@gitkraken/core-gitlens 0.6.0 → 0.7.1

package/dist/plus/integrations/providers/azure/azure.js

@@ -1,582 +1,637 @@
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-import { base64 } from '../../../../utils/base64.js';
-import { CancellationError, isCancellationError } from '../../../../utils/cancellation.js';
-import { sha256 } from '../../../../utils/crypto.js';
-import { trace } from '../../../../utils/decorators/log.js';
-import { Logger } from '../../../../utils/logger.js';
-import { getScopedLogger } from '../../../../utils/logger.scoped.js';
-import { PromiseCache } from '../../../../utils/promiseCache.js';
-import { maybeStopWatch } from '../../../../utils/stopwatch.js';
-import { AuthenticationError, AuthenticationErrorReason, isRateLimitResponse, ProviderFetchError, RequestClientError, RequestNotFoundError, toRateLimitError, } from '../../errors.js';
-import { baseProviderApiConfig } from '../apiConfig.js';
-import { azurePullRequestStatusToState, azureWorkItemsStateCategoryToState, fromAzurePullRequest, fromAzureWorkItem, getAzurePullRequestWebUrl, isClosedAzurePullRequestStatus, isClosedAzureWorkItemStateCategory, normalizeAzureBranchName, sanitizeAzureRepositoryUrl, } from './models.js';
-const forkRepositoryUrlCacheTtl = 5 * 60 * 1000;
-function parseAzureRepositoryDescriptor(repo) {
-    const parts = repo.split('/');
-    const [projectName, segment, repoName] = parts;
-    if (parts.length !== 3 || segment !== '_git' || !projectName || !repoName) {
-        throw new Error(`Invalid Azure repository descriptor '${repo}'; expected '{project}/_git/{repoName}'.`);
-    }
-    return { projectName: projectName, repoName: repoName };
+import { CancellationError, isCancellationError } from "../../../../utils/cancellation.js";
+import { Logger as _logger } from "../../../../utils/logger.js";
+import { getScopedLogger } from "../../../../utils/logger.scoped.js";
+import { trace } from "../../../../utils/decorators/log.js";
+import { PromiseCache } from "../../../../utils/promiseCache.js";
+import __decorate from "../../../../_virtual/@oxc-project+runtime/helpers/esm/decorate.js";
+import { AuthenticationError, RequestClientError, RequestNotFoundError } from "../../../../git/errors.js";
+import { sha256, uuid } from "../../../../utils/crypto.js";
+import { maybeStopWatch } from "../../../../utils/stopwatch.js";
+import { base64 } from "../../../../utils/base64.js";
+import { effectiveIssueSort } from "../../../../git/utils/issue.utils.js";
+import { ProviderFetchError, isRateLimitResponse, toRateLimitError } from "../../errors.js";
+import { azureWorkItemSearchResultLimit, parseAzureWorkItemSearchCursor, toAzureSearchPageSize, toAzureWorkItemSearchCursorKey, toAzureWorkItemSearchWiql } from "./search.js";
+import { decodePathSegment } from "../../utils/domain.utils.js";
+import { baseProviderApiConfig } from "../apiConfig.js";
+import { azurePullRequestStatusToState, azureWorkItemsStateCategoryToState, fromAzurePullRequest, fromAzureWorkItem, getAzurePullRequestWebUrl, isClosedAzurePullRequestStatus, isClosedAzureWorkItemStateCategory, normalizeAzureBranchName, sanitizeAzureRepositoryUrl } from "./models.js";
+import * as l10n from "@vscode/l10n";
+//#region ../plus/integrations/src/providers/azure/azure.ts
+const forkRepositoryUrlCacheTtl = 3e5;
+/** How long a work-item search's id snapshot outlives the last page read from it, and the most it lives at all. */
+const workItemSearchSnapshotTtl = 3e5;
+const workItemSearchSnapshotMaxTtl = 18e5;
+function encodePathSegment(value) {
+	if (value === "." || value === "..") throw new Error(`Invalid Azure path segment '${value}'.`);
+	return encodeURIComponent(value);
 }
-class WorkItemStates {
-    _categories = new Map();
-    _types = new Map();
-    // TODO@sergeibbb: we might need some logic for invalidating
-    getStateCategory(project, workItemType, stateName) {
-        return this._categories.get(this.getStateKey(project, workItemType, stateName));
-    }
-    clear() {
-        this._categories.clear();
-        this._types.clear();
-    }
-    saveTypeStates(project, workItemType, states) {
-        this.clearTypeStates(project, workItemType);
-        this._types.set(this.getTypeKey(project, workItemType), states);
-        for (const state of states) {
-            this._categories.set(this.getStateKey(project, workItemType, state.name), state.category);
-        }
-    }
-    hasTypeStates(project, workItemType) {
-        return this._types.has(this.getTypeKey(project, workItemType));
-    }
-    clearTypeStates(project, workItemType) {
-        const states = this._types.get(this.getTypeKey(project, workItemType));
-        if (states == null)
-            return;
-        for (const state of states) {
-            this._categories.delete(this.getStateKey(project, workItemType, state.name));
-        }
-    }
-    getStateKey(project, workItemType, stateName) {
-        // By stringifying the pair as JSON we make sure that all possible special characters are escaped
-        return JSON.stringify([project, workItemType, stateName]);
-    }
-    getTypeKey(project, workItemType) {
-        return JSON.stringify([project, workItemType]);
-    }
+/** Whether Azure refused a WIQL query for matching more work items than it will return (`VS402337`). */
+function isWorkItemLimitRefusal(ex) {
+	return ex instanceof RequestClientError && ex.message.includes("VS402337");
 }
-export class AzureDevOpsApi {
-    config;
-    _disposable;
-    _workItemStates = new WorkItemStates();
-    _forkRepositoryUrls = new PromiseCache({
-        capacity: 100,
-        createTTL: forkRepositoryUrlCacheTtl,
-    });
-    constructor(config) {
-        this.config = config;
-        this._disposable = config.onConfigChanged?.(() => this.resetCaches());
-    }
-    dispose() {
-        this._disposable?.dispose();
-    }
-    resetCaches() {
-        this._workItemStates.clear();
-        this._forkRepositoryUrls.clear();
-    }
-    async getPullRequestForBranch(provider, token, owner, repo, branch, options) {
-        const scope = getScopedLogger();
-        const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
-        try {
-            const prResult = await this.request(provider, token, options?.baseUrl, `${owner}/${projectName}/_apis/git/repositories/${repoName}/pullRequests?searchCriteria.status=all&searchCriteria.sourceRefName=refs/heads/${branch}`, {
-                method: 'GET',
-            }, scope);
-            // Sort PRs: open PRs first, then by most recent activity (creation or closure date)
-            const sortedPRs = prResult?.value.sort((a, b) => {
-                // First, prioritize open PRs (active/notSet) over closed ones (abandoned/completed)
-                const aIsOpen = a.status === 'active' || a.status === 'notSet';
-                const bIsOpen = b.status === 'active' || b.status === 'notSet';
-                if (aIsOpen !== bIsOpen) {
-                    return aIsOpen ? -1 : 1; // Open PRs come first
-                }
-                // Among PRs with the same status, sort by most recent activity
-                // Use closedDate if available, otherwise use creationDate
-                const aDate = new Date(a.closedDate || a.creationDate);
-                const bDate = new Date(b.closedDate || b.creationDate);
-                return bDate.getTime() - aDate.getTime(); // Most recent first
