@gitkraken/core-gitlens 0.4.101 → 0.5.101

package/src/plus/integrations/integrationService.ts

@@ -555,7 +555,7 @@ export class IntegrationService implements Disposable, RepositoryResolutionConte
 	async getMyIssues(
 		integrationIds?: (GitCloudHostIntegrationId | IssuesCloudHostIntegrationId | GitSelfManagedHostIntegrationId)[],
 		options?: { openRepositoriesOnly?: boolean; cancellation?: AbortSignal },
-	): Promise<IssueShape[] | undefined> {
+	): Promise<IntegrationResult<IssueShape[] | undefined>> {
 		const integrations: Map<Integration, ResourceDescriptor[] | undefined> = new Map();
 		const hostingIntegrationIds = integrationIds?.filter(
 			id => id in GitCloudHostIntegrationId || id in GitSelfManagedHostIntegrationId,
@@ -623,26 +623,54 @@ export class IntegrationService implements Disposable, RepositoryResolutionConte
 	private async getMyIssuesCore(
 		integrations: Map<Integration, ResourceDescriptor[] | undefined>,
 		cancellation?: AbortSignal,
-	): Promise<IssueShape[] | undefined> {
-		const promises: Promise<IssueShape[] | undefined>[] = [];
+	): Promise<IntegrationResult<IssueShape[] | undefined>> {
+		const start = performance.now();
+
+		const promises: Promise<IntegrationResult<IssueShape[] | undefined>>[] = [];
 		for (const [integration, repos] of integrations) {
 			if (integration == null) continue;
 
-			promises.push(integration.searchMyIssues(repos, cancellation));
+			promises.push(integration.searchMyIssuesResult(repos, cancellation));
 		}
 
 		const results = await Promise.allSettled(promises);
-		return [...flatten(filterMap(results, r => (r.status === 'fulfilled' ? r.value : undefined)))];
+		const successfulResults = [
+			...flatten(
+				filterMap(results, r =>
+					r.status === 'fulfilled' && r.value?.value != null ? r.value.value : undefined,
+				),
+			),
+		];
+		const errors = [
+			...filterMap(results, r =>
+				r.status === 'fulfilled' && r.value?.error != null ? r.value.error : undefined,
+			),
+		];
+
+		const error =
+			errors.length === 0
+				? undefined
+				: errors.length === 1
+					? errors[0]
+					: new AggregateError(errors, 'Failed to get some issues');
+
+		return {
+			value: successfulResults,
+			error: error,
+			duration: performance.now() - start,
+		};
 	}
 
-	async getMyIssuesForRemotes(remote: GitRemote): Promise<IssueShape[] | undefined>;
-	async getMyIssuesForRemotes(remotes: GitRemote[]): Promise<IssueShape[] | undefined>;
+	async getMyIssuesForRemotes(remote: GitRemote): Promise<IntegrationResult<IssueShape[] | undefined>>;
+	async getMyIssuesForRemotes(remotes: GitRemote[]): Promise<IntegrationResult<IssueShape[] | undefined>>;
 	@trace({
 		args: (remoteOrRemotes: GitRemote | GitRemote[]) => ({
 			remoteOrRemotes: Array.isArray(remoteOrRemotes) ? remoteOrRemotes.map(rp => rp.name) : remoteOrRemotes.name,
 		}),
 	})
-	async getMyIssuesForRemotes(remoteOrRemotes: GitRemote | GitRemote[]): Promise<IssueShape[] | undefined> {
+	async getMyIssuesForRemotes(
+		remoteOrRemotes: GitRemote | GitRemote[],
+	): Promise<IntegrationResult<IssueShape[] | undefined>> {
 		if (!Array.isArray(remoteOrRemotes)) {
 			remoteOrRemotes = [remoteOrRemotes];
 		}
@@ -653,7 +681,7 @@ export class IntegrationService implements Disposable, RepositoryResolutionConte
 			if (remote?.provider == null) return undefined;
 
 			const integration = await this.getByRemote(remote);
-			return integration?.searchMyIssues(remote.provider.repoDesc);
+			return integration?.searchMyIssuesResult(remote.provider.repoDesc);
 		}
 
