } from '../constants.js';\nimport { GitSelfManagedHostIntegrationId } from '../constants.js';\nimport { isAzureProviderId } from '../providers/providerErrors.js';\nimport type { ProviderResult, ProviderWarning } from '../results.js';\nimport { appendDedupedWarning } from '../results.js';\nimport { isGitHostIntegration, isIssuesHostIntegrationId } from '../utils/integration.utils.js';\nimport { appendBatchSlotWarning } from './batchEtags.js';\nimport type { ProviderReadContext } from './context.js';\nimport { getCurrentAccountIdentity, runCaptured } from './drains.js';\nimport { findDuplicateKey, trimCoordinateFields, unresolvedIntegration } from './issueBatch.js';\nimport { gitHostOnlySurfaceWarning, otherWarning, unsupportedWarning } from './warnings.js';\n\n/**\n * The pull-requests-by-branch read: for each branch, every pull request whose head is that branch, in any state.\n * A relationship-free point read — unlike the account-wide sweeps, it finds a teammate's pull request from the\n * user's branch — so an empty list is a PROVEN \"none\" a caller can cache.\n *\n * ONE integration call per invocation, whatever the target count, settling each target independently — see\n * `GitHostIntegration.getPullRequestsForBranchesResult`. Uncached, and not routed through the integration's\n * `getPullRequestForBranch`, which caches through `IntegrationCacheProvider.getPullRequestForBranch`, answers one\n * pull request, and on several hosts looks the branch ref up, answering \"none\" once a merged branch is deleted.\n */\n\n/** Pull requests returned per target. */\nconst pullRequestsForBranchLimit = 10;\n\n/** One branch whose pull requests to find, echoed back under the caller's own `key`. */\nexport interface PullRequestBranchTarget {\n\t/** Caller-owned identifier, echoed on the result so no positional matching is needed. Must be unique. */\n\tkey: string;\n\t/**\n\t * The repository the pull requests are OPENED AGAINST (their base), as in `PullRequestBatchTarget`: GitHub\n\t * owner, GitLab namespace path (may be nested), Bitbucket workspace, Bitbucket Data Center project key, or Azure\n\t * DevOps organization.\n\t */\n\towner: string;\n\t/** Repository name or slug. */\n\trepo: string;\n\t/** Azure DevOps project. Required there, ignored elsewhere. */\n\tproject?: string;\n\t/** The head branch's short name, without `refs/heads/`. */\n\tbranch: string;\n\t/**\n\t * Owner (GitHub user or org, GitLab namespace, Bitbucket workspace) of the repository the branch lives in, when\n\t * it's a fork. Omitted, or equal to `owner` (ignoring case), means the branch lives in the base repository itself,\n\t * so a caller can pass the owner of whichever remote the branch was pushed to.\n\t *\n\t * A different owner is refused on Bitbucket Data Center and Azure DevOps, where a fork can't be found by its\n\t * owner.\n\t */\n\theadOwner?: string;\n}\n\n/** The answer for one {@link PullRequestBranchTarget}. */\nexport interface PullRequestBranchResult {\n\tkey: string;\n\t/**\n\t * Every pull request whose head is this branch, in ANY state — open, closed and merged — most recently updated\n\t * first, up to a per-target cap. An empty array is a PROVEN \"none\" unless `truncated` is set. A target whose\n\t * read failed is not returned at all.\n\t */\n\tpullRequests: PullRequestShape[];\n\t/**\n\t * Set when a pull request that wasn't returned could still match: more matched than the cap, or the host held\n\t * more pull requests of this branch name than it returned and couldn't rule them out. GitHub/GHE rule them out\n\t * with a second request filtered by head owner, so there it means more than the cap truly match. That request\n\t * can't see a pull request from a since-deleted fork, so on GitHub/GHE such a pull request outside the first\n\t * request's page can be missing even when this is not set.\n\t */\n\ttruncated?: boolean;\n}\n\nexport async function getPullRequestsForBranches(\n\tctx: ProviderReadContext,\n\toptions: {\n\t\tproviderId: IntegrationIds;\n\t\ttargets: readonly PullRequestBranchTarget[];\n\t\tconnectionId?: string;\n\t\t/**\n\t\t * Explicit self-managed host domain. Used only when the requested connection has no configured domain;\n\t\t * it must come from the trusted authentication configuration, not repository or remote data.\n\t\t */\n\t\tdomain?: string;\n\t},\n): Promise<ProviderResult<PullRequestBranchResult>> {\n\tconst refused = (warning: ProviderWarning): ProviderResult<PullRequestBranchResult> => ({\n\t\titems: [],\n\t\twarnings: [warning],\n\t\tfetchFailed: true,\n\t});\n\tconst surface = 'Pull requests by branch';\n\n\tif (isIssuesHostIntegrationId(options.providerId)) {\n\t\treturn refused(gitHostOnlySurfaceWarning(options.providerId, undefined, options.connectionId, surface));\n\t}\n\n\tif (options.targets.length === 0) return { items: [], warnings: [] };\n\n\tconst duplicateKey = findDuplicateKey(options.targets);\n\tif (duplicateKey != null) {\n\t\t// Refuses the whole call rather than deduping: two results under one key make matching ambiguous for EVERY\n\t\t// target, not just the repeated one.\n\t\treturn refused(\n\t\t\totherWarning(\n\t\t\t\toptions.providerId,\n\t\t\t\tundefined,\n\t\t\t\toptions.connectionId,\n\t\t\t\t`Duplicate pull request branch target key '${duplicateKey}'; keys identify results, so each must be unique.`,\n\t\t\t),\n\t\t);\n\t}\n\n\t// The validated value must be the one sent to the provider, so every string field is trimmed once here.\n\t// `branch` is left alone: a git ref name can't carry surrounding whitespace, so a padded one is refused below\n\t// rather than being silently repaired.\n\tconst targets = options.targets.map(target => ({\n\t\t...trimCoordinateFields(target),\n\t\theadOwner: target.headOwner?.trim(),\n\t}));\n\n\t// Deterministic caller bugs, refused like a duplicate key rather than sent upstream to fail one by one.\n\tconst invalid = findInvalidTarget(options.providerId, targets);\n\tif (invalid != null) {\n\t\treturn refused(otherWarning(options.providerId, undefined, options.connectionId, invalid));\n\t}\n\n\tconst integration = await ctx.getIntegrationForRead(options.providerId, options.connectionId, options.domain);\n\tif (integration == null) {\n\t\treturn unresolvedIntegration(ctx, options.providerId, options.connectionId, options.domain);\n\t}\n\tif (!isGitHostIntegration(integration)) {\n\t\treturn refused(gitHostOnlySurfaceWarning(options.providerId, undefined, options.connectionId, surface));\n\t}\n\n\tconst domain = ctx.domainForRead(integration, options.providerId, options.connectionId, options.domain);\n\tconst currentAccount = await getCurrentAccountIdentity(integration, options.connectionId);\n\n\tconst warnings: ProviderWarning[] = [];\n\tlet fetchFailed = false;\n\n\tconst { value: slots, warning } = await runCaptured(\n\t\toptions.providerId,\n\t\tdomain,\n\t\toptions.connectionId,\n\t\t() =>\n\t\t\tintegration.getPullRequestsForBranchesResult(\n\t\t\t\ttargets.map(t => ({\n\t\t\t\t\towner: t.owner,\n\t\t\t\t\trepo: t.repo,\n\t\t\t\t\tproject: t.project,\n\t\t\t\t\tbranch: t.branch,\n\t\t\t\t\theadOwner: forkOwner(t),\n\t\t\t\t})),\n\t\t\t\t{ currentAccount: currentAccount, limit: pullRequestsForBranchLimit },\n\t\t\t\tundefined,\n\t\t\t\toptions.connectionId,\n\t\t\t),\n\t\t// A missing session must surface as a connection warning, including on the primary path, which\n\t\t// otherwise reads it as \"not connected\" and says nothing.\n\t\t{ warnOnMissingSession: true },\n\t);\n\tif (warning != null) {\n\t\tappendDedupedWarning(warnings, warning);\n\t}\n\n\tif (slots == null) {\n\t\t// Dropped, never reported as \"none\": \"unknown\" and \"proven none\" must stay distinguishable.\n\t\tif (warning == null) {\n\t\t\tappendDedupedWarning(\n\t\t\t\twarnings,\n\t\t\t\tunsupportedWarning(\n\t\t\t\t\toptions.providerId,\n\t\t\t\t\tdomain,\n\t\t\t\t\toptions.connectionId,\n\t\t\t\t\t`${surface} is not supported by '${options.providerId}'.`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\treturn { items: [], warnings: warnings, fetchFailed: true };\n\t}\n\n\tconst items: PullRequestBranchResult[] = [];\n\tfor (let i = 0; i < targets.length; i++) {\n\t\tconst slot = slots[i];\n\t\tif (slot.status === 'rejected') {\n\t\t\t// Dropped, never reported as \"none\", like a whole-call failure.\n\t\t\tappendBatchSlotWarning(warnings, options.providerId, domain, options.connectionId, slot);\n\t\t\tfetchFailed = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\titems.push({\n\t\t\tkey: targets[i].key,\n\t\t\tpullRequests: slot.value.pullRequests,\n\t\t\t...(slot.value.truncated ? { truncated: true } : {}),\n\t\t});\n\t}\n\n\treturn { items: items, warnings: warnings, fetchFailed: fetchFailed || undefined };\n}\n\n/** The owner of the fork the branch lives in, or `undefined` for a branch in the base repository. */\nfunction forkOwner(target: PullRequestBranchTarget): string | undefined {\n\treturn target.headOwner == null || equalsIgnoreCase(target.headOwner, target.owner) ? undefined : target.headOwner;\n}\n\nfunction findInvalidTarget(\n\tproviderId: IntegrationIds,\n\ttargets: readonly PullRequestBranchTarget[],\n): string | undefined {\n\tconst isAzure = isAzureProviderId(providerId);\n\tconst isBitbucketServer = providerId === GitSelfManagedHostIntegrationId.BitbucketServer;\n\tfor (const target of targets) {\n\t\tif (target.owner.length === 0 || target.repo.length === 0) {\n\t\t\treturn `Pull request branch target '${target.key}' requires a non-empty owner and repo.`;\n\t\t}\n\t\tif (target.branch.trim().length === 0) {\n\t\t\treturn `Pull request branch target '${target.key}' requires a non-empty branch.`;\n\t\t}\n\t\t// Sent as is, a padded name matches no branch and answers a cacheable \"none\".\n\t\tif (target.branch !== target.branch.trim()) {\n\t\t\treturn `Pull request branch target '${target.key}' has branch '${target.branch}'; a branch name can't start or end with whitespace.`;\n\t\t}\n\t\tif (target.branch.startsWith('refs/')) {\n\t\t\treturn `Pull request branch target '${target.key}' has branch '${target.branch}'; pass the branch's short name, without 'refs/heads/'.`;\n\t\t}\n\t\tif (isAzure && !target.project) {\n\t\t\treturn `Pull request branch target '${target.key}' requires a project for '${providerId}'.