-            });
-            const pr = sortedPRs?.[0];
-            if (pr == null)
-                return undefined;
-            return await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope);
-        }
-        catch (ex) {
-            scope?.error(ex);
-            return undefined;
-        }
-    }
-    async getPullRequestForCommit(provider, token, owner, repo, rev, baseUrl, _options, cancellation) {
-        const scope = getScopedLogger();
-        const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
-        try {
-            const prResult = await this.request(provider, token, baseUrl, `${owner}/${projectName}/_apis/git/repositories/${repoName}/pullrequestquery?api-version=4.1`, {
-                method: 'POST',
-                body: JSON.stringify({
-                    queries: [
-                        {
-                            items: [rev],
-                            type: 'commit',
-                        },
-                    ],
-                }),
-            }, scope, cancellation);
-            const pr = prResult?.results[0]?.[rev]?.[0];
-            if (pr == null)
-                return undefined;
-            const pullRequest = await this.request(provider, token, baseUrl, `${owner}/${encodeURIComponent(pr.repository.project.id)}/_apis/git/repositories/${encodeURIComponent(pr.repository.id)}/pullRequests/${encodeURIComponent(pr.pullRequestId.toString())}`, { method: 'GET' }, scope, cancellation);
-            if (pullRequest == null)
-                return undefined;
-            return await this.toPullRequest(pullRequest, provider, token, owner, baseUrl, scope, cancellation);
-        }
-        catch (ex) {
-            scope?.error(ex);
-            return undefined;
-        }
-    }
-    async getIssueOrPullRequest(provider, token, owner, repo, id, options) {
-        const scope = getScopedLogger();
-        const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
-        if (options?.type === undefined || options?.type === 'issue') {
-            try {
-                // Try to get the Work item (wit) first with specific fields
-                const issueResult = await this.request(provider, token, options?.baseUrl, `${owner}/${projectName}/_apis/wit/workItems/${id}`, {
-                    method: 'GET',
-                }, scope);
-                if (issueResult != null) {
-                    const issueType = issueResult.fields['System.WorkItemType'];
-                    const state = issueResult.fields['System.State'];
-                    const stateCategory = await this.getWorkItemStateCategory(issueType, state, provider, token, owner, projectName, options);
-                    return {
-                        id: issueResult.id.toString(),
-                        type: 'issue',
-                        nodeId: issueResult.id.toString(),
-                        provider: provider,
-                        createdDate: new Date(issueResult.fields['System.CreatedDate']),
-                        updatedDate: new Date(issueResult.fields['System.ChangedDate']),
-                        state: azureWorkItemsStateCategoryToState(stateCategory),
-                        closed: isClosedAzureWorkItemStateCategory(stateCategory),
-                        title: issueResult.fields['System.Title'],
-                        url: issueResult._links.html.href,
-                    };
-                }
-            }
-            catch (ex) {
-                if (ex.original?.status !== 404) {
-                    scope?.error(ex);
-                    return undefined;
-                }
-            }
-        }
-        if (options?.type === undefined || options?.type === 'pullrequest') {
-            try {
-                const prResult = await this.request(provider, token, options?.baseUrl, `${owner}/${projectName}/_apis/git/repositories/${repoName}/pullRequests/${id}`, {
-                    method: 'GET',
-                }, scope);
-                if (prResult != null) {
-                    return {
-                        id: prResult.pullRequestId.toString(),
-                        type: 'pullrequest',
-                        nodeId: prResult.pullRequestId.toString(), // prResult.artifactId maybe?
-                        provider: provider,
-                        createdDate: new Date(prResult.creationDate),
-                        updatedDate: new Date(prResult.creationDate),
-                        state: azurePullRequestStatusToState(prResult.status),
-                        closed: isClosedAzurePullRequestStatus(prResult.status),
-                        title: prResult.title,
-                        url: getAzurePullRequestWebUrl(prResult, options.baseUrl, owner),
-                    };
-                }
-                return undefined;
-            }
-            catch (ex) {
-                if (ex.original?.status !== 404) {
-                    scope?.error(ex);
-                    return undefined;
-                }
-            }
-        }
-        return undefined;
-    }
-    async getIssue(provider, token, project, id, options) {
-        const scope = getScopedLogger();
-        try {
-            // Try to get the Work item (wit) first with specific fields
-            const issueResult = await this.request(provider, token, options?.baseUrl, `${project.resourceName}/${project.name}/_apis/wit/workItems/${id}`, {
-                method: 'GET',
-            }, scope);
-            if (issueResult != null) {
-                const issueType = issueResult.fields['System.WorkItemType'];
-                const state = issueResult.fields['System.State'];
-                const stateCategory = await this.getWorkItemStateCategory(issueType, state, provider, token, project.resourceName, project.name, options);
-                return fromAzureWorkItem(issueResult, provider, project, stateCategory);
-            }
-        }
-        catch (ex) {
-            if (ex.original?.status !== 404) {
-                scope?.error(ex);
-                return undefined;
-            }
-        }
-        return undefined;
-    }
-    async getAccountForCommit(provider, token, owner, repo, rev, baseUrl, _options) {
-        const scope = getScopedLogger();
-        const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
-        try {
-            // Try to get the Work item (wit) first with specific fields
-            const commit = await this.request(provider, token, baseUrl, `${owner}/${projectName}/_apis/git/repositories/${repoName}/commits/${rev}`, {
-                method: 'GET',
-            }, scope);
-            const author = commit?.author;
-            if (!author) {
-                return undefined;
-            }
-            // Azure API never gives us an id/username we can use, therefore we always return UnidentifiedAuthor
-            return {
-                provider: provider,
-                id: undefined,
-                username: undefined,
-                name: author?.name,
-                email: author?.email,
-                avatarUrl: undefined,
-            };
-        }
-        catch (ex) {
-            if (ex.original?.status !== 404) {
-                scope?.error(ex);
-                return undefined;
-            }
-        }
-        return undefined;
-    }
-    async getCurrentUserOnServer(provider, token, baseUrl) {