 		const integrations = new Map<GitHostIntegration, ResourceDescriptor[]>();

package/src/plus/integrations/models/gitHostIntegration.ts

@@ -373,7 +373,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getOrganizationsForUser');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getOrganizationsForUser', ex, { scope: scope });
+			this.handleProviderException('getOrganizationsForUser', ex, {
+				scope: scope,
+				connectionId: connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -409,7 +412,7 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getProjectsForOrg');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getProjectsForOrg', ex, { scope: scope });
+			this.handleProviderException('getProjectsForOrg', ex, { scope: scope, connectionId: connectionId });
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -446,7 +449,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getRepositoriesForOrg');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getRepositoriesForOrg', ex, { scope: scope });
+			this.handleProviderException('getRepositoriesForOrg', ex, {
+				scope: scope,
+				connectionId: options?.connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -484,7 +490,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getRepositoriesForUser');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getRepositoriesForUser', ex, { scope: scope });
+			this.handleProviderException('getRepositoriesForUser', ex, {
+				scope: scope,
+				connectionId: options?.connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -1414,6 +1423,7 @@ export abstract class GitHostIntegration<
 			this.handleProviderException('searchMyPullRequests', ex, {
 				scope: scope,
 				silent: true,
+				connectionId: connectionId,
 			});
 			return {
 				error: toError(ex),
@@ -1456,7 +1466,10 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('getMyPullRequestsForUser');
 			return { value: result, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('getMyPullRequestsForUser', ex, { scope: scope });
+			this.handleProviderException('getMyPullRequestsForUser', ex, {
+				scope: scope,
+				connectionId: connectionId,
+			});
 			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
@@ -1588,7 +1601,7 @@ export abstract class GitHostIntegration<
 			this.resetRequestExceptionCount('searchPullRequests');
 			return prs;
 		} catch (ex) {
-			this.handleProviderException('searchPullRequests', ex, { scope: scope });
+			this.handleProviderException('searchPullRequests', ex, { scope: scope, connectionId: connectionId });
 			return undefined;
 		}
 	}

package/src/plus/integrations/models/integration.ts

@@ -20,6 +20,7 @@ import type {
 } from '../authentication/integrationAuthenticationProvider.js';
 import type { IntegrationAuthenticationService } from '../authentication/integrationAuthenticationService.js';
 import type { ProviderAuthenticationSession } from '../authentication/models.js';
+import { RejectedTokenTracker } from '../authentication/rejectedTokenTracker.js';
 import type { IntegrationIds, IssuesCloudHostIntegrationId } from '../constants.js';
 import { GitCloudHostIntegrationId } from '../constants.js';
 import type { IntegrationServiceContext } from '../context.js';
@@ -240,13 +241,18 @@ export abstract class IntegrationBase<
 		// A truthy connectionId targets a specific account; an empty string is not a real target, so it falls
 		// through to the primary path below.
 		if (connectionId) {
+			// A read of this connection previously failed with an AuthenticationError, so the token in
+			// storage is known-refused. Ask for a refresh through the GK cloud before reading again, which
+			// is this branch's equivalent of the primary path's `refreshSessionIfExpired`. Claimed here so
+			// the forced refresh runs at most once per rejection.
+			const refreshRejectedToken = this._rejectedTokens.claimRefresh(connectionId);
 			// Degrade to "no results" on failure, matching the primary path (whose ensureSession/
 			// refreshSessionIfExpired swallow errors) so read methods keep their never-throws contract.
 			try {
 				const authProvider = await this.authenticationService.get(this.authProvider.id);
 				const session = await authProvider.getSession(
 					{ ...this.authProviderDescriptor, connectionId: connectionId, cloud: true },
-					{ source: source },
+					{ source: source, refreshRejectedToken: refreshRejectedToken },
 				);
 				return session != null && this.isSessionForIntegrationHost(session) ? session : undefined;
 			} catch (ex) {
@@ -326,6 +332,10 @@ export abstract class IntegrationBase<
 