`;\n\t\t}\n\t\tif (target.headOwner?.length === 0) {\n\t\t\treturn `Pull request branch target '${target.key}' has an empty headOwner; omit it for a branch in the base repository.`;\n\t\t}\n\t\tif (forkOwner(target) != null) {\n\t\t\tif (isAzure) {\n\t\t\t\treturn `Pull request branch target '${target.key}' has a headOwner other than its owner, which '${providerId}' can't honor: an Azure DevOps fork shares its organization, so its owner can't identify it.`;\n\t\t\t}\n\t\t\tif (isBitbucketServer) {\n\t\t\t\treturn `Pull request branch target '${target.key}' has a headOwner other than its owner, which '${providerId}' can't honor: Bitbucket Data Center finds a branch's pull requests only through the repository the branch lives in, and a fork's repository can't be derived from its owner.`;\n\t\t\t}\n\t\t}\n\t}\n\treturn undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0BA,MAAM,6BAA6B;AAgDnC,eAAsB,2BACrB,KACA,SAUmD;CACnD,MAAM,WAAW,aAAuE;EACvF,OAAO,CAAC;EACR,UAAU,CAAC,OAAO;EAClB,aAAa;CACd;CACA,MAAM,UAAU;CAEhB,IAAI,0BAA0B,QAAQ,UAAU,GAC/C,OAAO,QAAQ,0BAA0B,QAAQ,YAAY,KAAA,GAAW,QAAQ,cAAc,OAAO,CAAC;CAGvG,IAAI,QAAQ,QAAQ,WAAW,GAAG,OAAO;EAAE,OAAO,CAAC;EAAG,UAAU,CAAC;CAAE;CAEnE,MAAM,eAAe,iBAAiB,QAAQ,OAAO;CACrD,IAAI,gBAAgB,MAGnB,OAAO,QACN,aACC,QAAQ,YACR,KAAA,GACA,QAAQ,cACR,6CAA6C,aAAa,kDAC3D,CACD;CAMD,MAAM,UAAU,QAAQ,QAAQ,KAAI,YAAW;EAC9C,GAAG,qBAAqB,MAAM;EAC9B,WAAW,OAAO,WAAW,KAAK;CACnC,EAAE;CAGF,MAAM,UAAU,kBAAkB,QAAQ,YAAY,OAAO;CAC7D,IAAI,WAAW,MACd,OAAO,QAAQ,aAAa,QAAQ,YAAY,KAAA,GAAW,QAAQ,cAAc,OAAO,CAAC;CAG1F,MAAM,cAAc,MAAM,IAAI,sBAAsB,QAAQ,YAAY,QAAQ,cAAc,QAAQ,MAAM;CAC5G,IAAI,eAAe,MAClB,OAAO,sBAAsB,KAAK,QAAQ,YAAY,QAAQ,cAAc,QAAQ,MAAM;CAE3F,IAAI,CAAC,qBAAqB,WAAW,GACpC,OAAO,QAAQ,0BAA0B,QAAQ,YAAY,KAAA,GAAW,QAAQ,cAAc,OAAO,CAAC;CAGvG,MAAM,SAAS,IAAI,cAAc,aAAa,QAAQ,YAAY,QAAQ,cAAc,QAAQ,MAAM;CACtG,MAAM,iBAAiB,MAAM,0BAA0B,aAAa,QAAQ,YAAY;CAExF,MAAM,WAA8B,CAAC;CACrC,IAAI,cAAc;CAElB,MAAM,EAAE,OAAO,OAAO,YAAY,MAAM,YACvC,QAAQ,YACR,QACA,QAAQ,oBAEP,YAAY,iCACX,QAAQ,KAAI,OAAM;EACjB,OAAO,EAAE;EACT,MAAM,EAAE;EACR,SAAS,EAAE;EACX,QAAQ,EAAE;EACV,WAAW,UAAU,CAAC;CACvB,EAAE,GACF;EAAkB;EAAgB,OAAO;CAA2B,GACpE,KAAA,GACA,QAAQ,YACT,GAGD,EAAE,sBAAsB,KAAK,CAC9B;CACA,IAAI,WAAW,MACd,qBAAqB,UAAU,OAAO;CAGvC,IAAI,SAAS,MAAM;EAElB,IAAI,WAAW,MACd,qBACC,UACA,mBACC,QAAQ,YACR,QACA,QAAQ,cACR,GAAG,QAAQ,wBAAwB,QAAQ,WAAW,GACvD,CACD;EAED,OAAO;GAAE,OAAO,CAAC;GAAa;GAAU,aAAa;EAAK;CAC3D;CAEA,MAAM,QAAmC,CAAC;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;EACxC,MAAM,OAAO,MAAM;EACnB,IAAI,KAAK,WAAW,YAAY;GAE/B,uBAAuB,UAAU,QAAQ,YAAY,QAAQ,QAAQ,cAAc,IAAI;GACvF,cAAc;GACd;EACD;EAEA,MAAM,KAAK;GACV,KAAK,QAAQ,EAAE,CAAC;GAChB,cAAc,KAAK,MAAM;GACzB,GAAI,KAAK,MAAM,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;EACnD,CAAC;CACF;CAEA,OAAO;EAAS;EAAiB;EAAU,aAAa,eAAe,KAAA;CAAU;AAClF;;AAGA,SAAS,UAAU,QAAqD;CACvE,OAAO,OAAO,aAAa,QAAQ,iBAAiB,OAAO,WAAW,OAAO,KAAK,IAAI,KAAA,IAAY,OAAO;AAC1G;AAEA,SAAS,kBACR,YACA,SACqB;CACrB,MAAM,UAAU,kBAAkB,UAAU;CAC5C,MAAM,oBAAoB,eAAA;CAC1B,KAAK,MAAM,UAAU,SAAS;EAC7B,IAAI,OAAO,MAAM,WAAW,KAAK,OAAO,KAAK,WAAW,GACvD,OAAO,+BAA+B,OAAO,IAAI;EAElD,IAAI,OAAO,OAAO,KAAK,CAAC,CAAC,WAAW,GACnC,OAAO,+BAA+B,OAAO,IAAI;EAGlD,IAAI,OAAO,WAAW,OAAO,OAAO,KAAK,GACxC,OAAO,+BAA+B,OAAO,IAAI,gBAAgB,OAAO,OAAO;EAEhF,IAAI,OAAO,OAAO,WAAW,OAAO,GACnC,OAAO,+BAA+B,OAAO,IAAI,gBAAgB,OAAO,OAAO;EAEhF,IAAI,WAAW,CAAC,OAAO,SACtB,OAAO,+BAA+B,OAAO,IAAI,4BAA4B,WAAW;EAEzF,IAAI,OAAO,WAAW,WAAW,GAChC,OAAO,+BAA+B,OAAO,IAAI;EAElD,IAAI,UAAU,MAAM,KAAK,MAAM;GAC9B,IAAI,SACH,OAAO,+BAA+B,OAAO,IAAI,iDAAiD,WAAW;GAE9G,IAAI,mBACH,OAAO,+BAA+B,OAAO,IAAI,iDAAiD,WAAW;EAE/G;CACD;AAED"}
+{"version":3,"file":"pullRequestBranches.js","names":[],"sources":["../../../../../plus/integrations/src/reads/pullRequestBranches.ts"],"sourcesContent":["import type { PullRequestShape } from '@gitlens/git/models/pullRequest.js';\nimport { equalsIgnoreCase } from '@gitlens/utils/string.js';\nimport type { IntegrationIds } from '../constants.js';\nimport { GitSelfManagedHostIntegrationId } from '../constants.js';\nimport { isAzureProviderId } from '../providers/providerErrors.js';\nimport type { ProviderResult, ProviderWarning } from '../results.js';\nimport { appendDedupedWarning } from '../results.js';\nimport { isGitHostIntegration, isIssuesHostIntegrationId } from '../utils/integration.utils.js';\nimport { appendBatchSlotWarning } from './batchEtags.js';\nimport type { ProviderReadContext } from './context.js';\nimport { getCurrentAccountIdentity, runCaptured } from './drains.js';\nimport { findDuplicateKey, trimCoordinateFields, unresolvedIntegration } from './issueBatch.js';\nimport { gitHostOnlySurfaceWarning, otherWarning, unsupportedWarning } from './warnings.js';\n\n/**\n * The pull-requests-by-branch read: for each branch, every pull request whose head is that branch, in any state.\n * A relationship-free point read — unlike the account-wide sweeps, it finds a teammate's pull request from the\n * user's branch — so an empty list is a PROVEN \"none\" a caller can cache.\n *\n * ONE integration call per invocation, whatever the target count, settling each target independently — see\n * `GitHostIntegration.getPullRequestsForBranchesResult`. Uncached, and not routed through the integration's\n * `getPullRequestForBranch`, which caches through `IntegrationCacheProvider.getPullRequestForBranch`, answers one\n * pull request, and on several hosts looks the branch ref up, answering \"none\" once a merged branch is deleted.\n */\n\n/** Pull requests returned per target. */\nconst pullRequestsForBranchLimit = 10;\n\n/** One branch whose pull requests to find, echoed back under the caller's own `key`. */\nexport interface PullRequestBranchTarget {\n\t/** Caller-owned identifier, echoed on the result so no positional matching is needed. Must be unique. */\n\tkey: string;\n\t/**\n\t * The repository the pull requests are OPENED AGAINST (their base), as in `PullRequestBatchTarget`: GitHub\n\t * owner, GitLab namespace path (may be nested), Bitbucket workspace, Bitbucket Data Center project key, or Azure\n\t * DevOps organization.\n\t */\n\towner: string;\n\t/** Repository name or slug. */\n\trepo: string;\n\t/** Azure DevOps project. Required there, ignored elsewhere. */\n\tproject?: string;\n\t/** The head branch's short name, without `refs/heads/`. */\n\tbranch: string;\n\t/**\n\t * Owner (GitHub user or org, GitLab namespace, Bitbucket workspace) of the repository the branch lives in, when\n\t * it's a fork. Omitted, or equal to `owner` (ignoring case), means the branch lives in the base repository itself,\n\t * so a caller can pass the owner of whichever remote the branch was pushed to.\n\t *\n\t * A different owner is refused on Bitbucket Data Center and Azure DevOps, where a fork can't be found by its\n\t * owner.\n\t */\n\theadOwner?: string;\n}\n\n/** The answer for one {@link PullRequestBranchTarget}. */\nexport interface PullRequestBranchResult {\n\tkey: string;\n\t/**\n\t * Every pull request whose head is this branch, in ANY state — open, closed and merged — most recently updated\n\t * first, up to a per-target cap. An empty array is a PROVEN \"none\" unless `truncated` is set. A target whose\n\t * read failed is not returned at all.\n\t */\n\tpullRequests: PullRequestShape[];\n\t/**\n\t * Set when a pull request that wasn't returned could still match: more matched than the cap, or the host held\n\t * more pull requests of this branch name than it returned and couldn't rule them out. GitHub/GHE rule them out\n\t * with a second request filtered by head owner, so there it means more than the cap truly match. That request\n\t * can't see a pull request from a since-deleted fork, so on GitHub/GHE such a pull request outside the first\n\t * request's page can be missing even when this is not set.\n\t */\n\ttruncated?: boolean;\n}\n\nexport async function getPullRequestsForBranches(\n\tctx: ProviderReadContext,\n\toptions: {\n\t\tproviderId: IntegrationIds;\n\t\ttargets: readonly PullRequestBranchTarget[];\n\t\tconnectionId?: string;\n\t\t/**\n\t\t * Explicit self-managed host domain. Used only when the requested connection has no configured domain;\n\t\t * it must come from the trusted authentication configuration, not repository or remote data.\n\t\t */\n\t\tdomain?: string;\n\t},\n): Promise<ProviderResult<PullRequestBranchResult>> {\n\tconst refused = (warning: ProviderWarning): ProviderResult<PullRequestBranchResult> => ({\n\t\titems: [],\n\t\twarnings: [warning],\n\t\tfetchFailed: true,\n\t});\n\tconst surface = 'Pull requests by branch';\n\n\tif (isIssuesHostIntegrationId(options.providerId)) {\n\t\treturn refused(gitHostOnlySurfaceWarning(options.providerId, undefined, options.connectionId, surface));\n\t}\n\n\tif (options.targets.length === 0) return { items: [], warnings: [] };\n\n\tconst duplicateKey = findDuplicateKey(options.targets);\n\tif (duplicateKey != null) {\n\t\t// Refuses the whole call rather than deduping: two results under one key make matching ambiguous for EVERY\n\t\t// target, not just the repeated one.\n\t\treturn refused(\n\t\t\totherWarning(\n\t\t\t\toptions.providerId,\n\t\t\t\tundefined,\n\t\t\t\toptions.connectionId,\n\t\t\t\t`Duplicate pull request branch target key '${duplicateKey}'; keys identify results, so each must be unique.`,\n\t\t\t),\n\t\t);\n\t}\n\n\t// The validated value must be the one sent to the provider, so every string field is trimmed once here.\n\t// `branch` is left alone: a git ref name can't carry surrounding whitespace, so a padded one is refused below\n\t// rather than being silently repaired.\n\tconst targets = options.targets.map(target => ({\n\t\t...trimCoordinateFields(target),\n\t\theadOwner: target.headOwner?.trim(),\n\t}));\n\n\t// Deterministic caller bugs, refused like a duplicate key rather than sent upstream to fail one by one.