-        const scope = getScopedLogger();
-        try {
-            const connectionData = await this.request(provider, token, baseUrl, '_apis/connectionData', {
-                method: 'GET',
-            }, scope);
-            const user = connectionData?.authenticatedUser;
-            const username = user?.properties?.Account?.$value;
-            if (!username) {
-                return undefined;
-            }
-            return {
-                id: user.id,
-                name: user.providerDisplayName,
-                email: user.emailAddress,
-                username: username,
-            };
-        }
-        catch (ex) {
-            scope?.error(ex, `Failed to get current user from ${baseUrl}`);
-            return undefined;
-        }
-    }
-    async getWorkItemStateCategory(issueType, state, provider, token, owner, projectName, options) {
-        const project = `${owner}/${projectName}`;
-        const category = this._workItemStates.getStateCategory(project, issueType, state);
-        if (category != null)
-            return category;
-        const states = await this.retrieveWorkItemTypeStates(issueType, provider, token, owner, projectName, options);
-        this._workItemStates.saveTypeStates(project, issueType, states);
-        return this._workItemStates.getStateCategory(project, issueType, state);
-    }
-    async retrieveWorkItemTypeStates(workItemType, provider, token, owner, projectName, options) {
-        const scope = getScopedLogger();
-        try {
-            const issueResult = await this.request(provider, token, options?.baseUrl, `${owner}/${projectName}/_apis/wit/workItemTypes/${workItemType}/states`, {
-                method: 'GET',
-            }, scope);
-            return issueResult?.value ?? [];
-        }
-        catch (ex) {
-            scope?.error(ex);
-            return [];
-        }
-    }
-    async getRepositoryMetadata(provider, token, owner, repo, options, cancellation) {
-        const scope = getScopedLogger();
-        try {
-            const response = await this.getRepository(provider, token, owner, repo, options.baseUrl, scope, cancellation);
-            if (response == null)
-                return undefined;
-            // Azure's `parentRepository` only reliably carries the repo name and its project; a fork's parent
-            // lives in the same organization, so the org (`owner`) is the parent owner. Only report `parent`
-            // when the parent's name is actually present — never fall back to the fork's own name.
-            return {
-                provider: provider,
-                owner: owner,
-                // Prefer the API's canonical name over parsing the composite `repo` descriptor string.
-                name: response.name,
-                isFork: response.isFork ?? false,
-                parent: response.isFork && response.parentRepository?.name != null
-                    ? { owner: owner, name: response.parentRepository.name }
-                    : undefined,
-            };
-        }
-        catch (ex) {
-            // Cancellations and 404s are expected outcomes for a probe; don't log them as errors.
-            if (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {
-                scope?.error(ex);
-            }
-            return undefined;
-        }
-    }
-    async getDefaultBranch(provider, token, owner, repo, options, cancellation) {
-        const scope = getScopedLogger();
-        try {
-            const response = await this.getRepository(provider, token, owner, repo, options.baseUrl, scope, cancellation);
-            if (response?.defaultBranch == null)
-                return undefined;
-            return {
-                provider: provider,
-                name: normalizeAzureBranchName(response.defaultBranch),
-            };
-        }
-        catch (ex) {
-            // Cancellations and 404s are expected outcomes for a probe; don't log them as errors.
-            if (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {
-                scope?.error(ex);
-            }
-            return undefined;
-        }
-    }
-    getRepository(provider, token, owner, repo, baseUrl, scope, cancellation) {
-        const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
-        return this.request(provider, token, baseUrl, `${owner}/${projectName}/_apis/git/repositories/${repoName}?api-version=7.1`, { method: 'GET' }, scope, cancellation);
-    }
-    async toPullRequest(pr, provider, token, owner, baseUrl, scope, cancellation) {
-        const forkRepositoryUrls = await this.getForkRepositoryUrls(provider, token, owner, baseUrl, pr.forkSource?.repository, scope, cancellation);
-        return fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls);
-    }
-    /**
-     * Resolves the web and HTTPS clone URLs of the fork a cross-repository pull request comes from. Every other
-     * repository URL the model reports is rebuilt from the pull request payload; only a fork reference lacks the
-     * project to do that, so only a fork costs a request.
-     *
-     * Best-effort by contract: a fork in a project the token cannot read, a deleted fork, or a throttled request
-     * leaves the head ref without a URL. It must never cost the pull request itself, which is what makes swallowing
-     * the failure here the right call rather than a shortcut.
-     */
-    async getForkRepositoryUrls(provider, token, owner, baseUrl, repository, scope, cancellation) {
-        if (repository == null)
-            return undefined;
-        let tokenHash;
-        try {
-            tokenHash = await sha256(token.accessToken);
-        }
-        catch {
-            return undefined;
-        }
-        const cacheKey = JSON.stringify([tokenHash, baseUrl, owner, repository.id]);
-        // The request is shared, so the factory is handed the cache's aggregate signal rather than this caller's: it
-        // aborts only once every caller waiting on the entry has cancelled.
-        return this._forkRepositoryUrls.getOrCreate(cacheKey, (cacheable, aggregate) => this.fetchForkRepositoryUrls(provider, token, owner, baseUrl, repository.id, cacheable, scope, aggregate), { cancellation: cancellation });
-    }
-    async fetchForkRepositoryUrls(provider, token, owner, baseUrl, repositoryId, cacheable, scope, cancellation) {
-        try {
-            const response = await this.request(provider, token, baseUrl, `${owner}/_apis/git/repositories/${encodeURIComponent(repositoryId)}?api-version=4.1`, { method: 'GET' }, scope, cancellation);
-            const webUrl = sanitizeAzureRepositoryUrl(response?.webUrl, baseUrl, owner);
-            const cloneHttps = sanitizeAzureRepositoryUrl(response?.remoteUrl, baseUrl, owner);
-            // The clone URL stands in for the web URL when the response omits it — an older `api-version` promises
-            // neither field, and naming the fork by the URL git would use beats naming it not at all.
-            const url = webUrl ?? cloneHttps;
-            if (url == null) {
-                cacheable.invalidate();
-                return undefined;
-            }
-            return { url: url, cloneHttps: cloneHttps };
-        }
-        catch (ex) {
-            // Missing or inaccessible forks are cached briefly; transient failures retry on the next read.