 	@debug()
 	async reauthenticate(): Promise<void> {
+		// `forceNewSession` below deletes the stored secrets to reconnect. Ahead of the guard — see
+		// `onStoredTokensReplaced`.
+		this.onStoredTokensReplaced();
+
 		if (this._session === undefined) return;
 
 		this._session = undefined;
@@ -343,6 +353,30 @@ export abstract class IntegrationBase<
 	requestSessionSyncForUsecase(syncReqUsecase: SyncReqUsecase): void {
 		this._syncRequestsPerFailedUsecase.add(syncReqUsecase);
 	}
+
+	/**
+	 * The per-connection counterpart of the primary session's expire-and-resync recovery: a token the
+	 * provider refused is refreshed once through the GK cloud, which exchanges the refresh token server-side
+	 * (the client never holds one). Armed by {@link handleProviderException} and consumed by
+	 * {@link resolveReadSession}; a rejection it declines belongs to {@link trackRequestException} instead.
+	 */
+	private readonly _rejectedTokens = new RejectedTokenTracker();
+
+	/**
+	 * Called by every path that replaces or removes the stored tokens — a disconnect, a forced re-sync, a
+	 * reauthentication, or the connection set changing. A rejection names a specific credential, so once that
+	 * credential is gone the rejection describes nothing and must not force a refresh (or, for a deleted
+	 * connection, outlive it).
+	 *
+	 * Deliberately NOT conditioned on `_session`. A per-connection read resolves through the auth provider and
+	 * never populates the cached primary session, so the connections this recovery exists for are exactly the
+	 * ones with no `_session` to inspect — the same blind spot the recovery itself was added to fix. Callers
+	 * that guard on `_session` therefore invoke this ahead of that guard.
+	 */
+	protected onStoredTokensReplaced(): void {
+		this._rejectedTokens.clear();
+	}
+
 	private static readonly requestExceptionLimit = 5;
 	private requestExceptionCount = 0;
 
@@ -350,6 +384,8 @@ export abstract class IntegrationBase<
 		this.requestExceptionCount = 0;
 		if (syncReqUsecase === 'all') {
 			this._syncRequestsPerFailedUsecase.clear();
+			// 'all' is the whole-integration reset: a disconnect, or a re-sync that produced a new access token.
+			this.onStoredTokensReplaced();
 		} else {
 			this._syncRequestsPerFailedUsecase.delete(syncReqUsecase);
 		}
@@ -374,6 +410,10 @@ export abstract class IntegrationBase<
 	 * `deleteConnection`). Unlike {@link reset}/{@link disconnect}, it deletes nothing from storage.
 	 */
 	switchConnection(): void {
+		// A connection was deleted, or a different one became primary. Ahead of the guard — see
+		// `onStoredTokensReplaced`.
+		this.onStoredTokensReplaced();
+
 		if (this._session === undefined) return;
 
 		const wasConnected = this._session != null;
@@ -419,6 +459,9 @@ export abstract class IntegrationBase<
 					// Reset our stored session so that we get a new one from the cloud
 					const authProvider = await this.authenticationService.get(this.authProvider.id);
 					await authProvider.deleteSession(this.authProviderDescriptor);
+					// The stored token was just deleted. Not left to the token-changed check below, which needs
+					// an `oldSession` — see `onStoredTokensReplaced`.
+					this.onStoredTokensReplaced();
 					// Reset the session and clear our "stay disconnected" flag
 					this._session = undefined;
 					await this.ctx.storage.deleteWorkspace(this.connectedKey);
@@ -474,12 +517,29 @@ export abstract class IntegrationBase<
 	protected handleProviderException(
 		syncReqUsecase: SyncReqUsecase,
 		ex: Error,
-		options?: { scope?: ScopedLogger | undefined; silent?: boolean },
+		options?: { scope?: ScopedLogger | undefined; silent?: boolean; connectionId?: string },
 	): void {
 		if (isCancellationError(ex)) return;
 
 		options?.scope?.error(ex);
 