\n\tconst invalid = findInvalidTarget(options.providerId, targets);\n\tif (invalid != null) {\n\t\treturn refused(otherWarning(options.providerId, undefined, options.connectionId, invalid));\n\t}\n\n\tconst integration = await ctx.getIntegrationForRead(options.providerId, options.connectionId, options.domain);\n\tif (integration == null) {\n\t\treturn unresolvedIntegration(ctx, options.providerId, options.connectionId, options.domain);\n\t}\n\tif (!isGitHostIntegration(integration)) {\n\t\treturn refused(gitHostOnlySurfaceWarning(options.providerId, undefined, options.connectionId, surface));\n\t}\n\n\tconst domain = ctx.domainForRead(integration, options.providerId, options.connectionId, options.domain);\n\tconst currentAccount = await getCurrentAccountIdentity(integration, options.connectionId);\n\n\tconst warnings: ProviderWarning[] = [];\n\tlet fetchFailed = false;\n\n\tconst { value: slots, warning } = await runCaptured(\n\t\toptions.providerId,\n\t\tdomain,\n\t\toptions.connectionId,\n\t\t() =>\n\t\t\tintegration.getPullRequestsForBranchesResult(\n\t\t\t\ttargets.map(t => ({\n\t\t\t\t\towner: t.owner,\n\t\t\t\t\trepo: t.repo,\n\t\t\t\t\tproject: t.project,\n\t\t\t\t\tbranch: t.branch,\n\t\t\t\t\theadOwner: forkOwner(t),\n\t\t\t\t})),\n\t\t\t\t{ currentAccount: currentAccount, limit: pullRequestsForBranchLimit },\n\t\t\t\tundefined,\n\t\t\t\toptions.connectionId,\n\t\t\t),\n\t\t// A missing session must surface as a connection warning, including on the primary path, which\n\t\t// otherwise reads it as \"not connected\" and says nothing.\n\t\t{ warnOnMissingSession: true },\n\t);\n\tconst allKeys = targets.map(t => t.key);\n\tif (warning != null) {\n\t\tappendDedupedWarning(warnings, { ...warning, targetKeys: allKeys });\n\t}\n\n\tif (slots == null) {\n\t\t// Dropped, never reported as \"none\": \"unknown\" and \"proven none\" must stay distinguishable.\n\t\tif (warning == null) {\n\t\t\tappendDedupedWarning(warnings, {\n\t\t\t\t...unsupportedWarning(\n\t\t\t\t\toptions.providerId,\n\t\t\t\t\tdomain,\n\t\t\t\t\toptions.connectionId,\n\t\t\t\t\t`${surface} is not supported by '${options.providerId}'.`,\n\t\t\t\t),\n\t\t\t\ttargetKeys: allKeys,\n\t\t\t});\n\t\t}\n\t\treturn { items: [], warnings: warnings, fetchFailed: true };\n\t}\n\n\tconst items: PullRequestBranchResult[] = [];\n\tfor (let i = 0; i < targets.length; i++) {\n\t\tconst slot = slots[i];\n\t\tif (slot.status === 'rejected') {\n\t\t\t// Dropped, never reported as \"none\", like a whole-call failure.\n\t\t\tappendBatchSlotWarning(warnings, options.providerId, domain, options.connectionId, slot, targets[i].key);\n\t\t\tfetchFailed = true;\n\t\t\tcontinue;\n\t\t}\n\n\t\titems.push({\n\t\t\tkey: targets[i].key,\n\t\t\tpullRequests: slot.value.pullRequests,\n\t\t\t...(slot.value.truncated ? { truncated: true } : {}),\n\t\t});\n\t}\n\n\treturn { items: items, warnings: warnings, fetchFailed: fetchFailed || undefined };\n}\n\n/** The owner of the fork the branch lives in, or `undefined` for a branch in the base repository. */\nfunction forkOwner(target: PullRequestBranchTarget): string | undefined {\n\treturn target.headOwner == null || equalsIgnoreCase(target.headOwner, target.owner) ? undefined : target.headOwner;\n}\n\nfunction findInvalidTarget(\n\tproviderId: IntegrationIds,\n\ttargets: readonly PullRequestBranchTarget[],\n): string | undefined {\n\tconst isAzure = isAzureProviderId(providerId);\n\tconst isBitbucketServer = providerId === GitSelfManagedHostIntegrationId.BitbucketServer;\n\tfor (const target of targets) {\n\t\tif (target.owner.length === 0 || target.repo.length === 0) {\n\t\t\treturn `Pull request branch target '${target.key}' requires a non-empty owner and repo.`;\n\t\t}\n\t\tif (target.branch.trim().length === 0) {\n\t\t\treturn `Pull request branch target '${target.key}' requires a non-empty branch.`;\n\t\t}\n\t\t// Sent as is, a padded name matches no branch and answers a cacheable \"none\".\n\t\tif (target.branch !== target.branch.trim()) {\n\t\t\treturn `Pull request branch target '${target.key}' has branch '${target.branch}'; a branch name can't start or end with whitespace.`;\n\t\t}\n\t\tif (target.branch.startsWith('refs/')) {\n\t\t\treturn `Pull request branch target '${target.key}' has branch '${target.branch}'; pass the branch's short name, without 'refs/heads/'.`;\n\t\t}\n\t\tif (isAzure && !target.project) {\n\t\t\treturn `Pull request branch target '${target.key}' requires a project for '${providerId}'.`;\n\t\t}\n\t\tif (target.headOwner?.length === 0) {\n\t\t\treturn `Pull request branch target '${target.key}' has an empty headOwner; omit it for a branch in the base repository.`;\n\t\t}\n\t\tif (forkOwner(target) != null) {\n\t\t\tif (isAzure) {\n\t\t\t\treturn `Pull request branch target '${target.key}' has a headOwner other than its owner, which '${providerId}' can't honor: an Azure DevOps fork shares its organization, so its owner can't identify it.`;\n\t\t\t}\n\t\t\tif (isBitbucketServer) {\n\t\t\t\treturn `Pull request branch target '${target.key}' has a headOwner other than its owner, which '${providerId}' can't honor: Bitbucket Data Center finds a branch's pull requests only through the repository the branch lives in, and a fork's repository can't be derived from its owner.`;\n\t\t\t}\n\t\t}\n\t}\n\treturn undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA0BA,MAAM,6BAA6B;AAgDnC,eAAsB,2BACrB,KACA,SAUmD;CACnD,MAAM,WAAW,aAAuE;EACvF,OAAO,CAAC;EACR,UAAU,CAAC,OAAO;EAClB,aAAa;CACd;CACA,MAAM,UAAU;CAEhB,IAAI,0BAA0B,QAAQ,UAAU,GAC/C,OAAO,QAAQ,0BAA0B,QAAQ,YAAY,KAAA,GAAW,QAAQ,cAAc,OAAO,CAAC;CAGvG,IAAI,QAAQ,QAAQ,WAAW,GAAG,OAAO;EAAE,OAAO,CAAC;EAAG,UAAU,CAAC;CAAE;CAEnE,MAAM,eAAe,iBAAiB,QAAQ,OAAO;CACrD,IAAI,gBAAgB,MAGnB,OAAO,QACN,aACC,QAAQ,YACR,KAAA,GACA,QAAQ,cACR,6CAA6C,aAAa,kDAC3D,CACD;CAMD,MAAM,UAAU,QAAQ,QAAQ,KAAI,YAAW;EAC9C,GAAG,qBAAqB,MAAM;EAC9B,WAAW,OAAO,WAAW,KAAK;CACnC,EAAE;CAGF,MAAM,UAAU,kBAAkB,QAAQ,YAAY,OAAO;CAC7D,IAAI,WAAW,MACd,OAAO,QAAQ,aAAa,QAAQ,YAAY,KAAA,GAAW,QAAQ,cAAc,OAAO,CAAC;CAG1F,MAAM,cAAc,MAAM,IAAI,sBAAsB,QAAQ,YAAY,QAAQ,cAAc,QAAQ,MAAM;CAC5G,IAAI,eAAe,MAClB,OAAO,sBAAsB,KAAK,QAAQ,YAAY,QAAQ,cAAc,QAAQ,MAAM;CAE3F,IAAI,CAAC,qBAAqB,WAAW,GACpC,OAAO,QAAQ,0BAA0B,QAAQ,YAAY,KAAA,GAAW,QAAQ,cAAc,OAAO,CAAC;CAGvG,MAAM,SAAS,IAAI,cAAc,aAAa,QAAQ,YAAY,QAAQ,cAAc,QAAQ,MAAM;CACtG,MAAM,iBAAiB,MAAM,0BAA0B,aAAa,QAAQ,YAAY;CAExF,MAAM,WAA8B,CAAC;CACrC,IAAI,cAAc;CAElB,MAAM,EAAE,OAAO,OAAO,YAAY,MAAM,YACvC,QAAQ,YACR,QACA,QAAQ,oBAEP,YAAY,iCACX,QAAQ,KAAI,OAAM;EACjB,OAAO,EAAE;EACT,MAAM,EAAE;EACR,SAAS,EAAE;EACX,QAAQ,EAAE;EACV,WAAW,UAAU,CAAC;CACvB,EAAE,GACF;EAAkB;EAAgB,OAAO;CAA2B,GACpE,KAAA,GACA,QAAQ,YACT,GAGD,EAAE,sBAAsB,KAAK,CAC9B;CACA,MAAM,UAAU,QAAQ,KAAI,MAAK,EAAE,GAAG;CACtC,IAAI,WAAW,MACd,qBAAqB,UAAU;EAAE,GAAG;EAAS,YAAY;CAAQ,CAAC;CAGnE,IAAI,SAAS,MAAM;EAElB,IAAI,WAAW,MACd,qBAAqB,UAAU;GAC9B,GAAG,mBACF,QAAQ,YACR,QACA,QAAQ,cACR,GAAG,QAAQ,wBAAwB,QAAQ,WAAW,GACvD;GACA,YAAY;EACb,CAAC;EAEF,OAAO;GAAE,OAAO,CAAC;GAAa;GAAU,aAAa;EAAK;CAC3D;CAEA,MAAM,QAAmC,CAAC;CAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;EACxC,MAAM,OAAO,MAAM;EACnB,IAAI,KAAK,WAAW,YAAY;GAE/B,uBAAuB,UAAU,QAAQ,YAAY,QAAQ,QAAQ,cAAc,MAAM,QAAQ,EAAE,CAAC,GAAG;GACvG,cAAc;GACd;EACD;EAEA,MAAM,KAAK;GACV,KAAK,QAAQ,EAAE,CAAC;GAChB,cAAc,KAAK,MAAM;GACzB,GAAI,KAAK,MAAM,YAAY,EAAE,WAAW,KAAK,IAAI,CAAC;EACnD,CAAC;CACF;CAEA,OAAO;EAAS;EAAiB;EAAU,aAAa,eAAe,KAAA;CAAU;AAClF;;AAGA,SAAS,UAAU,QAAqD;CACvE,OAAO,OAAO,aAAa,QAAQ,iBAAiB,OAAO,WAAW,OAAO,KAAK,IAAI,KAAA,IAAY,OAAO;AAC1G;AAEA,SAAS,kBACR,YACA,SACqB;CACrB,MAAM,UAAU,kBAAkB,UAAU;CAC5C,MAAM,oBAAoB,eAAA;CAC1B,KAAK,MAAM,UAAU,SAAS;EAC7B,IAAI,OAAO,MAAM,WAAW,KAAK,OAAO,KAAK,WAAW,GACvD,OAAO,+BAA+B,OAAO,IAAI;EAElD,IAAI,OAAO,OAAO,KAAK,CAAC,CAAC,WAAW,GACnC,OAAO,+BAA+B,OAAO,IAAI;EAGlD,IAAI,OAAO,WAAW,OAAO,OAAO,KAAK,GACxC,OAAO,+BAA+B,OAAO,IAAI,gBAAgB,OAAO,OAAO;EAEhF,IAAI,OAAO,OAAO,WAAW,OAAO,GACnC,OAAO,+BAA+B,OAAO,IAAI,gBAAgB,OAAO,OAAO;EAEhF,IAAI,WAAW,CAAC,OAAO,SACtB,OAAO,+BAA+B,OAAO,IAAI,4BAA4B,WAAW;EAEzF,IAAI,OAAO,WAAW,WAAW,GAChC,OAAO,+BAA+B,OAAO,IAAI;EAElD,IAAI,UAAU,MAAM,KAAK,MAAM;GAC9B,IAAI,SACH,OAAO,+BAA+B,OAAO,IAAI,iDAAiD,WAAW;GAE9G,IAAI,mBACH,OAAO,+BAA+B,OAAO,IAAI,iDAAiD,WAAW;EAE/G;CACD;AAED"}

package/dist/plus/integrations/results.d.ts

@@ -196,6 +196,19 @@ export interface ProviderWarning {
    * out, so treat a bare `kind: 'other'` warning as unclassified rather than as a proven failure.
    */
   omission?: ProviderWarningOmission;
+  /**
+   * The keys of the batch targets this warning concerns: the target a per-target failure was refused or failed
+   * for, or every target of an integration call that failed as a whole. So a caller that sends several callers'
+   * targets in one call can hand a failure only to the targets it belongs to.
+   *
+   * Its ABSENCE means the whole call. It is absent on every read that is not a batch read, and on a batch read's
+   * refusal of the whole call before any target is read (a duplicate key, an invalid target, an unknown etag
+   * include, no resolvable connection, the wrong surface), which concerns every target alike.
+   *
+   * It is not part of a warning's identity: two warnings that differ only here are one warning, for the union of
+   * their targets (see {@link appendDedupedWarning}).
+   */
+  targetKeys?: string[];
 }
 export interface ProviderPageInfo {
   /**
@@ -389,7 +402,9 @@ export declare function collectionScopeKey(scope: ProviderWarningOmissionScope |
 export declare function reconcileOmissionsWithFailure(warnings: ProviderWarning[], fetchFailed: boolean): void;
 /**
  * Appends `warning` to `into` only when an equal warning (by provider/connection/domain/kind/message, plus the
- * structured scope, cause and omission when present) is absent.
+ * structured scope, cause and omission when present) is absent. An equal warning already there merges its
+ * {@link ProviderWarning.targetKeys} with the new one's instead: the union of both, or none when either concerns
+ * the whole call. The existing warning is replaced, never mutated, since it may be shared.
  */
 export declare function appendDedupedWarning(into: ProviderWarning[], warning: ProviderWarning): void;
 //#endregion

package/dist/plus/integrations/results.js

@@ -121,12 +121,31 @@ function providerWarningKey(warning) {
 }
 /**
 * Appends `warning` to `into` only when an equal warning (by provider/connection/domain/kind/message, plus the
-* structured scope, cause and omission when present) is absent.
+* structured scope, cause and omission when present) is absent. An equal warning already there merges its
+* {@link ProviderWarning.targetKeys} with the new one's instead: the union of both, or none when either concerns
+* the whole call. The existing warning is replaced, never mutated, since it may be shared.
