@gitkraken/core-gitlens 0.3.1 → 0.4.100

package/dist/plus/integrations/providers/azureDevOps.js

@@ -0,0 +1,925 @@
+import { base64 } from '../../../utils/base64.js';
+import { CancellationError } from '../../../utils/cancellation.js';
+import { toTokenWithInfo } from '../authentication/models.js';
+import { toCollectionScopeFailure } from '../collectionMetadata.js';
+import { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId } from '../constants.js';
+import { GitHostIntegration } from '../models/gitHostIntegration.js';
+import { fromProviderIssue, fromProviderPullRequest, getProviderPullRequestIdentity, IssueFilter, providerPullRequestMatchesSearch, providersMetadata, PullRequestFilter, toProviderPullRequestStates, } from './models.js';
+import { collectProviderPagedResult, flatSettledOrThrow, mergeCollectionMetadata } from './utils/providerPaging.js';
+function getAzureRepositoryIdentity(repo) {
+    const match = /^([^/]+)\/_git\/([^/]+)$/i.exec(repo.name);
+    return {
+        resourceName: repo.owner,
+        projectName: repo.project ?? match?.[1],
+        repositoryName: match?.[2] ?? repo.name,
+    };
+}
+/**
+ * Matches an org/project descriptor against a caller-supplied name, mirroring the facade's own
+ * key/id/name comparison so `listIssuesPage({ org, project })` narrows on the same identifiers a consumer
+ * already got back from `listOrgs`/`listProjects`.
+ */
+function azureResourceMatches(resource, value) {
+    return resource.key === value || resource.id === value || resource.name === value;
+}
+export class AzureDevOpsIntegrationBase extends GitHostIntegration {
+    getApiOptions(session, doNotConvertToPat = false) {
+        const usePat = !doNotConvertToPat;
+        const accessToken = usePat ? convertTokentoPAT(session.accessToken) : session.accessToken;
+        const tokenWithInfo = toTokenWithInfo(this.id, session, accessToken);
+        return {
+            tokenWithInfo: tokenWithInfo,
+            options: { isPAT: usePat },
+        };
+    }
+    _accounts;
+    async getProviderCurrentAccount(session) {
+        const { accessToken } = session;
+        this._accounts ??= new Map();
+        const cachedAccount = this._accounts.get(accessToken);
+        if (cachedAccount == null) {
+            const user = await this._requestForCurrentUser(session);
+            this._accounts.set(accessToken, user);
+        }
+        return this._accounts.get(accessToken);
+    }
+    async _requestForCurrentUser(session) {
+        const api = await this.getProvidersApi();
+        const { tokenWithInfo, options } = this.getApiOptions(session, true);
+        const user = await api.getCurrentUser(tokenWithInfo, options);
+        return user
+            ? {
+                provider: this,
+                id: user.id,
+                name: user.name ?? undefined,
+                email: user.email ?? undefined,
+                avatarUrl: user.avatarUrl ?? undefined,
+                username: user.username ?? undefined,
+            }
+            : undefined;
+    }
+    _organizations;
+    async getProviderResourcesForUser(session, force = false) {
+        this._organizations ??= new Map();
+        const { accessToken } = session;
+        const cachedResources = this._organizations.get(accessToken);
+        if (cachedResources == null || force) {
+            const api = await this.getProvidersApi();
+            const account = await this.getProviderCurrentAccount(session);
+            if (account?.id == null)
+                return undefined;
+            const { tokenWithInfo, options } = this.getApiOptions(session);
+            const resources = await api.getAzureResourcesForUser(tokenWithInfo, account.id, options);
+            this._organizations.set(accessToken, resources != null ? resources.map(r => ({ ...r, key: r.id })) : undefined);
+        }
+        return this._organizations.get(accessToken);
+    }
+    _projects;
+    /**
+     * Discovers (and caches) each resource's projects. Only resources whose drain completed cleanly are cached;
+     * a rejected or backstop-truncated drain is left uncached (retried next call). When `failures` is supplied,
+     * a rejected resource is recorded there as a structured {@link CollectionScopeFailure} so an account-wide
+     * caller can surface the incomplete project set (a whole org's PRs/issues silently missing otherwise) as a
+     * scope-aware warning + `fetchFailed` rather than an all-pages success over a hole.
+     */
+    async getProviderProjectsForResources(session, resources, force = false, failures) {
+        this._projects ??= new Map();
+        const { accessToken } = session;
+        let resourcesWithoutProjects = [];
+        if (force) {
+            resourcesWithoutProjects = resources;
+        }
+        else {
+            for (const resource of resources) {
+                const resourceKey = `${accessToken}:${resource.id}`;
+                const cachedProjects = this._projects.get(resourceKey);
+                if (cachedProjects == null) {
+                    resourcesWithoutProjects.push(resource);
+                }
+            }
+        }
+        const allProjects = [];
+        let resultMetadata;
+        if (resourcesWithoutProjects.length > 0) {
+            const api = await this.getProvidersApi();
+            const { tokenWithInfo, options } = this.getApiOptions(session);
+            // The projects API is paginated; a single call would drop every project past the first page (and
+            // with it their repos and PRs). Drain all pages per resource, threading the returned cursor.
+            // Per-resource (not a shared flatSettled) so a resource whose drain was truncated (hit the paging
+            // backstop) or rejected is NOT cached — caching a partial list here would make every later repo/PR/
+            // issue read for that org silently inherit an incomplete project set. Leaving it uncached means the
+            // next call retries it. The scope is passed so a page-level failure preserves the prefix already
+            // fetched and records a structured failure instead of re-throwing.