-            if (!(ex instanceof RequestNotFoundError) && !(ex instanceof AuthenticationError)) {
-                cacheable.invalidate();
-            }
-            const status = ex instanceof ProviderFetchError ? ` (${ex.status})` : '';
-            scope?.warn(`Unable to resolve the fork repository URLs${status}`);
-            return undefined;
-        }
-    }
-    async request(provider, token, baseUrl, route, options, scope, cancellation) {
-        const { accessToken } = token;
-        const url = baseUrl ? `${baseUrl}/${route}` : route;
-        let rsp;
-        try {
-            const sw = maybeStopWatch(`[AZURE] ${options?.method ?? 'GET'} request`, { log: { onlyExit: true } });
-            try {
-                if (cancellation?.aborted)
-                    throw new CancellationError();
-                rsp = await this.config.wrapForForcedInsecureSSL(provider.getIgnoreSSLErrors(), () => this.config.fetch(url, {
-                    headers: {
-                        Authorization: `Basic ${base64(`PAT:${accessToken}`)}`,
-                        'Content-Type': 'application/json',
-                    },
-                    signal: cancellation,
-                    ...options,
-                }));
-                if (rsp.ok) {
-                    return (await rsp.json());
-                }
-                // Reads the body so the 403 branch below can tell a throttled request from a permission failure.
-                throw await ProviderFetchError.fromResponse('AzureDevOps', rsp);
-            }
-            finally {
-                sw?.stop();
-            }
-        }
-        catch (ex) {
-            if (ex instanceof ProviderFetchError || ex.name === 'AbortError') {
-                this.handleRequestError(provider, token, ex, scope);
-            }
-            else if (Logger.isDebugging) {
-                this.config.onError?.(`AzureDevOps request failed: ${ex.message}`);
-            }
-            throw ex;
-        }
-    }
-    handleRequestError(provider, token, ex, scope) {
-        if (ex.name === 'AbortError' || !(ex instanceof ProviderFetchError))
-            throw new CancellationError(ex);
-        const { accessToken, ...tokenInfo } = token;
-        switch (ex.status) {
-            case 404: // Not found
-            case 410: // Gone
-            case 422: // Unprocessable Entity
-                throw new RequestNotFoundError(ex);
-            case 401: // Unauthorized
-                throw new AuthenticationError(tokenInfo, AuthenticationErrorReason.Unauthorized, ex);
-            case 429: // Too Many Requests
-                throw toRateLimitError(ex, accessToken);
-            case 403: // Forbidden
-                // Azure returns 403 for both a permission failure and a throttled request ("Request was blocked
-                // due to exceeding usage of resource 'RateLimit'"), so the message is the discriminant. Reporting
-                // a throttle as `auth` would prompt the user to re-authenticate a healthy connection instead of
-                // retrying (see `isRateLimitResponse`).
-                if (isRateLimitResponse(ex))
-                    throw toRateLimitError(ex, accessToken);
-                throw new AuthenticationError(tokenInfo, AuthenticationErrorReason.Forbidden, ex);
-            case 500: // Internal Server Error
-                scope?.error(ex);
-                if (ex.response != null) {
-                    provider?.trackRequestException();
-                    this.config.onRequestFailed?.(`${provider?.name ?? 'AzureDevOps'} failed to respond and might be experiencing issues.${provider == null || provider.id === 'azure'
-                        ? ' Please visit the [AzureDevOps status page](https://status.dev.azure.com) for more information.'
-                        : ''}`);
-                }
-                return;
-            case 502: // Bad Gateway
-                scope?.error(ex);
-                // TODO: Learn the Azure API docs and put it in order:
-                // if (ex.message.includes('timeout')) {
-                // 	provider?.trackRequestException();
-                // 	void showIntegrationRequestTimedOutWarningMessage(provider?.name ?? 'Azure');
-                // 	return;
-                // }
-                break;
-            default:
-                if (ex.status >= 400 && ex.status < 500)
-                    throw new RequestClientError(ex);
-                break;
-        }
-        scope?.error(ex);
-        if (Logger.isDebugging) {
-            this.config.onError?.(`AzureDevOps request failed: ${ex.response?.errors?.[0]?.message ?? ex.message}`);
-        }
-    }
+function parseAzureRepositoryDescriptor(repo) {
+	const parts = repo.split("/");
+	const [projectName, segment, repoName] = parts;
+	if (parts.length !== 3 || segment !== "_git" || !projectName || !repoName) throw new Error(`Invalid Azure repository descriptor '${repo}'; expected '{project}/_git/{repoName}'.`);
+	return {
+		projectName,
+		repoName
+	};
 }
-__decorate([
-    trace({
-        args: (provider, token, owner, repo, branch) => ({
-            provider: provider.name,
-            token: `<token:${token.microHash}>`,
-            owner: owner,
-            repo: repo,
-            branch: branch,
-        }),
-    })
-], AzureDevOpsApi.prototype, "getPullRequestForBranch", null);
-__decorate([
-    trace({
-        args: (provider, token, owner, repo, rev, baseUrl) => ({
-            provider: provider.name,
-            token: `<token:${token.microHash}>`,
-            owner: owner,
-            repo: repo,
-            rev: rev,
-            baseUrl: baseUrl,
-        }),
-    })
-], AzureDevOpsApi.prototype, "getPullRequestForCommit", null);
-__decorate([
-    trace({
-        args: (provider, token, owner, repo, id) => ({
-            provider: provider.name,
-            token: `<token:${token.microHash}>`,
-            owner: owner,
-            repo: repo,
-            id: id,
-        }),
-    })
-], AzureDevOpsApi.prototype, "getIssueOrPullRequest", null);
-__decorate([
-    trace({
-        args: (provider, token, project, id) => ({
-            provider: provider.name,
-            token: `<token:${token.microHash}>`,
-            project: project,
-            id: id,
-        }),
-    })
-], AzureDevOpsApi.prototype, "getIssue", null);
-__decorate([
-    trace({
-        args: (provider, token, owner, repo, rev, baseUrl) => ({
-            provider: provider.name,
-            token: `<token:${token.microHash}>`,
-            owner: owner,
-            repo: repo,
-            rev: rev,
-            baseUrl: baseUrl,
-        }),
-    })
-], AzureDevOpsApi.prototype, "getAccountForCommit", null);
-__decorate([
-    trace({