+		// A per-connection (multi-account) read resolved its session through `resolveReadSession`'s
+		// `connectionId` branch, which deliberately never touches the cached primary `_session`. So the
+		// primary-session recovery below cannot apply to it: expiring `_session` would mark a session this
+		// read never used, while the rejected connection kept its stored token and re-sent it on every
+		// later read — a token the provider has already refused (expired scopes, a revoked grant, an
+		// uninstalled app) is not self-healing, so the read failed identically until the user reconnected
+		// by hand. Record the rejection against the connection instead; `resolveReadSession` consumes it
+		// and forces the cloud `/refresh` on the next read of that connection. When there is nothing to
+		// recover, fall through to the shared failure budget, which disconnects after
+		// `requestExceptionLimit` and surfaces the reconnect prompt.
+		if (ex instanceof AuthenticationError && options?.connectionId) {
+			if (!this._rejectedTokens.recordRejection(options.connectionId)) {
+				this.trackRequestException(options);
+			}
+			return;
+		}
+
 		if (ex instanceof AuthenticationError && this._session?.cloud) {
 			if (!this.hasSessionSyncRequests()) {
 				this.requestSessionSyncForUsecase(syncReqUsecase);
@@ -677,6 +737,7 @@ export abstract class IntegrationBase<
 		const session = await this.resolveReadSession(connectionId, scope);
 		if (session == null) return undefined;
 
+		const start = performance.now();
 		try {
 			const issues = await this.searchProviderMyIssues(
 				session,
@@ -684,10 +745,10 @@ export abstract class IntegrationBase<
 				cancellation,
 			);
 			this.resetRequestExceptionCount('searchMyIssues');
-			return { value: issues };
+			return { value: issues, duration: performance.now() - start };
 		} catch (ex) {
-			this.handleProviderException('searchMyIssues', ex, { scope: scope });
-			return { error: toError(ex) };
+			this.handleProviderException('searchMyIssues', ex, { scope: scope, connectionId: connectionId });
+			return { error: toError(ex), duration: performance.now() - start };
 		}
 	}
 
@@ -738,7 +799,7 @@ export abstract class IntegrationBase<
 			this.resetRequestExceptionCount('searchMyIssues');
 			return { value: result };
 		} catch (ex) {
-			this.handleProviderException('searchMyIssues', ex, { scope: scope });
+			this.handleProviderException('searchMyIssues', ex, { scope: scope, connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -858,7 +919,10 @@ export abstract class IntegrationBase<
 							return undefined;
 						}
 
-						this.handleProviderException('getCurrentAccount', ex, { scope: scope });
+						this.handleProviderException('getCurrentAccount', ex, {
+							scope: scope,
+							connectionId: connectionId,
+						});
 
 						// Invalidate the cache on error, except for auth errors
 						if (!(ex instanceof AuthenticationError)) {

package/src/plus/integrations/models/issuesIntegration.ts

@@ -48,7 +48,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getAccountForResource');
 			return { value: account };
 		} catch (ex) {
-			this.handleProviderException('getAccountForResource', ex);
+			this.handleProviderException('getAccountForResource', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -80,7 +80,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getResourcesForUser');
 			return { value: resources };
 		} catch (ex) {
-			this.handleProviderException('getResourcesForUser', ex);
+			this.handleProviderException('getResourcesForUser', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -108,7 +108,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getProjectsForResources');
 			return { value: projects };
 		} catch (ex) {
-			this.handleProviderException('getProjectsForResources', ex);
+			this.handleProviderException('getProjectsForResources', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -161,7 +161,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getIssuesForProject');
 			return { value: issues };
 		} catch (ex) {
-			this.handleProviderException('getIssuesForProject', ex);
+			this.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}
@@ -188,7 +188,7 @@ export abstract class IssuesIntegration<
 			this.resetRequestExceptionCount('getIssuesForProject');
 			return { value: result };
 		} catch (ex) {
-			this.handleProviderException('getIssuesForProject', ex);
+			this.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });
 			return { error: toError(ex) };
 		}
 	}