+            const drains = await Promise.allSettled(resourcesWithoutProjects.map(async (resource) => ({
+                resource: resource,
+                result: await collectProviderPagedResult(cursor => api.getAzureProjectsForResource(tokenWithInfo, resource.name, {
+                    ...options,
+                    cursor: cursor,
+                }), 20, { providerId: this.id, resourceId: resource.id }),
+            })));
+            // `allSettled` preserves order, so `drains[i]` is `resourcesWithoutProjects[i]`.
+            drains.forEach((drain, i) => {
+                // A rejected resource drain contributes nothing and is left uncached (retried next call). Record
+                // it as a structured failure so an account-wide caller can warn on the org whose projects (and
+                // thus PRs/issues) are missing, instead of silently narrowing the read.
+                if (drain.status !== 'fulfilled') {
+                    const resource = resourcesWithoutProjects[i];
+                    const failure = toCollectionScopeFailure({ providerId: this.id, resourceId: resource.id }, drain.reason);
+                    failures?.push(failure);
+                    resultMetadata = mergeCollectionMetadata(resultMetadata, {
+                        completeness: 'partial',
+                        failures: [failure],
+                    });
+                    return;
+                }
+                const { resource, result } = drain.value;
+                const projects = result.values
+                    .filter(p => p.namespace === resource.name)
+                    .map(p => ({
+                    id: p.id,
+                    name: p.name,
+                    resourceId: resource.id,
+                    resourceName: resource.name,
+                    key: p.id,
+                }));
+                if (result.metadata != null) {
+                    resultMetadata = mergeCollectionMetadata(resultMetadata, result.metadata);
+                }
+                const metadataIncomplete = result.metadata != null && result.metadata.completeness !== 'complete';
+                if (result.truncated || metadataIncomplete) {
+                    // A truncated drain is an incomplete project set; include its partial values in the current
+                    // result but don't cache it as if complete. Add a structured failure for the truncation unless
+                    // the drain already recorded a page-level failure for this resource.
+                    if (result.truncated &&
+                        !result.metadata?.failures?.some(f => f.scope?.resourceId === resource.id && f.kind !== 'unknown')) {
+                        const failure = toCollectionScopeFailure({ providerId: this.id, resourceId: resource.id }, new Error('Project discovery was truncated before all pages were read'));
+                        failures?.push(failure);
+                        resultMetadata = mergeCollectionMetadata(resultMetadata, {
+                            completeness: 'partial',
+                            failures: [failure],
+                        });
+                    }
+                    allProjects.push(...projects);
+                    return;
+                }
+                this._projects.set(`${accessToken}:${resource.id}`, projects);
+            });
+        }
+        const cachedProjects = resources.reduce((projects, resource) => {
+            const resourceProjects = this._projects.get(`${accessToken}:${resource.id}`);
+            if (resourceProjects != null) {
+                projects.push(...resourceProjects);
+            }
+            return projects;
+        }, []);
+        allProjects.push(...cachedProjects);
+        const projectsByIdentity = new Map();
+        for (const project of allProjects) {
+            const identity = `${project.resourceId}:${project.id}`;
+            if (!projectsByIdentity.has(identity)) {
+                projectsByIdentity.set(identity, project);
+            }
+        }
+        const values = [...projectsByIdentity.values()];
+        return resultMetadata != null ? { values: values, metadata: resultMetadata } : { values: values };
+    }
+    async getRepoDescriptorsForProjects(session, projects) {
+        const descriptors = new Map();
+        if (projects.length === 0)
+            return descriptors;
+        const api = await this.getProvidersApi();
+        const { tokenWithInfo, options } = this.getApiOptions(session);
+        await Promise.all(projects.map(async (project) => {
+            const repos = (await api.getReposForAzureProject(tokenWithInfo, project.resourceName, project.name, options))?.values;
+            if (repos != null && repos.length > 0) {
+                descriptors.set(project.id, repos.map(r => ({
+                    id: r.id,
+                    nodeId: r.graphQLId ?? undefined,
+                    resourceName: project.resourceName,
+                    name: r.name,
+                    projectName: project.name,
+                    url: r.webUrl ?? undefined,
+                    cloneUrlHttps: r.httpsUrl ?? undefined,
+                    cloneUrlSsh: r.sshUrl ?? undefined,
+                    key: r.id,
+                })));
+            }
+        }));
+        return descriptors;
+    }
+    async getProviderOrganizationsForUser(session) {
+        const orgs = await this.getProviderResourcesForUser(session);
+        if (orgs == null)
+            return undefined;
+        return {
+            values: orgs.map(o => ({
+                id: o.id,
+                providerId: this.id,
+                name: o.name,
+                url: `${this.apiBaseUrl}/${o.name}`,
+            })),
+        };
+    }
+    async getProviderProjectsForOrg(session, org) {
+        // Azure is the one git host with a project tier: repos live under org (resource) → project. Enumerate
+        // the user's orgs (optionally scoped to `org`), read their projects, and surface each as an org-shaped
+        // entry so the ProviderBackend facade can list them uniformly.
