@gitkraken/core-gitlens 0.6.0 → 0.7.1

package/dist/plus/integrations/models/gitHostIntegration.js

@@ -1,1304 +1,1229 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-import { ensureArray } from '../../../utils/array.js';
-import { isCancellationError } from '../../../utils/cancellation.js';
-import { gate } from '../../../utils/decorators/gate.js';
-import { trace } from '../../../utils/decorators/log.js';
-import { first } from '../../../utils/iterable.js';
-import { Logger } from '../../../utils/logger.js';
-import { getScopedLogger } from '../../../utils/logger.scoped.js';
-import { toTokenWithInfo } from '../authentication/models.js';
-import { throwIfCallerContractError, toCollectionFailureError, toCollectionScopeFailure, } from '../collectionMetadata.js';
-import { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId } from '../constants.js';
-import { toError } from '../errors.js';
-import { IssueFilter, PagingMode, PullRequestFilter, toIssueShape, toProviderIssueStates, toProviderPullRequestStates, } from '../providers/models.js';
-import { mergeCollectionMetadata, throwIfAllSettledFailed } from '../providers/utils/providerPaging.js';
-import { IntegrationBase } from './integration.js';
-function isAzureDevOpsProvider(providerId) {
-    return (providerId === GitCloudHostIntegrationId.AzureDevOps ||
-        providerId === GitSelfManagedHostIntegrationId.AzureDevOpsServer);
-}
-function normalizeSelfManagedBaseUrl(domain, protocol) {
-    const value = domain?.trim();
-    if (!value)
-        return undefined;
-    if (/^[a-z][a-z\d+\-.]*:\/\//i.test(value)) {
-        try {
-            const url = new URL(value);
-            return `${url.protocol}//${url.host}${url.pathname.replace(/\/+$/, '')}`;
-        }
-        catch {
-            return undefined;
-        }
-    }
-    const scheme = protocol ?? 'https:';
-    try {
-        const url = new URL(`${scheme}//${value}`);
-        return `${url.protocol}//${url.host}${url.pathname.replace(/\/+$/, '')}`;
-    }
-    catch {
-        return undefined;
-    }
+import { first } from "../../../utils/iterable.js";
+import { ensureArray } from "../../../utils/array.js";
+import { isCancellationError } from "../../../utils/cancellation.js";
+import { Logger as _logger } from "../../../utils/logger.js";
+import { getScopedLogger } from "../../../utils/logger.scoped.js";
+import { trace } from "../../../utils/decorators/log.js";
+import __decorate from "../../../_virtual/@oxc-project+runtime/helpers/esm/decorate.js";
+import { gate } from "../../../utils/decorators/gate.js";
+import "../../../git/models/pullRequest.js";
+import { toError } from "../errors.js";
+import { throwIfCallerContractError, toCollectionFailureError, toCollectionScopeFailure } from "../collectionMetadata.js";
+import "../constants.js";
+import { toTokenWithInfo } from "../authentication/models.js";
+import "../providerFilters.js";
+import { mergeCollectionMetadata, throwIfAllSettledFailed } from "../providers/utils/providerPaging.js";
+import { areDomainsOnSameHost } from "../utils/domain.utils.js";
+import { getSelfManagedBaseUrl, isGitSelfManagedHostIntegrationId } from "../utils/integration.utils.js";
+import { toIssueShape, toProviderIssueStates, toProviderPullRequestStates } from "../providers/models.js";
+import { IntegrationBase } from "./integration.js";
+//#region ../plus/integrations/src/models/gitHostIntegration.ts
+/**
+* Whether an SDK read for `providerId` must send the session's secret as an HTTP Basic credential.
+*
+* Azure DevOps authenticates a PAT only as Basic — Azure DevOps Server refuses one sent as a bearer token outright —
+* and the Azure integration's own reads already pass it that way (`AzureDevOpsIntegrationBase.getApiOptions`). The
+* reads here are shared by every host, so they have to ask; every other provider keeps the SDK's default.
+*/
+function sendsBasicCredential(providerId, session) {
+	return isAzureDevOpsProvider(providerId) ? session.type !== "oauth" : void 0;
 }
-function getSelfManagedApiBaseUrl(providerId, domain, protocol) {
-    const baseUrl = normalizeSelfManagedBaseUrl(domain, protocol);
-    if (baseUrl == null)
-        return undefined;
-    switch (providerId) {
-        case GitSelfManagedHostIntegrationId.CloudGitHubEnterprise:
-            return `${baseUrl.replace(/\/api(?:\/v\d+)?$/, '')}/api/v3`;
-        case GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted:
-            return baseUrl.replace(/\/api(?:\/v\d+)?$/, '');
-        case GitSelfManagedHostIntegrationId.BitbucketServer:
-            return `${baseUrl.replace(/\/rest\/api\/1\.0$/, '')}/rest/api/1.0`;
-        case GitSelfManagedHostIntegrationId.AzureDevOpsServer:
-            return baseUrl;
-        default:
-            return undefined;
-    }
+function isAzureDevOpsProvider(providerId) {
+	return providerId === "azureDevOps" || providerId === "azure-devops-server";
 }
 /**
- * Rejects a read the provider can't serve as asked: logs the reason and returns it as the `{ error }` half of an
- * {@link IntegrationResult}, timed from `start`.
- *
- * A single builder because these refusals are a contract, not incidental returns — the read cores below reject on
- * unsupported input, an inexpressible filter set, or an unresolvable filter account, and each one must reach the
- * caller as an error it can surface as a warning rather than as an empty success. Writing the message once also
- * keeps the logged text and the thrown text from drifting apart, which is exactly what happened while each site
- * spelled its message out twice.
- */
+* Rejects a read the provider can't serve as asked: logs the reason and returns it as the `{ error }` half of an
+* {@link IntegrationResult}, timed from `start`.
+*
+* A single builder because these refusals are a contract, not incidental returns — the read cores below reject on
+* unsupported input, an inexpressible filter set, or an unresolvable filter account, and each one must reach the
+* caller as an error it can surface as a warning rather than as an empty success. Writing the message once also
+* keeps the logged text and the thrown text from drifting apart, which is exactly what happened while each site
+* spelled its message out twice.
+*/
 function unsupportedRead(message, start, logContext) {
-    Logger.warn(message, logContext);
-    return { error: new Error(message), duration: performance.now() - start };
+	_logger.warn(message, logContext);
+	return {
+		error: new Error(message),
+		duration: performance.now() - start
+	};
 }
 /**
- * Both fields gate the same GitHub `commits` subtree, so either truthy key retains the build-status rollup.
- * An absent map retains the full row; a summary read explicitly drops both optional fields.
- */
+* Both fields gate the same GitHub `commits` subtree, so either truthy key retains the build-status rollup.
+* An absent map retains the full row; a summary read explicitly drops both optional fields.
+*/
 const summaryPullRequestFields = {
-    headCommit: false,
-    commitCount: false,
+	headCommit: false,
+	commitCount: false
 };
-export class GitHostIntegration extends IntegrationBase {
-    type = 'git';
-    async getAccountForEmail(repo, email, options) {
-        const scope = getScopedLogger();
-        const connected = this.maybeConnected ?? (await this.isConnected());
-        if (!connected)
-            return undefined;
-        await this.refreshSessionIfExpired(scope);
-        try {
-            const author = await this.getProviderAccountForEmail(this._session, repo, email, options);
-            this.resetRequestExceptionCount('getAccountForEmail');
-            return author;
-        }
-        catch (ex) {
-            this.handleProviderException('getAccountForEmail', ex, { scope: scope });
-            return undefined;
-        }
-    }
-    /**
-     * Returns the SSH signing keys (full OpenSSH-format `<type> <key> [comment]` strings) registered by the accounts
-     * matching the given emails on this integration, for building an `allowed_signers` file. Keyed by lowercased email;
-     * emails with no match (and unsupported integrations) are absent. Batching the lookups is left to the integration.
-     */
-    async getSshSigningKeysForEmails(repo, emails) {
-        const scope = getScopedLogger();
-        const connected = this.maybeConnected ?? (await this.isConnected());
-        if (!connected)
-            return new Map();
-        await this.refreshSessionIfExpired(scope);
-        try {
-            const keys = await this.getProviderSshSigningKeysForEmails(this._session, repo, emails);
-            this.resetRequestExceptionCount('getSshSigningKeysForEmails');
-            return keys;
-        }
-        catch (ex) {
-            this.handleProviderException('getSshSigningKeysForEmails', ex, { scope: scope });
-            return new Map();
-        }
-    }
-    /** Override in integrations that expose users' SSH signing keys. Defaults to none. */
-    getProviderSshSigningKeysForEmails(_session, _repo, _emails) {
-        return Promise.resolve(new Map());
-    }
-    async getAccountForCommit(repo, rev, options) {
-        const scope = getScopedLogger();
-        const connected = this.maybeConnected ?? (await this.isConnected());
-        if (!connected)
-            return undefined;
-        await this.refreshSessionIfExpired(scope);
-        try {
-            const author = await this.getProviderAccountForCommit(this._session, repo, rev, options);
-            this.resetRequestExceptionCount('getAccountForCommit');
-            return author;
-        }
-        catch (ex) {
-            this.handleProviderException('getAccountForCommit', ex, { scope: scope });
-            return undefined;
-        }
-    }
-    async getDefaultBranch(repo, options) {
-        const scope = getScopedLogger();
-        const connected = this.maybeConnected ?? (await this.isConnected());
-        if (!connected)
-            return undefined;
-        await this.refreshSessionIfExpired(scope);
-        const defaultBranch = this.ctx.cache.getRepositoryDefaultBranch(repo, this, () => ({
-            value: (async () => {
-                try {
-                    const result = await this.getProviderDefaultBranch(this._session, repo, options?.cancellation);
-                    this.resetRequestExceptionCount('getDefaultBranch');
-                    return result;
-                }
-                catch (ex) {
-                    this.handleProviderException('getDefaultBranch', ex, { scope: scope });
-                    return undefined;
-                }
-            })(),
-        }), { expiryOverride: options?.expiryOverride });
-        return defaultBranch;
-    }
-    async getRepositoryMetadata(repo, options) {
-        const scope = getScopedLogger();
-        const connected = this.maybeConnected ?? (await this.isConnected());
-        if (!connected)
-            return undefined;
-        await this.refreshSessionIfExpired(scope);
-        const metadata = this.ctx.cache.getRepositoryMetadata(repo, this, () => ({
-            value: (async () => {
-                try {
-                    const result = await this.getProviderRepositoryMetadata(this._session, repo, options?.cancellation);
-                    this.resetRequestExceptionCount('getRepositoryMetadata');
-                    return result;
-                }
-                catch (ex) {
-                    this.handleProviderException('getRepositoryMetadata', ex, { scope: scope });
-                    return undefined;
-                }
-            })(),
-        }), { expiryOverride: options?.expiryOverride });
-        return metadata;
-    }
-    /**
-     * Whether this git host implements generic org discovery. False for providers that register no
-     * {@link getProviderOrganizationsForUser} hook (e.g. Bitbucket Data Center) — the facade uses this to
-     * report `unsupported` instead of a silent empty list, which is indistinguishable from "has no orgs".
-     */
-    get supportsOrganizationDiscovery() {
-        return this.getProviderOrganizationsForUser != null;
-    }
-    /** Whether this git host implements generic repository discovery ({@link getProviderRepositoriesForOrg}). */
-    get supportsRepositoryDiscovery() {
-        return this.getProviderRepositoriesForOrg != null;
-    }
-    /**
-     * Whether this git host has a project tier between org and repo ({@link getProviderProjectsForOrg}). Only
-     * Azure DevOps does; the facade uses this to skip the read entirely rather than call a core that returns
-     * `undefined` for a session-less reason and be misread as a broken connection.
-     */
-    get supportsProjectDiscovery() {
-        return this.getProviderProjectsForOrg != null;
-    }
-    /**
-     * Whether this git host implements the account-wide user-affiliated repository read
-     * ({@link getProviderRepositoriesForUser}) — the org-less `gk provider repos <provider>` equivalent.
-     */
-    get supportsUserRepositoryDiscovery() {
-        return this.getProviderRepositoriesForUser != null;
-    }
-    /**
-     * Whether this git host exposes issues on the ProviderBackend surface. Most git hosts do; a host with no
-     * usable issue tracker overrides this to false — Bitbucket Cloud (deprecated in favor of dedicated issue
-     * integrations like Jira) and Bitbucket Data Center (never had one) — so the facade reports issues as
-     * unsupported instead of serving a partial/deprecated source or failing inside a provider client that
-     * registers no issue function at all.