 */
 function appendDedupedWarning(into, warning) {
 	const key = providerWarningKey(warning);
-	if (into.some((existing) => providerWarningKey(existing) === key)) return;
-	into.push(warning);
+	const index = into.findIndex((existing) => providerWarningKey(existing) === key);
+	if (index === -1) {
+		into.push(warning);
+		return;
+	}
+	const existing = into[index];
+	const existingKeys = existing.targetKeys;
+	if (existingKeys == null) return;
+	if (warning.targetKeys == null) {
+		const { targetKeys: _, ...wholeCall } = existing;
+		into[index] = wholeCall;
+		return;
+	}
+	const added = warning.targetKeys.filter((k) => !existingKeys.includes(k));
+	if (!added.length) return;
+	into[index] = {
+		...existing,
+		targetKeys: [...existingKeys, ...new Set(added)]
+	};
 }
 //#endregion
 export { appendDedupedWarning, collectionScopeKey, providerWarningMessage, reconcileOmissionsWithFailure, toProviderWarning };

package/dist/plus/integrations/results.js.map

@@ -1 +1 @@
-{"version":3,"file":"results.js","names":[],"sources":["../../../../plus/integrations/src/results.ts"],"sourcesContent":["import { isUnsupportedSortError } from '@gitkraken/provider-apis';\nimport { AuthenticationError, RequestNotFoundError, RequestRateLimitError } from '@gitlens/git/errors.js';\nimport type { IssueSorting } from '@gitlens/git/models/issue.js';\nimport type { PullRequestSorting } from '@gitlens/git/models/pullRequest.js';\nimport type { IntegrationIds } from './constants.js';\nimport { isProviderUnreachableError } from './errors.js';\n\nexport interface ConnectionStateChangeEvent {\n\tkey: string;\n\treason: 'connected' | 'disconnected';\n}\n\n/**\n * A per-provider, per-connection warning surfaced alongside (partial) read results. Consumers use\n * these to drive auth recovery, retry, or truncation messaging without the read itself throwing.\n *\n * `kind` is the programmatic discriminant (a rate-limit is retryable, a 404 is not, an unsupported capability\n * never succeeds on retry, an auth failure needs re-connection unless {@link ProviderWarning.scope} confines\n * it); `isAuth` is retained as a convenience mirror of `kind === 'auth'`.\n *\n * `'unsupported'`: the provider — or this integration of it — lacks the capability the request asked for: a\n * surface (issues on Bitbucket, pull requests on an issue tracker, a batch read, org/repo discovery,\n * current-account lookup, project-scoped or account-wide issue reads), or a filter, sort, state, search\n * criterion or option combination it cannot express. Retrying the same request never succeeds; a different\n * provider, scope or request may. NOT unsupported (these stay `'other'`): malformed or contradictory caller\n * input the caller fixes in the request itself (a duplicate batch key, invalid target numbers, an empty owner,\n * an unusable scope), incompleteness or omission warnings, and unclassified errors.\n */\nexport type ProviderWarningKind = 'auth' | 'rate-limit' | 'not-found' | 'no-connection' | 'unsupported' | 'other';\n\n/**\n * Why a read that SUCCEEDED still withheld results:\n * - `provider-limit`: the provider refuses to serve past a cap it enforces (GitHub search's 1,000-result\n *   ceiling, Trello's `cards_limit`), so the excess is unreachable through that query.\n * - `recovery-budget`: the internal partitioned recovery stopped spending upstream requests before it ran\n *   out of partitions to visit.\n * - `pagination-incomplete`: pages were left unread — a sub-scope of a multi-scope read that was not drained,\n *   a drain that stopped at its own page backstop, or a provider that advertised another page and gave no way\n *   to reach it. These have DIFFERENT remedies, so the kind alone does not say whether more can be fetched;\n *   read {@link ProviderWarningOmission.recovery} for that.\n *\n * Mirrors the vocabulary the SDK reports. Declared here rather than imported so this module stays free of\n * `@gitkraken/provider-apis` types (see the export block in `index.ts`); `collectionMetadata.ts` holds the\n * compile-time link, so an SDK bump that adds a kind fails the build at that boundary.\n */\nexport type ProviderWarningOmissionKind = 'provider-limit' | 'recovery-budget' | 'pagination-incomplete';\n\n/**\n * How a consumer can recover omitted results. `page-budget` reruns with a larger budget; `narrow-scope`\n * requests a smaller server-side scope; `none` promises neither. Switch on the exact value because only\n * `page-budget` is a fetch-more action.\n */\nexport type ProviderWarningOmissionRecovery = 'none' | 'page-budget' | 'narrow-scope';\n\n/**\n * The part of a provider a warning is confined to: one resource (organization, workspace, site), project or\n * repository. All fields optional; see {@link ProviderWarning.scope} for when one is forwarded.\n */\nexport interface ProviderWarningScope {\n\t/**\n\t * The resource as the read addressed it: its id on most reads, its name on the few that address it by name\n\t * (Azure DevOps' repo-scoped reads, Bitbucket's workspace reads). Match it against both\n\t * `ProviderOrganization.id` and `name`.\n\t */\n\tresourceId?: string;\n\tprojectId?: string;\n\trepositoryId?: string;\n}\n\n/**\n * Why a provider request failed, when the failure itself says so:\n * - `unreachable`: a transport failure or server-side error prevented the provider from answering. The connection\n *   still exists; this accompanies `kind: 'other'`, never an authentication warning.\n * - `oauth-app-not-allowed`: the organization does not let third-party OAuth apps in. On Azure DevOps this is the\n *   organization policy \"Third-party application access via OAuth\", off by default for new organizations. An\n *   organization admin enables it, or the user connects with a personal access token instead, which the policy\n *   does not govern.\n * - `access-denied`: the account has no access to that organization or project (not a member, or lacking the\n *   permission). Someone who administers it has to grant access.\n * - `conditional-access`: a Microsoft Entra Conditional Access policy blocked the request (Azure DevOps\n *   `VS403463`). Its admin has to exempt the request, e.g. by location or device.\n *\n * None of these is healed by reconnecting, which is the point of naming them.\n */\nexport type ProviderWarningCauseReason =\n\t| 'oauth-app-not-allowed'\n\t| 'access-denied'\n\t| 'conditional-access'\n\t| 'unreachable';\n\n/** See {@link ProviderWarning.cause}. */\nexport interface ProviderWarningCause {\n\treason: ProviderWarningCauseReason;\n\t/** The provider's own error code, when it reports one (Azure DevOps `TF400813`, `VS403463`). */\n\tcode?: string;\n\t/** Where the setting behind the refusal is changed, when this layer can address it. */\n\tremedyUrl?: string;\n}\n\n/** Which repository / project / resource an omission is attributed to. All fields optional; a scope may name none. */\nexport interface ProviderWarningOmissionScope extends ProviderWarningScope {\n\tproviderId?: string;\n}\n\nexport interface ProviderWarningOmission {\n\tkind: ProviderWarningOmissionKind;\n\t/**\n\t * Whether anything would fetch the missing items, and what. Gate a \"load more\" affordance on this rather\n\t * than on `kind` — see {@link ProviderWarningOmissionRecovery}.\n\t */\n\trecovery: ProviderWarningOmissionRecovery;\n\t/**\n\t * The cap the provider enforces, when it reports one. NOT a result count for every kind: on\n\t * `recovery-budget` this is a REQUEST budget and must not be shown to a user as a number of results.\n\t */\n\tlimit?: number;\n\t/** Total matches the provider reported, when it reports one. Only GitHub's search cap does today. */\n\ttotalCount?: number;\n\t/**\n\t * The order the reachable window was selected under, as `field:direction`, when the omission is a result\n\t * ceiling.\n\t *\n\t * Present so a consumer can word its own \"N matched, showing the first M\" without assuming WHICH M: the\n\t * provider serves the top M under this key, so the sentence is only true if it names it. Absent for every\n\t * omission that isn't a ceiling, where no window was selected by an order.\n\t *\n\t * A union of both vocabularies rather than the issue one alone: `PullRequestSorting` happens to be a subset\n\t * today, so narrowing this to {@link IssueSorting} would still compile while describing only half the reads\n\t * that set it — and would break the day the PR search gains a key the issue search has no name for.\n\t */\n\tsort?: IssueSorting | PullRequestSorting;\n\t/** Which repository / project / resource was affected, when one is attributed. */\n\tscope?: ProviderWarningOmissionScope;\n}\n\nexport interface ProviderWarning {\n\tproviderId: IntegrationIds;\n\t/** Disambiguates connections on self-managed hosts (where one provider id spans multiple domains). */\n\tdomain?: string;\n\t/** The specific token/connection the read was pinned to, when a `connectionId` was supplied. */\n\tconnectionId?: string;\n\tmessage: string;\n\tkind: ProviderWarningKind;\n\t/** Convenience mirror of `kind === 'auth'`, scoped or not; read {@link scope} before prompting to reconnect. */\n\tisAuth: boolean;\n\t/**\n\t * Present when the failure was recorded against one sub-scope of the read (an organization, project or\n\t * repository) rather than against the connection. A scoped `auth` failure is that one scope refusing this\n\t * credential, e.g. an Azure DevOps organization that disallows third-party OAuth apps, one in another Entra\n\t * tenant, or a Conditional Access policy. Reconnecting cannot fix those, so this warning alone is no reason\n\t * to prompt for it.\n\t *\n\t * `kind` and `isAuth` are unaffected: a scoped 401 is still an authentication failure, and this field says\n\t * how far it reaches. It names at least one of its IDs, and is never set on an omission (which carries its\n\t * own {@link ProviderWarningOmission.scope}) or on a warning derived from a caught exception (see\n\t * {@link toProviderWarning}), even when that call targeted a single organization. The exception is a batch\n\t * read's refused target, which names its scope: the Azure DevOps organization and project, the repository on\n\t * other git hosts, or the tracker's resource.\n\t *\n\t * Its ABSENCE means account-wide or unattributed, so existing handling stays correct without it.\n\t *\n\t * A scoped `auth` failure also means the credential itself was accepted. A dead token can come back as nothing\n\t * but scoped refusals wherever a read reaches its scopes without an uncached request to the connection first:\n\t * discovery served from a per-token cache (Azure DevOps, Bitbucket, Jira Cloud) or an SDK fan-out across the\n\t * requested repositories (Bitbucket Data Center). So when a read's only auth failures are scoped, those providers\n\t * confirm the credential with one uncached check first, and a refused credential fails the whole read with an\n\t * unscoped `auth` warning. A batch read checks it only when every target was refused, since a target that\n\t * answered already proved it. A refusal the provider attributes to the credential itself, like Bitbucket's or Jira\n\t * Cloud's for a token missing the OAuth scopes a read needs, which a reconnect fixes, is published unscoped too,\n\t * once for the connection, while the scopes that answered keep their results.\n\t *\n\t * So the promise holds for a read that carries no unscoped `auth` warning of its own; one that does already asks\n\t * for a reconnect, and its other scoped refusals are not checked. Two exceptions stay scoped even then. A check\n\t * that could not complete or was denied (a network error, a throttle, a `403`, Bitbucket Data Center refusing a\n\t * credential it authenticated, or a Bitbucket Data Center project access token, whose user the check cannot\n\t * find) proves nothing, so the warnings are published unconfirmed, with no {@link cause}, and the next read\n\t * checks again. And a credential confirmed within the last minute is not probed again, so a revocation can take\n\t * up to a minute to surface.\n\t */\n\tscope?: ProviderWarningScope;\n\t/**\n\t * Why the provider request failed, when the failure itself says so: see {@link ProviderWarningCauseReason}. Switch on\n\t * `reason` to recommend a fix instead of a reconnect; `message` then carries the same explanation as prose.\n\t *\n\t * `unreachable` accompanies a transport or server failure with `kind: 'other'`. Credential refusal causes are\n\t * set only on a scoped `auth` warning whose credential was confirmed first (see {@link scope}), because the\n\t * refusals they name are indistinguishable from a dead credential until then: Azure DevOps answers a\n\t * third-party OAuth app its organization disallows exactly as it answers an expired token. Only Azure DevOps\n\t * reports one today. Its absence proves nothing about the cause.