+        const orgs = await this.getProviderResourcesForUser(session);
+        if (orgs == null)
+            return undefined;
+        if (orgs.length === 0) {
+            return { values: [], paging: { cursor: '{}', more: false } };
+        }
+        const scopedOrgs = org != null ? orgs.filter(o => o.name === org || o.id === org) : orgs;
+        if (scopedOrgs.length === 0)
+            return { values: [] };
+        const projects = await this.getProviderProjectsForResources(session, scopedOrgs);
+        if (projects.values.length === 0 && projects.metadata == null)
+            return { values: [] };
+        return {
+            values: projects.values.map(p => ({
+                id: p.id,
+                providerId: this.id,
+                name: p.name,
+                org: p.resourceName,
+                url: `${this.apiBaseUrl}/${p.resourceName}/${p.name}`,
+            })),
+            ...(projects.metadata != null ? { metadata: projects.metadata } : {}),
+        };
+    }
+    /**
+     * With `options.project`, returns one page of that project's repos (follow `paging.cursor` to page).
+     * Without a project it fans out across every project under `org` and returns them all at once — there's
+     * no single cursor to page a parallel merge — skipping any project that fails to list rather than
+     * failing the whole org. If any successful project drain hits the defensive page backstop, the merged
+     * result is marked `truncated` without exposing a synthetic cursor.
+     */
+    async getProviderRepositoriesForOrg(session, org, options) {
+        const api = await this.getProvidersApi();
+        const { tokenWithInfo, options: apiOptions } = this.getApiOptions(session);
+        if (options?.project) {
+            return api.getReposForAzureProject(tokenWithInfo, org, options.project, {
+                ...apiOptions,
+                cursor: options.cursor,
+            });
+        }
+        const orgDescriptor = (await this.getProviderResourcesForUser(session))?.find(o => o.name === org);
+        if (orgDescriptor == null)
+            return undefined;
+        const discoveryFailures = [];
+        const projects = await this.getProviderProjectsForResources(session, [orgDescriptor], false, discoveryFailures);
+        // An empty result is only proven-empty when discovery itself succeeded; a rejected project-discovery
+        // leaves the repo set unknowable, so surface the discovery metadata rather than publishing a hole as a
+        // complete list.
+        if (projects.values.length === 0) {
+            return { values: [], metadata: projects.metadata };
+        }
+        let repoMetadata;
+        const results = await Promise.allSettled(projects.values.map(p => collectProviderPagedResult(cursor => api.getReposForAzureProject(tokenWithInfo, org, p.name, { ...apiOptions, cursor: cursor }), 20, { providerId: this.id, resourceId: org, projectId: p.name })));
+        const values = [];
+        let truncated = false;
+        for (const result of results) {
+            // With a per-project scope, collectProviderPagedResult catches page-level failures itself and returns
+            // them as metadata rather than rejecting. A rejected promise here is an unexpected internal error.
+            if (result.status !== 'fulfilled') {
+                truncated = true;
+                continue;
+            }
+            values.push(...result.value.values);
+            if (result.value.metadata != null) {
+                repoMetadata = mergeCollectionMetadata(repoMetadata, result.value.metadata);
+            }
+            truncated ||= result.value.truncated === true;
+        }
+        const metadata = mergeCollectionMetadata(repoMetadata, projects.metadata);
+        return {
+            values: values,
+            ...(metadata != null ? { metadata: metadata } : {}),
+            ...(truncated || (metadata != null && metadata.completeness !== 'complete') ? { truncated: true } : {}),
+        };
+    }
+    async mergeProviderPullRequest(session, pr, options) {
+        const api = await this.getProvidersApi();
+        if (pr.refs == null || pr.project == null)
+            return false;
+        const { tokenWithInfo, options: apiOptions } = this.getApiOptions(session);
+        try {
+            const merged = await api.mergePullRequest(tokenWithInfo, pr, {
+                ...options,
+                ...apiOptions,
+            });
+            return merged;
+        }
+        catch (ex) {
+            this.showMergeErrorMessage(ex);
+            return false;
+        }
+    }
+    showMergeErrorMessage(ex) {
+        this.ctx.hooks?.ui?.onError?.(`${ex.message}. Check branch policies, and ensure you have the necessary permissions to merge the pull request.`);
+    }
+    async getProviderAccountForCommit(session, repo, rev, options) {
+        return (await this.authenticationService.apis.azure)?.getAccountForCommit(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, rev, this.apiBaseUrl, options);
+    }
+    async getProviderAccountForEmail(_session, _repo, _email, _options) {
+        return Promise.resolve(undefined);
+    }
+    async getProviderDefaultBranch(session, repo, cancellation) {
+        return (await this.authenticationService.apis.azure)?.getDefaultBranch(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, { baseUrl: this.apiBaseUrl }, cancellation);
+    }
+    async getProviderLinkedIssueOrPullRequest(session, repo, { id }, type) {
+        return (await this.authenticationService.apis.azure)?.getIssueOrPullRequest(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, id, {
+            baseUrl: this.apiBaseUrl,
+            type: type,
+        });
+    }
+    async getProviderIssue(session, project, id) {
+        const user = await this.getProviderCurrentAccount(session);
+        if (user?.username == null)
+            return undefined;
+        const orgs = await this.getProviderResourcesForUser(session);
+        if (orgs == null || orgs.length === 0)
+            return undefined;
+        const projects = await this.getProviderProjectsForResources(session, orgs);
+        if (projects.values.length === 0)
+            return undefined;
+        const matchingProject = projects.values.find(p => p.resourceName === project.owner && p.name === project.name);
+        if (matchingProject == null)
+            return undefined;
+        return (await this.authenticationService.apis.azure)?.getIssue(this, toTokenWithInfo(this.id, session), matchingProject, id, {