-     *
-     * Keep this in sync with {@link ProviderMetadata.supportedIssueFilters}: a provider that declares no issue
-     * filters and no issue read is answering the same capability question twice, and the two must agree.
-     */
-    get supportsIssues() {
-        return true;
-    }
-    /**
-     * Lists the organizations (orgs/workspaces/groups) the current user belongs to on this host.
-     * `truncated === true` means the defensive page-drain backstop stopped before the upstream listing was
-     * exhausted.
-     *
-     * Resolves the session for `connectionId` (or the primary connection when omitted, honoring multi-account
-     * reads) and recovers a thrown error into `{ error }` so callers can surface it as a warning instead of
-     * swallowing it to `undefined`.
-     */
-    async getOrganizationsForUserResult(connectionId) {
-        const scope = getScopedLogger();
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        const start = performance.now();
-        try {
-            const result = await this.getProviderOrganizationsForUser?.(session);
-            this.resetRequestExceptionCount('getOrganizationsForUser');
-            return { value: result, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('getOrganizationsForUser', ex, {
-                scope: scope,
-                connectionId: connectionId,
-            });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    /**
-     * Result-returning list of the projects a git host exposes beneath its orgs, unified into the
-     * {@link ProviderOrganization} shape. Only Azure DevOps has a project tier between org and repo; other
-     * git hosts have none and leave {@link getProviderProjectsForOrg} undefined, so this returns `undefined`
-     * for them (the ProviderBackend facade then treats them as having no projects). With `org`, scopes to
-     * that org's projects; without, returns projects across every org the user can see.
-     */
-    async getProjectsForOrgResult(org, connectionId) {
-        const scope = getScopedLogger();
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        if (this.getProviderProjectsForOrg == null) {
-            return undefined;
-        }
-        const start = performance.now();
-        try {
-            const result = await this.getProviderProjectsForOrg(session, org);
-            this.resetRequestExceptionCount('getProjectsForOrg');
-            return { value: result, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('getProjectsForOrg', ex, { scope: scope, connectionId: connectionId });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    /**
-     * Lists repositories under the given organization (org/workspace/group) one page at a time — follow
-     * `paging.cursor` to page, or drain with the integrations provider paging helper.
-     * `options.project` is only meaningful for Azure DevOps, whose repos are scoped by `org` + `project`;
-     * every other host ignores it. (Azure without a project can't page its cross-project merge, so it
-     * returns all matches in a single page.) `truncated === true` means the defensive page-drain
-     * backstop stopped before the upstream listing was exhausted.
-     *
-     * Resolves the session for `connectionId` (or the primary connection when omitted) and recovers a thrown
-     * error into `{ error }`, so a caller surfaces it as a warning instead of a silent `undefined`.
-     */
-    async getRepositoriesForOrgResult(org, options) {
-        const scope = getScopedLogger();
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(options?.connectionId, scope);
-        if (session == null)
-            return undefined;
-        const start = performance.now();
-        try {
-            const result = await this.getProviderRepositoriesForOrg?.(session, org, options);
-            this.resetRequestExceptionCount('getRepositoriesForOrg');
-            return { value: result, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('getRepositoriesForOrg', ex, {
-                scope: scope,
-                connectionId: options?.connectionId,
-            });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    /**
-     * Result-returning account-wide, user-affiliated repository read (the org-less
-     * `gk provider repos <provider>` equivalent): repositories the user owns, collaborates on, or can
-     * access through org membership — NOT every repo of every org. Optional: providers without a native
-     * user-affiliated listing (Bitbucket workspaces, Azure orgs, which require an org/workspace scope)
-     * leave the hook undefined and the facade reports the read as unsupported so callers fan out per org.
-     */
-    async getRepositoriesForUserResult(options) {
-        const scope = getScopedLogger();
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(options?.connectionId, scope);
-        if (session == null)
-            return undefined;
-        if (this.getProviderRepositoriesForUser == null) {
-            return undefined;
-        }
-        const start = performance.now();
-        try {
-            const result = await this.getProviderRepositoriesForUser(session, options);
-            this.resetRequestExceptionCount('getRepositoriesForUser');
-            return { value: result, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('getRepositoriesForUser', ex, {
-                scope: scope,
-                connectionId: options?.connectionId,
-            });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    async mergePullRequest(pr, options, cancellation) {
-        const scope = getScopedLogger();
-        const connected = this.maybeConnected ?? (await this.isConnected());
-        if (!connected)
-            return false;
-        await this.refreshSessionIfExpired(scope);
-        try {
-            const result = await this.mergeProviderPullRequest(this._session, pr, options, cancellation);
-            this.resetRequestExceptionCount('mergePullRequest');
-            return result;
-        }
-        catch (ex) {
-            if (isCancellationError(ex))
-                return false;
-            this.handleProviderException('mergePullRequest', ex, { scope: scope });
-            return false;
-        }
-        finally {
-            // A merge attempt just changed the state of more than this pull request on the server (a
-            // stacked merge lands every layer below and retargets every layer above) whether it succeeded
-            // or failed partway through — so cached pull requests can't be trusted either way. Without
-            // this, ref pills and branch enrichment keep serving the pre-merge object until its expiry.
-            this.ctx.cache.deletePullRequests();
-        }
-    }
-    async getPullRequestForBranch(repo, branch, options) {
-        const scope = getScopedLogger();
-        const connected = this.maybeConnected ?? (await this.isConnected());
-        if (!connected)
-            return undefined;
-        await this.refreshSessionIfExpired(scope);
-        const { expiryOverride, ...opts } = options ?? {};
-        const pr = this.ctx.cache.getPullRequestForBranch(branch, repo, this, () => ({
-            value: (async () => {
-                try {
-                    const result = await this.getProviderPullRequestForBranch(this._session, repo, branch, opts);
-                    this.resetRequestExceptionCount('getPullRequestForBranch');
-                    return result;
-                }
-                catch (ex) {
-                    this.handleProviderException('getPullRequestForBranch', ex, { scope: scope });
-                    return undefined;
-                }
-            })(),
-        }), { expiryOverride: expiryOverride });
-        return pr;
-    }
-    async getPullRequestForCommit(repo, rev, options) {
-        const scope = getScopedLogger();
-        const connected = this.maybeConnected ?? (await this.isConnected());
-        if (!connected)
-            return undefined;
-        await this.refreshSessionIfExpired(scope);
-        const pr = this.ctx.cache.getPullRequestForSha(rev, repo, this, () => ({
-            value: (async () => {
-                try {
-                    const result = await this.getProviderPullRequestForCommit(this._session, repo, rev);
-                    this.resetRequestExceptionCount('getPullRequestForCommit');
-                    return result;
-                }
-                catch (ex) {
-                    this.handleProviderException('getPullRequestForCommit', ex, { scope: scope });
-                    return undefined;
-                }
-            })(),
-        }), options);
-        return pr;
-    }
-    /**
-     * Memoized identity lookups backing filter resolution. Keyed by the session's token fingerprint plus the
-     * scope of the lookup (base URL, and the Azure organization for the per-instance variant), so a different
-     * account, host, or org never reuses an entry and a rotated token simply misses.
-     *
-     * Not cleared when the token changes: one integration instance serves every connection of its provider
-     * (multi-account), so clearing on a fingerprint change would make two accounts reading in alternation
-     * evict each other and defeat the memo. Entries are bounded by tokens x hosts x orgs seen — a handful for
-     * the life of the integration.
-     */
-    _filterAccounts = new Map();
-    /**
-     * Resolves the account a repo-scoped read turns `IssueFilter`/`PullRequestFilter` into a provider
-     * login/id with, memoized per token+scope.
-     *
-     * Every FILTERED read needs this, and `ProvidersApi.getCurrentUser` is a bare round trip — unlike
-     * {@link IntegrationBase.getCurrentAccount}, which the host caches. So a consumer that fans ONE page out
-     * into several filtered reads paid one identity request PER read, all resolving the same account: a
-     * per-user-facet fan-out (author + assignee + review-requested) doubled its request count, and paid it
-     * again on every page turn.
-     *
-     * The promise is memoized rather than the value, so concurrent facets share one in-flight request instead
-     * of racing. A rejection is evicted so the next read retries rather than caching a failure — matching how
-     * `getCurrentAccount` invalidates on error.
-     */
-    getFilterAccount(api, session, customUrl, organization) {
-        const key = `${this.getSessionFingerprint(session)}:${customUrl ?? ''}:${organization ?? ''}`;
-        let pending = this._filterAccounts.get(key);
-        if (pending == null) {
-            const tokenWithInfo = toTokenWithInfo(this.authProvider.id, session);
-            pending = (organization != null
-                ? api.getCurrentUserForInstance(tokenWithInfo, organization, { baseUrl: customUrl })
-                : api.getCurrentUser(tokenWithInfo, { baseUrl: customUrl })).catch((ex) => {
-                this._filterAccounts.delete(key);
-                throw ex;
-            });
-            this._filterAccounts.set(key, pending);
-        }
-        return pending;
-    }
-    async getMyIssuesForRepos(reposOrRepoIds, options, connectionId) {
-        return (await this.getMyIssuesForReposResult(reposOrRepoIds, options, connectionId))?.value;
-    }
-    /**
-     * Result-returning core of {@link getMyIssuesForRepos}. Resolves the session for `connectionId`
-     * (or the primary connection when omitted, so multi-account reads use the right token) and recovers
-     * thrown errors and validation failures into `{ error }` so callers can surface them as warnings
-     * rather than swallowing them to `undefined`.
-     */
-    async getMyIssuesForReposResult(reposOrRepoIds, options, connectionId) {
-        const scope = getScopedLogger();
-        const providerId = this.authProvider.id;
-        const states = toProviderIssueStates(options?.state);
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary. The session
-        // is resolved here for connectivity/bail; the connection's token is applied per API call below.
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        const start = performance.now();
-        const customUrl = options?.customUrl ?? getSelfManagedApiBaseUrl(providerId, session.domain || this.domain, session.protocol);
-        let api;
-        try {
-            api = await this.getProvidersApi();
-        }
-        catch (ex) {
-            this.handleProviderException('getIssuesForRepos', ex, { scope: scope, connectionId: connectionId });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-        const repoIdsInput = api.isRepoIdsInput(reposOrRepoIds);
-        if (providerId !== GitCloudHostIntegrationId.GitLab &&
-            (repoIdsInput ||
-                (isAzureDevOpsProvider(providerId) &&
-                    !reposOrRepoIds.every(repo => repo.project != null && repo.namespace != null)))) {
-            return unsupportedRead(`Unsupported input for provider ${providerId}`, start, 'getIssuesForRepos');
-        }
-        let getIssuesOptions;
-        if (isAzureDevOpsProvider(providerId)) {
-            const organizations = new Set();
-            const projects = new Set();
-            for (const repo of reposOrRepoIds) {
-                organizations.add(repo.namespace);
-                projects.add(repo.project);
-            }
-            if (organizations.size > 1) {
-                return unsupportedRead(`Multiple organizations not supported for provider ${providerId}`, start, 'getIssuesForRepos');
-            }
-            else if (organizations.size === 0) {
-                return unsupportedRead(`No organizations found for provider ${providerId}`, start, 'getIssuesForRepos');
-            }
-            const organization = first(organizations.values());
-            if (options?.filters != null) {
-                if (!api.providerSupportsIssueFilters(providerId, options.filters)) {
-                    return unsupportedRead(`Unsupported filters for provider ${providerId}`, start, 'getIssuesForRepos');
-                }
-                let userAccount;
-                try {
-                    userAccount = await this.getFilterAccount(api, session, customUrl, organization);
-                }
-                catch (ex) {
-                    this.handleProviderException('getIssuesForRepos', ex, {
-                        scope: scope,
-                        connectionId: connectionId,
-                    });
-                    return { error: toError(ex), duration: performance.now() - start };
-                }
-                if (userAccount == null) {
-                    return unsupportedRead(`Unable to get current user for ${providerId}`, start, 'getIssuesForRepos');
-                }
-                const userFilterProperty = userAccount.name;
-                if (userFilterProperty == null) {
-                    return unsupportedRead(`Unable to get user property for filter for ${providerId}`, start, 'getIssuesForRepos');
-                }
-                getIssuesOptions = {
-                    authorLogin: options.filters.includes(IssueFilter.Author) ? userFilterProperty : undefined,
-                    assigneeLogins: !options.includeAllAssignees && options.filters.includes(IssueFilter.Assignee)
-                        ? [userFilterProperty]
-                        : undefined,
-                    mentionLogin: options.filters.includes(IssueFilter.Mention) ? userFilterProperty : undefined,
-                };
-            }
-            const cursorInfo = this.parseCursorInfo(options?.cursor);
-            const cursors = cursorInfo.cursors ?? [];
-            let projectInputs = Array.from(projects.values(), project => ({
-                namespace: organization,
-                project: project,
-                cursor: undefined,
-            }));
-            if (cursors.length > 0) {
-                projectInputs = cursors;
-            }
-            try {
-                const cursor = { cursors: [] };
-                let hasMore = false;
-                let truncated = false;
-                let metadata;
-                const data = [];
-                // `allSettled`, not `Promise.all`: one project's read rejecting must not discard every sibling
-                // project's already-fetched issues and cursors. A rejected project is recorded as a structured
-                // failure so the facade can warn and set `fetchFailed` instead of reporting a partial project set
-                // as complete.