\n\t */\n\tcause?: ProviderWarningCause;\n\t/**\n\t * Present when this warning describes results the read could not return even though the request itself\n\t * SUCCEEDED — a provider-enforced cap, an exhausted recovery budget, a page budget, or a sub-scope the read\n\t * did not drain.\n\t *\n\t * Its presence is the signal: an omission is not a failure. Message it as incompleteness rather than as a\n\t * failed read, and do NOT derive that from `message`, which is English prose and subject to rewording.\n\t * `kind` stays `'other'` for these, so the failure discriminant keeps meaning exactly what it meant before\n\t * this field existed.\n\t *\n\t * Whether anything would fetch the rest is a SEPARATE question — read {@link ProviderWarningOmission.recovery},\n\t * not `kind`, and never assume a retry of the same request returns more.\n\t *\n\t * `limit` / `totalCount` / `scope` are forwarded only when they are reported; most omissions carry none of\n\t * the three, so render correctly without them — and see {@link ProviderWarningOmission.limit} before\n\t * showing that figure as a result count.\n\t *\n\t * Its ABSENCE proves nothing. It is never set on a warning derived from a caught exception (see\n\t * {@link toProviderWarning}) or from a structured scope failure — those are failures, and the field would\n\t * be a lie there. But it is also absent whenever incompleteness was reported without naming what was left\n\t * out, so treat a bare `kind: 'other'` warning as unclassified rather than as a proven failure.\n\t */\n\tomission?: ProviderWarningOmission;\n}\n\nexport interface ProviderPageInfo {\n\t/**\n\t * The 1-based POSITION of the returned page. One convention across every paged read, page-number and\n\t * cursor paging alike, so a `getNextPageParam`-style consumer can key off it uniformly:\n\t * - the page number the provider itself reported, when it reports one (authoritative);\n\t * - else the position the caller addressed: the page encoded in a threaded page cursor, or the `page`\n\t *   supplied alongside an opaque cursor (1 when the caller supplied no `page`);\n\t * - else, for a read that can be advanced by page number, the requested `page` — the provider either\n\t *   honored it or the internal drain reached it (see the paging contract on `IntegrationManager`);\n\t * - else 1: a cursor-only read with no cursor threaded back ignores a requested page number and answers\n\t *   with its first page, so echoing the request would mislabel page 1 as page N.\n\t *\n\t * A page past the provider's terminal cursor still reports the requested `page` with empty `items` — an\n\t * empty page N, never page N-1 relabeled.\n\t *\n\t * Continue a cursor-paged read from `cursor`, NOT from `currentPage + 1`: a cursor-only host can't be\n\t * addressed by number, so this is a position label and not always a resumable request parameter.\n\t */\n\tcurrentPage: number;\n\t/**\n\t * The page size IN EFFECT, which is not always the one requested — it is whichever of these the read can\n\t * actually vouch for:\n\t * - the size the provider reported for the page it served (numbered-page hosts), else\n\t * - the `itemsPerPage` that was applied to the request (repo-scoped reads, which forward it), else\n\t * - `items.length`, for a read that takes no page size at all: the account-wide PR/issue reads, `listRepos`\n\t *   (cursor-only), and `listIssueTrackerIssuesPage`, whose `itemsPerPage` counts PROJECTS rather than issues.\n\t *\n\t * So it is a description of the page, not an echo of the request: don't derive a total from\n\t * `currentPage * itemsPerPage`, and don't read `items.length < itemsPerPage` as \"last page\" — `hasMore` /\n\t * `cursor` are the only continuation signals.\n\t */\n\titemsPerPage: number;\n\t/**\n\t * A COMPLETENESS assertion, not a mode flag: `true` only when a sweep drained every page of every target\n\t * without truncating or failing (`!truncated && !fetchFailed`). Set exclusively by `sweepPullRequests` /\n\t * `sweepClosedPullRequests` and absent on every paged read, so `allPages !== true` does NOT by itself mean\n\t * \"this was a single page\".\n\t *\n\t * This is the signal to gate on before caching a sweep as authoritative: unlike `truncated` it is `false`\n\t * for BOTH kinds of incompleteness, so it can't be misread as a benign cap.\n\t */\n\tallPages?: boolean;\n\t/**\n\t * True when the read stopped before it could confirm it had everything. Deliberately does NOT distinguish\n\t * WHY, and a consumer must not assume it means a provider ceiling — a sweep sets it from three different\n\t * origins:\n\t * - a provider-side ceiling or per-scope backstop propagated from below (e.g. GitHub Search's 1000-result\n\t *   cap): the missing items are NOT reachable, so this really is \"complete to the provider's limit\";\n\t * - the sweep's OWN `maxPages` cap (default 100) with a usable cursor still in hand: the missing items ARE\n\t *   reachable and were simply not fetched — raise `maxPages` to get them;\n\t * - the provider reporting another page but handing back no usable cursor: not reachable.\n\t *\n\t * Only the second is recoverable, and a sweep exposes no continuation cursor, so treating a truncated sweep\n\t * as a complete set silently drops reachable data in that case. Prefer `allPages` for the cache decision.\n\t */\n\ttruncated?: boolean;\n}\n\nexport interface ProviderResult<T> {\n\titems: T[];\n\twarnings: ProviderWarning[];\n\t/**\n\t * True when `items` is incomplete — distinguishes a failed or truncated flat read from a genuinely empty\n\t * result. Paged results additionally use `page.truncated` when a completed page could not confirm it\n\t * drained everything.\n\t */\n\tfetchFailed?: boolean;\n}\n\nexport interface ProviderPagedResult<T> extends ProviderResult<T> {\n\tpage: ProviderPageInfo;\n\thasMore: boolean;\n\t/**\n\t * Opaque cursor for cursor-based paging (GraphQL, per-repo/per-project cursors, etc.). For hosts that\n\t * require the previous page's cursor, consumers should pass this value back to the next `cursor` option.\n\t * A retry-only cursor may remain when `hasMore` is false: `hasMore` means automatic forward progress,\n\t * while explicitly reusing such a cursor retries failed work without creating an infinite paging loop.\n\t */\n\tcursor?: string;\n}\n\nexport interface ProviderSweepResult<T> extends ProviderResult<T> {\n\tpage: ProviderPageInfo;\n\thasMore: boolean;\n\t/**\n\t * Providers whose top-level read failed before returning any usable page. Partial per-scope failures stay\n\t * represented by `warnings` + `fetchFailed` and are intentionally excluded.\n\t */\n\tfailedProviderIds: IntegrationIds[];\n\t/**\n\t * Providers whose read started successfully but could not produce an authoritative complete slice (for\n\t * example, a later page failed, collection metadata reported a partial scope, or a paging backstop was hit).\n\t * Kept separate from\n\t * `failedProviderIds` so consumers can accept healthy sibling providers while preserving an older snapshot\n\t * for a provider whose returned slice has a gap.\n\t */\n\tincompleteProviderIds: IntegrationIds[];\n}\n\nexport interface ProviderBroadenResult<T> extends ProviderPagedResult<T> {\n\tbroadenedProviderIds: IntegrationIds[];\n\t/** Providers for which no requested org produced a usable issue result. */\n\tfailedProviderIds: IntegrationIds[];\n\t/** Providers with both a usable org result and at least one failed or truncated org slice. */\n\tincompleteProviderIds: IntegrationIds[];\n\tfanOutCount: number;\n}\n\nexport type RepositoryResolutionStatus =\n\t| 'resolved'\n\t| 'not-found'\n\t| 'unauthorized'\n\t| 'unsupported-provider'\n\t| 'invalid-remote-url'\n\t| 'host-mismatch'\n\t| 'undetermined';\n\nexport interface RepositoryIdentity {\n\tproviderId: IntegrationIds;\n\tdomain: string;\n\t/** The provider's canonical owner/namespace (follows renames), falling back to the parsed remote when omitted. */\n\towner: string;\n\t/** The provider's canonical repo name (follows renames), falling back to the parsed remote when omitted. */\n\tname: string;\n\tproject?: string;\n\t/** The original input remote URL, so the caller can key the resolution back to the remote it asked about. */\n\tremoteUrl: string;\n\t/**\n\t * True when the provider's canonical owner/name differ from what the input remote URL carried — i.e. the\n\t * repo was renamed/moved host-side and the local remote is stale. Case-insensitive, mirroring gkcli's\n\t * `EqualFold` compare so hosts that echo the input casing (e.g. Bitbucket Server/Azure) aren't flagged.\n\t */\n\trenamed: boolean;\n}\n\nexport interface RepositoryResolution {\n\tstatus: RepositoryResolutionStatus;\n\tidentity?: RepositoryIdentity;\n\twarning?: ProviderWarning;\n}\n\nexport interface ResolveRepositoryResult {\n\tresolution: RepositoryResolution;\n}\n\nconst maxProviderWarningMessageLength = 500;\n\n/** A caught error's message as a warning can carry it: an HTML page becomes its status, and prose is capped. */\nexport function providerWarningMessage(ex: unknown): string {\n\tconst raw = (ex instanceof Error ? ex.message : String(ex)).trim();\n\tconst carrier = ex as { status?: unknown; response?: { status?: unknown } } | null | undefined;\n\tconst status =\n\t\ttypeof carrier?.status === 'number'\n\t\t\t? carrier.status\n\t\t\t: typeof carrier?.response?.status === 'number'\n\t\t\t\t? carrier.response.status\n\t\t\t\t: undefined;\n\n\t// Gateways commonly answer API requests with a complete HTML error page. That payload is neither actionable\n\t// nor suitable for a warning DTO consumed by UIs and logs; preserve the status without leaking the document.\n\tif (/<(?:!doctype\\s+html|html|head|body)\\b/i.test(raw)) {\n\t\treturn status != null ? `Provider request failed with status ${status}.` : 'Provider request failed.';\n\t}\n\n\tif (!raw) {\n\t\treturn status != null ? `Provider request failed with status ${status}.` : 'Provider request failed.';\n\t}\n\treturn raw.length > maxProviderWarningMessageLength\n\t\t? `${raw.slice(0, maxProviderWarningMessageLength - 3)}...`\n\t\t: raw;\n}\n\n/**\n * Normalized org/workspace/group shape returned by the provider facade.\n * `name` is the provider identifier to pass to follow-up reads, while `org` is an optional display label.\n */\nexport interface ProviderOrganization {\n\tid: string;\n\tproviderId: IntegrationIds;\n\tname: string;\n\torg?: string;\n\turl: string;\n}\n\n/** Normalized repository shape returned by the provider facade. */\nexport interface ProviderRepositoryShape {\n\tid: string;\n\tnamespace: string;\n\tname: string;\n\t/** Azure DevOps project; `undefined` for hosts without a project layer. */\n\tproject?: string;\n\t/** Web (browser) URL, when the provider exposes it. */\n\turl?: string;\n\t/** HTTPS clone URL, when available. */\n\tcloneUrlHttps?: string;\n\t/** SSH clone URL, when available. */\n\tcloneUrlSsh?: string;\n\t/** Default branch name, when the provider reports it. */\n\tdefaultBranch?: string;\n}\n\n/**\n * Classifies a caught provider exception into a neutral {@link ProviderWarning}. Ordering matters:\n * `instanceof` is checked most-specific-first so a rate-limit isn't mislabeled as a generic error and\n * a 404 isn't mislabeled as auth.\n */\nexport function toProviderWarning(\n\tproviderId: IntegrationIds,\n\tdomain: string | undefined,\n\tconnectionId: string | undefined,\n\tex: unknown,\n): ProviderWarning {\n\tlet kind: ProviderWarning['kind'];\n\tif (ex instanceof AuthenticationError) {\n\t\tkind = 'auth';\n\t} else if (ex instanceof RequestRateLimitError) {\n\t\tkind = 'rate-limit';\n\t} else if (ex instanceof RequestNotFoundError) {\n\t\tkind = 'not-found';\n\t} else if (isUnsupportedSortError(ex)) {\n\t\tkind = 'unsupported';\n\t} else {\n\t\tkind = 'other';\n\t}\n\n\treturn {\n\t\tproviderId: providerId,\n\t\tdomain: domain,\n\t\tconnectionId: connectionId,\n\t\tmessage: providerWarningMessage(ex),\n\t\tkind: kind,\n\t\tisAuth: kind === 'auth',\n\t\t...(kind === 'other' && isProviderUnreachableError(ex) ? { cause: { reason: 'unreachable' as const } } : {}),\n\t};\n}\n\n/**\n * A scope's identity, as the stable string that keys it.\n *\n * The single definition of what \"the same scope\" means, shared by the failure and omission dedup keys in\n * `providerPaging.ts` and by {@link providerWarningKey} below, so a scope gaining a field is one edit rather\n * than three. `providerId` is included: the same repository ID under two providers is two scopes.\n *\n * The parameter is structural rather than the SDK's `CollectionScope` so this module keeps naming no\n * `@gitkraken/provider-apis` types (see the export block in `index.ts`) while still serving its SDK-facing\n * callers, which pass that type in unchanged.\n */\nexport function collectionScopeKey(scope: ProviderWarningOmissionScope | undefined): string {\n\treturn [scope?.providerId ?? '', scope?.resourceId ?? '', scope?.projectId ?? '', scope?.repositoryId ?? ''].join(\n\t\t' ',\n\t);\n}\n\n/**\n * The omission's contribution to a warning's identity — empty when there is none, so a warning without an\n * omission keeps deduping exactly as it did before the field existed.