+            baseUrl: this.apiBaseUrl,
+        });
+    }
+    async getProviderPullRequestForBranch(session, repo, branch, _options) {
+        return (await this.authenticationService.apis.azure)?.getPullRequestForBranch(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, branch, {
+            baseUrl: this.apiBaseUrl,
+        });
+    }
+    async getProviderPullRequestForCommit(session, repo, rev) {
+        return (await this.authenticationService.apis.azure)?.getPullRequestForCommit(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, rev, this.apiBaseUrl);
+    }
+    async getRepoInfo(repo) {
+        const identity = getAzureRepositoryIdentity(repo);
+        if (identity.projectName == null)
+            return undefined;
+        const api = await this.getProvidersApi();
+        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
+        const session = await this.resolveReadSession(repo.connectionId, undefined);
+        if (session == null)
+            return undefined;
+        const { tokenWithInfo, options } = this.getApiOptions(session);
+        return api.getRepo(tokenWithInfo, identity.resourceName, identity.repositoryName, identity.projectName, options);
+    }
+    async getProviderRepositoryMetadata(session, repo, cancellation) {
+        return (await this.authenticationService.apis.azure)?.getRepositoryMetadata(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, { baseUrl: this.apiBaseUrl }, cancellation);
+    }
+    async searchProviderMyPullRequests(session, repos, _cancellation, _silent, state, _options) {
+        const api = await this.getProvidersApi();
+        if (repos != null) {
+            // TODO: implement repos version
+            return undefined;
+        }
+        const states = toProviderPullRequestStates(state);
+        const user = await this.getProviderCurrentAccount(session);
+        // Azure filters key on the identity GUID (account id), not the display name — see
+        // getProviderMyPullRequestsForUser and the repo-scoped path in gitHostIntegration.ts.
+        if (user?.id == null)
+            return undefined;
+        const orgs = await this.getProviderResourcesForUser(session);
+        if (orgs == null || orgs.length === 0)
+            return undefined;
+        const projects = await this.getProviderProjectsForResources(session, orgs);
+        if (projects.values.length === 0)
+            return undefined;
+        const repoDescriptors = [
+            ...((await this.getRepoDescriptorsForProjects(session, projects.values)) ?? new Map()).values(),
+        ]
+            .filter(r => r != null)
+            .flat();
+        const { tokenWithInfo, options } = this.getApiOptions(session);
+        const projectInputs = projects.values.map(p => ({ namespace: p.resourceName, project: p.name }));
+        // Legacy array-returning path (Launchpad/focus view): unwrap `.values` from the SDK collection result.
+        // The metadata (partial/failures) isn't surfaced here because this path's return type has no warning
+        // channel; the metadata-aware ProviderBackend surface is getProviderMyPullRequestsForUser above.
+        const assignedPrs = (await api.getPullRequestsForAzureProjects(tokenWithInfo, projectInputs, {
+            ...options,
+            assigneeLogins: [user.id],
+            states: states,
+        })).values.map(pr => this.fromAzureProviderPullRequest(pr, repoDescriptors, projects.values));
+        const authoredPrs = (await api.getPullRequestsForAzureProjects(tokenWithInfo, projectInputs, {
+            ...options,
+            authorLogin: user.id,
+            states: states,
+        })).values.map(pr => this.fromAzureProviderPullRequest(pr, repoDescriptors, projects.values));
+        const prsById = new Map();
+        for (const pr of authoredPrs) {
+            prsById.set(pr.id, pr);
+        }
+        for (const pr of assignedPrs) {
+            const existing = prsById.get(pr.id);
+            if (existing == null) {
+                prsById.set(pr.id, pr);
+            }
+        }
+        return [...prsById.values()];
+    }
+    async getProviderMyPullRequestsForUser(session, options) {
+        const api = await this.getProvidersApi();
+        const user = await this.getProviderCurrentAccount(session);
+        // Azure routes authorLogin/assigneeLogins to `searchCriteria.creatorId`/`reviewerId`, which require the
+        // identity GUID (account id), not the display name — matching the repo-scoped path in
+        // gitHostIntegration.ts. Using `username` here would match nothing and return zero PRs.
+        if (user?.id == null)
+            return undefined;
+        // Azure PRs are org + project scoped: enumerate the user's orgs and their projects, then read authored
+        // and assigned PRs across all of them. Return the raw provider shape (not the normalized model) so the
+        // ProviderBackend surface stays uniform with the other providers.
+        const orgs = await this.getProviderResourcesForUser(session);
+        if (orgs == null || orgs.length === 0)
+            return undefined;
+        // Structured per-scope failures from BOTH project discovery (a whole org dropped) and the per-project PR
+        // drains, so the facade warns on the failed scope + sets `fetchFailed` instead of silently narrowing.
+        const failures = [];
+        const projects = await this.getProviderProjectsForResources(session, orgs, false, failures);
+        if (projects.values.length === 0) {
+            // Project discovery itself was incomplete (e.g. a truncated org); surface the metadata so the facade
+            // can warn and set fetchFailed rather than reporting an empty account.
+            const incomplete = projects.metadata != null && projects.metadata.completeness !== 'complete';
+            return {
+                values: [],
+                paging: { cursor: '{}', more: false, truncated: incomplete || undefined },
+                ...(projects.metadata != null ? { metadata: projects.metadata } : {}),
+            };
+        }
+        const { tokenWithInfo, options: apiOptions } = this.getApiOptions(session);
+        const states = toProviderPullRequestStates(options?.state);
+        const maxPagesPerProject = 20;
+        // Drain each project fully (numbered pages) for both the authored and assigned reads. Azure has no
+        // single cross-project cursor, so the aggregate is one page; `truncated` is set only if a project hit
+        // the backstop with more pages remaining.
