@gitkraken/core-gitlens 0.5.108 → 0.5.110

package/src/plus/integrations/providers/github.ts

@@ -1,3 +1,4 @@
+import { gitHubPullRequestRelationshipQualifiers } from '../../git-github/api/pullRequestSearchQuery.js';
 import type { Account, UnidentifiedAuthor } from '../../../git/models/author.js';
 import type { DefaultBranch } from '../../../git/models/defaultBranch.js';
 import type { Issue, IssueSearchCriteria, IssueShape } from '../../../git/models/issue.js';
@@ -50,17 +51,6 @@ import {
 } from './models.js';
 import type { ProvidersApi } from './providersApi.js';
 
-/**
- * Page size for GitHub's account-wide search reads: the maximum GitHub's search connection accepts, and what
- * `GitHubApi.searchMyPullRequestsPage` already caps itself to.
- *
- * Requested explicitly rather than left to the SDK's own fallback. That fallback is also 100 as of
- * `@gitkraken/provider-apis` 0.54.0 (it was 15 before, which cost a drained sweep ~7x the round trips it needs),
- * so this is now a pin rather than an override — it keeps the size this read is tuned for from silently tracking
- * a shared SDK default that other reads may want smaller.
- */
-const githubSearchMaxPageSize = 100;
-
 type GitHubPullRequestFacetCursor = Record<string, string>;
 
 function toPullRequestFacetCursor(value: unknown): GitHubPullRequestFacetCursor {
@@ -91,13 +81,6 @@ function parsePullRequestFacetCursor(cursor: string | undefined): GitHubPullRequ
 	}
 }
 