\n *\n * Two omissions of different kinds do produce different `message` values today, so message alone would still\n * separate them. That is incidental: the premise of `omission` is that consumers must not depend on prose\n * carrying the distinguishing fact, and this key must not either.\n */\nfunction providerWarningOmissionKey(omission: ProviderWarningOmission | undefined): string {\n\tif (omission == null) return '';\n\n\treturn [\n\t\tomission.kind,\n\t\tomission.recovery,\n\t\tomission.limit ?? '',\n\t\tomission.totalCount ?? '',\n\t\tcollectionScopeKey(omission.scope),\n\t].join(' ');\n}\n\n/**\n * Strips the omission from every warning in `warnings` when the read as a whole failed.\n *\n * An omission asserts the request SUCCEEDED, and a drain only learns it failed AFTER it may have emitted one:\n * an early page can report its own truncation and then a later page can die. Deciding per warning, at the\n * moment each is built, cannot see that future — so the aggregate is reconciled once, here, where\n * `fetchFailed` is final. Call it at the point a read returns its `fetchFailed`.\n *\n * Re-dedupes as it goes: the omission is part of a warning's identity, so two warnings that differed only\n * there become identical once it is gone, and the array's contract is that no two entries are equal.\n *\n * Mutates in place: the warning array is the one being returned, and callers accumulate into it across pages.\n */\nexport function reconcileOmissionsWithFailure(warnings: ProviderWarning[], fetchFailed: boolean): void {\n\tif (!fetchFailed || !warnings.some(w => w.omission != null)) return;\n\n\tconst reconciled: ProviderWarning[] = [];\n\tfor (const warning of warnings) {\n\t\tif (warning.omission == null) {\n\t\t\tappendDedupedWarning(reconciled, warning);\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst { omission: _omission, ...rest } = warning;\n\t\tappendDedupedWarning(reconciled, rest);\n\t}\n\n\twarnings.splice(0, warnings.length, ...reconciled);\n}\n\n/**\n * A stable key for deduplicating warnings accumulated across drained pages / fan-out scopes.\n *\n * The scope and the cause are keyed for the reason the omission is (see {@link providerWarningOmissionKey}): today's\n * failure messages happen to spell them out, but two failures that differ in either must stay two warnings even if\n * they don't.\n *\n * `message` stays LAST. It is the only free-form segment — provider prose, spaces and all — so anything\n * appended after it could be impersonated by a message that happens to end in the same text.\n */\nfunction providerWarningKey(warning: ProviderWarning): string {\n\treturn [\n\t\twarning.providerId,\n\t\twarning.connectionId ?? '',\n\t\twarning.domain ?? '',\n\t\twarning.kind,\n\t\tcollectionScopeKey(warning.scope),\n\t\twarning.cause?.reason ?? '',\n\t\tproviderWarningOmissionKey(warning.omission),\n\t\twarning.message,\n\t].join(' ');\n}\n\n/**\n * Appends `warning` to `into` only when an equal warning (by provider/connection/domain/kind/message, plus the\n * structured scope, cause and omission when present) is absent.\n */\nexport function appendDedupedWarning(into: ProviderWarning[], warning: ProviderWarning): void {\n\tconst key = providerWarningKey(warning);\n\tif (into.some(existing => providerWarningKey(existing) === key)) return;\n\n\tinto.push(warning);\n}\n"],"mappings":";;;;AAyWA,MAAM,kCAAkC;;AAGxC,SAAgB,uBAAuB,IAAqB;CAC3D,MAAM,OAAO,cAAc,QAAQ,GAAG,UAAU,OAAO,EAAE,EAAA,CAAG,KAAK;CACjE,MAAM,UAAU;CAChB,MAAM,SACL,OAAO,SAAS,WAAW,WACxB,QAAQ,SACR,OAAO,SAAS,UAAU,WAAW,WACpC,QAAQ,SAAS,SACjB,KAAA;CAIL,IAAI,yCAAyC,KAAK,GAAG,GACpD,OAAO,UAAU,OAAO,uCAAuC,OAAO,KAAK;CAG5E,IAAI,CAAC,KACJ,OAAO,UAAU,OAAO,uCAAuC,OAAO,KAAK;CAE5E,OAAO,IAAI,SAAS,kCACjB,GAAG,IAAI,MAAM,GAAG,GAAmC,EAAE,OACrD;AACJ;;;;;;AAoCA,SAAgB,kBACf,YACA,QACA,cACA,IACkB;CAClB,IAAI;CACJ,IAAI,cAAc,qBACjB,OAAO;MACD,IAAI,cAAc,uBACxB,OAAO;MACD,IAAI,cAAc,sBACxB,OAAO;MACD,IAAI,uBAAuB,EAAE,GACnC,OAAO;MAEP,OAAO;CAGR,OAAO;EACM;EACJ;EACM;EACd,SAAS,uBAAuB,EAAE;EAC5B;EACN,QAAQ,SAAS;EACjB,GAAI,SAAS,WAAW,2BAA2B,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,cAAuB,EAAE,IAAI,CAAC;CAC3G;AACD;;;;;;;;;;;;AAaA,SAAgB,mBAAmB,OAAyD;CAC3F,OAAO;EAAC,OAAO,cAAc;EAAI,OAAO,cAAc;EAAI,OAAO,aAAa;EAAI,OAAO,gBAAgB;CAAE,CAAC,CAAC,KAC5G,GACD;AACD;;;;;;;;;AAUA,SAAS,2BAA2B,UAAuD;CAC1F,IAAI,YAAY,MAAM,OAAO;CAE7B,OAAO;EACN,SAAS;EACT,SAAS;EACT,SAAS,SAAS;EAClB,SAAS,cAAc;EACvB,mBAAmB,SAAS,KAAK;CAClC,CAAC,CAAC,KAAK,GAAG;AACX;;;;;;;;;;;;;;AAeA,SAAgB,8BAA8B,UAA6B,aAA4B;CACtG,IAAI,CAAC,eAAe,CAAC,SAAS,MAAK,MAAK,EAAE,YAAY,IAAI,GAAG;CAE7D,MAAM,aAAgC,CAAC;CACvC,KAAK,MAAM,WAAW,UAAU;EAC/B,IAAI,QAAQ,YAAY,MAAM;GAC7B,qBAAqB,YAAY,OAAO;GACxC;EACD;EAEA,MAAM,EAAE,UAAU,WAAW,GAAG,SAAS;EACzC,qBAAqB,YAAY,IAAI;CACtC;CAEA,SAAS,OAAO,GAAG,SAAS,QAAQ,GAAG,UAAU;AAClD;;;;;;;;;;;AAYA,SAAS,mBAAmB,SAAkC;CAC7D,OAAO;EACN,QAAQ;EACR,QAAQ,gBAAgB;EACxB,QAAQ,UAAU;EAClB,QAAQ;EACR,mBAAmB,QAAQ,KAAK;EAChC,QAAQ,OAAO,UAAU;EACzB,2BAA2B,QAAQ,QAAQ;EAC3C,QAAQ;CACT,CAAC,CAAC,KAAK,GAAG;AACX;;;;;AAMA,SAAgB,qBAAqB,MAAyB,SAAgC;CAC7F,MAAM,MAAM,mBAAmB,OAAO;CACtC,IAAI,KAAK,MAAK,aAAY,mBAAmB,QAAQ,MAAM,GAAG,GAAG;CAEjE,KAAK,KAAK,OAAO;AAClB"}
+{"version":3,"file":"results.js","names":[],"sources":["../../../../plus/integrations/src/results.ts"],"sourcesContent":["import { isUnsupportedSortError } from '@gitkraken/provider-apis';\nimport { AuthenticationError, RequestNotFoundError, RequestRateLimitError } from '@gitlens/git/errors.js';\nimport type { IssueSorting } from '@gitlens/git/models/issue.js';\nimport type { PullRequestSorting } from '@gitlens/git/models/pullRequest.js';\nimport type { IntegrationIds } from './constants.js';\nimport { isProviderUnreachableError } from './errors.js';\n\nexport interface ConnectionStateChangeEvent {\n\tkey: string;\n\treason: 'connected' | 'disconnected';\n}\n\n/**\n * A per-provider, per-connection warning surfaced alongside (partial) read results. Consumers use\n * these to drive auth recovery, retry, or truncation messaging without the read itself throwing.\n *\n * `kind` is the programmatic discriminant (a rate-limit is retryable, a 404 is not, an unsupported capability\n * never succeeds on retry, an auth failure needs re-connection unless {@link ProviderWarning.scope} confines\n * it); `isAuth` is retained as a convenience mirror of `kind === 'auth'`.\n *\n * `'unsupported'`: the provider — or this integration of it — lacks the capability the request asked for: a\n * surface (issues on Bitbucket, pull requests on an issue tracker, a batch read, org/repo discovery,\n * current-account lookup, project-scoped or account-wide issue reads), or a filter, sort, state, search\n * criterion or option combination it cannot express. Retrying the same request never succeeds; a different\n * provider, scope or request may. NOT unsupported (these stay `'other'`): malformed or contradictory caller\n * input the caller fixes in the request itself (a duplicate batch key, invalid target numbers, an empty owner,\n * an unusable scope), incompleteness or omission warnings, and unclassified errors.\n */\nexport type ProviderWarningKind = 'auth' | 'rate-limit' | 'not-found' | 'no-connection' | 'unsupported' | 'other';\n\n/**\n * Why a read that SUCCEEDED still withheld results:\n * - `provider-limit`: the provider refuses to serve past a cap it enforces (GitHub search's 1,000-result\n *   ceiling, Trello's `cards_limit`), so the excess is unreachable through that query.\n * - `recovery-budget`: the internal partitioned recovery stopped spending upstream requests before it ran\n *   out of partitions to visit.\n * - `pagination-incomplete`: pages were left unread — a sub-scope of a multi-scope read that was not drained,\n *   a drain that stopped at its own page backstop, or a provider that advertised another page and gave no way\n *   to reach it. These have DIFFERENT remedies, so the kind alone does not say whether more can be fetched;\n *   read {@link ProviderWarningOmission.recovery} for that.\n *\n * Mirrors the vocabulary the SDK reports. Declared here rather than imported so this module stays free of\n * `@gitkraken/provider-apis` types (see the export block in `index.ts`); `collectionMetadata.ts` holds the\n * compile-time link, so an SDK bump that adds a kind fails the build at that boundary.\n */\nexport type ProviderWarningOmissionKind = 'provider-limit' | 'recovery-budget' | 'pagination-incomplete';\n\n/**\n * How a consumer can recover omitted results. `page-budget` reruns with a larger budget; `narrow-scope`\n * requests a smaller server-side scope; `none` promises neither. Switch on the exact value because only\n * `page-budget` is a fetch-more action.\n */\nexport type ProviderWarningOmissionRecovery = 'none' | 'page-budget' | 'narrow-scope';\n\n/**\n * The part of a provider a warning is confined to: one resource (organization, workspace, site), project or\n * repository. All fields optional; see {@link ProviderWarning.scope} for when one is forwarded.\n */\nexport interface ProviderWarningScope {\n\t/**\n\t * The resource as the read addressed it: its id on most reads, its name on the few that address it by name\n\t * (Azure DevOps' repo-scoped reads, Bitbucket's workspace reads). Match it against both\n\t * `ProviderOrganization.id` and `name`.\n\t */\n\tresourceId?: string;\n\tprojectId?: string;\n\trepositoryId?: string;\n}\n\n/**\n * Why a provider request failed, when the failure itself says so:\n * - `unreachable`: a transport failure or server-side error prevented the provider from answering. The connection\n *   still exists; this accompanies `kind: 'other'`, never an authentication warning.\n * - `oauth-app-not-allowed`: the organization does not let third-party OAuth apps in. On Azure DevOps this is the\n *   organization policy \"Third-party application access via OAuth\", off by default for new organizations. An\n *   organization admin enables it, or the user connects with a personal access token instead, which the policy\n *   does not govern.\n * - `access-denied`: the account has no access to that organization or project (not a member, or lacking the\n *   permission). Someone who administers it has to grant access.\n * - `conditional-access`: a Microsoft Entra Conditional Access policy blocked the request (Azure DevOps\n *   `VS403463`). Its admin has to exempt the request, e.g. by location or device.\n *\n * None of these is healed by reconnecting, which is the point of naming them.\n */\nexport type ProviderWarningCauseReason =\n\t| 'oauth-app-not-allowed'\n\t| 'access-denied'\n\t| 'conditional-access'\n\t| 'unreachable';\n\n/** See {@link ProviderWarning.cause}. */\nexport interface ProviderWarningCause {\n\treason: ProviderWarningCauseReason;\n\t/** The provider's own error code, when it reports one (Azure DevOps `TF400813`, `VS403463`). */\n\tcode?: string;\n\t/** Where the setting behind the refusal is changed, when this layer can address it. */\n\tremedyUrl?: string;\n}\n\n/** Which repository / project / resource an omission is attributed to. All fields optional; a scope may name none. */\nexport interface ProviderWarningOmissionScope extends ProviderWarningScope {\n\tproviderId?: string;\n}\n\nexport interface ProviderWarningOmission {\n\tkind: ProviderWarningOmissionKind;\n\t/**\n\t * Whether anything would fetch the missing items, and what. Gate a \"load more\" affordance on this rather\n\t * than on `kind` — see {@link ProviderWarningOmissionRecovery}.\n\t */\n\trecovery: ProviderWarningOmissionRecovery;\n\t/**\n\t * The cap the provider enforces, when it reports one. NOT a result count for every kind: on\n\t * `recovery-budget` this is a REQUEST budget and must not be shown to a user as a number of results.\n\t */\n\tlimit?: number;\n\t/** Total matches the provider reported, when it reports one. Only GitHub's search cap does today. */\n\ttotalCount?: number;\n\t/**\n\t * The order the reachable window was selected under, as `field:direction`, when the omission is a result\n\t * ceiling.\n\t *\n\t * Present so a consumer can word its own \"N matched, showing the first M\" without assuming WHICH M: the\n\t * provider serves the top M under this key, so the sentence is only true if it names it. Absent for every\n\t * omission that isn't a ceiling, where no window was selected by an order.\n\t *\n\t * A union of both vocabularies rather than the issue one alone: `PullRequestSorting` happens to be a subset\n\t * today, so narrowing this to {@link IssueSorting} would still compile while describing only half the reads\n\t * that set it — and would break the day the PR search gains a key the issue search has no name for.