+        let truncated = projects.metadata != null && projects.metadata.completeness !== 'complete';
+        // Drain one project's numbered pages, returning its PRs and any per-page failure. Returns per-project
+        // (not mutating shared state) so the fan-out below can be settled independently: one project's read
+        // failure must not discard every other project's already-drained PRs.
+        const drainProject = async (project, scope, filter) => {
+            const collected = [];
+            const projectIdentity = `${project.namespace}/${project.project}`;
+            let page;
+            for (let i = 0; i < maxPagesPerProject; i++) {
+                try {
+                    const result = await api.getPullRequestsForAzureProject(tokenWithInfo, project, {
+                        ...apiOptions,
+                        ...filter,
+                        states: states,
+                        page: page,
+                    });
+                    if (result == null) {
+                        if (page == null)
+                            break;
+                        truncated = true;
+                        return {
+                            prs: collected,
+                            projectIdentity: projectIdentity,
+                            failure: toCollectionScopeFailure(scope, new Error('Azure DevOps returned no page after advertising a continuation')),
+                        };
+                    }
+                    collected.push(...result.data);
+                    if (!result.hasMore)
+                        break;
+                    if (result.nextPage == null || result.nextPage === page) {
+                        truncated = true;
+                        return {
+                            prs: collected,
+                            projectIdentity: projectIdentity,
+                            failure: toCollectionScopeFailure(scope, new Error('Azure DevOps returned no advancing pull request continuation')),
+                        };
+                    }
+                    page = result.nextPage;
+                    if (i === maxPagesPerProject - 1) {
+                        truncated = true;
+                    }
+                }
+                catch (ex) {
+                    // A page failure after the first page leaves the already-drained prefix intact; record the
+                    // failure at the project scope instead of re-throwing and discarding the prefix.
+                    truncated = true;
+                    return {
+                        prs: collected,
+                        projectIdentity: projectIdentity,
+                        failure: toCollectionScopeFailure(scope, ex),
+                    };
+                }
+            }
+            return { prs: collected, projectIdentity: projectIdentity };
+        };
+        // Settle per-project failures instead of rejecting the whole sweep. `drainProject` already catches its own
+        // page-level failures, so the structured failure (attributed to that project) is preserved rather than
+        // re-thrown — re-throwing an auth/rate-limit rejection would discard every other project's already-drained
+        // PRs. Auth/rate-limit stay actionable through the failure's kind (the facade maps it to an `auth`/`rate-limit`
+        // warning + `fetchFailed`), matching the SDK's model. `failures` was declared above so project-discovery
+        // failures and per-project drain failures share it.
+        const requested = options?.filters?.length ? new Set(options.filters) : undefined;
+        const wantAuthored = requested == null || requested.has(PullRequestFilter.Author);
+        // Azure has no assignee concept distinct from reviewer. Both neutral relationships map to reviewerId.
+        const wantReviewed = requested == null ||
+            requested.has(PullRequestFilter.Assignee) ||
+            requested.has(PullRequestFilter.ReviewRequested);
+        const outcomes = await Promise.all(projects.values.flatMap(p => {
+            const project = { namespace: p.resourceName, project: p.name };
+            const scope = { providerId: this.id, resourceId: p.resourceId, projectId: p.name };
+            const drains = [];
+            if (wantAuthored) {
+                drains.push(drainProject(project, scope, { authorLogin: user.id }));
+            }
+            if (wantReviewed) {
+                drains.push(drainProject(project, scope, { reviewerId: user.id }));
+            }
+            return drains;
+        }));
+        // Azure's `pullRequestId` is not account-global. Prefer repository + PR id, then the org-qualified URL.
+        // If neither is available, preserve the row instead of collapsing unrelated repositories by numeric id.
+        const prsByIdentity = new Map();
+        for (const outcome of outcomes) {
+            if (outcome.failure != null) {
+                failures.push(outcome.failure);
+            }
+            for (const pr of outcome.prs) {
+                const key = getProviderPullRequestIdentity(pr) ?? `project:${outcome.projectIdentity}:pull-request:${pr.id}`;
+                if (!prsByIdentity.has(key)) {
+                    prsByIdentity.set(key, pr);
+                }
+            }
+        }
+        const metadata = mergeCollectionMetadata(failures.length > 0 ? { completeness: 'partial', failures: failures } : undefined, projects.metadata);
+        return {
+            values: [...prsByIdentity.values()],
+            paging: { cursor: '{}', more: false, truncated: truncated || undefined },
+            metadata: metadata,
+        };
+    }
+    async searchProviderPullRequests(session, searchQuery, repos, cancellation, options) {
+        if (cancellation?.aborted)
+            throw new CancellationError();
+        const orgs = await this.getProviderResourcesForUser(session);
+        if (cancellation?.aborted)
+            throw new CancellationError();
+        if (orgs == null || orgs.length === 0)
+            return undefined;
+        // `getProviderProjectsForResources` returns a collection result ({ values, metadata }); this search
+        // path only needs the resolved projects, so read `.values`.