-const pullRequestRelationshipQualifier: Record<PullRequestFilter, string> = {
-	[PullRequestFilter.Author]: 'author:@me',
-	[PullRequestFilter.Assignee]: 'assignee:@me',
-	[PullRequestFilter.ReviewRequested]: 'review-requested:@me',
-	[PullRequestFilter.Mention]: 'mentions:@me',
-};
-
 const metadata = providersMetadata[GitCloudHostIntegrationId.GitHub];
 const authProvider: IntegrationAuthenticationProviderDescriptor = Object.freeze({
 	id: metadata.id,
@@ -441,140 +424,124 @@ abstract class GitHubIntegrationBase<ID extends GitHubIntegrationIds> extends Gi
 		},
 	): Promise<ProviderApiPagedResult<ProviderPullRequest> | undefined> {
 		const explicitFilters = options?.filters?.length ? [...new Set(options.filters)] : undefined;
-		// Explicit relationships need independent search facets so the returned union is exact. State-only reads
-		// retain the provider-native `involves:@me` behavior for backward compatibility.
-		if ((options?.state?.length ?? 0) > 0 || explicitFilters != null || options?.includeReviewRequested === true) {
-			const github = await this.authenticationService.apis.github;
-			if (github == null) return undefined;
-
-			const requestedStates: PullRequestStateFilter[] =
-				options?.state != null && options.state.length > 0 ? [...new Set(options.state)] : ['open'];
-			const facets =
-				explicitFilters?.length != null
-					? requestedStates.flatMap(state =>
-							explicitFilters.map(filter => ({
-								key: `${state}:${filter}`,
-								state: state,
-								search: pullRequestRelationshipQualifier[filter],
-							})),
-						)
-					: requestedStates.flatMap(state => [
-							{ key: state, state: state, search: undefined },
-							...(options?.includeReviewRequested === true
-								? [
-										{
-											key: `${state}:${PullRequestFilter.ReviewRequested}`,
-											state: state,
-											search: pullRequestRelationshipQualifier[PullRequestFilter.ReviewRequested],
-										},
-									]
-								: []),
-						]);
-			const cursors = parsePullRequestFacetCursor(options?.cursor);
-			const hasResumableFacetCursor = Object.keys(cursors).length !== 0;
-			const facetsWithCursor = facets.filter(facet => cursors[facet.key] != null);
-			// The first call has no cursor, so query every requested state. A continuation only happens after a
-			// prior page reported `more:true`, whose bundle carries a cursor for each facet still in flight;
-			// facets absent from the bundle are exhausted, so re-querying them from scratch would refetch the
-			// same PRs (duplicated by the dedup-free sweep) and waste an API call per page. Query only the
-			// states that still have a cursor, but degrade a malformed/empty cursor bundle, or one that doesn't
-			// apply to the current requested states, to the first page rather than returning an empty page.
-			const facetsToQuery =
-				options?.cursor != null && hasResumableFacetCursor && facetsWithCursor.length !== 0
-					? facetsWithCursor
-					: facets;
-			const results = await Promise.allSettled(
-				facetsToQuery.map(async facet => ({
-					key: facet.key,
-					result: await github.searchMyPullRequestsPage(this, toTokenWithInfo(this.id, session), {
-						baseUrl: this.apiBaseUrl,
-						state: facet.state,
-						cursor: cursors[facet.key],
-						summary: options?.summary,
-						...(facet.search != null
-							? { search: facet.search, includeDefaultInvolvement: false }
-							: undefined),
-					}),
-				})),
-			);
-			if (results.every(result => result.status === 'rejected')) {
-				const first = results[0];
-				if (first?.status === 'rejected') throw first.reason;
-			}
+		// Every account-wide read goes through our own facet search — there is deliberately no SDK
+		// `getPullRequestsForUser` fallback. It could express neither a state set, nor exact relationships (its
+		// `involves:` is a different question), nor the full projection, so which reads it could serve depended on
+		// the options, and the two routes disagreed on more than they had to: only this one applies the Launchpad
+		// ignored/included repository and organization qualifiers, so the same read returned different pull
+		// requests depending on options that were supposed to affect only projection or relationship. With no
+		// state and no filters this emits a single facet with no relationship qualifier, which is GitHub's own
+		// `involves:@me` and `is:open` default — the same question the fallback asked, now on one route.
+		const github = await this.authenticationService.apis.github;
+		if (github == null) return undefined;
+
+		const requestedStates: PullRequestStateFilter[] =
+			options?.state != null && options.state.length > 0 ? [...new Set(options.state)] : ['open'];
+		const facets =
+			explicitFilters?.length != null
+				? requestedStates.flatMap(state =>
+						explicitFilters.map(filter => ({
+							key: `${state}:${filter}`,
+							state: state,
+							search: gitHubPullRequestRelationshipQualifiers[filter],
+						})),
+					)
+				: requestedStates.flatMap(state => [
+						{ key: state, state: state, search: undefined },
+						...(options?.includeReviewRequested === true
+							? [
+									{
+										key: `${state}:${PullRequestFilter.ReviewRequested}`,
+										state: state,
+										search: gitHubPullRequestRelationshipQualifiers[
+											PullRequestFilter.ReviewRequested
+										],
+									},
+								]
+							: []),
+					]);
+		const cursors = parsePullRequestFacetCursor(options?.cursor);
+		const hasResumableFacetCursor = Object.keys(cursors).length !== 0;
+		const facetsWithCursor = facets.filter(facet => cursors[facet.key] != null);
+		// The first call has no cursor, so query every requested state. A continuation only happens after a
+		// prior page reported `more:true`, whose bundle carries a cursor for each facet still in flight;
+		// facets absent from the bundle are exhausted, so re-querying them from scratch would refetch the
+		// same PRs (duplicated by the dedup-free sweep) and waste an API call per page. Query only the
+		// states that still have a cursor, but degrade a malformed/empty cursor bundle, or one that doesn't
+		// apply to the current requested states, to the first page rather than returning an empty page.
+		const facetsToQuery =
+			options?.cursor != null && hasResumableFacetCursor && facetsWithCursor.length !== 0
+				? facetsWithCursor
+				: facets;
+		const results = await Promise.allSettled(
+			facetsToQuery.map(async facet => ({
+				key: facet.key,
+				result: await github.searchMyPullRequestsPage(this, toTokenWithInfo(this.id, session), {
+					baseUrl: this.apiBaseUrl,
+					state: facet.state,
+					cursor: cursors[facet.key],
+					summary: options?.summary,
+					...(facet.search != null ? { search: facet.search, includeDefaultInvolvement: false } : undefined),
+				}),
+			})),
+		);
+		if (results.every(result => result.status === 'rejected')) {
+			const first = results[0];
+			if (first?.status === 'rejected') throw first.reason;
+		}
 