-        args: (provider, token, baseUrl) => ({
-            provider: provider.name,
-            token: `<token:${token.microHash}>`,
-            baseUrl: baseUrl,
-        }),
-    })
-], AzureDevOpsApi.prototype, "getCurrentUserOnServer", null);
-__decorate([
-    trace({
-        args: (provider, token, owner, repo) => ({
-            provider: provider.name,
-            token: `<token:${token.microHash}>`,
-            owner: owner,
-            repo: repo,
-        }),
-    })
-], AzureDevOpsApi.prototype, "getRepositoryMetadata", null);
-__decorate([
-    trace({
-        args: (provider, token, owner, repo) => ({
-            provider: provider.name,
-            token: `<token:${token.microHash}>`,
-            owner: owner,
-            repo: repo,
-        }),
-    })
-], AzureDevOpsApi.prototype, "getDefaultBranch", null);
+var WorkItemStates = class {
+	_categories = /* @__PURE__ */ new Map();
+	_types = /* @__PURE__ */ new Map();
+	getStateCategory(project, workItemType, stateName) {
+		return this._categories.get(this.getStateKey(project, workItemType, stateName));
+	}
+	clear() {
+		this._categories.clear();
+		this._types.clear();
+	}
+	saveTypeStates(project, workItemType, states) {
+		this.clearTypeStates(project, workItemType);
+		this._types.set(this.getTypeKey(project, workItemType), states);
+		for (const state of states) this._categories.set(this.getStateKey(project, workItemType, state.name), state.category);
+	}
+	hasTypeStates(project, workItemType) {
+		return this._types.has(this.getTypeKey(project, workItemType));
+	}
+	clearTypeStates(project, workItemType) {
+		const states = this._types.get(this.getTypeKey(project, workItemType));
+		if (states == null) return;
+		for (const state of states) this._categories.delete(this.getStateKey(project, workItemType, state.name));
+	}
+	getStateKey(project, workItemType, stateName) {
+		return JSON.stringify([
+			project,
+			workItemType,
+			stateName
+		]);
+	}
+	getTypeKey(project, workItemType) {
+		return JSON.stringify([project, workItemType]);
+	}
+};
+var AzureDevOpsApi = class {
+	config;
+	_disposable;
+	_workItemStates = new WorkItemStates();
+	_forkRepositoryUrls = new PromiseCache({
+		capacity: 100,
+		createTTL: forkRepositoryUrlCacheTtl
+	});
+	/**
+	* The ordered ids each filtered work-item search's first page queried, paged through by its continuations. Kept
+	* alive while a pagination keeps reading them (see `workItemSearchSnapshotTtl`). Every first page adds one, so
+	* the capacity leaves room for repeated first pages before an idle pagination's snapshot is the one evicted.
+	*/
+	_workItemSearches = new PromiseCache({
+		capacity: 50,
+		accessTTL: workItemSearchSnapshotTtl,
+		createTTL: workItemSearchSnapshotMaxTtl
+	});
+	constructor(config) {
+		this.config = config;
+		this._disposable = config.onConfigChanged?.(() => this.resetCaches());
+	}
+	dispose() {
+		this._disposable?.dispose();
+	}
+	resetCaches() {
+		this._workItemStates.clear();
+		this._forkRepositoryUrls.clear();
+		this._workItemSearches.clear();
+	}
+	async getPullRequestForBranch(provider, token, owner, repo, branch, options) {
+		const scope = getScopedLogger();
+		const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
+		try {
+			const pr = ((await this.request(provider, token, options?.baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/pullRequests?searchCriteria.status=all&searchCriteria.sourceRefName=${encodeURIComponent(`refs/heads/${branch}`)}`, { method: "GET" }, scope))?.value.sort((a, b) => {
+				const aIsOpen = a.status === "active" || a.status === "notSet";
+				if (aIsOpen !== (b.status === "active" || b.status === "notSet")) return aIsOpen ? -1 : 1;
+				const aDate = new Date(a.closedDate || a.creationDate);
+				return new Date(b.closedDate || b.creationDate).getTime() - aDate.getTime();
+			}))?.[0];
+			if (pr == null) return void 0;
+			return await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope);
+		} catch (ex) {
+			if (ex instanceof AuthenticationError) throw ex;
+			scope?.error(ex);
+			return;
+		}
+	}
+	async getPullRequestForCommit(provider, token, owner, repo, rev, baseUrl, _options, cancellation) {
+		const scope = getScopedLogger();
+		const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
+		try {
+			const pr = (await this.request(provider, token, baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/pullrequestquery?api-version=4.1`, {
+				method: "POST",
+				body: JSON.stringify({ queries: [{
+					items: [rev],
+					type: "commit"
+				}] })
+			}, scope, cancellation))?.results[0]?.[rev]?.[0];
+			if (pr == null) return void 0;
+			const pullRequest = await this.request(provider, token, baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(pr.repository.project.id)}/_apis/git/repositories/${encodePathSegment(pr.repository.id)}/pullRequests/${encodePathSegment(pr.pullRequestId.toString())}`, { method: "GET" }, scope, cancellation);
+			if (pullRequest == null) return void 0;
+			return await this.toPullRequest(pullRequest, provider, token, owner, baseUrl, scope, cancellation);
+		} catch (ex) {
+			if (ex instanceof AuthenticationError) throw ex;
+			scope?.error(ex);
+			return;
+		}
+	}
+	async getIssueOrPullRequest(provider, token, owner, repo, id, options) {
+		const scope = getScopedLogger();
+		const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
+		if (options?.type === void 0 || options?.type === "issue") try {
+			const issueResult = await this.request(provider, token, options?.baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/wit/workItems/${encodePathSegment(id)}`, { method: "GET" }, scope);
+			if (issueResult != null) {
+				const issueType = issueResult.fields["System.WorkItemType"];
+				const state = issueResult.fields["System.State"];
+				const stateCategory = await this.getWorkItemStateCategory(issueType, state, provider, token, owner, projectName, options);
+				return {
+					id: issueResult.id.toString(),
+					type: "issue",
+					nodeId: issueResult.id.toString(),
+					provider,
+					createdDate: new Date(issueResult.fields["System.CreatedDate"]),
+					updatedDate: new Date(issueResult.fields["System.ChangedDate"]),
+					state: azureWorkItemsStateCategoryToState(stateCategory),
+					closed: isClosedAzureWorkItemStateCategory(stateCategory),
+					title: issueResult.fields["System.Title"],
+					url: issueResult._links.html.href
+				};
+			}
+		} catch (ex) {
+			if (ex instanceof AuthenticationError) throw ex;
+			if (ex.original?.status !== 404) {
+				scope?.error(ex);
+				return;
+			}
+		}
+		if (options?.type === void 0 || options?.type === "pullrequest") try {
+			const prResult = await this.request(provider, token, options?.baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/pullRequests/${encodePathSegment(id)}`, { method: "GET" }, scope);