+        const projects = (await this.getProviderProjectsForResources(session, orgs)).values;
+        if (cancellation?.aborted)
+            throw new CancellationError();
+        if (projects.length === 0)
+            return undefined;
+        const repoDescriptorsByProject = await this.getRepoDescriptorsForProjects(session, projects);
+        if (cancellation?.aborted)
+            throw new CancellationError();
+        const repoDescriptors = [...repoDescriptorsByProject.values()].filter(r => r != null).flat();
+        const requestedRepos = repos?.map(getAzureRepositoryIdentity);
+        const repoInputs = requestedRepos == null
+            ? undefined
+            : repoDescriptors.filter(r => requestedRepos.some(repo => repo.resourceName === r.resourceName &&
+                repo.repositoryName === r.name &&
+                (repo.projectName == null || repo.projectName === r.projectName)));
+        if (repoInputs?.length === 0)
+            return [];
+        const api = await this.getProvidersApi();
+        const { tokenWithInfo, options: apiOptions } = this.getApiOptions(session);
+        const states = toProviderPullRequestStates(options?.include);
+        const searchScopes = repoInputs != null
+            ? repoInputs.flatMap(repo => repo.projectName == null
+                ? []
+                : [
+                    {
+                        project: { namespace: repo.resourceName, project: repo.projectName },
+                        repo: {
+                            id: repo.id,
+                            name: repo.name,
+                            namespace: repo.resourceName,
+                            project: repo.projectName,
+                        },
+                    },
+                ])
+            : projects.map(project => ({
+                project: { namespace: project.resourceName, project: project.name },
+            }));
+        const providerPullRequests = await flatSettledOrThrow(searchScopes.map(async (scope) => {
+            const values = [];
+            let page;
+            for (let i = 0; i < 20; i++) {
+                if (cancellation?.aborted)
+                    throw new CancellationError();
+                const result = await api.getPullRequestsForAzureProject(tokenWithInfo, scope.project, {
+                    ...apiOptions,
+                    page: page,
+                    repo: scope.repo,
+                    states: states,
+                });
+                if (result == null)
+                    break;
+                values.push(...result.data);
+                if (!result.hasMore || result.nextPage == null)
+                    break;
+                page = result.nextPage;
+            }
+            return values;
+        }));
+        if (cancellation?.aborted)
+            throw new CancellationError();
+        return [...new Map(providerPullRequests.map(pr => [pr.url ?? `${pr.repository.id}:${pr.id}`, pr])).values()]
+            .filter(pr => providerPullRequestMatchesSearch(pr, searchQuery))
+            .map(pr => this.fromAzureProviderPullRequest(pr, repoDescriptors, projects));
+    }
+    async searchProviderMyIssues(session, repos) {
+        return (await this.searchProviderMyIssuesWithTruncation(session, repos))?.values;
+    }
+    /**
+     * Account-wide "my issues" for Azure = the user's authored + assigned work items across every project of
+     * every org. Azure's issue read is numbered-page, so each (project × filter) read is drained to exhaustion
+     * (bounded by a defensive per-read backstop). Unlike a silent `flatSettled`, a project read that was
+     * truncated by the backstop or rejected outright is recorded as `truncated`, so the facade reports an
+     * incomplete read instead of publishing a partial list as complete.
+     *
+     * `searchOptions.org`/`.project` narrow the fan-out server-side (each drain is already a per-project read,
+     * so scoping just selects which projects to drain). Without this there was no way to ask for "work items in
+     * project P": a consumer had to filter the account-wide page client-side, which desynchronizes the filtered
+     * `items` from the `hasMore`/`currentPage` of the pre-filter read — a project-less page reads as "no issues"
+     * while `hasMore` is still true.
+     */
+    async searchProviderMyIssuesWithTruncation(session, _resources, _cancellation, searchOptions) {
+        const api = await this.getProvidersApi();
+        const user = await this.getProviderCurrentAccount(session);
+        if (user?.username == null)
+            return undefined;
+        const allOrgs = await this.getProviderResourcesForUser(session);
+        if (allOrgs == null)
+            return undefined;
+        if (allOrgs.length === 0)
+            return { values: [], truncated: false };
+        // Scope by org first so project discovery only fans out over the requested account. An org filter that
+        // matches nothing is an empty-but-successful read, not an unsupported one: returning `undefined` here
+        // would be reported as "account-wide issue search is not supported by this provider".
+        const orgs = searchOptions?.org != null ? allOrgs.filter(o => azureResourceMatches(o, searchOptions.org)) : allOrgs;
+        if (orgs.length === 0)
+            return { values: [], truncated: false };
+        // Structured per-scope failures from BOTH project discovery (a whole org dropped) and the per-project
+        // issue drains, so the facade warns on the failed scope + sets `fetchFailed` instead of narrowing silently.
+        const failures = [];
+        const discovered = await this.getProviderProjectsForResources(session, orgs, false, failures);
+        const projects = searchOptions?.project != null
+            ? {
+                ...discovered,
+                values: discovered.values.filter(p => azureResourceMatches(p, searchOptions.project)),
+            }
+            : discovered;
+        if (projects.values.length === 0) {
+            // An explicitly-scoped read that found no matching project is an empty SUCCESS: `undefined` here is
+            // reported as "account-wide issue search is not supported by this provider", which would send the
+            // consumer down a repo-scoped fallback for what is simply an empty scope. Only an incomplete discovery
+            // (which may itself have dropped the requested project) is truncated, and its metadata is forwarded so
+            // the facade still warns on the failed scope.