-                const settled = await Promise.allSettled(projectInputs.map(async (projectInput) => {
-                    const results = await api.getIssuesForAzureProject(toTokenWithInfo(providerId, session), projectInput.namespace, projectInput.project, {
-                        ...getIssuesOptions,
-                        cursor: projectInput.cursor,
-                        baseUrl: customUrl,
-                        // Continuation is driven by the per-project cursor; only apply an explicit page on the
-                        // first request so it can't clobber a continuation cursor on later pages.
-                        page: projectInput.cursor == null ? options?.page : undefined,
-                        pageSize: options?.pageSize,
-                        states: states,
-                        sort: options?.sort,
-                    });
-                    return { projectInput: projectInput, results: results };
-                }));
-                throwIfAllSettledFailed(settled);
-                for (let i = 0; i < settled.length; i++) {
-                    const outcome = settled[i];
-                    const projectInput = projectInputs[i];
-                    if (outcome.status !== 'fulfilled') {
-                        // Errors that really are per-scope (auth, rate limit, a missing project) degrade below; one
-                        // that is a fact about the call is re-thrown instead — see `throwIfCallerContractError`.
-                        throwIfCallerContractError(outcome.reason);
-                        truncated = true;
-                        const failure = toCollectionScopeFailure({
-                            providerId: providerId,
-                            resourceId: projectInput.namespace,
-                            projectId: projectInput.project,
-                        }, outcome.reason);
-                        metadata = mergeCollectionMetadata(metadata, {
-                            completeness: 'partial',
-                            failures: [failure],
-                        });
-                        continue;
-                    }
-                    const { projectInput: _projectInput, results } = outcome.value;
-                    data.push(...results.values);
-                    if (results.paging?.more) {
-                        hasMore = true;
-                        cursor.cursors.push({
-                            namespace: projectInput.namespace,
-                            project: projectInput.project,
-                            cursor: results.paging.cursor,
-                        });
-                    }
-                }
-                // Keep the requested page number in the composite cursor so the facade can report the real
-                // currentPage when the consumer continues using only the cursor.
-                if (options?.page != null) {
-                    cursor.page = options.page;
-                }
-                this.resetRequestExceptionCount('getIssuesForRepos');
-                return {
-                    value: {
-                        values: data,
-                        paging: {
-                            more: hasMore,
-                            cursor: JSON.stringify(cursor),
-                            truncated: truncated || undefined,
-                            // Echo the requested numbered page so the facade reports the real currentPage for
-                            // numbered-page hosts (GitLab/Bitbucket/Azure), not a synthesized 1. Cursor-only hosts
-                            // leave `page` undefined via their own reads.
-                            page: options?.page,
-                        },
-                        metadata: metadata,
-                    },
-                    duration: performance.now() - start,
-                };
-            }
-            catch (ex) {
-                this.handleProviderException('getIssuesForRepos', ex, {
-                    scope: scope,
-                    connectionId: connectionId,
-                });
-                return { error: toError(ex), duration: performance.now() - start };
-            }
-        }
-        if (options?.filters != null) {
-            // Validate the requested filters against what this provider actually supports — same guard the Azure
-            // branch above applies. Without it an unsupported filter (e.g. GitLab has no Mention endpoint) would
-            // resolve to no filter property being set and silently degrade to an unfiltered, project-wide read.
-            if (!api.providerSupportsIssueFilters(providerId, options.filters)) {
-                return unsupportedRead(`Unsupported filters for provider ${providerId}`, start, 'getIssuesForRepos');
-            }
-            let userAccount;
-            try {
-                userAccount = await this.getFilterAccount(api, session, customUrl);
-            }
-            catch (ex) {
-                this.handleProviderException('getIssuesForRepos', ex, {
-                    scope: scope,
-                    connectionId: connectionId,
-                });
-                return { error: toError(ex), duration: performance.now() - start };
-            }
-            if (userAccount == null) {
-                return unsupportedRead(`Unable to get current user for ${providerId}`, start, 'getIssuesForRepos');
-            }
-            const userFilterProperty = userAccount.username;
-            if (userFilterProperty == null) {
-                return unsupportedRead(`Unable to get user property for filter for ${providerId}`, start, 'getIssuesForRepos');
-            }
-            getIssuesOptions = {
-                authorLogin: options.filters.includes(IssueFilter.Author) ? userFilterProperty : undefined,
-                assigneeLogins: !options.includeAllAssignees && options.filters.includes(IssueFilter.Assignee)
-                    ? [userFilterProperty]
-                    : undefined,
-                mentionLogin: options.filters.includes(IssueFilter.Mention) ? userFilterProperty : undefined,
-            };
-        }
-        if (api.getProviderIssuesPagingMode(providerId) === PagingMode.Repo && !repoIdsInput) {
-            const cursorInfo = this.parseCursorInfo(options?.cursor);
-            const cursors = cursorInfo.cursors ?? [];
-            let repoInputs = reposOrRepoIds.map(repo => ({ repo: repo, cursor: undefined }));
-            if (cursors.length > 0) {
-                repoInputs = cursors;
-            }
-            try {
-                const cursor = { cursors: [] };
-                let hasMore = false;
-                let truncated = false;
-                let metadata;
-                const data = [];
-                // `allSettled`, not `Promise.all`: one repo's read rejecting must not discard every sibling repo's
-                // already-fetched issues and cursors. A rejected repo is recorded as a structured failure so the
-                // facade can warn and set `fetchFailed` instead of reporting a partial repo set as complete.
-                const settled = await Promise.allSettled(repoInputs.map(async (repoInput) => {
-                    const results = await api.getIssuesForRepo(toTokenWithInfo(providerId, session), repoInput.repo, {
-                        ...getIssuesOptions,
-                        cursor: repoInput.cursor,
-                        baseUrl: customUrl,
-                        // Continuation is driven by the per-repo cursor; only apply an explicit page on the
-                        // first request so it can't clobber a continuation cursor on later pages.
-                        page: repoInput.cursor == null ? options?.page : undefined,
-                        pageSize: options?.pageSize,
-                        states: states,
-                        sort: options?.sort,
-                    });
-                    return { repoInput: repoInput, results: results };
-                }));
-                throwIfAllSettledFailed(settled);
-                for (let i = 0; i < settled.length; i++) {
-                    const outcome = settled[i];
-                    const repoInput = repoInputs[i];
-                    if (outcome.status !== 'fulfilled') {
-                        // See the project fan-out above. Reachable in practice even though the facade validates the
-                        // key first — a self-managed GitLab can reject an `IssueSort` member the SDK declares, which
-                        // is only discoverable from the response.
-                        throwIfCallerContractError(outcome.reason);
-                        truncated = true;
-                        const failure = toCollectionScopeFailure({
-                            providerId: providerId,
-                            repositoryId: `${repoInput.repo.namespace}/${repoInput.repo.name}`,
-                        }, outcome.reason);
-                        metadata = mergeCollectionMetadata(metadata, {
-                            completeness: 'partial',
-                            failures: [failure],
-                        });
-                        continue;
-                    }
-                    const { repoInput: _repoInput, results } = outcome.value;
-                    data.push(...results.values);
-                    if (results.paging?.more) {
-                        hasMore = true;
-                        cursor.cursors.push({ repo: repoInput.repo, cursor: results.paging.cursor });
-                    }
-                }
-                if (options?.page != null) {
-                    cursor.page = options.page;
-                }
-                this.resetRequestExceptionCount('getIssuesForRepos');
-                return {
-                    value: {
-                        values: data,
-                        paging: {
-                            more: hasMore,
-                            cursor: JSON.stringify(cursor),
-                            truncated: truncated || undefined,
-                            // Echo the requested numbered page so the facade reports the real currentPage for
-                            // numbered-page hosts (GitLab/Bitbucket/Azure), not a synthesized 1. Cursor-only hosts
-                            // leave `page` undefined via their own reads.
-                            page: options?.page,
-                        },
-                        metadata: metadata,
-                    },
-                    duration: performance.now() - start,
-                };
-            }
-            catch (ex) {
-                this.handleProviderException('getIssuesForRepos', ex, {
-                    scope: scope,
-                    connectionId: connectionId,
-                });
-                return { error: toError(ex), duration: performance.now() - start };
-            }
-        }
-        try {
-            const tokenWithInfo = toTokenWithInfo(providerId, session);
-            const result = await api.getIssuesForRepos(tokenWithInfo, reposOrRepoIds, {
-                ...getIssuesOptions,
-                cursor: options?.cursor,
-                baseUrl: customUrl,
-                page: options?.page,
-                pageSize: options?.pageSize,
-                states: states,
-                sort: options?.sort,
-            });
-            const failures = result.metadata?.failures;
-            if (repoIdsInput &&
-                reposOrRepoIds.length > 0 &&
-                result.values.length === 0 &&
-                failures?.length === reposOrRepoIds.length) {
-                const ex = toCollectionFailureError(failures[0], tokenWithInfo);
-                this.handleProviderException('getIssuesForRepos', ex, {
-                    scope: scope,
-                    connectionId: connectionId,
-                });
-                return { error: ex, duration: performance.now() - start };
-            }
-            this.resetRequestExceptionCount('getIssuesForRepos');
-            return { value: result, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('getIssuesForRepos', ex, {
-                scope: scope,
-                connectionId: connectionId,
-            });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    /**
-     * Repo-scoped "my issues" read returning the normalized {@link IssueShape} the ProviderBackend facade
-     * consumes (`listIssuesPage({ repos })`, `broadenIssues`). Maps {@link getMyIssuesForReposResult} — the raw
-     * provider-apis path — to IssueShape.
-     *
-     * It's the seam rather than an inline map so a provider whose only issue client already yields normalized
-     * shapes, and isn't wired into the raw path, can override it and serve these reads without a
-     * `ProviderIssue` round-trip. No provider does today: the one candidate (Bitbucket Cloud's legacy
-     * `getUsersIssuesForRepo`) reports `supportsIssues: false`, so the facade never reaches this for it.
-     */
-    async getMyIssuesForReposAsShapesResult(reposOrRepoIds, options, connectionId) {
-        const result = await this.getMyIssuesForReposResult(reposOrRepoIds, options, connectionId);
-        if (result == null)
-            return undefined;
-        if (result.error != null)
-            return { error: result.error, duration: result.duration };
-        if (result.value == null)
-            return { value: undefined, duration: result.duration };
-        const values = result.value.values
-            .map(issue => toIssueShape(issue, this))
-            .filter((issue) => issue != null);
-        return { value: { ...result.value, values: values }, duration: result.duration };
-    }
-    async getMyPullRequestsForRepos(reposOrRepoIds, options, connectionId) {
-        return (await this.getMyPullRequestsForReposResult(reposOrRepoIds, options, connectionId))?.value;
-    }
-    /**
-     * Result-returning core of {@link getMyPullRequestsForRepos}. Resolves the session for `connectionId`
-     * (or the primary connection when omitted, so multi-account reads use the right token) and recovers
-     * thrown errors and validation failures into `{ error }` so callers can surface them as warnings
-     * rather than swallowing them to `undefined`.
-     */
-    async getMyPullRequestsForReposResult(reposOrRepoIds, options, connectionId) {
-        const scope = getScopedLogger();
-        const providerId = this.authProvider.id;
-        const states = toProviderPullRequestStates(options?.state);
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary. The session
-        // is resolved here for connectivity/bail; the connection's token is applied per API call below.