\n\t */\n\tsort?: IssueSorting | PullRequestSorting;\n\t/** Which repository / project / resource was affected, when one is attributed. */\n\tscope?: ProviderWarningOmissionScope;\n}\n\nexport interface ProviderWarning {\n\tproviderId: IntegrationIds;\n\t/** Disambiguates connections on self-managed hosts (where one provider id spans multiple domains). */\n\tdomain?: string;\n\t/** The specific token/connection the read was pinned to, when a `connectionId` was supplied. */\n\tconnectionId?: string;\n\tmessage: string;\n\tkind: ProviderWarningKind;\n\t/** Convenience mirror of `kind === 'auth'`, scoped or not; read {@link scope} before prompting to reconnect. */\n\tisAuth: boolean;\n\t/**\n\t * Present when the failure was recorded against one sub-scope of the read (an organization, project or\n\t * repository) rather than against the connection. A scoped `auth` failure is that one scope refusing this\n\t * credential, e.g. an Azure DevOps organization that disallows third-party OAuth apps, one in another Entra\n\t * tenant, or a Conditional Access policy. Reconnecting cannot fix those, so this warning alone is no reason\n\t * to prompt for it.\n\t *\n\t * `kind` and `isAuth` are unaffected: a scoped 401 is still an authentication failure, and this field says\n\t * how far it reaches. It names at least one of its IDs, and is never set on an omission (which carries its\n\t * own {@link ProviderWarningOmission.scope}) or on a warning derived from a caught exception (see\n\t * {@link toProviderWarning}), even when that call targeted a single organization. The exception is a batch\n\t * read's refused target, which names its scope: the Azure DevOps organization and project, the repository on\n\t * other git hosts, or the tracker's resource.\n\t *\n\t * Its ABSENCE means account-wide or unattributed, so existing handling stays correct without it.\n\t *\n\t * A scoped `auth` failure also means the credential itself was accepted. A dead token can come back as nothing\n\t * but scoped refusals wherever a read reaches its scopes without an uncached request to the connection first:\n\t * discovery served from a per-token cache (Azure DevOps, Bitbucket, Jira Cloud) or an SDK fan-out across the\n\t * requested repositories (Bitbucket Data Center). So when a read's only auth failures are scoped, those providers\n\t * confirm the credential with one uncached check first, and a refused credential fails the whole read with an\n\t * unscoped `auth` warning. A batch read checks it only when every target was refused, since a target that\n\t * answered already proved it. A refusal the provider attributes to the credential itself, like Bitbucket's or Jira\n\t * Cloud's for a token missing the OAuth scopes a read needs, which a reconnect fixes, is published unscoped too,\n\t * once for the connection, while the scopes that answered keep their results.\n\t *\n\t * So the promise holds for a read that carries no unscoped `auth` warning of its own; one that does already asks\n\t * for a reconnect, and its other scoped refusals are not checked. Two exceptions stay scoped even then. A check\n\t * that could not complete or was denied (a network error, a throttle, a `403`, Bitbucket Data Center refusing a\n\t * credential it authenticated, or a Bitbucket Data Center project access token, whose user the check cannot\n\t * find) proves nothing, so the warnings are published unconfirmed, with no {@link cause}, and the next read\n\t * checks again. And a credential confirmed within the last minute is not probed again, so a revocation can take\n\t * up to a minute to surface.\n\t */\n\tscope?: ProviderWarningScope;\n\t/**\n\t * Why the provider request failed, when the failure itself says so: see {@link ProviderWarningCauseReason}. Switch on\n\t * `reason` to recommend a fix instead of a reconnect; `message` then carries the same explanation as prose.\n\t *\n\t * `unreachable` accompanies a transport or server failure with `kind: 'other'`. Credential refusal causes are\n\t * set only on a scoped `auth` warning whose credential was confirmed first (see {@link scope}), because the\n\t * refusals they name are indistinguishable from a dead credential until then: Azure DevOps answers a\n\t * third-party OAuth app its organization disallows exactly as it answers an expired token. Only Azure DevOps\n\t * reports one today. Its absence proves nothing about the cause.\n\t */\n\tcause?: ProviderWarningCause;\n\t/**\n\t * Present when this warning describes results the read could not return even though the request itself\n\t * SUCCEEDED — a provider-enforced cap, an exhausted recovery budget, a page budget, or a sub-scope the read\n\t * did not drain.\n\t *\n\t * Its presence is the signal: an omission is not a failure. Message it as incompleteness rather than as a\n\t * failed read, and do NOT derive that from `message`, which is English prose and subject to rewording.\n\t * `kind` stays `'other'` for these, so the failure discriminant keeps meaning exactly what it meant before\n\t * this field existed.\n\t *\n\t * Whether anything would fetch the rest is a SEPARATE question — read {@link ProviderWarningOmission.recovery},\n\t * not `kind`, and never assume a retry of the same request returns more.\n\t *\n\t * `limit` / `totalCount` / `scope` are forwarded only when they are reported; most omissions carry none of\n\t * the three, so render correctly without them — and see {@link ProviderWarningOmission.limit} before\n\t * showing that figure as a result count.\n\t *\n\t * Its ABSENCE proves nothing. It is never set on a warning derived from a caught exception (see\n\t * {@link toProviderWarning}) or from a structured scope failure — those are failures, and the field would\n\t * be a lie there. But it is also absent whenever incompleteness was reported without naming what was left\n\t * out, so treat a bare `kind: 'other'` warning as unclassified rather than as a proven failure.\n\t */\n\tomission?: ProviderWarningOmission;\n\t/**\n\t * The keys of the batch targets this warning concerns: the target a per-target failure was refused or failed\n\t * for, or every target of an integration call that failed as a whole. So a caller that sends several callers'\n\t * targets in one call can hand a failure only to the targets it belongs to.\n\t *\n\t * Its ABSENCE means the whole call. It is absent on every read that is not a batch read, and on a batch read's\n\t * refusal of the whole call before any target is read (a duplicate key, an invalid target, an unknown etag\n\t * include, no resolvable connection, the wrong surface), which concerns every target alike.\n\t *\n\t * It is not part of a warning's identity: two warnings that differ only here are one warning, for the union of\n\t * their targets (see {@link appendDedupedWarning}).\n\t */\n\ttargetKeys?: string[];\n}\n\nexport interface ProviderPageInfo {\n\t/**\n\t * The 1-based POSITION of the returned page. One convention across every paged read, page-number and\n\t * cursor paging alike, so a `getNextPageParam`-style consumer can key off it uniformly:\n\t * - the page number the provider itself reported, when it reports one (authoritative);\n\t * - else the position the caller addressed: the page encoded in a threaded page cursor, or the `page`\n\t *   supplied alongside an opaque cursor (1 when the caller supplied no `page`);\n\t * - else, for a read that can be advanced by page number, the requested `page` — the provider either\n\t *   honored it or the internal drain reached it (see the paging contract on `IntegrationManager`);\n\t * - else 1: a cursor-only read with no cursor threaded back ignores a requested page number and answers\n\t *   with its first page, so echoing the request would mislabel page 1 as page N.\n\t *\n\t * A page past the provider's terminal cursor still reports the requested `page` with empty `items` — an\n\t * empty page N, never page N-1 relabeled.\n\t *\n\t * Continue a cursor-paged read from `cursor`, NOT from `currentPage + 1`: a cursor-only host can't be\n\t * addressed by number, so this is a position label and not always a resumable request parameter.\n\t */\n\tcurrentPage: number;\n\t/**\n\t * The page size IN EFFECT, which is not always the one requested — it is whichever of these the read can\n\t * actually vouch for:\n\t * - the size the provider reported for the page it served (numbered-page hosts), else\n\t * - the `itemsPerPage` that was applied to the request (repo-scoped reads, which forward it), else\n\t * - `items.length`, for a read that takes no page size at all: the account-wide PR/issue reads, `listRepos`\n\t *   (cursor-only), and `listIssueTrackerIssuesPage`, whose `itemsPerPage` counts PROJECTS rather than issues.\n\t *\n\t * So it is a description of the page, not an echo of the request: don't derive a total from\n\t * `currentPage * itemsPerPage`, and don't read `items.length < itemsPerPage` as \"last page\" — `hasMore` /\n\t * `cursor` are the only continuation signals.\n\t */\n\titemsPerPage: number;\n\t/**\n\t * A COMPLETENESS assertion, not a mode flag: `true` only when a sweep drained every page of every target\n\t * without truncating or failing (`!truncated && !fetchFailed`). Set exclusively by `sweepPullRequests` /\n\t * `sweepClosedPullRequests` and absent on every paged read, so `allPages !== true` does NOT by itself mean\n\t * \"this was a single page\".\n\t *\n\t * This is the signal to gate on before caching a sweep as authoritative: unlike `truncated` it is `false`\n\t * for BOTH kinds of incompleteness, so it can't be misread as a benign cap.\n\t */\n\tallPages?: boolean;\n\t/**\n\t * True when the read stopped before it could confirm it had everything. Deliberately does NOT distinguish\n\t * WHY, and a consumer must not assume it means a provider ceiling — a sweep sets it from three different\n\t * origins:\n\t * - a provider-side ceiling or per-scope backstop propagated from below (e.g. GitHub Search's 1000-result\n\t *   cap): the missing items are NOT reachable, so this really is \"complete to the provider's limit\";\n\t * - the sweep's OWN `maxPages` cap (default 100) with a usable cursor still in hand: the missing items ARE\n\t *   reachable and were simply not fetched — raise `maxPages` to get them;\n\t * - the provider reporting another page but handing back no usable cursor: not reachable.\n\t *\n\t * Only the second is recoverable, and a sweep exposes no continuation cursor, so treating a truncated sweep\n\t * as a complete set silently drops reachable data in that case. Prefer `allPages` for the cache decision.\n\t */\n\ttruncated?: boolean;\n}\n\nexport interface ProviderResult<T> {\n\titems: T[];\n\twarnings: ProviderWarning[];\n\t/**\n\t * True when `items` is incomplete — distinguishes a failed or truncated flat read from a genuinely empty\n\t * result. Paged results additionally use `page.truncated` when a completed page could not confirm it\n\t * drained everything.\n\t */\n\tfetchFailed?: boolean;\n}\n\nexport interface ProviderPagedResult<T> extends ProviderResult<T> {\n\tpage: ProviderPageInfo;\n\thasMore: boolean;\n\t/**\n\t * Opaque cursor for cursor-based paging (GraphQL, per-repo/per-project cursors, etc.). For hosts that\n\t * require the previous page's cursor, consumers should pass this value back to the next `cursor` option.\n\t * A retry-only cursor may remain when `hasMore` is false: `hasMore` means automatic forward progress,\n\t * while explicitly reusing such a cursor retries failed work without creating an infinite paging loop.\n\t */\n\tcursor?: string;\n}\n\nexport interface ProviderSweepResult<T> extends ProviderResult<T> {\n\tpage: ProviderPageInfo;\n\thasMore: boolean;\n\t/**\n\t * Providers whose top-level read failed before returning any usable page. Partial per-scope failures stay\n\t * represented by `warnings` + `fetchFailed` and are intentionally excluded.\n\t */\n\tfailedProviderIds: IntegrationIds[];\n\t/**\n\t * Providers whose read started successfully but could not produce an authoritative complete slice (for\n\t * example, a later page failed, collection metadata reported a partial scope, or a paging backstop was hit).\n\t * Kept separate from\n\t * `failedProviderIds` so consumers can accept healthy sibling providers while preserving an older snapshot\n\t * for a provider whose returned slice has a gap.\n\t */\n\tincompleteProviderIds: IntegrationIds[];\n}\n\nexport interface ProviderBroadenResult<T> extends ProviderPagedResult<T> {\n\tbroadenedProviderIds: IntegrationIds[];\n\t/** Providers for which no requested org produced a usable issue result. */\n\tfailedProviderIds: IntegrationIds[];\n\t/** Providers with both a usable org result and at least one failed or truncated org slice. */\n\tincompleteProviderIds: IntegrationIds[];\n\tfanOutCount: number;\n}\n\nexport type RepositoryResolutionStatus =\n\t| 'resolved'\n\t| 'not-found'\n\t| 'unauthorized'\n\t| 'unsupported-provider'\n\t| 'invalid-remote-url'\n\t| 'host-mismatch'\n\t| 'undetermined';\n\nexport interface RepositoryIdentity {\n\tproviderId: IntegrationIds;\n\tdomain: string;\n\t/** The provider's canonical owner/namespace (follows renames), falling back to the parsed remote when omitted. */\n\towner: string;\n\t/** The provider's canonical repo name (follows renames), falling back to the parsed remote when omitted. */\n\tname: string;\n\tproject?: string;\n\t/** The original input remote URL, so the caller can key the resolution back to the remote it asked about. */\n\tremoteUrl: string;\n\t/**\n\t * True when the provider's canonical owner/name differ from what the input remote URL carried — i.e. the\n\t * repo was renamed/moved host-side and the local remote is stale. Case-insensitive, mirroring gkcli's\n\t * `EqualFold` compare so hosts that echo the input casing (e.g. Bitbucket Server/Azure) aren't flagged.