-			const values = new Map<string, ProviderPullRequest>();
-			const nextCursors: GitHubPullRequestFacetCursor = {};
-			const failures = [];
-			let hasMore = false;
-			let truncated = false;
-			let structuralIncompleteness = false;
-			let unkeyedPullRequest = 0;
-			for (const outcome of results) {
-				if (outcome.status === 'rejected') {
-					failures.push(toCollectionScopeFailure({ providerId: this.id }, outcome.reason));
-					truncated = true;
-					continue;
-				}
+		const values = new Map<string, ProviderPullRequest>();
+		const nextCursors: GitHubPullRequestFacetCursor = {};
+		const failures = [];
+		let hasMore = false;
+		let truncated = false;
+		let structuralIncompleteness = false;
+		let unkeyedPullRequest = 0;
+		for (const outcome of results) {
+			if (outcome.status === 'rejected') {
+				failures.push(toCollectionScopeFailure({ providerId: this.id }, outcome.reason));
+				truncated = true;
+				continue;
+			}
 
-				const { key, result } = outcome.value;
-				for (const pr of result.values) {
-					const mapped = toProviderPullRequest(pr);
-					const identity = getProviderPullRequestIdentity(mapped) ?? `unkeyed:${unkeyedPullRequest++}`;
-					if (!values.has(identity)) {
-						values.set(identity, mapped);
-					}
+			const { key, result } = outcome.value;
+			for (const pr of result.values) {
+				const mapped = toProviderPullRequest(pr);
+				const identity = getProviderPullRequestIdentity(mapped) ?? `unkeyed:${unkeyedPullRequest++}`;
+				if (!values.has(identity)) {
+					values.set(identity, mapped);
 				}
-				if (result.hasMore) {
-					if (result.cursor == null || result.cursor === '{}' || result.cursor === cursors[key]) {
-						truncated = true;
-						structuralIncompleteness = true;
-					} else {
-						hasMore = true;
-						nextCursors[key] = result.cursor;
-					}
-				}
-				if (result.truncated) {
+			}
+			if (result.hasMore) {
+				if (result.cursor == null || result.cursor === '{}' || result.cursor === cursors[key]) {
 					truncated = true;
+					structuralIncompleteness = true;
+				} else {
+					hasMore = true;
+					nextCursors[key] = result.cursor;
 				}
 			}
-
-			return {
-				values: [...values.values()],
-				paging: {
-					more: hasMore,
-					cursor: hasMore ? JSON.stringify({ type: 'cursor', cursors: nextCursors }) : '{}',
-					truncated: truncated || undefined,
-				},
-				...(failures.length || structuralIncompleteness
-					? {
-							metadata: {
-								completeness: 'partial' as const,
-								...(failures.length ? { failures: failures } : {}),
-							},
-						}
-					: undefined),
-			};
+			if (result.truncated) {
+				truncated = true;
+			}
 		}
 
-		// The current user's login scopes the account-wide `involves:` query (see getPullRequestsForUser →
-		// getPullRequestsAssociatedWithUser). Resolve it from THIS session (multi-account safe).
-		const username = (await this.getProviderCurrentAccount(session))?.username;
-		if (username == null) return undefined;
-
-		const api = await this.getProvidersApi();
-		// Only reachable with NO requested state (the branch above owns every state-filtered read), so there is
-		// deliberately no `states` to forward: the SDK's `involves:` search applies its own `is:open` default
-		// qualifier, which is exactly the unfiltered "my open PRs" this path is for. Nor could a state be
-		// honored here — `getPullRequestsAssociatedWithUser` doesn't accept one — which is why the state-filtered
-		// read goes through `searchMyPullRequestsPage` instead of post-filtering a page that never contained the
-		// requested states.
-		const result = await api.getPullRequestsForUser(toTokenWithInfo(this.id, session), username, {
-			baseUrl: this.apiBaseUrl,
-			cursor: options?.cursor,
-			// The sweep drains this read page by page, so it asks for the largest page the search allows.
-			pageSize: githubSearchMaxPageSize,
-		});
-		return result ?? undefined;
+		return {
+			values: [...values.values()],
+			paging: {
+				more: hasMore,
+				cursor: hasMore ? JSON.stringify({ type: 'cursor', cursors: nextCursors }) : '{}',
+				truncated: truncated || undefined,
+			},
+			...(failures.length || structuralIncompleteness
+				? {
+						metadata: {
+							completeness: 'partial' as const,
+							...(failures.length ? { failures: failures } : {}),
+						},
+					}
+				: undefined),
+		};
 	}
 