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        const start = performance.now();
-        const customUrl = options?.customUrl ?? getSelfManagedApiBaseUrl(providerId, session.domain || this.domain, session.protocol);
-        let api;
-        try {
-            api = await this.getProvidersApi();
-        }
-        catch (ex) {
-            this.handleProviderException('getPullRequestsForRepos', ex, {
-                scope: scope,
-                connectionId: connectionId,
-            });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-        if (providerId !== GitCloudHostIntegrationId.GitLab &&
-            (api.isRepoIdsInput(reposOrRepoIds) ||
-                (isAzureDevOpsProvider(providerId) &&
-                    !reposOrRepoIds.every(repo => repo.project != null && repo.namespace != null)))) {
-            return unsupportedRead(`Unsupported input for provider ${providerId}`, start);
-        }
-        let getPullRequestsOptions;
-        if (options?.filters != null) {
-            if (!api.providerSupportsPullRequestFilters(providerId, options.filters)) {
-                return unsupportedRead(`Unsupported filters for provider ${providerId}`, start, 'getPullRequestsForRepos');
-            }
-            let userAccount;
-            if (isAzureDevOpsProvider(providerId)) {
-                const organizations = new Set();
-                for (const repo of reposOrRepoIds) {
-                    organizations.add(repo.namespace);
-                }
-                if (organizations.size > 1) {
-                    Logger.warn(`Multiple organizations not supported for provider ${providerId}`, 'getPullRequestsForRepos');
-                    return {
-                        error: new Error(`Multiple organizations not supported for provider ${providerId}`),
-                        duration: performance.now() - start,
-                    };
-                }
-                else if (organizations.size === 0) {
-                    return unsupportedRead(`No organizations found for provider ${providerId}`, start, 'getPullRequestsForRepos');
-                }
-                const organization = first(organizations.values());
-                try {
-                    userAccount = await this.getFilterAccount(api, session, customUrl, organization);
-                }
-                catch (ex) {
-                    this.handleProviderException('getPullRequestsForRepos', ex, {
-                        scope: scope,
-                        connectionId: connectionId,
-                    });
-                    return { error: toError(ex), duration: performance.now() - start };
-                }
-            }
-            else {
-                try {
-                    userAccount = await this.getFilterAccount(api, session, customUrl);
-                }
-                catch (ex) {
-                    this.handleProviderException('getPullRequestsForRepos', ex, {
-                        scope: scope,
-                        connectionId: connectionId,
-                    });
-                    return { error: toError(ex), duration: performance.now() - start };
-                }
-            }
-            if (userAccount == null) {
-                return unsupportedRead(`Unable to get current user for ${providerId}`, start, 'getPullRequestsForRepos');
-            }
-            let userFilterProperty;
-            switch (providerId) {
-                case GitCloudHostIntegrationId.Bitbucket:
-                case GitCloudHostIntegrationId.AzureDevOps:
-                case GitSelfManagedHostIntegrationId.AzureDevOpsServer:
-                    userFilterProperty = userAccount.id;
-                    break;
-                default:
-                    userFilterProperty = userAccount.username;
-                    break;
-            }
-            if (userFilterProperty == null) {
-                return unsupportedRead(`Unable to get user property for filter for ${providerId}`, start, 'getPullRequestsForRepos');
-            }
-            // Route the "review requested from me" filter to the field each provider actually reads:
-            // GitHub/GitLab expect a login (reviewRequestedLogin), Bitbucket/Azure an account id (reviewerId),
-            // and Bitbucket Server a login (reviewerLogin). `userFilterProperty` is already the account id for
-            // Bitbucket/Azure and the username for the rest.
-            let reviewRequestedLogin;
-            let reviewerId;
-            let reviewerLogin;
-            if (options.filters.includes(PullRequestFilter.ReviewRequested)) {
-                switch (providerId) {
-                    case GitCloudHostIntegrationId.Bitbucket:
-                    case GitCloudHostIntegrationId.AzureDevOps:
-                    case GitSelfManagedHostIntegrationId.AzureDevOpsServer:
-                        reviewerId = userFilterProperty;
-                        break;
-                    case GitSelfManagedHostIntegrationId.BitbucketServer:
-                        reviewerLogin = userFilterProperty;
-                        break;
-                    default:
-                        reviewRequestedLogin = userFilterProperty;
-                        break;
-                }
-            }
-            getPullRequestsOptions = {
-                authorLogin: options.filters.includes(PullRequestFilter.Author) ? userFilterProperty : undefined,
-                assigneeLogins: options.filters.includes(PullRequestFilter.Assignee) ? [userFilterProperty] : undefined,
-                reviewRequestedLogin: reviewRequestedLogin,
-                reviewerId: reviewerId,
-                reviewerLogin: reviewerLogin,
-                mentionLogin: options.filters.includes(PullRequestFilter.Mention) ? userFilterProperty : undefined,
-            };
-        }
-        if (api.getProviderPullRequestsPagingMode(providerId) === PagingMode.Repo &&
-            !api.isRepoIdsInput(reposOrRepoIds)) {
-            const cursorInfo = this.parseCursorInfo(options?.cursor);
-            const cursors = cursorInfo.cursors ?? [];
-            let repoInputs = reposOrRepoIds.map(repo => ({ repo: repo, cursor: undefined }));
-            if (cursors.length > 0) {
-                repoInputs = cursors;
-            }
-            try {
-                const cursor = { cursors: [] };
-                let hasMore = false;
-                let truncated = false;
-                let metadata;
-                const failures = [];
-                const data = [];
-                // `allSettled`, not `Promise.all`: one repo's read rejecting must not discard every sibling repo's
-                // already-fetched PRs and cursors. A rejected repo becomes a structured `CollectionScopeFailure`
-                // (attributed to that repo) so the facade warns on it + sets `fetchFailed`, while the survivors and
-                // their continuation cursors are still returned.
-                const settled = await Promise.allSettled(repoInputs.map(async (repoInput) => {
-                    const results = await api.getPullRequestsForRepo(toTokenWithInfo(providerId, session), repoInput.repo, {
-                        ...getPullRequestsOptions,
-                        cursor: repoInput.cursor,
-                        baseUrl: customUrl,
-                        // Continuation is driven by the per-repo cursor; only apply an explicit page on the
-                        // first request so it can't clobber a continuation cursor on later pages.
-                        page: repoInput.cursor == null ? options?.page : undefined,
-                        pageSize: options?.pageSize,
-                        states: states,
-                        // Azure DevOps only populates clone URLs on request (extra call); no-op elsewhere.
-                        includeRemoteInfo: isAzureDevOpsProvider(providerId) ? true : undefined,
-                    });
-                    return { repoInput: repoInput, results: results };
-                }));
-                throwIfAllSettledFailed(settled);
-                // `allSettled` preserves order, so `settled[i]` is `repoInputs[i]`.
-                settled.forEach((outcome, i) => {
-                    if (outcome.status !== 'fulfilled') {
-                        const failedRepo = repoInputs[i].repo;
-                        failures.push(toCollectionScopeFailure({ providerId: providerId, repositoryId: `${failedRepo.namespace}/${failedRepo.name}` }, outcome.reason));
-                        return;
-                    }
-                    const { repoInput, results } = outcome.value;
-                    data.push(...results.values);
-                    // Fan-out across repos: preserve each repo's SDK completeness/failures and its terminal
-                    // truncation so a single failed/incomplete repo isn't lost when merged with its siblings.
-                    metadata = mergeCollectionMetadata(metadata, results.metadata);
-                    if (results.paging?.truncated) {
-                        truncated = true;
-                    }
-                    if (results.paging?.more) {
-                        hasMore = true;
-                        cursor.cursors.push({ repo: repoInput.repo, cursor: results.paging.cursor });
-                    }
-                });
-                // Merge the GitLens-side per-repo rejections into the SDK metadata so both flow through the same
-                // warning/fetchFailed assessment downstream.
-                if (failures.length > 0) {
-                    metadata = mergeCollectionMetadata(metadata, { completeness: 'partial', failures: failures });
-                }
-                // Keep the requested page number in the composite cursor so the facade can report the real
-                // currentPage when the consumer continues using only the cursor.
-                if (options?.page != null) {
-                    cursor.page = options.page;
-                }
-                this.resetRequestExceptionCount('getPullRequestsForRepos');
-                return {
-                    value: {
-                        values: data,
-                        paging: {
-                            more: hasMore,
-                            cursor: JSON.stringify(cursor),
-                            truncated: truncated || undefined,
-                            // Echo the requested numbered page so the facade reports the real currentPage for
-                            // numbered-page hosts (GitLab/Bitbucket/Azure), not a synthesized 1. Cursor-only hosts
-                            // leave `page` undefined via their own reads.
-                            page: options?.page,
-                        },
-                        metadata: metadata,
-                    },
-                    duration: performance.now() - start,
-                };
-            }
-            catch (ex) {
-                this.handleProviderException('getPullRequestsForRepos', ex, {
-                    scope: scope,
-                    connectionId: connectionId,
-                });
-                return { error: toError(ex), duration: performance.now() - start };
-            }
-        }
-        try {
-            const result = await api.getPullRequestsForRepos(toTokenWithInfo(providerId, session), reposOrRepoIds, {
-                ...getPullRequestsOptions,
-                cursor: options?.cursor,
-                baseUrl: customUrl,
-                page: options?.page,
-                pageSize: options?.pageSize,
-                states: states,
-                // Azure DevOps only populates clone URLs on request (extra call); no-op elsewhere.
-                includeRemoteInfo: isAzureDevOpsProvider(providerId) ? true : undefined,
-                fields: options?.summary ? summaryPullRequestFields : undefined,
-            });
-            this.resetRequestExceptionCount('getPullRequestsForRepos');
-            return { value: result, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('getPullRequestsForRepos', ex, {
-                scope: scope,
-                connectionId: connectionId,
-            });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    /** Account-wide (or repo-scoped) search for the current user's pull requests. */
-    async searchMyPullRequests(repos, cancellation, options) {
-        const scope = getScopedLogger();
-        const { connectionId, ...searchOptions } = options ?? {};
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        const start = performance.now();
-        try {
-            const prs = await this.searchProviderMyPullRequests(session, ensureArray(repos), cancellation, searchOptions);
-            this.resetRequestExceptionCount('searchMyPullRequests');
-            return { value: prs, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('searchMyPullRequests', ex, {
-                scope: scope,
-                silent: true,
-                connectionId: connectionId,
-            });
-            return {
-                error: toError(ex),
-                duration: performance.now() - start,
-            };
-        }
-    }
-    /**
-     * Account-wide, user-scoped counterpart of {@link getMyPullRequestsForReposResult} that returns the raw
-     * `ProviderPullRequest` shape (not the normalized model). Unlike the repo-scoped core, this needs no
-     * `repos` — it reads the current user's pull requests across the account, so the ProviderBackend sweep
-     * can drive its Kanban "done" column even when no repositories are supplied (where the repo-scoped core
-     * rejects an empty `repos` input). Recovers thrown errors into `{ error }` so callers surface warnings.
-     */
-    async getMyPullRequestsForUserResult(options, connectionId) {
-        const scope = getScopedLogger();
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        if (this.getProviderMyPullRequestsForUser == null) {
-            return undefined;
-        }
-        const start = performance.now();
-        try {
-            const result = await this.getProviderMyPullRequestsForUser(session, options);
-            this.resetRequestExceptionCount('getMyPullRequestsForUser');
-            return { value: result, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('getMyPullRequestsForUser', ex, {
-                scope: scope,
-                connectionId: connectionId,
-            });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    /**
-     * Parses a Repo/Project paging cursor into its `cursors` bundle. Guards against valid JSON whose
-     * `cursors` is a truthy non-array (e.g. `{ "cursors": "..." }`), which would otherwise bypass the
-     * `?? []` fallback at call sites and flow into `.map()` downstream, throwing instead of degrading to
-     * the first page.
-     */
-    parseCursorInfo(cursor) {
-        try {
-            const parsed = JSON.parse(cursor ?? '{}');
-            return Array.isArray(parsed?.cursors) ? parsed : {};
-        }
-        catch {
-            return {};
-        }
-    }
-    /**
-     * Result-returning wrapper for the filtered pull-request search. Errors become the soft
-     * `{ error }` branch so the public facade can preserve an empty account and a failed request as distinct
-     * outcomes.