+			if (prResult != null) return {
+				id: prResult.pullRequestId.toString(),
+				type: "pullrequest",
+				nodeId: prResult.pullRequestId.toString(),
+				provider,
+				createdDate: new Date(prResult.creationDate),
+				updatedDate: new Date(prResult.creationDate),
+				state: azurePullRequestStatusToState(prResult.status),
+				closed: isClosedAzurePullRequestStatus(prResult.status),
+				title: prResult.title,
+				url: getAzurePullRequestWebUrl(prResult, options.baseUrl, owner)
+			};
+			return;
+		} catch (ex) {
+			if (ex instanceof AuthenticationError) throw ex;
+			if (ex.original?.status !== 404) {
+				scope?.error(ex);
+				return;
+			}
+		}
+	}
+	async getIssue(provider, token, project, id, options) {
+		const scope = getScopedLogger();
+		try {
+			const issueResult = await this.request(provider, token, options?.baseUrl, `${encodePathSegment(project.resourceName)}/${encodePathSegment(project.name)}/_apis/wit/workItems/${encodePathSegment(id)}`, { method: "GET" }, scope);
+			if (issueResult != null) {
+				const issueType = issueResult.fields["System.WorkItemType"];
+				const state = issueResult.fields["System.State"];
+				const stateCategory = await this.getWorkItemStateCategory(issueType, state, provider, token, project.resourceName, project.name, options);
+				return fromAzureWorkItem(issueResult, provider, project, stateCategory);
+			}
+		} catch (ex) {
+			if (ex instanceof AuthenticationError) throw ex;
+			if (ex.original?.status !== 404) {
+				scope?.error(ex);
+				return;
+			}
+		}
+	}
+	async getAccountForCommit(provider, token, owner, repo, rev, baseUrl, _options) {
+		const scope = getScopedLogger();
+		const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
+		try {
+			const author = (await this.request(provider, token, baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/commits/${encodePathSegment(rev)}`, { method: "GET" }, scope))?.author;
+			if (!author) return;
+			return {
+				provider,
+				id: void 0,
+				username: void 0,
+				name: author?.name,
+				email: author?.email,
+				avatarUrl: void 0
+			};
+		} catch (ex) {
+			if (ex instanceof AuthenticationError) throw ex;
+			if (ex.original?.status !== 404) {
+				scope?.error(ex);
+				return;
+			}
+		}
+	}
+	/**
+	* The collection an Azure DevOps Server address names, or `undefined` when it names the installation.
+	*
+	* Below a collection, `connectionData` describes that collection: its `instanceId` is the collection's id, and its
+	* `webApplicationRelativeDirectory` ends in the collection's path segment (`DefaultCollection/`); it is empty or
+	* absent at the server level. As measured against Azure DevOps Server 2020. The directory may also carry the
+	* installation's own virtual directory before the collection (`tfs/DefaultCollection/`), so only its LAST segment
+	* names the collection, and only when it is the last segment of the address asked about.
+	*/
+	async getAddressedCollection(provider, token, baseUrl) {
+		const scope = getScopedLogger();
+		const connectionData = await this.request(provider, token, baseUrl, "_apis/connectionData", { method: "GET" }, scope);
+		const segment = connectionData?.webApplicationRelativeDirectory?.split("/").findLast(Boolean);
+		const addressed = new URL(baseUrl).pathname.split("/").findLast(Boolean);
+		if (segment == null || addressed == null || connectionData?.instanceId == null) return void 0;
+		const name = decodePathSegment(segment);
+		if (name.toLowerCase() !== decodePathSegment(addressed).toLowerCase()) return void 0;
+		return {
+			id: connectionData.instanceId,
+			name
+		};
+	}
+	async getCurrentUserOnServer(provider, token, baseUrl) {
+		const scope = getScopedLogger();
+		try {
+			const user = (await this.request(provider, token, baseUrl, "_apis/connectionData", { method: "GET" }, scope))?.authenticatedUser;
+			const username = user?.properties?.Account?.$value;
+			if (!username) return;
+			return {
+				id: user.id,
+				name: user.providerDisplayName,
+				email: user.emailAddress,
+				username
+			};
+		} catch (ex) {
+			if (ex instanceof AuthenticationError) throw ex;
+			scope?.error(ex, `Failed to get current user from ${baseUrl}`);
+			return;
+		}
+	}
+	async getWorkItemStateCategory(issueType, state, provider, token, owner, projectName, options) {
+		const project = JSON.stringify([
+			options.baseUrl,
+			owner,
+			projectName
+		]);
+		const category = this._workItemStates.getStateCategory(project, issueType, state);
+		if (category != null) return category;
+		const states = await this.retrieveWorkItemTypeStates(issueType, provider, token, owner, projectName, options);
+		this._workItemStates.saveTypeStates(project, issueType, states);
+		return this._workItemStates.getStateCategory(project, issueType, state);
+	}
+	async retrieveWorkItemTypeStates(workItemType, provider, token, owner, projectName, options) {
+		const scope = getScopedLogger();
+		try {
+			return (await this.request(provider, token, options?.baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/wit/workItemTypes/${encodePathSegment(workItemType)}/states`, { method: "GET" }, scope))?.value ?? [];
+		} catch (ex) {
+			if (ex instanceof AuthenticationError) throw ex;
+			scope?.error(ex);
+			return [];
+		}
+	}
+	async getRepositoryMetadata(provider, token, owner, repo, options, cancellation) {
+		const scope = getScopedLogger();
+		try {
+			const response = await this.getRepository(provider, token, owner, repo, options.baseUrl, scope, cancellation);
+			if (response == null) return void 0;
+			return {
+				provider,
+				owner,
+				name: response.name,
+				isFork: response.isFork ?? false,
+				parent: response.isFork && response.parentRepository?.name != null ? {
+					owner,
+					name: response.parentRepository.name
+				} : void 0
+			};
+		} catch (ex) {
+			if (ex instanceof AuthenticationError) throw ex;
+			if (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) scope?.error(ex);
+			return;
+		}
+	}
+	async getDefaultBranch(provider, token, owner, repo, options, cancellation) {
+		const scope = getScopedLogger();
+		try {
+			const response = await this.getRepository(provider, token, owner, repo, options.baseUrl, scope, cancellation);
+			if (response?.defaultBranch == null) return void 0;
+			return {
+				provider,
+				name: normalizeAzureBranchName(response.defaultBranch)
+			};
+		} catch (ex) {
+			if (ex instanceof AuthenticationError) throw ex;
+			if (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) scope?.error(ex);
+			return;
+		}
+	}
+	/**
+	* One page of a filtered work-item search over a collection: a WIQL query for the ordered ids, then one detail
+	* read for the page's slice of them.