package/src/plus/integrations/providers/models.ts

@@ -470,7 +470,10 @@ export type GetIssueFn = (
 export type GetIssuesForReposFn = (
 	input: (GetIssuesForReposInput | GetIssuesForRepoIdsInput) & PagingInput,
 	options?: EnterpriseOptions,
-) => Promise<{ data: ProviderIssue[]; pageInfo?: PageInfo }>;
+	// GitHub's multi-repo issue search reports its 1,000-result cap — and, when it recovers past it by
+	// partitioning, what that recovery could not reach — through `metadata`. Documented on the contract for
+	// the reader; `getPagedResult` accepts and forwards `metadata` from any provider fn regardless.
+) => Promise<{ data: ProviderIssue[]; pageInfo?: PageInfo; metadata?: CollectionMetadata }>;
 
 export type GetIssuesForCurrentUserInput = PagingInput & {
 	// GitLab's account-wide REST read (`GET /issues`): `scope` controls breadth ('assigned_to_me' vs 'all') and

package/src/plus/integrations/providers/providersApi.ts

@@ -13,6 +13,7 @@ import type { PagedResult } from '../../../utils/paging.js';
 import type { IntegrationAuthenticationService } from '../authentication/integrationAuthenticationService.js';
 import type { TokenOptInfo, TokenWithInfo } from '../authentication/models.js';
 import { toTokenWithInfo } from '../authentication/models.js';
+import { isIncompleteCollection } from '../collectionMetadata.js';
 import type { IntegrationIds } from '../constants.js';
 import {
 	GitCloudHostIntegrationId,
@@ -32,7 +33,6 @@ import type {
 	GetIssueFn,
 	GetIssuesForReposFn,
 	GetIssuesOptions,
-	GetPullRequestsForRepoFn,
 	GetPullRequestsForReposFn,
 	GetPullRequestsForUserFn,
 	GetPullRequestsForUserOptions,
@@ -275,9 +275,7 @@ export class ProvidersApi {
 				getPullRequestsForReposFn: providerApis.gitlab.getPullRequestsForRepos.bind(
 					providerApis.gitlab,
 				) as GetPullRequestsForReposFn,
-				getPullRequestsForRepoFn: providerApis.gitlab.getPullRequestsForRepo.bind(
-					providerApis.gitlab,
-				) as GetPullRequestsForRepoFn,
+				getPullRequestsForRepoFn: providerApis.gitlab.getPullRequestsForRepo.bind(providerApis.gitlab),
 				getPullRequestsForUserFn: providerApis.gitlab.getPullRequestsAssociatedWithUser.bind(
 					providerApis.gitlab,
 				) as GetPullRequestsForUserFn,
@@ -302,9 +300,7 @@ export class ProvidersApi {
 				getPullRequestsForReposFn: providerApis.gitlab.getPullRequestsForRepos.bind(
 					providerApis.gitlab,
 				) as GetPullRequestsForReposFn,
-				getPullRequestsForRepoFn: providerApis.gitlab.getPullRequestsForRepo.bind(
-					providerApis.gitlab,
-				) as GetPullRequestsForRepoFn,
+				getPullRequestsForRepoFn: providerApis.gitlab.getPullRequestsForRepo.bind(providerApis.gitlab),
 				getPullRequestsForUserFn: providerApis.gitlab.getPullRequestsAssociatedWithUser.bind(
 					providerApis.gitlab,
 				) as GetPullRequestsForUserFn,
@@ -681,9 +677,9 @@ export class ProvidersApi {
 			// SDK collection completeness is independent from provider-native pagination: a result can expose a
 			// real next page (`more`) and still have a failed sibling scope (`partial`/`unknown`). Surface the
 			// latter as `truncated` so consumers treat the page as incomplete. Absent metadata (old providers,
-			// test doubles) leaves `truncated` unset for backward compatibility.
-			const truncated =
-				normalizedMetadata != null && normalizedMetadata.completeness !== 'complete' ? true : undefined;
+			// test doubles) leaves `truncated` unset for backward compatibility. Shares the incompleteness
+			// predicate with the facade assessment so one metadata object can't be truncated there and whole here.
+			const truncated = isIncompleteCollection(normalizedMetadata) ? true : undefined;
 