 	protected override async searchProviderMyIssues(
@@ -618,6 +585,7 @@ abstract class GitHubIntegrationBase<ID extends GitHubIntegrationIds> extends Gi
 				includeBody: true,
 				includeAllAssignees: options?.includeAllAssignees,
 				cursor: options?.cursor,
+				sort: options?.sort,
 				categories: options?.filters?.length
 					? {
 							authored: options.filters.includes(IssueFilter.Author),
@@ -718,6 +686,28 @@ abstract class GitHubIntegrationBase<ID extends GitHubIntegrationIds> extends Gi
 		);
 	}
 
+	/**
+	 * Counts several pull-request scopes in ONE request. Like {@link countProviderIssues}, GitHub's `search`
+	 * reports `issueCount` on a zero-node selection, so a count preview costs no pull-request transfer.
+	 */
+	protected override async countProviderPullRequests(
+		session: ProviderAuthenticationSession,
+		scopes: readonly { repos?: ProviderRepoInput[]; org?: string; criteria?: PullRequestSearchCriteria }[],
+		cancellation?: AbortSignal,
+	): Promise<(number | undefined)[] | undefined> {
+		return (await this.authenticationService.apis.github)?.countPullRequests(
+			this,
+			toTokenWithInfo(this.id, session),
+			scopes.map(s => ({
+				repos: s.repos?.map(r => `${r.namespace}/${r.name}`),
+				org: s.org,
+				criteria: s.criteria,
+			})),
+			{ baseUrl: this.apiBaseUrl },
+			cancellation,
+		);
+	}
+
 	protected override async searchProviderPullRequests(
 		session: ProviderAuthenticationSession,
 		searchQuery: string,

package/src/plus/integrations/providers/gitlab.ts

@@ -23,6 +23,7 @@ import { toTokenWithInfo } from '../authentication/models.js';
 import { toCollectionScopeFailure } from '../collectionMetadata.js';
 import { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId } from '../constants.js';
 import type { IntegrationServiceContext } from '../context.js';
+import { IntegrationReadUnavailableError } from '../errors.js';
 import type { IntegrationConnectionChangeEvent } from '../integrationService.js';
 import type { SearchMyPullRequestsOptions } from '../models/gitHostIntegration.js';
 import { GitHostIntegration } from '../models/gitHostIntegration.js';
@@ -64,13 +65,19 @@ const cloudEnterpriseAuthProvider: IntegrationAuthenticationProviderDescriptor =
 type GitLabPullRequestAssociation = 'assigned' | 'authored' | 'reviewRequested';
 type GitLabPullRequestFacetCursor = Partial<Record<GitLabPullRequestAssociation, string>>;
 