+            return projects.metadata != null
+                ? {
+                    values: [],
+                    truncated: projects.metadata.completeness !== 'complete',
+                    metadata: projects.metadata,
+                }
+                : { values: [], truncated: false };
+        }
+        const { tokenWithInfo, options } = this.getApiOptions(session);
+        // Drain one (project × filter) read fully, threading the provider's paging cursor. The scope is passed so
+        // a page-level failure preserves the already-drained prefix and records a structured failure instead of
+        // re-throwing.
+        const drain = async (p, filter) => {
+            const result = await collectProviderPagedResult(cursor => api.getIssuesForAzureProject(tokenWithInfo, p.resourceName, p.name, {
+                ...options,
+                ...filter,
+                cursor: cursor,
+            }), 20, { providerId: this.id, resourceId: p.resourceId, projectId: p.name });
+            return {
+                issues: result.values.map(i => fromProviderIssue(i, this, { project: p })),
+                // Azure work-item ids are organization-scoped. Include both org and project so the
+                // assigned/authored passes dedupe the same item without collapsing another org's item.
+                projectKey: `${p.resourceId}:${p.id}`,
+                truncated: result.truncated ?? false,
+                metadata: result.metadata,
+            };
+        };
+        // `includeAllAssignees` broadens to every issue in each project (any assignee, any author), so a single
+        // unfiltered drain per project replaces the assigned+authored pair — an unfiltered assignee drain already
+        // subsumes the authored one.
+        //
+        // `filters` narrows the other way: unfiltered, "my issues" here is assigned ∪ authored, which is wider than
+        // `assignee:@me`. Selecting the drains is the only correct place to narrow — dropping authored-only items
+        // from the returned page would leave them counted in the per-project paging that produced it.
+        const filters = searchOptions?.filters;
+        const wantAssigned = !filters?.length || filters.includes(IssueFilter.Assignee);
+        const wantAuthored = !filters?.length || filters.includes(IssueFilter.Author);
+        const outcomes = await Promise.all(projects.values.flatMap(p => {
+            if (searchOptions?.includeAllAssignees)
+                return [drain(p, {})];
+            const drains = [];
+            if (wantAssigned) {
+                drains.push(drain(p, { assigneeLogins: [user.username] }));
+            }
+            if (wantAuthored) {
+                drains.push(drain(p, { authorLogin: user.username }));
+            }
+            return drains;
+        }));
+        const issuesById = new Map();
+        let truncated = projects.metadata != null && projects.metadata.completeness !== 'complete';
+        let drainMetadata;
+        for (const outcome of outcomes) {
+            if (outcome.truncated) {
+                truncated = true;
+            }
+            if (outcome.metadata != null) {
+                drainMetadata = mergeCollectionMetadata(drainMetadata, outcome.metadata);
+            }
+            for (const issue of outcome.issues) {
+                const key = `${outcome.projectKey}:${issue.nodeId ?? issue.id}`;
+                if (!issuesById.has(key)) {
+                    issuesById.set(key, issue);
+                }
+            }
+        }
+        const metadata = mergeCollectionMetadata(failures.length > 0 ? { completeness: 'partial', failures: failures } : undefined, mergeCollectionMetadata(drainMetadata, projects.metadata));
+        return { values: [...issuesById.values()], truncated: truncated, metadata: metadata };
+    }
+    async providerOnConnect() {
+        if (this._session == null)
+            return;
+        const canHydrateStoredProjects = (metadata) => metadata == null || metadata.completeness === 'complete';
+        const storedAccount = this.ctx.storage.get(`azure:${this._session.accessToken}:account`);
+        const storedOrganizations = this.ctx.storage.get(`azure:${this._session.accessToken}:organizations`);
+        const storedProjects = this.ctx.storage.get(`azure:${this._session.accessToken}:projects`);
+        let account = storedAccount?.data ? { ...storedAccount.data, provider: this } : undefined;
+        let organizations = storedOrganizations?.data?.map((o) => ({ ...o }));
+        const storedProjectsData = storedProjects?.data;
+        let projects;
+        if (!Array.isArray(storedProjectsData) && Array.isArray(storedProjectsData?.values)) {
+            const hydrated = {
+                values: storedProjectsData.values.map((p) => ({ ...p })),
+                ...(storedProjectsData.metadata != null ? { metadata: storedProjectsData.metadata } : {}),
+            };
+            if (canHydrateStoredProjects(hydrated.metadata)) {
+                projects = hydrated;
+            }
+        }
+        if (storedAccount == null) {
+            account = await this.getProviderCurrentAccount(this._session);
+            if (account != null) {
+                // Clear all other stored organizations and projects and accounts when our session changes
+                await this.ctx.storage.deleteWithPrefix('azure');
+                await this.ctx.storage.store(`azure:${this._session.accessToken}:account`, {
+                    v: 1,
+                    timestamp: Date.now(),
+                    data: {
+                        id: account.id,
+                        name: account.name,
+                        email: account.email,
+                        avatarUrl: account.avatarUrl,
+                        username: account.username,
+                    },
+                });
+            }
+        }
+        this._accounts ??= new Map();
+        this._accounts.set(this._session.accessToken, account);
+        if (storedOrganizations == null) {