 			return {
 				values: result.data,

package/src/plus/integrations/providers/trello.ts

@@ -1,3 +1,4 @@
+import type { CollectionMetadata } from '@gitkraken/provider-apis';
 import type { Account } from '../../../git/models/author.js';
 import type { Issue, IssueShape } from '../../../git/models/issue.js';
 import type { IssueOrPullRequest, IssueOrPullRequestType } from '../../../git/models/issueOrPullRequest.js';
@@ -103,7 +104,7 @@ export class TrelloIntegration extends IssuesIntegration<IssuesCloudHostIntegrat
 		session: ProviderAuthenticationSession,
 		project: ResourceDescriptor,
 		options?: { user?: string; filters?: IssueFilter[] },
-	): Promise<{ values: IssueShape[]; truncated: boolean } | undefined> {
+	): Promise<{ values: IssueShape[]; truncated: boolean; metadata?: CollectionMetadata } | undefined> {
 		// A non-issue descriptor genuinely has nothing to read (empty), but a missing app key is a broken read.
 		if (!isIssueResourceDescriptor(project)) return undefined;
 
@@ -139,7 +140,7 @@ export class TrelloIntegration extends IssuesIntegration<IssuesCloudHostIntegrat
 		// never a cursor. Surface that as terminal truncation; there is no next page to fetch, so retrying the
 		// same read cannot recover the omitted cards (D11).
 		const truncated = result.metadata != null && result.metadata.completeness !== 'complete';
-		return { values: values, truncated: truncated };
+		return { values: values, truncated: truncated, metadata: result.metadata };
 	}
 
 	protected override searchProviderMyIssues(

package/src/plus/integrations/providers/utils/providerPaging.ts

@@ -1,6 +1,12 @@
-import type { CollectionCompleteness, CollectionMetadata, CollectionScopeFailure } from '@gitkraken/provider-apis';
+import type {
+	CollectionCompleteness,
+	CollectionMetadata,
+	CollectionOmission,
+	CollectionScopeFailure,
+} from '@gitkraken/provider-apis';
 import { isCancellationError } from '../../../../utils/cancellation.js';
-import { toCollectionScopeFailure } from '../../collectionMetadata.js';
+import { uniqueBy } from '../../../../utils/iterable.js';
+import { collectionScopeKey, toCollectionScopeFailure } from '../../collectionMetadata.js';
 import type { ProviderApiPagedResult, ProviderHierarchyResult } from '../models.js';
 
 /**
@@ -42,21 +48,29 @@ const completenessRank: Record<CollectionCompleteness, number> = { partial: 2, u
 
 /** A stable key for deduplicating structurally-identical scope failures accumulated across drained pages. */
 function collectionFailureKey(failure: CollectionScopeFailure): string {
-	const scope = failure.scope;
-	return [
-		failure.kind,
-		scope?.providerId ?? '',
-		scope?.resourceId ?? '',
-		scope?.projectId ?? '',
-		scope?.repositoryId ?? '',
-		failure.message ?? '',
-	].join(' ');
+	return [failure.kind, collectionScopeKey(failure.scope), failure.message ?? ''].join(' ');
+}
+
+/**
+ * A stable key for collapsing omissions accumulated across drained pages, matching the SDK's own
+ * `dedupeOmissions`: kind plus scope IDs, deliberately WITHOUT `limit`/`totalCount`.
+ *
+ * Those counts are a re-measurement, not an identity. GitHub recomputes the match total on every request, so
+ * one repository drained over several pages reports the same cap with a drifting total; keying on the total
+ * would emit a near-identical warning per page ("matched 1393…", "matched 1402…") that
+ * `appendDedupedWarning` cannot collapse, since the messages genuinely differ. Independently-scoped omissions
+ * still stay distinct, which is the case that carries information.
+ */
+function collectionOmissionKey(omission: CollectionOmission): string {
+	return [omission.kind, collectionScopeKey(omission.scope)].join(' ');
 }
 