-const gitLabAssociationForFilter: Record<
-	Exclude<PullRequestFilter, PullRequestFilter.Mention>,
-	GitLabPullRequestAssociation
-> = {
+/**
+ * The account-wide relationships GitLab can express, and the `scope` each maps to. `undefined` means GitLab has
+ * no equivalent axis (it has neither `Mention` nor `reviewed-by`), and this map is the single declaration of
+ * that. Exhaustive over `PullRequestFilter` on purpose: a new member must be decided for GitLab here rather
+ * than compiling through as silently unsupported. Exported for the advertised-vs-expressible capability test,
+ * which is what keeps it agreeing with `supportedAccountWidePullRequestFilters`; no runtime consumer imports it.
+ */
+export const gitLabAssociationForFilter: Record<PullRequestFilter, GitLabPullRequestAssociation | undefined> = {
 	[PullRequestFilter.Assignee]: 'assigned',
 	[PullRequestFilter.Author]: 'authored',
 	[PullRequestFilter.ReviewRequested]: 'reviewRequested',
+	[PullRequestFilter.Reviewed]: undefined,
+	[PullRequestFilter.Mention]: undefined,
 };
 
 function parseGitLabPullRequestFacetCursor(cursor: string | undefined): GitLabPullRequestFacetCursor {
@@ -473,15 +480,26 @@ abstract class GitLabIntegrationBase<ID extends GitLabIntegrationIds> extends Gi
 
 		const api = await this.getProvidersApi();
 		const requested = options?.filters?.length ? new Set(options.filters) : undefined;
+		// The filter contract is all-or-nothing, so refuse as soon as ONE requested member is inexpressible rather
+		// than only when every one is: dropping the rest would answer a narrower question than was asked
+		// (`[Author, Mention]` becoming `authored`). Throw rather than return `undefined`, which the facade reads
+		// as "no session could be resolved" and a drain turns into a not-connected warning, misattributing a
+		// refusal; `getMyPullRequestsForUserResult` recovers the throw into `{ error }`. Defense in depth:
+		// `resolveAccountWidePullRequestFilters` already refuses such a set, so only a direct caller of the public
+		// method reaches this.
+		const unsupported = requested == null ? [] : [...requested].filter(f => gitLabAssociationForFilter[f] == null);
+		if (unsupported.length > 0) {
+			throw new IntegrationReadUnavailableError(
+				this.name,
+				`account-wide pull request filters not expressible by GitLab: ${unsupported.join(', ')}`,
+			);
+		}
+
 		const associations: GitLabPullRequestAssociation[] =
 			requested == null
 				? ['authored', 'assigned', 'reviewRequested']
-				: [...requested]
-						.filter(
-							(filter): filter is Exclude<PullRequestFilter, PullRequestFilter.Mention> =>
-								filter !== PullRequestFilter.Mention,
-						)
-						.map(filter => gitLabAssociationForFilter[filter]);
+				: Array.from(requested, f => gitLabAssociationForFilter[f]).filter(a => a != null);
+
 		const cursors = parseGitLabPullRequestFacetCursor(options?.cursor);
 		const resumable = associations.filter(association => cursors[association] != null);
 		const associationsToQuery = options?.cursor != null && resumable.length > 0 ? resumable : associations;
@@ -668,6 +686,7 @@ abstract class GitLabIntegrationBase<ID extends GitLabIntegrationIds> extends Gi
 						isPAT: this.isEnterprise,
 						baseUrl: baseUrl,
 						cursor: cursor,
+						sort: options?.sort,
 					});
 					if (cancellation?.aborted) throw new CancellationError();
 					return page;