\n\t */\n\trenamed: boolean;\n}\n\nexport interface RepositoryResolution {\n\tstatus: RepositoryResolutionStatus;\n\tidentity?: RepositoryIdentity;\n\twarning?: ProviderWarning;\n}\n\nexport interface ResolveRepositoryResult {\n\tresolution: RepositoryResolution;\n}\n\nconst maxProviderWarningMessageLength = 500;\n\n/** A caught error's message as a warning can carry it: an HTML page becomes its status, and prose is capped. */\nexport function providerWarningMessage(ex: unknown): string {\n\tconst raw = (ex instanceof Error ? ex.message : String(ex)).trim();\n\tconst carrier = ex as { status?: unknown; response?: { status?: unknown } } | null | undefined;\n\tconst status =\n\t\ttypeof carrier?.status === 'number'\n\t\t\t? carrier.status\n\t\t\t: typeof carrier?.response?.status === 'number'\n\t\t\t\t? carrier.response.status\n\t\t\t\t: undefined;\n\n\t// Gateways commonly answer API requests with a complete HTML error page. That payload is neither actionable\n\t// nor suitable for a warning DTO consumed by UIs and logs; preserve the status without leaking the document.\n\tif (/<(?:!doctype\\s+html|html|head|body)\\b/i.test(raw)) {\n\t\treturn status != null ? `Provider request failed with status ${status}.` : 'Provider request failed.';\n\t}\n\n\tif (!raw) {\n\t\treturn status != null ? `Provider request failed with status ${status}.` : 'Provider request failed.';\n\t}\n\treturn raw.length > maxProviderWarningMessageLength\n\t\t? `${raw.slice(0, maxProviderWarningMessageLength - 3)}...`\n\t\t: raw;\n}\n\n/**\n * Normalized org/workspace/group shape returned by the provider facade.\n * `name` is the provider identifier to pass to follow-up reads, while `org` is an optional display label.\n */\nexport interface ProviderOrganization {\n\tid: string;\n\tproviderId: IntegrationIds;\n\tname: string;\n\torg?: string;\n\turl: string;\n}\n\n/** Normalized repository shape returned by the provider facade. */\nexport interface ProviderRepositoryShape {\n\tid: string;\n\tnamespace: string;\n\tname: string;\n\t/** Azure DevOps project; `undefined` for hosts without a project layer. */\n\tproject?: string;\n\t/** Web (browser) URL, when the provider exposes it. */\n\turl?: string;\n\t/** HTTPS clone URL, when available. */\n\tcloneUrlHttps?: string;\n\t/** SSH clone URL, when available. */\n\tcloneUrlSsh?: string;\n\t/** Default branch name, when the provider reports it. */\n\tdefaultBranch?: string;\n}\n\n/**\n * Classifies a caught provider exception into a neutral {@link ProviderWarning}. Ordering matters:\n * `instanceof` is checked most-specific-first so a rate-limit isn't mislabeled as a generic error and\n * a 404 isn't mislabeled as auth.\n */\nexport function toProviderWarning(\n\tproviderId: IntegrationIds,\n\tdomain: string | undefined,\n\tconnectionId: string | undefined,\n\tex: unknown,\n): ProviderWarning {\n\tlet kind: ProviderWarning['kind'];\n\tif (ex instanceof AuthenticationError) {\n\t\tkind = 'auth';\n\t} else if (ex instanceof RequestRateLimitError) {\n\t\tkind = 'rate-limit';\n\t} else if (ex instanceof RequestNotFoundError) {\n\t\tkind = 'not-found';\n\t} else if (isUnsupportedSortError(ex)) {\n\t\tkind = 'unsupported';\n\t} else {\n\t\tkind = 'other';\n\t}\n\n\treturn {\n\t\tproviderId: providerId,\n\t\tdomain: domain,\n\t\tconnectionId: connectionId,\n\t\tmessage: providerWarningMessage(ex),\n\t\tkind: kind,\n\t\tisAuth: kind === 'auth',\n\t\t...(kind === 'other' && isProviderUnreachableError(ex) ? { cause: { reason: 'unreachable' as const } } : {}),\n\t};\n}\n\n/**\n * A scope's identity, as the stable string that keys it.\n *\n * The single definition of what \"the same scope\" means, shared by the failure and omission dedup keys in\n * `providerPaging.ts` and by {@link providerWarningKey} below, so a scope gaining a field is one edit rather\n * than three. `providerId` is included: the same repository ID under two providers is two scopes.\n *\n * The parameter is structural rather than the SDK's `CollectionScope` so this module keeps naming no\n * `@gitkraken/provider-apis` types (see the export block in `index.ts`) while still serving its SDK-facing\n * callers, which pass that type in unchanged.\n */\nexport function collectionScopeKey(scope: ProviderWarningOmissionScope | undefined): string {\n\treturn [scope?.providerId ?? '', scope?.resourceId ?? '', scope?.projectId ?? '', scope?.repositoryId ?? ''].join(\n\t\t' ',\n\t);\n}\n\n/**\n * The omission's contribution to a warning's identity — empty when there is none, so a warning without an\n * omission keeps deduping exactly as it did before the field existed.\n *\n * Two omissions of different kinds do produce different `message` values today, so message alone would still\n * separate them. That is incidental: the premise of `omission` is that consumers must not depend on prose\n * carrying the distinguishing fact, and this key must not either.\n */\nfunction providerWarningOmissionKey(omission: ProviderWarningOmission | undefined): string {\n\tif (omission == null) return '';\n\n\treturn [\n\t\tomission.kind,\n\t\tomission.recovery,\n\t\tomission.limit ?? '',\n\t\tomission.totalCount ?? '',\n\t\tcollectionScopeKey(omission.scope),\n\t].join(' ');\n}\n\n/**\n * Strips the omission from every warning in `warnings` when the read as a whole failed.\n *\n * An omission asserts the request SUCCEEDED, and a drain only learns it failed AFTER it may have emitted one:\n * an early page can report its own truncation and then a later page can die. Deciding per warning, at the\n * moment each is built, cannot see that future — so the aggregate is reconciled once, here, where\n * `fetchFailed` is final. Call it at the point a read returns its `fetchFailed`.\n *\n * Re-dedupes as it goes: the omission is part of a warning's identity, so two warnings that differed only\n * there become identical once it is gone, and the array's contract is that no two entries are equal.\n *\n * Mutates in place: the warning array is the one being returned, and callers accumulate into it across pages.\n */\nexport function reconcileOmissionsWithFailure(warnings: ProviderWarning[], fetchFailed: boolean): void {\n\tif (!fetchFailed || !warnings.some(w => w.omission != null)) return;\n\n\tconst reconciled: ProviderWarning[] = [];\n\tfor (const warning of warnings) {\n\t\tif (warning.omission == null) {\n\t\t\tappendDedupedWarning(reconciled, warning);\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst { omission: _omission, ...rest } = warning;\n\t\tappendDedupedWarning(reconciled, rest);\n\t}\n\n\twarnings.splice(0, warnings.length, ...reconciled);\n}\n\n/**\n * A stable key for deduplicating warnings accumulated across drained pages / fan-out scopes.\n *\n * The scope and the cause are keyed for the reason the omission is (see {@link providerWarningOmissionKey}): today's\n * failure messages happen to spell them out, but two failures that differ in either must stay two warnings even if\n * they don't.\n *\n * `message` stays LAST. It is the only free-form segment — provider prose, spaces and all — so anything\n * appended after it could be impersonated by a message that happens to end in the same text.\n */\nfunction providerWarningKey(warning: ProviderWarning): string {\n\treturn [\n\t\twarning.providerId,\n\t\twarning.connectionId ?? '',\n\t\twarning.domain ?? '',\n\t\twarning.kind,\n\t\tcollectionScopeKey(warning.scope),\n\t\twarning.cause?.reason ?? '',\n\t\tproviderWarningOmissionKey(warning.omission),\n\t\twarning.message,\n\t].join(' ');\n}\n\n/**\n * Appends `warning` to `into` only when an equal warning (by provider/connection/domain/kind/message, plus the\n * structured scope, cause and omission when present) is absent. An equal warning already there merges its\n * {@link ProviderWarning.targetKeys} with the new one's instead: the union of both, or none when either concerns\n * the whole call. The existing warning is replaced, never mutated, since it may be shared.\n */\nexport function appendDedupedWarning(into: ProviderWarning[], warning: ProviderWarning): void {\n\tconst key = providerWarningKey(warning);\n\tconst index = into.findIndex(existing => providerWarningKey(existing) === key);\n\tif (index === -1) {\n\t\tinto.push(warning);\n\t\treturn;\n\t}\n\n\tconst existing = into[index];\n\tconst existingKeys = existing.targetKeys;\n\t// Already covers the whole call.\n\tif (existingKeys == null) return;\n\n\tif (warning.targetKeys == null) {\n\t\tconst { targetKeys: _, ...wholeCall } = existing;\n\t\tinto[index] = wholeCall;\n\t\treturn;\n\t}\n\n\tconst added = warning.targetKeys.filter(k => !existingKeys.includes(k));\n\tif (!added.length) return;\n\n\tinto[index] = { ...existing, targetKeys: [...existingKeys, ...new Set(added)] };\n}\n"],"mappings":";;;;AAsXA,MAAM,kCAAkC;;AAGxC,SAAgB,uBAAuB,IAAqB;CAC3D,MAAM,OAAO,cAAc,QAAQ,GAAG,UAAU,OAAO,EAAE,EAAA,CAAG,KAAK;CACjE,MAAM,UAAU;CAChB,MAAM,SACL,OAAO,SAAS,WAAW,WACxB,QAAQ,SACR,OAAO,SAAS,UAAU,WAAW,WACpC,QAAQ,SAAS,SACjB,KAAA;CAIL,IAAI,yCAAyC,KAAK,GAAG,GACpD,OAAO,UAAU,OAAO,uCAAuC,OAAO,KAAK;CAG5E,IAAI,CAAC,KACJ,OAAO,UAAU,OAAO,uCAAuC,OAAO,KAAK;CAE5E,OAAO,IAAI,SAAS,kCACjB,GAAG,IAAI,MAAM,GAAG,GAAmC,EAAE,OACrD;AACJ;;;;;;AAoCA,SAAgB,kBACf,YACA,QACA,cACA,IACkB;CAClB,IAAI;CACJ,IAAI,cAAc,qBACjB,OAAO;MACD,IAAI,cAAc,uBACxB,OAAO;MACD,IAAI,cAAc,sBACxB,OAAO;MACD,IAAI,uBAAuB,EAAE,GACnC,OAAO;MAEP,OAAO;CAGR,OAAO;EACM;EACJ;EACM;EACd,SAAS,uBAAuB,EAAE;EAC5B;EACN,QAAQ,SAAS;EACjB,GAAI,SAAS,WAAW,2BAA2B,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,cAAuB,EAAE,IAAI,CAAC;CAC3G;AACD;;;;;;;;;;;;AAaA,SAAgB,mBAAmB,OAAyD;CAC3F,OAAO;EAAC,OAAO,cAAc;EAAI,OAAO,cAAc;EAAI,OAAO,aAAa;EAAI,OAAO,gBAAgB;CAAE,CAAC,CAAC,KAC5G,GACD;AACD;;;;;;;;;AAUA,SAAS,2BAA2B,UAAuD;CAC1F,IAAI,YAAY,MAAM,OAAO;CAE7B,OAAO;EACN,SAAS;EACT,SAAS;EACT,SAAS,SAAS;EAClB,SAAS,cAAc;EACvB,mBAAmB,SAAS,KAAK;CAClC,CAAC,CAAC,KAAK,GAAG;AACX;;;;;;;;;;;;;;AAeA,SAAgB,8BAA8B,UAA6B,aAA4B;CACtG,IAAI,CAAC,eAAe,CAAC,SAAS,MAAK,MAAK,EAAE,YAAY,IAAI,GAAG;CAE7D,MAAM,aAAgC,CAAC;CACvC,KAAK,MAAM,WAAW,UAAU;EAC/B,IAAI,QAAQ,YAAY,MAAM;GAC7B,qBAAqB,YAAY,OAAO;GACxC;EACD;EAEA,MAAM,EAAE,UAAU,WAAW,GAAG,SAAS;EACzC,qBAAqB,YAAY,IAAI;CACtC;CAEA,SAAS,OAAO,GAAG,SAAS,QAAQ,GAAG,UAAU;AAClD;;;;;;;;;;;AAYA,SAAS,mBAAmB,SAAkC;CAC7D,OAAO;EACN,QAAQ;EACR,QAAQ,gBAAgB;EACxB,QAAQ,UAAU;EAClB,QAAQ;EACR,mBAAmB,QAAQ,KAAK;EAChC,QAAQ,OAAO,UAAU;EACzB,2BAA2B,QAAQ,QAAQ;EAC3C,QAAQ;CACT,CAAC,CAAC,KAAK,GAAG;AACX;;;;;;;AAQA,SAAgB,qBAAqB,MAAyB,SAAgC;CAC7F,MAAM,MAAM,mBAAmB,OAAO;CACtC,MAAM,QAAQ,KAAK,WAAU,aAAY,mBAAmB,QAAQ,MAAM,GAAG;CAC7E,IAAI,UAAU,IAAI;EACjB,KAAK,KAAK,OAAO;EACjB;CACD;CAEA,MAAM,WAAW,KAAK;CACtB,MAAM,eAAe,SAAS;CAE9B,IAAI,gBAAgB,MAAM;CAE1B,IAAI,QAAQ,cAAc,MAAM;EAC/B,MAAM,EAAE,YAAY,GAAG,GAAG,cAAc;EACxC,KAAK,SAAS;EACd;CACD;CAEA,MAAM,QAAQ,QAAQ,WAAW,QAAO,MAAK,CAAC,aAAa,SAAS,CAAC,CAAC;CACtE,IAAI,CAAC,MAAM,QAAQ;CAEnB,KAAK,SAAS;EAAE,GAAG;EAAU,YAAY,CAAC,GAAG,cAAc,GAAG,IAAI,IAAI,KAAK,CAAC;CAAE;AAC/E"}

package/dist/utils/event.d.ts

@@ -1,5 +1,5 @@
-import { Deferred } from "./promise.js";
 import { UnifiedDisposable } from "./disposable.js";
+import { Deferred } from "./promise.js";
 //#region ../utils/src/event.d.ts
 export interface Event<T> {
   (listener: (e: T) => any, thisArgs?: unknown, disposables?: {

package/docs/integrations.md

@@ -190,6 +190,11 @@ and an `unchanged` pull request's always can. A row is in one of four states:
 - `{ key }` — proven absent, as before.
 - no row, with `fetchFailed` and a warning — unknown, as before.
 
+A dropped target's warning names its key in `targetKeys` (a failed integration call names every target it carried), so
+a caller that merges several callers' targets into one call can attribute each failure to the targets it concerns.
+Equal warnings merge their keys instead of one being dropped. A warning with no `targetKeys` refused the whole call
+before any target was read.
+
 The hosts with a cheap check select only the change state:
 
 - **GitHub/GHE:** one aliased document per 25 targets, like the full read.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gitkraken/core-gitlens",
   "description": "GitLens core — shared Git / AI / GitHub primitives for internal GitKraken consumption",
-  "version": "0.10.7",
+  "version": "0.11.1",
   "license": "SEE LICENSE IN LICENSE",
   "author": {
     "name": "GitKraken",