 /**
  * Merges SDK collection metadata across drained pages. Completeness follows {@link completenessRank};
- * failures are concatenated and deduplicated by kind, scope IDs, and message. Returns `undefined` when no
- * page supplied metadata, so metadata-free providers and test doubles keep behaving as before.
+ * failures are deduplicated by kind, scope IDs, and message, and omissions are collapsed per kind and scope
+ * keeping the highest reported total ({@link collectionOmissionKey}). Both preserve first-reported order.
+ * Returns `undefined` when no page supplied metadata, so metadata-free providers and test doubles keep
+ * behaving as before.
  */
 export function mergeCollectionMetadata(
 	base: CollectionMetadata | undefined,
@@ -70,17 +84,25 @@ export function mergeCollectionMetadata(
 			? next.completeness
 			: base.completeness;
 
-	const failures: CollectionScopeFailure[] = [];
-	const seen = new Set<string>();
-	for (const failure of [...(base.failures ?? []), ...(next.failures ?? [])]) {
-		const key = collectionFailureKey(failure);
-		if (seen.has(key)) continue;
-
-		seen.add(key);
-		failures.push(failure);
-	}
-
-	return { completeness: completeness, ...(failures.length ? { failures: failures } : {}) };
+	// First occurrence wins: a repeated failure carries no new information, since the message is part of its key.
+	const failures = [
+		...uniqueBy([...(base.failures ?? []), ...(next.failures ?? [])], collectionFailureKey, original => original),
+	];
+	// Highest total wins, so re-measuring one cap across pages collapses to a single omission holding the
+	// largest figure reported for it — the same rule the SDK applies in `createCollectionMetadata`.
+	const omissions = [
+		...uniqueBy(
+			[...(base.omissions ?? []), ...(next.omissions ?? [])],
+			collectionOmissionKey,
+			(original, current) => ((current.totalCount ?? -1) > (original.totalCount ?? -1) ? current : undefined),
+		),
+	];
+
+	return {
+		completeness: completeness,
+		...(failures.length ? { failures: failures } : {}),
+		...(omissions.length ? { omissions: omissions } : {}),
+	};
 }
 
 /**

package/src/plus/integrations/reads/warnings.ts

@@ -15,8 +15,10 @@ import type { ProviderWarning } from '../results.js';
 /**
  * The single builder for a provider-neutral, non-auth warning: an unsupported capability, a
  * contradictory/inexpressible request, or a read that couldn't confirm completeness. Every `kind: 'other'`
- * warning the facade emits goes through here (directly, or via one of the named builders below that pin a
- * recurring message), so the discriminant is assigned in exactly one place.
+ * warning the facade raises on its own terms goes through here (directly, or via one of the named builders
+ * below that pin a recurring message), so the discriminant is assigned in one place. The warnings mapped from
+ * SDK collection metadata are the documented exception — `collectionMetadata.ts` builds those from the
+ * structured failure/omission it is given.
  *
  * The kinds that carry a programmatic remedy — `auth`, `rate-limit`, `not-found`, `no-connection` — are derived
  * from the caught error's type instead and never come from here; see `ProviderWarningKind` and

package/src/utils/date.ts

@@ -149,9 +149,12 @@ export function unitThresholdMs(unit: Intl.RelativeTimeFormatUnit): number {
 
 // fromNow keeps its OWN single-pass loop (not routed through fromNowUnit) — one iteration, no
 // intermediate {unit,value} object allocation on this hot formatting path; fromNowUnit below iterates
-// the SAME `relativeUnitThresholds` array, so the two classifications can't drift apart.
-export function fromNow(date: Date | number, short?: boolean): string {
-	const elapsed = (typeof date === 'number' ? date : date.getTime()) - Date.now();
+// the SAME `relativeUnitThresholds` array, so the two classifications can't drift apart. `now` defaults
+// to `Date.now()`, like fromNowUnit's — pass it to pin the instant (a caller comparing against its own
+// clock read otherwise sits one unpredictable tick away from the bucket it expects).
+export function fromNow(date: Date | number, short?: boolean, now: Date | number = Date.now()): string {
+	const elapsed =
+		(typeof date === 'number' ? date : date.getTime()) - (typeof now === 'number' ? now : now.getTime());
 	// Guard against invalid dates (e.g. `new Date(<unparseable>)`), since a non-finite value would throw in `Intl.RelativeTimeFormat.format`
 	if (!Number.isFinite(elapsed)) return '';