package/src/plus/integrations/providers/issueSorts.ts

@@ -0,0 +1,89 @@
+import { SUPPORTED_ISSUE_SORTS } from '@gitkraken/provider-apis';
+import { getIssueComparator } from '../../../git/utils/issue.utils.js';
+import type { IssueSorting } from '../providerFilters.js';
+
+/**
+ * The per-provider ordering vocabulary of the issue reads: which neutral `field:direction` keys each provider
+ * surface can express SERVER-SIDE.
+ *
+ * DERIVED from `@gitkraken/provider-apis`, not transcribed from it. The SDK is where a neutral key becomes a
+ * provider query, so it is the only place that can say what a provider accepts; a copy kept here would be a
+ * second hand-maintained table on a second release cadence, and the symptom of drift is not a failed build but a
+ * read this facade promised and the SDK then rejects at runtime — which is exactly what happened while these were
+ * transcribed, on the one key (`reactions`) whose meaning is narrower than its name.
+ *
+ * Why the asymmetries between surfaces exist (GitHub cannot order by close date, GitLab's two reads are different
+ * APIs with different vocabularies, Azure has no `dueDate` outside the Agile process, Trello has only its
+ * `sort:edited` modifier, Jira has votes rather than reactions) is documented on the SDK's own maps. This module
+ * adds exactly one rule of its own — {@link mergeableSorts} — and everything else is a rename from the SDK's
+ * surface names to the two fields `ProviderMetadata` publishes.
+ *
+ * A caveat for anything building ONE ordering control across providers: a neutral key does not always mean the
+ * same thing. `priority:desc` is most-important-first on Jira and Linear, and least-important-first on Azure
+ * DevOps, whose WIQL orders the raw numeric column where 1 is the highest priority — so no single direction
+ * means "highest priority first" everywhere, and a unified control has to pick the direction per provider.
+ * `title` likewise orders by each backing database's collation, never JavaScript's.
+ */
+
+/** One SDK read surface, widened to the union this package uses (structurally the same `field:direction` type). */
+const surface = (name: keyof typeof SUPPORTED_ISSUE_SORTS): IssueSorting[] => [...SUPPORTED_ISSUE_SORTS[name]];
+
+/**
+ * The subset a MERGED page can honor: the keys a normalized issue carries.
+ *
+ * Applied to the account-wide surfaces because every account-wide read is a union of several provider queries
+ * merged in this facade — GitHub's three `@me` searches, GitLab's one REST call per relationship, Azure's
+ * (project × relationship) drains — and the caller has no scope count to reduce, so it ALWAYS merges. GitLab's
+ * REST endpoint really does order by `priority` and `dueDate`, and Azure's WIQL by `resolved` and `priority`;
+ * none of them survive a merge, so the surface cannot honor them and must not advertise them.
+ *
+ * Expressed as the rule rather than as a hand-removed list, so a key the SDK adds later is classified by the same
+ * predicate that will decide at read time whether the merge can order by it, instead of by whoever last edited a
+ * literal here. The repo-scoped surfaces are NOT filtered: those merge only when the caller passes several
+ * scopes, which is a property of the call rather than of the provider (see `mergesProviderQueries`).
+ */
+const mergeableSorts = (sorts: readonly IssueSorting[]): IssueSorting[] =>
+	sorts.filter(sort => getIssueComparator(sort) != null);
+
+/** GitHub and GHE: one `search` channel serves all three issue reads, so all three order the same way. */
+export const githubIssueSorts: IssueSorting[] = surface('github');
+
+/**
+ * The same `search` channel, narrowed to what the three `@me` searches can order once this facade has merged them.
+ *
+ * Identical to {@link githubIssueSorts} today — every qualifier the SDK's GitHub surface carries is a field an
+ * `IssueShape` models — so this exists for the drift, not for a difference: `readAccountWideIssuesPage`
+ * deliberately runs no `unmergeable` check, on the stated grounds that an account-wide table only lists keys a
+ * merge can honor. Left as the raw surface, one qualifier added upstream (a `closed` or `interactions` sort) would
+ * make that assumption false for GitHub alone and publish three concatenated alias runs under it, unwarned.
+ */
+export const githubAccountWideIssueSorts: IssueSorting[] = mergeableSorts(surface('github'));
+
+/** GitLab's repository-scoped read, which goes through GraphQL `IssueSort`. */
+export const gitlabIssueSorts: IssueSorting[] = surface('gitlabRepository');
+
+/** GitLab's account-wide read: the REST `order_by`/`sort` pair, narrowed to what its merge can order. */
+export const gitlabAccountWideIssueSorts: IssueSorting[] = mergeableSorts(surface('gitlabAccountWide'));
+
+/** Azure DevOps, as WIQL `ORDER BY` columns. */
+export const azureIssueSorts: IssueSorting[] = surface('azureDevOps');
+
+/** The same WIQL, narrowed to what the per-project fan-out can order once it has merged. */
+export const azureAccountWideIssueSorts: IssueSorting[] = mergeableSorts(surface('azureDevOps'));
+
+/** Jira Cloud and Server, as JQL `ORDER BY` fields — one JQL builder, so one surface. */
+export const jiraIssueSorts: IssueSorting[] = surface('jira');
+
+/**
+ * Linear's one root `issues` query, which both of its reads share and which takes the same `sort` argument in
+ * either direction — so this is one surface, not a repo-scoped and an account-wide pair.
+ *
+ * NOT filtered by {@link mergeableSorts} even though the account-wide read is "my issues": that read is a
+ * single server-ordered query (one `or` filter over the four relationships), so nothing is merged in this
+ * facade and there is no comparator to satisfy. Filtering it would drop `priority` and `dueDate` — keys the
+ * server really does order by — for a merge that does not happen.
+ */
+export const linearIssueSorts: IssueSorting[] = surface('linear');
+
+/** Trello's search modifiers: `sort:edited` / `sort:-edited`, and nothing else usable for issues. */
+export const trelloIssueSorts: IssueSorting[] = surface('trello');