+            organizations = await this.getProviderResourcesForUser(this._session, true);
+            await this.ctx.storage.store(`azure:${this._session.accessToken}:organizations`, {
+                v: 1,
+                timestamp: Date.now(),
+                data: organizations,
+            });
+        }
+        this._organizations ??= new Map();
+        this._organizations.set(this._session.accessToken, organizations);
+        if (projects == null && organizations?.length) {
+            projects = await this.getProviderProjectsForResources(this._session, organizations);
+            if (projects != null && canHydrateStoredProjects(projects.metadata)) {
+                await this.ctx.storage.store(`azure:${this._session.accessToken}:projects`, {
+                    v: 2,
+                    timestamp: Date.now(),
+                    data: projects,
+                });
+            }
+            else {
+                await this.ctx.storage.delete(`azure:${this._session.accessToken}:projects`);
+            }
+        }
+        this._projects ??= new Map();
+        if (projects != null && canHydrateStoredProjects(projects.metadata)) {
+            for (const project of projects.values) {
+                const projectKey = `${this._session.accessToken}:${project.resourceId}`;
+                const projects = this._projects.get(projectKey);
+                if (projects == null) {
+                    this._projects.set(projectKey, [project]);
+                }
+                else if (!projects.some(p => p.id === project.id)) {
+                    projects.push(project);
+                }
+            }
+        }
+    }
+    providerOnDisconnect() {
+        this._organizations = undefined;
+        this._projects = undefined;
+        this._accounts = undefined;
+    }
+    fromAzureProviderPullRequest(azurePullRequest, repoDescriptors, projectDescriptors) {
+        const baseRepoDescriptor = repoDescriptors.find(r => r.id === azurePullRequest.repository.id);
+        const headRepoDescriptor = azurePullRequest.headRepository != null
+            ? repoDescriptors.find(r => r.id === azurePullRequest.headRepository.id)
+            : undefined;
+        let project;
+        if (baseRepoDescriptor != null) {
+            azurePullRequest.repository.remoteInfo = {
+                ...azurePullRequest.repository.remoteInfo,
+                cloneUrlHTTPS: baseRepoDescriptor.cloneUrlHttps ?? '',
+                cloneUrlSSH: baseRepoDescriptor.cloneUrlSsh ?? '',
+            };
+        }
+        if (headRepoDescriptor != null) {
+            azurePullRequest.headRepository = {
+                ...azurePullRequest.headRepository,
+                id: azurePullRequest.headRepository?.id ?? headRepoDescriptor.id,
+                name: azurePullRequest.headRepository?.name ?? headRepoDescriptor.name,
+                owner: {
+                    login: azurePullRequest.headRepository?.owner.login ?? headRepoDescriptor.resourceName,
+                },
+                remoteInfo: {
+                    ...azurePullRequest.headRepository?.remoteInfo,
+                    cloneUrlHTTPS: headRepoDescriptor.cloneUrlHttps ?? '',
+                    cloneUrlSSH: headRepoDescriptor.cloneUrlSsh ?? '',
+                },
+            };
+        }
+        if (baseRepoDescriptor?.projectName != null) {
+            project = projectDescriptors.find(p => p.resourceName === baseRepoDescriptor.resourceName && p.name === baseRepoDescriptor.projectName);
+        }
+        return fromProviderPullRequest(azurePullRequest, this, { project: project });
+    }
+}
+const cloudMetadata = providersMetadata[GitCloudHostIntegrationId.AzureDevOps];
+const cloudAuthProvider = Object.freeze({ id: cloudMetadata.id, scopes: cloudMetadata.scopes });
+export class AzureDevOpsIntegration extends AzureDevOpsIntegrationBase {
+    authProvider = cloudAuthProvider;
+    id = GitCloudHostIntegrationId.AzureDevOps;
+    key = this.id;
+    name = 'Azure DevOps';
+    get domain() {
+        return cloudMetadata.domain;
+    }
+    get apiBaseUrl() {
+        return 'https://dev.azure.com';
+    }
+}
+const serverMetadata = providersMetadata[GitSelfManagedHostIntegrationId.AzureDevOpsServer];
+const serverAuthProvider = Object.freeze({ id: serverMetadata.id, scopes: serverMetadata.scopes });
+export class AzureDevOpsServerIntegration extends AzureDevOpsIntegrationBase {
+    domain;
+    authProvider = serverAuthProvider;
+    id = GitSelfManagedHostIntegrationId.AzureDevOpsServer;
+    key;
+    name = 'Azure DevOps Server';
+    constructor(ctx, authenticationService, getProvidersApi, didChangeConnection, domain) {
+        super(ctx, authenticationService, getProvidersApi, didChangeConnection);
+        this.domain = domain;
+        this.key = `${this.id}:${this.domain}`;
+    }
+    get apiBaseUrl() {
+        const protocol = this._session?.protocol ?? 'https:';
+        return `${protocol}//${this.domain}`;
+    }
+    getApiOptions(session, doNotConvertToPat = false) {
+        const { options, ...rest } = super.getApiOptions(session, doNotConvertToPat);
+        return {
+            ...rest,
+            options: { ...options, baseUrl: this.apiBaseUrl },
+        };
+    }
+    async _requestForCurrentUser(session) {
+        const azure = await this.authenticationService.apis.azure;
+        const user = azure
+            ? await azure.getCurrentUserOnServer(this, toTokenWithInfo(this.id, session), this.apiBaseUrl)
+            : undefined;
+        return user
+            ? {
+                provider: this,
+                id: user.id,
+                name: user.name ?? undefined,
+                email: user.email ?? undefined,
+                avatarUrl: user.avatarUrl ?? undefined,
+                username: user.username ?? undefined,
+            }
+            : undefined;
+    }
+}
+export function convertTokentoPAT(accessToken) {
+    return base64(`PAT:${accessToken}`);
+}
+//# sourceMappingURL=azureDevOps.js.map