+	*
+	* The ids a first page queried are kept as the snapshot its continuations page through, for as long as the
+	* pagination keeps reading it, so it reads a consistent set rather than re-running a query whose rows move under
+	* an `updated` order. Each first page queries its own snapshot, so paginations of one query never share one, and
+	* a continuation whose snapshot is gone is refused (see {@link AzureWorkItemSearchCursor}).
+	*
+	* The query asks for one id more than {@link azureWorkItemSearchResultLimit}, bounded by `$top`: the extra id is
+	* what tells "exactly the limit" from "past it". Past it, the page is `truncated` with `limitReached` and no total,
+	* since the true count is unknowable here. A server that refuses the match set even so fails the page with a
+	* "narrow the search" error: no bounded query could serve that order's first window.
+	*
+	* `resolveProject` maps each result's project name to its descriptor. A work item in a project it doesn't know
+	* fails the page rather than being dropped or mis-attributed, since either would leave the page disagreeing with
+	* the count of the same query; the caller refreshes its project discovery before a search so that means a
+	* project created during the pagination.
+	*/
+	async searchWorkItemsPage(provider, token, collection, options, cancellation) {
+		const scope = getScopedLogger();
+		const wiql = toAzureWorkItemSearchWiql(options.criteria, effectiveIssueSort(options.criteria?.sort), options.projectNames);
+		const key = toAzureWorkItemSearchCursorKey(collection, wiql);
+		const pageSize = toAzureSearchPageSize(options.pageSize, 100, 200);
+		const cursor = parseAzureWorkItemSearchCursor(options.cursor, key, pageSize);
+		const page = cursor?.page ?? 1;
+		const snapshot = cursor?.snapshot ?? uuid();
+		const snapshotKey = JSON.stringify([
+			await sha256(token.accessToken),
+			options.baseUrl,
+			collection,
+			wiql,
+			snapshot
+		]);
+		const snapshotFound = cursor?.snapshot != null ? this._workItemSearches.get(snapshotKey) : void 0;
+		if (cursor?.snapshot != null && snapshotFound == null) throw new Error("Work item search results expired; restart the read without a cursor");
+		const result = await (snapshotFound ?? this._workItemSearches.getOrCreate(snapshotKey, (_cacheable, signal) => this.queryWorkItemIds(provider, token, collection, options.baseUrl, wiql, 20001, scope, signal).catch((ex) => {
+			if (isWorkItemLimitRefusal(ex)) throw new Error(`${provider.name} refused a work item search matching more than 20000 results; narrow the search`);
+			throw ex;
+		}), { cancellation }));
+		const limitReached = result.length > azureWorkItemSearchResultLimit;
+		const ids = limitReached ? result.slice(0, azureWorkItemSearchResultLimit) : result;
+		const offset = cursor?.offset ?? 0;
+		const slice = ids.slice(offset, offset + pageSize);
+		const values = [];
+		if (slice.length > 0) {
+			const workItems = await this.request(provider, token, options.baseUrl, `${encodePathSegment(collection)}/_apis/wit/workitemsbatch?api-version=5.0`, {
+				method: "POST",
+				body: JSON.stringify({
+					ids: slice,
+					$expand: "Links",
+					errorPolicy: "Omit"
+				})
+			}, scope, cancellation);
+			const byId = new Map((workItems?.value ?? []).filter((w) => w != null).map((w) => [w.id, w]));
+			for (const id of slice) {
+				const workItem = byId.get(id);
+				if (workItem == null) continue;
+				const projectName = workItem.fields["System.TeamProject"];
+				const project = options.resolveProject(projectName);
+				if (project == null) throw new Error(`Azure DevOps work item ${id} is in project '${projectName}', which isn't visible`);
+				const stateCategory = await this.getWorkItemStateCategory(workItem.fields["System.WorkItemType"], workItem.fields["System.State"], provider, token, collection, project.name, options);
+				values.push(fromAzureWorkItem(workItem, provider, project, stateCategory));
+			}
+		}
+		const nextOffset = offset + slice.length;
+		const hasMore = nextOffset < ids.length;
+		const next = {
+			key,
+			snapshot,
+			offset: nextOffset,
+			page: page + 1
+		};
+		return {
+			values,
+			cursor: hasMore ? JSON.stringify(next) : void 0,
+			hasMore,
+			page,
+			truncated: limitReached,
+			totalCount: limitReached ? void 0 : ids.length,
+			limitReached: limitReached || void 0
+		};
+	}
+	/**
+	* How many work items the same WIQL {@link searchWorkItemsPage} would page through match, reading no details.
+	*
+	* Asks for one id more than the result ceiling, so the count is exact up to it and `'exceeds-limit'` past it —
+	* never the ceiling itself, which would understate the match set.
+	*/
+	async countWorkItems(provider, token, collection, options, cancellation) {
+		const scope = getScopedLogger();
+		const wiql = toAzureWorkItemSearchWiql(options.criteria, effectiveIssueSort(options.criteria?.sort), options.projectNames);
+		try {
+			const ids = await this.queryWorkItemIds(provider, token, collection, options.baseUrl, wiql, azureWorkItemSearchResultLimit + 1, scope, cancellation);
+			return ids.length > 2e4 ? "exceeds-limit" : ids.length;
+		} catch (ex) {
+			if (isWorkItemLimitRefusal(ex)) return "exceeds-limit";
+			throw ex;
+		}
+	}
+	/**
+	* The ids a collection-level WIQL query matches, in its order.
+	*
+	* `api-version=5.0` is the oldest version every Azure DevOps Server release this search supports (2019 and later)
+	* answers; `timePrecision=true` is what lets the criteria's dates compare as instants — see `toWiqlDate`.
+	*/
+	async queryWorkItemIds(provider, token, collection, baseUrl, wiql, top, scope, cancellation) {
+		const result = await this.request(provider, token, baseUrl, `${encodePathSegment(collection)}/_apis/wit/wiql?$top=${top}&timePrecision=true&api-version=5.0`, {
+			method: "POST",
+			body: JSON.stringify({ query: wiql })
+		}, scope, cancellation);
+		if (result?.workItems == null) throw new Error("Azure DevOps returned no work item query result");
+		return result.workItems.map((w) => w.id);
+	}
+	getRepository(provider, token, owner, repo, baseUrl, scope, cancellation) {
+		const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
+		return this.request(provider, token, baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}?api-version=7.1`, { method: "GET" }, scope, cancellation);
+	}
+	async toPullRequest(pr, provider, token, owner, baseUrl, scope, cancellation) {
+		const forkRepositoryUrls = await this.getForkRepositoryUrls(provider, token, owner, baseUrl, pr.forkSource?.repository, scope, cancellation);
+		return fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls);
+	}
+	/**
+	* Resolves the web and HTTPS clone URLs of the fork a cross-repository pull request comes from. Every other
+	* repository URL the model reports is rebuilt from the pull request payload; only a fork reference lacks the
+	* project to do that, so only a fork costs a request.