-     */
-    async searchPullRequestsPageResult(options, cancellation, connectionId) {
-        const scope = getScopedLogger();
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        const start = performance.now();
-        try {
-            const result = await this.searchProviderPullRequestsPage?.(session, options, cancellation);
-            this.resetRequestExceptionCount('searchPullRequestsPage');
-            return { value: result, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('searchPullRequestsPage', ex, { scope: scope, connectionId: connectionId });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    /** Free-text search across pull requests, optionally narrowed to `repos`. */
-    async searchPullRequests(searchQuery, repos, cancellation, options) {
-        const scope = getScopedLogger();
-        const { connectionId, ...searchOptions } = options ?? {};
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        try {
-            const prs = await this.searchProviderPullRequests?.(session, searchQuery, ensureArray(repos), cancellation, searchOptions);
-            this.resetRequestExceptionCount('searchPullRequests');
-            return prs;
-        }
-        catch (ex) {
-            this.handleProviderException('searchPullRequests', ex, { scope: scope, connectionId: connectionId });
-            return undefined;
-        }
-    }
-    /**
-     * Result-returning wrapper for the FILTERED issue search — issues matching structured criteria over a
-     * repository/org scope, with no forced relationship to the current user. Recovers thrown errors into
-     * `{ error }` so the facade surfaces a warning instead of a silent empty page.
-     *
-     * Distinct from every other issue read on this class: {@link searchMyIssuesWithTruncationResult} is bound to
-     * the current user by construction, and {@link getMyIssuesForReposAsShapesResult} goes through the SDK's
-     * repo-scoped read (whose over-limit recovery walk can cost up to 128 requests). This one is one request per
-     * page and carries no relationship it wasn't asked for.
-     */
-    async searchIssuesPageResult(options, cancellation, connectionId) {
-        const scope = getScopedLogger();
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        const start = performance.now();
-        try {
-            const result = await this.searchProviderIssuesPage?.(session, options, cancellation);
-            this.resetRequestExceptionCount('searchIssuesPage');
-            return { value: result, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('searchIssuesPage', ex, { scope: scope, connectionId: connectionId });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    /**
-     * Result-returning wrapper for the count-only probe: how many issues MATCH each scope, transferring no issues
-     * at all. Recovers thrown errors into `{ error }` like the reads around it.
-     *
-     * Counts come back POSITIONALLY — one per input scope, in order — because a caller's key must never reach the
-     * provider query. `undefined` in a slot means the provider didn't report a count for it, never zero matches.
-     */
-    async countIssuesResult(scopes, cancellation, connectionId) {
-        const scope = getScopedLogger();
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        const start = performance.now();
-        try {
-            const counts = await this.countProviderIssues?.(session, scopes, cancellation);
-            this.resetRequestExceptionCount('countIssues');
-            return { value: counts, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('countIssues', ex, { scope: scope, connectionId: connectionId });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    /**
-     * Result-returning wrapper for the BATCH issue read: resolves several `(owner, repo, number)` coordinates in
-     * one request. Recovers thrown errors into `{ error }` like the reads around it.
-     *
-     * Distinct from every search on this class, and deliberately so. A search answers "what matches"; this answers
-     * "does this exact issue exist", which is the question a caller correlating a branch name to an issue is
-     * actually asking. It has no result ceiling, no ordering and no cursor, and — the property that matters most —
-     * an absent slot is a PROVEN ABSENCE rather than "not found within a page budget", so a caller can cache a
-     * miss instead of re-walking for it forever.
-     *
-     * Results come back POSITIONALLY — one per input coordinate, in order — for the same reason
-     * {@link countIssuesResult} does: a caller's key must never reach the provider query. `undefined` in a slot
-     * means the issue does not exist or is not visible to this token, never that the read failed.
-     */
-    async getIssuesBatchResult(coordinates, cancellation, connectionId) {
-        const scope = getScopedLogger();
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        const start = performance.now();
-        try {
-            const issues = await this.getProviderIssuesBatch?.(session, coordinates, cancellation);
-            this.resetRequestExceptionCount('getIssuesBatch');
-            return { value: issues, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('getIssuesBatch', ex, { scope: scope, connectionId: connectionId });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    /** The PR twin of {@link countIssuesResult}: counts each scope's pull requests, transferring none. */
-    async countPullRequestsResult(scopes, cancellation, connectionId) {
-        const scope = getScopedLogger();
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(connectionId, scope);
-        if (session == null)
-            return undefined;
-        const start = performance.now();
-        try {
-            const counts = await this.countProviderPullRequests?.(session, scopes, cancellation);
-            this.resetRequestExceptionCount('countPullRequests');
-            return { value: counts, duration: performance.now() - start };
-        }
-        catch (ex) {
-            this.handleProviderException('countPullRequests', ex, { scope: scope, connectionId: connectionId });
-            return { error: toError(ex), duration: performance.now() - start };
-        }
-    }
-    getPullRequestIdentityFromMaybeUrl(search) {
-        return this.getProviderPullRequestIdentityFromMaybeUrl?.(search);
-    }
-}
-__decorate([
-    gate(),
-    trace()
-], GitHostIntegration.prototype, "getAccountForEmail", null);
-__decorate([
-    gate(),
-    trace()
-], GitHostIntegration.prototype, "getSshSigningKeysForEmails", null);
-__decorate([
-    gate(),
-    trace()
-], GitHostIntegration.prototype, "getAccountForCommit", null);
-__decorate([
-    trace()
-], GitHostIntegration.prototype, "getDefaultBranch", null);
-__decorate([
-    trace()
-], GitHostIntegration.prototype, "getRepositoryMetadata", null);
-__decorate([
-    trace()
-], GitHostIntegration.prototype, "getOrganizationsForUserResult", null);
-__decorate([
-    trace()
-], GitHostIntegration.prototype, "getProjectsForOrgResult", null);
-__decorate([
-    trace()
-], GitHostIntegration.prototype, "getRepositoriesForOrgResult", null);
-__decorate([
-    trace()
-], GitHostIntegration.prototype, "getRepositoriesForUserResult", null);
-__decorate([
-    trace()
-], GitHostIntegration.prototype, "getPullRequestForBranch", null);
-__decorate([
-    trace()
-], GitHostIntegration.prototype, "getPullRequestForCommit", null);
-__decorate([
-    trace()
-], GitHostIntegration.prototype, "searchMyPullRequests", null);
-__decorate([
-    trace()
-], GitHostIntegration.prototype, "searchPullRequests", null);
+var GitHostIntegration = class extends IntegrationBase {
+	type = "git";
+	/** The self-managed installation `session` addresses, validated against this integration's host. */
+	getSelfManagedInstallationUrl(session) {
+		const baseUrl = getSelfManagedBaseUrl(this.id, session.baseUrl ?? (session.domain || this.domain), session.protocol);
+		if (baseUrl == null || !areDomainsOnSameHost(baseUrl, this.domain)) throw new Error("Invalid self-managed integration base URL");
+		return baseUrl;
+	}
+	getSelfManagedApiBaseUrl(session) {
+		const baseUrl = this.getSelfManagedInstallationUrl(session);
+		switch (this.id) {
+			case "cloud-github-enterprise": return `${baseUrl}/api/v3`;
+			case "bitbucket-server": return `${baseUrl}/rest/api/1.0`;
+			default: return baseUrl;
+		}
+	}
+	/** The base the repository-list reads hand the provider client for a self-managed host. */
+	getRepositoriesApiBaseUrl(session, _repos) {
+		return this.getSelfManagedApiBaseUrl(session);
+	}
+	async getAccountForEmail(repo, email, options) {
+		const scope = getScopedLogger();
+		if (!(this.maybeConnected ?? await this.isConnected())) return void 0;
+		await this.refreshSessionIfExpired(scope);
+		try {
+			const author = await this.getProviderAccountForEmail(this._session, repo, email, options);
+			this.resetRequestExceptionCount("getAccountForEmail");
+			return author;
+		} catch (ex) {
+			this.handleProviderException("getAccountForEmail", ex, { scope });
+			return;
+		}
+	}
+	/**
+	* Returns the SSH signing keys (full OpenSSH-format `<type> <key> [comment]` strings) registered by the accounts
+	* matching the given emails on this integration, for building an `allowed_signers` file. Keyed by lowercased email;
+	* emails with no match (and unsupported integrations) are absent. Batching the lookups is left to the integration.
+	*/
+	async getSshSigningKeysForEmails(repo, emails) {
+		const scope = getScopedLogger();
+		if (!(this.maybeConnected ?? await this.isConnected())) return /* @__PURE__ */ new Map();
+		await this.refreshSessionIfExpired(scope);
+		try {
+			const keys = await this.getProviderSshSigningKeysForEmails(this._session, repo, emails);
+			this.resetRequestExceptionCount("getSshSigningKeysForEmails");
+			return keys;
+		} catch (ex) {
+			this.handleProviderException("getSshSigningKeysForEmails", ex, { scope });
+			return /* @__PURE__ */ new Map();
+		}
+	}
+	/** Override in integrations that expose users' SSH signing keys. Defaults to none. */
+	getProviderSshSigningKeysForEmails(_session, _repo, _emails) {
+		return Promise.resolve(/* @__PURE__ */ new Map());
+	}
+	async getAccountForCommit(repo, rev, options) {
+		const scope = getScopedLogger();
+		if (!(this.maybeConnected ?? await this.isConnected())) return void 0;
+		await this.refreshSessionIfExpired(scope);
+		try {
+			const author = await this.getProviderAccountForCommit(this._session, repo, rev, options);
+			this.resetRequestExceptionCount("getAccountForCommit");
+			return author;
+		} catch (ex) {
+			this.handleProviderException("getAccountForCommit", ex, { scope });
+			return;
+		}
+	}
+	async getDefaultBranch(repo, options) {
+		const scope = getScopedLogger();
+		if (!(this.maybeConnected ?? await this.isConnected())) return void 0;
+		await this.refreshSessionIfExpired(scope);
+		return this.ctx.cache.getRepositoryDefaultBranch(repo, this, () => ({ value: (async () => {
+			try {
+				const result = await this.getProviderDefaultBranch(this._session, repo, options?.cancellation);
+				this.resetRequestExceptionCount("getDefaultBranch");
+				return result;
+			} catch (ex) {
+				this.handleProviderException("getDefaultBranch", ex, { scope });
+				return;
+			}
+		})() }), { expiryOverride: options?.expiryOverride });
+	}
+	async getRepositoryMetadata(repo, options) {
+		const scope = getScopedLogger();
+		if (!(this.maybeConnected ?? await this.isConnected())) return void 0;
+		await this.refreshSessionIfExpired(scope);
+		return this.ctx.cache.getRepositoryMetadata(repo, this, () => ({ value: (async () => {
+			try {
+				const result = await this.getProviderRepositoryMetadata(this._session, repo, options?.cancellation);
+				this.resetRequestExceptionCount("getRepositoryMetadata");
+				return result;
+			} catch (ex) {
+				this.handleProviderException("getRepositoryMetadata", ex, { scope });
+				return;
+			}
+		})() }), { expiryOverride: options?.expiryOverride });
+	}
+	/**
+	* Whether this git host implements generic org discovery. False for providers that register no
+	* {@link getProviderOrganizationsForUser} hook — the facade uses this to
+	* report `unsupported` instead of a silent empty list, which is indistinguishable from "has no orgs".
+	*/
+	get supportsOrganizationDiscovery() {
+		return this.getProviderOrganizationsForUser != null;
+	}
+	/** Whether this git host implements generic repository discovery ({@link getProviderRepositoriesForOrg}). */
+	get supportsRepositoryDiscovery() {
+		return this.getProviderRepositoriesForOrg != null;
+	}
+	/**
+	* Whether this git host has a project tier between org and repo ({@link getProviderProjectsForOrg}). Only
+	* Azure DevOps does; the facade uses this to skip the read entirely rather than call a core that returns
+	* `undefined` for a session-less reason and be misread as a broken connection.
+	*/
+	get supportsProjectDiscovery() {
+		return this.getProviderProjectsForOrg != null;
+	}
+	/**
+	* Whether this git host implements the account-wide user-affiliated repository read
+	* ({@link getProviderRepositoriesForUser}) — the org-less `gk provider repos <provider>` equivalent.