package/src/plus/integrations/providers/jira.ts

@@ -8,8 +8,9 @@ import { Logger } from '../../../utils/logger.js';
 import type { IntegrationAuthenticationProviderDescriptor } from '../authentication/integrationAuthenticationProvider.js';
 import type { ProviderAuthenticationSession } from '../authentication/models.js';
 import { toTokenWithInfo } from '../authentication/models.js';
-import { toCollectionScopeFailure } from '../collectionMetadata.js';
+import { throwIfCallerContractError, toCollectionScopeFailure } from '../collectionMetadata.js';
 import { IssuesCloudHostIntegrationId } from '../constants.js';
+import type { IssuesForProjectOptions } from '../models/issueReads.js';
 import { IssuesIntegration } from '../models/issuesIntegration.js';
 import type { ProviderApiCollectionResult, ProviderIssue } from './models.js';
 import { IssueFilter, providersMetadata, toAccount, toIssueShape } from './models.js';
@@ -234,7 +235,7 @@ export class JiraIntegration extends IssuesIntegration<IssuesCloudHostIntegratio
 	protected override async getProviderIssuesForProject(
 		session: ProviderAuthenticationSession,
 		project: JiraProjectDescriptor,
-		options?: { user?: string; filters?: IssueFilter[] },
+		options?: IssuesForProjectOptions,
 	): Promise<IssueShape[] | undefined> {
 		return (await this.getProviderIssuesForProjectWithTruncation(session, project, options))?.values;
 	}
@@ -242,7 +243,7 @@ export class JiraIntegration extends IssuesIntegration<IssuesCloudHostIntegratio
 	protected override async getProviderIssuesForProjectWithTruncation(
 		session: ProviderAuthenticationSession,
 		project: JiraProjectDescriptor,
-		options?: { user?: string; filters?: IssueFilter[] },
+		options?: IssuesForProjectOptions,
 	): Promise<{ values: IssueShape[]; truncated: boolean; metadata?: CollectionMetadata } | undefined> {
 		const tokenWithInfo = toTokenWithInfo(this.id, session);
 
@@ -273,6 +274,7 @@ export class JiraIntegration extends IssuesIntegration<IssuesCloudHostIntegratio
 					result = await api.getIssuesForProjectPaged(tokenWithInfo, project.name, project.resourceId, {
 						...scope,
 						cursor: cursor,
+						sort: options?.sort,
 					});
 				} catch (ex) {
 					// A page failure after the first page leaves the already-drained prefix intact; record the
@@ -390,6 +392,10 @@ export class JiraIntegration extends IssuesIntegration<IssuesCloudHostIntegratio
 				// incomplete: keep the sibling results but record a structured failure so the facade can warn on
 				// the specific filter (auth/rate-limit) instead of just a generic truncation flag.
 				if (outcome.status !== 'fulfilled') {
+					// Identical for every filter branch, so degrading it would report one failure per branch for a
+					// single invalid call — see `throwIfCallerContractError`.
+					throwIfCallerContractError(outcome.reason);
+
 					truncated = true;
 					const failure = toCollectionScopeFailure(
 						{ providerId: this.id, resourceId: project.resourceId, projectId: project.name },