+	*/
+	get supportsUserRepositoryDiscovery() {
+		return this.getProviderRepositoriesForUser != null;
+	}
+	/**
+	* Whether this git host exposes issues on the ProviderBackend surface. Most git hosts do; a host with no
+	* usable issue tracker overrides this to false — Bitbucket Cloud (deprecated in favor of dedicated issue
+	* integrations like Jira) and Bitbucket Data Center (never had one) — so the facade reports issues as
+	* unsupported instead of serving a partial/deprecated source or failing inside a provider client that
+	* registers no issue function at all.
+	*
+	* Keep this in sync with {@link ProviderMetadata.supportedIssueFilters}: a provider that declares no issue
+	* filters and no issue read is answering the same capability question twice, and the two must agree.
+	*/
+	get supportsIssues() {
+		return true;
+	}
+	/**
+	* Lists the organizations (orgs/workspaces/groups) the current user belongs to on this host.
+	* `truncated === true` means the defensive page-drain backstop stopped before the upstream listing was
+	* exhausted.
+	*
+	* Resolves the session for `connectionId` (or the primary connection when omitted, honoring multi-account
+	* reads) and recovers a thrown error into `{ error }` so callers can surface it as a warning instead of
+	* swallowing it to `undefined`.
+	*/
+	async getOrganizationsForUserResult(connectionId) {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		const start = performance.now();
+		try {
+			const result = await this.getProviderOrganizationsForUser?.(session);
+			const authFailure = result?.metadata?.failures?.find((failure) => failure.kind === "authentication" && failure.scope != null && failure.scope.providerId === this.id && Object.keys(failure.scope).length === 1);
+			if (authFailure != null) this.handleProviderException("getOrganizationsForUser", toCollectionFailureError(authFailure, toTokenWithInfo(this.id, session)), {
+				scope,
+				connectionId
+			});
+			else this.resetRequestExceptionCount("getOrganizationsForUser");
+			return {
+				value: result,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("getOrganizationsForUser", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	/**
+	* Result-returning list of the projects a git host exposes beneath its orgs, unified into the
+	* {@link ProviderOrganization} shape. Only Azure DevOps has a project tier between org and repo; other
+	* git hosts have none and leave {@link getProviderProjectsForOrg} undefined, so this returns `undefined`
+	* for them (the ProviderBackend facade then treats them as having no projects). With `org`, scopes to
+	* that org's projects; without, returns projects across every org the user can see.
+	*/
+	async getProjectsForOrgResult(org, connectionId) {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		if (this.getProviderProjectsForOrg == null) return;
+		const start = performance.now();
+		try {
+			const result = await this.getProviderProjectsForOrg(session, org);
+			this.resetRequestExceptionCount("getProjectsForOrg");
+			return {
+				value: result,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("getProjectsForOrg", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	/**
+	* Lists repositories under the given organization (org/workspace/group) one page at a time — follow
+	* `paging.cursor` to page, or drain with the integrations provider paging helper.
+	* `options.project` is only meaningful for Azure DevOps, whose repos are scoped by `org` + `project`;
+	* every other host ignores it. (Azure without a project can't page its cross-project merge, so it
+	* returns all matches in a single page.) `truncated === true` means the defensive page-drain
+	* backstop stopped before the upstream listing was exhausted.
+	*
+	* Resolves the session for `connectionId` (or the primary connection when omitted) and recovers a thrown
+	* error into `{ error }`, so a caller surfaces it as a warning instead of a silent `undefined`.
+	*/
+	async getRepositoriesForOrgResult(org, options) {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(options?.connectionId, scope);
+		if (session == null) return void 0;
+		const start = performance.now();
+		try {
+			const result = await this.getProviderRepositoriesForOrg?.(session, org, options);
+			this.resetRequestExceptionCount("getRepositoriesForOrg");
+			return {
+				value: result,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("getRepositoriesForOrg", ex, {
+				scope,
+				connectionId: options?.connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	/**
+	* Result-returning account-wide, user-affiliated repository read (the org-less
+	* `gk provider repos <provider>` equivalent): repositories the user owns, collaborates on, or can
+	* access through org membership — NOT every repo of every org. Optional: providers without a native
+	* user-affiliated listing (Bitbucket workspaces, Azure orgs, which require an org/workspace scope)
+	* leave the hook undefined and the facade reports the read as unsupported so callers fan out per org.
+	*/
+	async getRepositoriesForUserResult(options) {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(options?.connectionId, scope);
+		if (session == null) return void 0;
+		if (this.getProviderRepositoriesForUser == null) return;
+		const start = performance.now();
+		try {
+			const result = await this.getProviderRepositoriesForUser(session, options);
+			this.resetRequestExceptionCount("getRepositoriesForUser");
+			return {
+				value: result,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("getRepositoriesForUser", ex, {
+				scope,
+				connectionId: options?.connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	async mergePullRequest(pr, options, cancellation) {
+		const scope = getScopedLogger();
+		if (!(this.maybeConnected ?? await this.isConnected())) return false;
+		await this.refreshSessionIfExpired(scope);
+		try {
+			const result = await this.mergeProviderPullRequest(this._session, pr, options, cancellation);
+			this.resetRequestExceptionCount("mergePullRequest");
+			return result;
+		} catch (ex) {
+			if (isCancellationError(ex)) return false;
+			this.handleProviderException("mergePullRequest", ex, { scope });
+			return false;
+		} finally {
+			this.ctx.cache.deletePullRequests();
+		}
+	}
+	async getPullRequestForBranch(repo, branch, options) {
+		const scope = getScopedLogger();
+		if (!(this.maybeConnected ?? await this.isConnected())) return void 0;
+		await this.refreshSessionIfExpired(scope);
+		const { expiryOverride, throwOnError, ...opts } = options ?? {};
+		return this.ctx.cache.getPullRequestForBranch(branch, repo, this, (cacheable) => ({ value: (async () => {
+			try {
+				const result = await this.getProviderPullRequestForBranch(this._session, repo, branch, opts);
+				this.resetRequestExceptionCount("getPullRequestForBranch");
+				return result;
+			} catch (ex) {
+				cacheable.invalidate();
+				this.handleProviderException("getPullRequestForBranch", ex, { scope });
+				if (throwOnError) throw ex;
+				return;
+			}
+		})() }), { expiryOverride });
+	}
+	async getPullRequestForCommit(repo, rev, options) {
+		const scope = getScopedLogger();
+		if (!(this.maybeConnected ?? await this.isConnected())) return void 0;
+		await this.refreshSessionIfExpired(scope);
+		const { throwOnError, ...cacheOptions } = options ?? {};
+		return this.ctx.cache.getPullRequestForSha(rev, repo, this, (cacheable) => ({ value: (async () => {
+			try {
+				const result = await this.getProviderPullRequestForCommit(this._session, repo, rev);
+				this.resetRequestExceptionCount("getPullRequestForCommit");
+				return result;
+			} catch (ex) {
+				cacheable.invalidate();
+				this.handleProviderException("getPullRequestForCommit", ex, { scope });
+				if (throwOnError) throw ex;
+				return;
+			}
+		})() }), cacheOptions);
+	}
+	/**
+	* Memoized identity lookups backing filter resolution. Keyed by the session's token fingerprint plus the
+	* scope of the lookup (base URL, and the Azure organization for the per-instance variant), so a different
+	* account, host, or org never reuses an entry and a rotated token simply misses.
+	*
+	* Not cleared when the token changes: one integration instance serves every connection of its provider
+	* (multi-account), so clearing on a fingerprint change would make two accounts reading in alternation
+	* evict each other and defeat the memo. Entries are bounded by tokens x hosts x orgs seen — a handful for
+	* the life of the integration.
+	*/
+	_filterAccounts = /* @__PURE__ */ new Map();
+	/**
+	* Resolves the account a repo-scoped read turns `IssueFilter`/`PullRequestFilter` into a provider
+	* login/id with, memoized per token+scope.
+	*
+	* Every FILTERED read needs this, and `ProvidersApi.getCurrentUser` is a bare round trip — unlike
+	* {@link IntegrationBase.getCurrentAccount}, which the host caches. So a consumer that fans ONE page out
+	* into several filtered reads paid one identity request PER read, all resolving the same account: a
+	* per-user-facet fan-out (author + assignee + review-requested) doubled its request count, and paid it
+	* again on every page turn.
+	*
+	* The promise is memoized rather than the value, so concurrent facets share one in-flight request instead
+	* of racing. A rejection is evicted so the next read retries rather than caching a failure — matching how
+	* `getCurrentAccount` invalidates on error.
+	*/
+	getFilterAccount(api, session, customUrl, organization) {
+		const key = `${this.getSessionFingerprint(session)}:${customUrl ?? ""}:${organization ?? ""}`;
+		let pending = this._filterAccounts.get(key);
+		if (pending == null) {
+			const tokenWithInfo = toTokenWithInfo(this.authProvider.id, session);
+			pending = (organization != null ? api.getCurrentUserForInstance(tokenWithInfo, organization, {
+				baseUrl: customUrl,
+				isPAT: sendsBasicCredential(this.id, session)
+			}) : api.getCurrentUser(tokenWithInfo, { baseUrl: customUrl })).catch((ex) => {
+				this._filterAccounts.delete(key);
+				throw ex;
+			});
+			this._filterAccounts.set(key, pending);
+		}
+		return pending;
+	}
+	async getMyIssuesForRepos(reposOrRepoIds, options, connectionId) {
+		return (await this.getMyIssuesForReposResult(reposOrRepoIds, options, connectionId))?.value;
+	}
+	/**
+	* Result-returning core of {@link getMyIssuesForRepos}. Resolves the session for `connectionId`
+	* (or the primary connection when omitted, so multi-account reads use the right token) and recovers
+	* thrown errors and validation failures into `{ error }` so callers can surface them as warnings
+	* rather than swallowing them to `undefined`.
+	*/
+	async getMyIssuesForReposResult(reposOrRepoIds, options, connectionId) {
+		const scope = getScopedLogger();
+		const providerId = this.authProvider.id;
+		const states = toProviderIssueStates(options?.state);
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		const start = performance.now();
+		let customUrl;
+		let api;
+		try {
+			customUrl = options?.customUrl ?? (isGitSelfManagedHostIntegrationId(providerId) ? this.getRepositoriesApiBaseUrl(session, reposOrRepoIds) : void 0);
+			api = await this.getProvidersApi();
+		} catch (ex) {
+			this.handleProviderException("getIssuesForRepos", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+		const repoIdsInput = api.isRepoIdsInput(reposOrRepoIds);
+		if (providerId !== "gitlab" && (repoIdsInput || isAzureDevOpsProvider(providerId) && !reposOrRepoIds.every((repo) => repo.project != null && repo.namespace != null))) return unsupportedRead(`Unsupported input for provider ${providerId}`, start, "getIssuesForRepos");
+		let getIssuesOptions;
+		if (isAzureDevOpsProvider(providerId)) {
+			const organizations = /* @__PURE__ */ new Set();
+			const projects = /* @__PURE__ */ new Set();
+			for (const repo of reposOrRepoIds) {
+				organizations.add(repo.namespace);
+				projects.add(repo.project);
+			}
+			if (organizations.size > 1) return unsupportedRead(`Multiple organizations not supported for provider ${providerId}`, start, "getIssuesForRepos");
+			else if (organizations.size === 0) return unsupportedRead(`No organizations found for provider ${providerId}`, start, "getIssuesForRepos");
+			const organization = first(organizations.values());
+			if (options?.filters != null) {
+				if (!api.providerSupportsIssueFilters(providerId, options.filters)) return unsupportedRead(`Unsupported filters for provider ${providerId}`, start, "getIssuesForRepos");
+				let userAccount;
+				try {
+					userAccount = await this.getFilterAccount(api, session, customUrl, organization);
+				} catch (ex) {
+					this.handleProviderException("getIssuesForRepos", ex, {
+						scope,
+						connectionId
+					});
+					return {
+						error: toError(ex),
+						duration: performance.now() - start
+					};
+				}
+				if (userAccount == null) return unsupportedRead(`Unable to get current user for ${providerId}`, start, "getIssuesForRepos");
+				const userFilterProperty = userAccount.name;
+				if (userFilterProperty == null) return unsupportedRead(`Unable to get user property for filter for ${providerId}`, start, "getIssuesForRepos");
+				getIssuesOptions = {
+					authorLogin: options.filters.includes("author") ? userFilterProperty : void 0,
+					assigneeLogins: !options.includeAllAssignees && options.filters.includes("assignee") ? [userFilterProperty] : void 0,
+					mentionLogin: options.filters.includes("mention") ? userFilterProperty : void 0
+				};
+			}
+			const cursors = this.parseCursorInfo(options?.cursor).cursors ?? [];
+			let projectInputs = Array.from(projects.values(), (project) => ({
+				namespace: organization,
+				project,
+				cursor: void 0
+			}));
+			if (cursors.length > 0) projectInputs = cursors;
+			try {
+				const cursor = { cursors: [] };
+				let hasMore = false;
+				let truncated = false;
+				let metadata;
+				const data = [];
+				const settled = await Promise.allSettled(projectInputs.map(async (projectInput) => {
+					return {
+						projectInput,
+						results: await api.getIssuesForAzureProject(toTokenWithInfo(providerId, session), projectInput.namespace, projectInput.project, {
+							...getIssuesOptions,
+							cursor: projectInput.cursor,
+							baseUrl: customUrl,
+							isPAT: sendsBasicCredential(providerId, session),
+							page: projectInput.cursor == null ? options?.page : void 0,
+							pageSize: options?.pageSize,
+							states,
+							sort: options?.sort
+						})
+					};
+				}));
+				throwIfAllSettledFailed(settled);
+				for (let i = 0; i < settled.length; i++) {
+					const outcome = settled[i];
+					const projectInput = projectInputs[i];
+					if (outcome.status !== "fulfilled") {
+						throwIfCallerContractError(outcome.reason);
+						truncated = true;
+						const failure = toCollectionScopeFailure({
+							providerId,
+							resourceId: projectInput.namespace,
+							projectId: projectInput.project
+						}, outcome.reason);
+						metadata = mergeCollectionMetadata(metadata, {
+							completeness: "partial",
+							failures: [failure]
+						});
+						continue;
+					}
+					const { projectInput: _projectInput, results } = outcome.value;
+					data.push(...results.values);
+					if (results.paging?.more) {
+						hasMore = true;
+						cursor.cursors.push({
+							namespace: projectInput.namespace,
+							project: projectInput.project,
+							cursor: results.paging.cursor
+						});
+					}
+				}
+				if (options?.page != null) cursor.page = options.page;
+				this.resetRequestExceptionCount("getIssuesForRepos");
+				return {
+					value: {
+						values: data,
+						paging: {
+							more: hasMore,
+							cursor: JSON.stringify(cursor),
+							truncated: truncated || void 0,
+							page: options?.page
+						},
+						metadata
+					},
+					duration: performance.now() - start
+				};
+			} catch (ex) {
+				this.handleProviderException("getIssuesForRepos", ex, {
+					scope,
+					connectionId
+				});
+				return {
+					error: toError(ex),
+					duration: performance.now() - start
+				};
+			}
+		}
+		if (options?.filters != null) {
+			if (!api.providerSupportsIssueFilters(providerId, options.filters)) return unsupportedRead(`Unsupported filters for provider ${providerId}`, start, "getIssuesForRepos");
+			let userAccount;
+			try {
+				userAccount = await this.getFilterAccount(api, session, customUrl);
+			} catch (ex) {
+				this.handleProviderException("getIssuesForRepos", ex, {
+					scope,
+					connectionId
+				});
+				return {
+					error: toError(ex),
+					duration: performance.now() - start
+				};
+			}
+			if (userAccount == null) return unsupportedRead(`Unable to get current user for ${providerId}`, start, "getIssuesForRepos");
+			const userFilterProperty = userAccount.username;
+			if (userFilterProperty == null) return unsupportedRead(`Unable to get user property for filter for ${providerId}`, start, "getIssuesForRepos");
+			getIssuesOptions = {
+				authorLogin: options.filters.includes("author") ? userFilterProperty : void 0,
+				assigneeLogins: !options.includeAllAssignees && options.filters.includes("assignee") ? [userFilterProperty] : void 0,
+				mentionLogin: options.filters.includes("mention") ? userFilterProperty : void 0
+			};
+		}
+		if (api.getProviderIssuesPagingMode(providerId) === "repo" && !repoIdsInput) {
+			const cursors = this.parseCursorInfo(options?.cursor).cursors ?? [];
+			let repoInputs = reposOrRepoIds.map((repo) => ({
+				repo,
+				cursor: void 0
+			}));
+			if (cursors.length > 0) repoInputs = cursors;
+			try {
+				const cursor = { cursors: [] };
+				let hasMore = false;
+				let truncated = false;
+				let metadata;
+				const data = [];
+				const settled = await Promise.allSettled(repoInputs.map(async (repoInput) => {
+					return {
+						repoInput,
+						results: await api.getIssuesForRepo(toTokenWithInfo(providerId, session), repoInput.repo, {
+							...getIssuesOptions,
+							cursor: repoInput.cursor,
+							baseUrl: customUrl,
+							page: repoInput.cursor == null ? options?.page : void 0,
+							pageSize: options?.pageSize,
+							states,
+							sort: options?.sort
+						})
+					};
+				}));
+				throwIfAllSettledFailed(settled);
+				for (let i = 0; i < settled.length; i++) {
+					const outcome = settled[i];
+					const repoInput = repoInputs[i];
+					if (outcome.status !== "fulfilled") {
+						throwIfCallerContractError(outcome.reason);
+						truncated = true;
+						const failure = toCollectionScopeFailure({
+							providerId,
+							repositoryId: `${repoInput.repo.namespace}/${repoInput.repo.name}`
+						}, outcome.reason);
+						metadata = mergeCollectionMetadata(metadata, {
+							completeness: "partial",
+							failures: [failure]
+						});
+						continue;
+					}
+					const { repoInput: _repoInput, results } = outcome.value;
+					data.push(...results.values);
+					if (results.paging?.more) {
+						hasMore = true;
+						cursor.cursors.push({
+							repo: repoInput.repo,
+							cursor: results.paging.cursor
+						});
+					}
+				}
+				if (options?.page != null) cursor.page = options.page;
+				this.resetRequestExceptionCount("getIssuesForRepos");
+				return {
+					value: {
+						values: data,
+						paging: {
+							more: hasMore,
+							cursor: JSON.stringify(cursor),
+							truncated: truncated || void 0,
+							page: options?.page
+						},
+						metadata
+					},
+					duration: performance.now() - start
+				};
+			} catch (ex) {
+				this.handleProviderException("getIssuesForRepos", ex, {
+					scope,
+					connectionId
+				});
+				return {
+					error: toError(ex),
+					duration: performance.now() - start
+				};
+			}
+		}
+		try {
+			const tokenWithInfo = toTokenWithInfo(providerId, session);
+			const result = await api.getIssuesForRepos(tokenWithInfo, reposOrRepoIds, {
+				...getIssuesOptions,
+				cursor: options?.cursor,
+				baseUrl: customUrl,
+				isPAT: sendsBasicCredential(providerId, session),
+				page: options?.page,
+				pageSize: options?.pageSize,
+				states,
+				sort: options?.sort
+			});
+			const failures = result.metadata?.failures;
+			if (repoIdsInput && reposOrRepoIds.length > 0 && result.values.length === 0 && failures?.length === reposOrRepoIds.length) {
+				const ex = toCollectionFailureError(failures[0], tokenWithInfo);
+				this.handleProviderException("getIssuesForRepos", ex, {
+					scope,
+					connectionId
+				});
+				return {
+					error: ex,
+					duration: performance.now() - start
+				};
+			}
+			this.resetRequestExceptionCount("getIssuesForRepos");
+			return {
+				value: result,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("getIssuesForRepos", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	/**
+	* Repo-scoped "my issues" read returning the normalized {@link IssueShape} the ProviderBackend facade
+	* consumes (`listIssuesPage({ repos })`, `broadenIssues`). Maps {@link getMyIssuesForReposResult} — the raw
+	* provider-apis path — to IssueShape.
+	*
+	* It's the seam rather than an inline map so a provider whose only issue client already yields normalized
+	* shapes, and isn't wired into the raw path, can override it and serve these reads without a
+	* `ProviderIssue` round-trip. No provider does today: the one candidate (Bitbucket Cloud's legacy
+	* `getUsersIssuesForRepo`) reports `supportsIssues: false`, so the facade never reaches this for it.
+	*/
+	async getMyIssuesForReposAsShapesResult(reposOrRepoIds, options, connectionId) {
+		const result = await this.getMyIssuesForReposResult(reposOrRepoIds, options, connectionId);
+		if (result == null) return void 0;
+		if (result.error != null) return {
+			error: result.error,
+			duration: result.duration
+		};
+		if (result.value == null) return {
+			value: void 0,
+			duration: result.duration
+		};
+		const values = result.value.values.map((issue) => toIssueShape(issue, this)).filter((issue) => issue != null);
+		return {
+			value: {
+				...result.value,
+				values
+			},
+			duration: result.duration
+		};
+	}
+	async getMyPullRequestsForRepos(reposOrRepoIds, options, connectionId) {
+		return (await this.getMyPullRequestsForReposResult(reposOrRepoIds, options, connectionId))?.value;
+	}
+	/**
+	* Result-returning core of {@link getMyPullRequestsForRepos}. Resolves the session for `connectionId`
+	* (or the primary connection when omitted, so multi-account reads use the right token) and recovers
+	* thrown errors and validation failures into `{ error }` so callers can surface them as warnings
+	* rather than swallowing them to `undefined`.
+	*/
+	async getMyPullRequestsForReposResult(reposOrRepoIds, options, connectionId) {
+		const scope = getScopedLogger();
+		const providerId = this.authProvider.id;
+		const states = toProviderPullRequestStates(options?.state);
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		const start = performance.now();
+		let customUrl;
+		let api;
+		try {
+			customUrl = options?.customUrl ?? (isGitSelfManagedHostIntegrationId(providerId) ? this.getRepositoriesApiBaseUrl(session, reposOrRepoIds) : void 0);
+			api = await this.getProvidersApi();
+		} catch (ex) {
+			this.handleProviderException("getPullRequestsForRepos", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+		if (providerId !== "gitlab" && (api.isRepoIdsInput(reposOrRepoIds) || isAzureDevOpsProvider(providerId) && !reposOrRepoIds.every((repo) => repo.project != null && repo.namespace != null))) return unsupportedRead(`Unsupported input for provider ${providerId}`, start);
+		let getPullRequestsOptions;
+		if (options?.filters != null) {
+			if (!api.providerSupportsPullRequestFilters(providerId, options.filters)) return unsupportedRead(`Unsupported filters for provider ${providerId}`, start, "getPullRequestsForRepos");
+			let userAccount;
+			if (isAzureDevOpsProvider(providerId)) {
+				const organizations = /* @__PURE__ */ new Set();
+				for (const repo of reposOrRepoIds) organizations.add(repo.namespace);
+				if (organizations.size > 1) {
+					_logger.warn(`Multiple organizations not supported for provider ${providerId}`, "getPullRequestsForRepos");
+					return {
+						error: /* @__PURE__ */ new Error(`Multiple organizations not supported for provider ${providerId}`),
+						duration: performance.now() - start
+					};
+				} else if (organizations.size === 0) return unsupportedRead(`No organizations found for provider ${providerId}`, start, "getPullRequestsForRepos");
+				const organization = first(organizations.values());
+				try {
+					userAccount = await this.getFilterAccount(api, session, customUrl, organization);
+				} catch (ex) {
+					this.handleProviderException("getPullRequestsForRepos", ex, {
+						scope,
+						connectionId
+					});
+					return {
+						error: toError(ex),
+						duration: performance.now() - start
+					};
+				}
+			} else try {
+				userAccount = await this.getFilterAccount(api, session, customUrl);
+			} catch (ex) {
+				this.handleProviderException("getPullRequestsForRepos", ex, {
+					scope,
+					connectionId
+				});
+				return {
+					error: toError(ex),
+					duration: performance.now() - start
+				};
+			}
+			if (userAccount == null) return unsupportedRead(`Unable to get current user for ${providerId}`, start, "getPullRequestsForRepos");
+			let userFilterProperty;
+			switch (providerId) {
+				case "bitbucket":
+				case "azureDevOps":
+				case "azure-devops-server":
+					userFilterProperty = userAccount.id;
+					break;
+				default: userFilterProperty = userAccount.username;
+			}
+			if (userFilterProperty == null) return unsupportedRead(`Unable to get user property for filter for ${providerId}`, start, "getPullRequestsForRepos");
+			let reviewRequestedLogin;
+			let reviewerId;
+			let reviewerLogin;
+			if (options.filters.includes("review-requested")) switch (providerId) {
+				case "bitbucket":
+				case "azureDevOps":
+				case "azure-devops-server":
+					reviewerId = userFilterProperty;
+					break;
+				case "bitbucket-server":
+					reviewerLogin = userFilterProperty;
+					break;
+				default: reviewRequestedLogin = userFilterProperty;
+			}
+			getPullRequestsOptions = {
+				authorLogin: options.filters.includes("author") ? userFilterProperty : void 0,
+				assigneeLogins: options.filters.includes("assignee") ? [userFilterProperty] : void 0,
+				reviewRequestedLogin,
+				reviewerId,
+				reviewerLogin,
+				mentionLogin: options.filters.includes("mention") ? userFilterProperty : void 0
+			};
+		}
+		if (api.getProviderPullRequestsPagingMode(providerId) === "repo" && !api.isRepoIdsInput(reposOrRepoIds)) {
+			const cursors = this.parseCursorInfo(options?.cursor).cursors ?? [];
+			let repoInputs = reposOrRepoIds.map((repo) => ({
+				repo,
+				cursor: void 0
+			}));
+			if (cursors.length > 0) repoInputs = cursors;
+			try {
+				const cursor = { cursors: [] };
+				let hasMore = false;
+				let truncated = false;
+				let metadata;
+				const failures = [];
+				const data = [];
+				const settled = await Promise.allSettled(repoInputs.map(async (repoInput) => {
+					return {
+						repoInput,
+						results: await api.getPullRequestsForRepo(toTokenWithInfo(providerId, session), repoInput.repo, {
+							...getPullRequestsOptions,
+							cursor: repoInput.cursor,
+							isPAT: sendsBasicCredential(providerId, session),
+							baseUrl: options?.customUrl == null && isGitSelfManagedHostIntegrationId(providerId) ? this.getRepositoriesApiBaseUrl(session, [repoInput.repo]) : customUrl,
+							page: repoInput.cursor == null ? options?.page : void 0,
+							pageSize: options?.pageSize,
+							states,
+							includeRemoteInfo: isAzureDevOpsProvider(providerId) ? true : void 0
+						})
+					};
+				}));
+				throwIfAllSettledFailed(settled);
+				settled.forEach((outcome, i) => {
+					if (outcome.status !== "fulfilled") {
+						const failedRepo = repoInputs[i].repo;
+						failures.push(toCollectionScopeFailure({
+							providerId,
+							repositoryId: `${failedRepo.namespace}/${failedRepo.name}`
+						}, outcome.reason));
+						return;
+					}
+					const { repoInput, results } = outcome.value;
+					data.push(...results.values);
+					metadata = mergeCollectionMetadata(metadata, results.metadata);
+					if (results.paging?.truncated) truncated = true;
+					if (results.paging?.more) {
+						hasMore = true;
+						cursor.cursors.push({
+							repo: repoInput.repo,
+							cursor: results.paging.cursor
+						});
+					}
+				});
+				if (failures.length > 0) metadata = mergeCollectionMetadata(metadata, {
+					completeness: "partial",
+					failures
+				});
+				if (options?.page != null) cursor.page = options.page;
+				this.resetRequestExceptionCount("getPullRequestsForRepos");
+				return {
+					value: {
+						values: data,
+						paging: {
+							more: hasMore,
+							cursor: JSON.stringify(cursor),
+							truncated: truncated || void 0,
+							page: options?.page
+						},
+						metadata
+					},
+					duration: performance.now() - start
+				};
+			} catch (ex) {
+				this.handleProviderException("getPullRequestsForRepos", ex, {
+					scope,
+					connectionId
+				});
+				return {
+					error: toError(ex),
+					duration: performance.now() - start
+				};
+			}
+		}
+		try {
+			const result = await api.getPullRequestsForRepos(toTokenWithInfo(providerId, session), reposOrRepoIds, {
+				...getPullRequestsOptions,
+				cursor: options?.cursor,
+				isPAT: sendsBasicCredential(providerId, session),
+				baseUrl: customUrl,
+				page: options?.page,
+				pageSize: options?.pageSize,
+				states,
+				includeRemoteInfo: isAzureDevOpsProvider(providerId) ? true : void 0,
+				fields: options?.summary ? summaryPullRequestFields : void 0
+			});
+			this.resetRequestExceptionCount("getPullRequestsForRepos");
+			return {
+				value: result,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("getPullRequestsForRepos", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	/** Account-wide (or repo-scoped) search for the current user's pull requests. */
+	async searchMyPullRequests(repos, cancellation, options) {
+		const scope = getScopedLogger();
+		const { connectionId, ...searchOptions } = options ?? {};
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		const start = performance.now();
+		try {
+			const prs = await this.searchProviderMyPullRequests(session, ensureArray(repos), cancellation, searchOptions);
+			this.resetRequestExceptionCount("searchMyPullRequests");
+			return {
+				value: prs,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("searchMyPullRequests", ex, {
+				scope,
+				silent: true,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	/**
+	* Account-wide, user-scoped counterpart of {@link getMyPullRequestsForReposResult} that returns the raw
+	* `ProviderPullRequest` shape (not the normalized model). Unlike the repo-scoped core, this needs no
+	* `repos` — it reads the current user's pull requests across the account, so the ProviderBackend sweep
+	* can drive its Kanban "done" column even when no repositories are supplied (where the repo-scoped core
+	* rejects an empty `repos` input). Recovers thrown errors into `{ error }` so callers surface warnings.
+	*/
+	async getMyPullRequestsForUserResult(options, connectionId) {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		if (this.getProviderMyPullRequestsForUser == null) return;
+		const start = performance.now();
+		try {
+			const result = await this.getProviderMyPullRequestsForUser(session, options);
+			this.resetRequestExceptionCount("getMyPullRequestsForUser");
+			return {
+				value: result,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("getMyPullRequestsForUser", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	/**
+	* Parses a Repo/Project paging cursor into its `cursors` bundle. Guards against valid JSON whose
+	* `cursors` is a truthy non-array (e.g. `{ "cursors": "..." }`), which would otherwise bypass the
+	* `?? []` fallback at call sites and flow into `.map()` downstream, throwing instead of degrading to
+	* the first page.
+	*/
+	parseCursorInfo(cursor) {
+		try {
+			const parsed = JSON.parse(cursor ?? "{}");
+			return Array.isArray(parsed?.cursors) ? parsed : {};
+		} catch {
+			return {};
+		}
+	}
+	/**
+	* Result-returning wrapper for the filtered pull-request search. Errors become the soft
+	* `{ error }` branch so the public facade can preserve an empty account and a failed request as distinct
+	* outcomes.
+	*/
+	async searchPullRequestsPageResult(options, cancellation, connectionId) {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		const start = performance.now();
+		try {
+			const result = await this.searchProviderPullRequestsPage?.(session, options, cancellation);
+			this.resetRequestExceptionCount("searchPullRequestsPage");
+			return {
+				value: result,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("searchPullRequestsPage", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	/** Free-text search across pull requests, optionally narrowed to `repos`. */
+	async searchPullRequests(searchQuery, repos, cancellation, options) {
+		const scope = getScopedLogger();
+		const { connectionId, ...searchOptions } = options ?? {};
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		try {
+			const prs = await this.searchProviderPullRequests?.(session, searchQuery, ensureArray(repos), cancellation, searchOptions);
+			this.resetRequestExceptionCount("searchPullRequests");
+			return prs;
+		} catch (ex) {
+			this.handleProviderException("searchPullRequests", ex, {
+				scope,
+				connectionId
+			});
+			return;
+		}
+	}
+	/**
+	* Result-returning wrapper for the FILTERED issue search — issues matching structured criteria over a
+	* repository/org scope, with no forced relationship to the current user. Recovers thrown errors into
+	* `{ error }` so the facade surfaces a warning instead of a silent empty page.
+	*
+	* Distinct from every other issue read on this class: {@link searchMyIssuesWithTruncationResult} is bound to
+	* the current user by construction, and {@link getMyIssuesForReposAsShapesResult} goes through the SDK's
+	* repo-scoped read (whose over-limit recovery walk can cost up to 128 requests). This one is one request per
+	* page and carries no relationship it wasn't asked for.
+	*/
+	async searchIssuesPageResult(options, cancellation, connectionId) {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		const start = performance.now();
+		try {
+			const result = await this.searchProviderIssuesPage?.(session, options, cancellation);
+			this.resetRequestExceptionCount("searchIssuesPage");
+			return {
+				value: result,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("searchIssuesPage", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	/**
+	* Result-returning wrapper for the count-only probe: how many issues MATCH each scope, transferring no issues
+	* at all. Recovers thrown errors into `{ error }` like the reads around it.
+	*
+	* Counts come back POSITIONALLY — one per input scope, in order — because a caller's key must never reach the
+	* provider query. See {@link ProviderSearchCount} for what each slot can hold; `undefined` means the provider
+	* didn't report a count for it, never zero matches.
+	*/
+	async countIssuesResult(scopes, cancellation, connectionId) {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		const start = performance.now();
+		try {
+			const counts = await this.countProviderIssues?.(session, scopes, cancellation);
+			this.resetRequestExceptionCount("countIssues");
+			return {
+				value: counts,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("countIssues", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	/**
+	* Result-returning wrapper for the BATCH issue read: resolves several `(owner, repo, number)` coordinates in
+	* one request. Recovers thrown errors into `{ error }` like the reads around it.
+	*
+	* Distinct from every search on this class, and deliberately so. A search answers "what matches"; this answers
+	* "does this exact issue exist", which is the question a caller correlating a branch name to an issue is
+	* actually asking. It has no result ceiling, no ordering and no cursor, and — the property that matters most —
+	* an absent slot is a PROVEN ABSENCE rather than "not found within a page budget", so a caller can cache a
+	* miss instead of re-walking for it forever.
+	*
+	* Results come back POSITIONALLY — one per input coordinate, in order — for the same reason
+	* {@link countIssuesResult} does: a caller's key must never reach the provider query. `undefined` in a slot
+	* means the issue does not exist or is not visible to this token, never that the read failed.
+	*/
+	async getIssuesBatchResult(coordinates, cancellation, connectionId) {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		const start = performance.now();
+		try {
+			const issues = await this.getProviderIssuesBatch?.(session, coordinates, cancellation);
+			this.resetRequestExceptionCount("getIssuesBatch");
+			return {
+				value: issues,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("getIssuesBatch", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	/**
+	* The PR twin of {@link countIssuesResult}: counts each scope's pull requests, transferring none where the
+	* provider has a count query. Each slot is a {@link ProviderPullRequestCount}, so a provider that can only count
+	* by reading (Bitbucket Data Center) can mark a figure it stopped short of as a floor, or an `Error` refusing only
+	* that scope (Azure DevOps Server).
+	*/
+	async countPullRequestsResult(scopes, cancellation, connectionId) {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		const start = performance.now();
+		try {
+			const counts = await this.countProviderPullRequests?.(session, scopes, cancellation);
+			this.resetRequestExceptionCount("countPullRequests");
+			return {
+				value: counts,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleProviderException("countPullRequests", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
+	getPullRequestIdentityFromMaybeUrl(search) {
+		return this.getProviderPullRequestIdentityFromMaybeUrl?.(search);
+	}
+};
+__decorate([gate(), trace()], GitHostIntegration.prototype, "getAccountForEmail", null);
+__decorate([gate(), trace()], GitHostIntegration.prototype, "getSshSigningKeysForEmails", null);
+__decorate([gate(), trace()], GitHostIntegration.prototype, "getAccountForCommit", null);
+__decorate([trace()], GitHostIntegration.prototype, "getDefaultBranch", null);
+__decorate([trace()], GitHostIntegration.prototype, "getRepositoryMetadata", null);
+__decorate([trace()], GitHostIntegration.prototype, "getOrganizationsForUserResult", null);
+__decorate([trace()], GitHostIntegration.prototype, "getProjectsForOrgResult", null);
+__decorate([trace()], GitHostIntegration.prototype, "getRepositoriesForOrgResult", null);
+__decorate([trace()], GitHostIntegration.prototype, "getRepositoriesForUserResult", null);
+__decorate([trace()], GitHostIntegration.prototype, "getPullRequestForBranch", null);
+__decorate([trace()], GitHostIntegration.prototype, "getPullRequestForCommit", null);
+__decorate([trace()], GitHostIntegration.prototype, "searchMyPullRequests", null);
+__decorate([trace()], GitHostIntegration.prototype, "searchPullRequests", null);
+//#endregion
+export { GitHostIntegration };
+
 //# sourceMappingURL=gitHostIntegration.js.map