+	*
+	* Best-effort by contract: a fork in a project the token cannot read, a deleted fork, or a throttled request
+	* leaves the head ref without a URL. It must never cost the pull request itself, which is what makes swallowing
+	* the failure here the right call rather than a shortcut.
+	*/
+	async getForkRepositoryUrls(provider, token, owner, baseUrl, repository, scope, cancellation) {
+		if (repository == null) return void 0;
+		let tokenHash;
+		try {
+			tokenHash = await sha256(token.accessToken);
+		} catch {
+			return;
+		}
+		const cacheKey = JSON.stringify([
+			tokenHash,
+			baseUrl,
+			owner,
+			repository.id
+		]);
+		return this._forkRepositoryUrls.getOrCreate(cacheKey, (cacheable, aggregate) => this.fetchForkRepositoryUrls(provider, token, owner, baseUrl, repository.id, cacheable, scope, aggregate), { cancellation });
+	}
+	async fetchForkRepositoryUrls(provider, token, owner, baseUrl, repositoryId, cacheable, scope, cancellation) {
+		try {
+			const response = await this.request(provider, token, baseUrl, `${encodePathSegment(owner)}/_apis/git/repositories/${encodePathSegment(repositoryId)}?api-version=4.1`, { method: "GET" }, scope, cancellation);
+			const webUrl = sanitizeAzureRepositoryUrl(response?.webUrl, baseUrl, owner);
+			const cloneHttps = sanitizeAzureRepositoryUrl(response?.remoteUrl, baseUrl, owner);
+			const url = webUrl ?? cloneHttps;
+			if (url == null) {
+				cacheable.invalidate();
+				return;
+			}
+			return {
+				url,
+				cloneHttps
+			};
+		} catch (ex) {
+			if (!(ex instanceof RequestNotFoundError) && !(ex instanceof AuthenticationError)) cacheable.invalidate();
+			const status = ex instanceof ProviderFetchError ? ` (${ex.status})` : "";
+			scope?.warn(`Unable to resolve the fork repository URLs${status}`);
+			return;
+		}
+	}
+	async request(provider, token, baseUrl, route, options, scope, cancellation) {
+		const { accessToken } = token;
+		const url = baseUrl ? `${baseUrl}/${route}` : route;
+		let rsp;
+		try {
+			const sw = maybeStopWatch(`[AZURE] ${options?.method ?? "GET"} request`, { log: { onlyExit: true } });
+			try {
+				if (cancellation?.aborted) throw new CancellationError();
+				rsp = await this.config.wrapForForcedInsecureSSL(provider.getIgnoreSSLErrors(), () => this.config.fetch(url, {
+					headers: {
+						Authorization: `Basic ${base64(`PAT:${accessToken}`)}`,
+						"Content-Type": "application/json"
+					},
+					signal: cancellation,
+					...options
+				}));
+				if (rsp.ok) {
+					if ((rsp.headers.get("content-type")?.toLowerCase() ?? "").startsWith("text/html")) {
+						const { accessToken: _accessToken, ...tokenInfo } = token;
+						throw new AuthenticationError(tokenInfo, 2, /* @__PURE__ */ new Error(`(${rsp.status}) Azure DevOps returned a sign-in page instead of data`));
+					}
+					return await rsp.json();
+				}
+				throw await ProviderFetchError.fromResponse("AzureDevOps", rsp);
+			} finally {
+				sw?.stop();
+			}
+		} catch (ex) {
+			if (ex instanceof ProviderFetchError || ex.name === "AbortError") this.handleRequestError(provider, token, ex, scope);
+			else if (_logger.isDebugging) this.config.onError?.(`AzureDevOps request failed: ${ex.message}`);
+			throw ex;
+		}
+	}
+	handleRequestError(provider, token, ex, scope) {
+		if (ex.name === "AbortError" || !(ex instanceof ProviderFetchError)) throw new CancellationError(ex);
+		const { accessToken, ...tokenInfo } = token;
+		switch (ex.status) {
+			case 404:
+			case 410:
+			case 422: throw new RequestNotFoundError(ex);
+			case 401: throw new AuthenticationError(tokenInfo, 2, ex);
+			case 429: throw toRateLimitError(ex, accessToken);
+			case 403:
+				if (isRateLimitResponse(ex)) throw toRateLimitError(ex, accessToken);
+				throw new AuthenticationError(tokenInfo, 3, ex);
+			case 500:
+				scope?.error(ex);
+				if (ex.response != null) {
+					provider?.trackRequestException();
+					this.config.onRequestFailed?.(provider == null || provider.id === "azure" ? l10n.t("{0} failed to respond and might be experiencing issues. Please visit the [AzureDevOps status page](https://status.dev.azure.com) for more information.", provider?.name ?? "AzureDevOps") : l10n.t("{0} failed to respond and might be experiencing issues.", provider.name));
+				}
+				return;
+			case 502:
+				scope?.error(ex);
+				break;
+			default: if (ex.status >= 400 && ex.status < 500) throw new RequestClientError(ex);
+		}
+		scope?.error(ex);
+		if (_logger.isDebugging) this.config.onError?.(`AzureDevOps request failed: ${ex.response?.errors?.[0]?.message ?? ex.message}`);
+	}
+};
+__decorate([trace({ args: (provider, token, owner, repo, branch) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	owner,
+	repo,
+	branch
+}) })], AzureDevOpsApi.prototype, "getPullRequestForBranch", null);
+__decorate([trace({ args: (provider, token, owner, repo, rev, baseUrl) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	owner,
+	repo,
+	rev,
+	baseUrl
+}) })], AzureDevOpsApi.prototype, "getPullRequestForCommit", null);
+__decorate([trace({ args: (provider, token, owner, repo, id) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	owner,
+	repo,
+	id
+}) })], AzureDevOpsApi.prototype, "getIssueOrPullRequest", null);
+__decorate([trace({ args: (provider, token, project, id) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	project,
+	id
+}) })], AzureDevOpsApi.prototype, "getIssue", null);
+__decorate([trace({ args: (provider, token, owner, repo, rev, baseUrl) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	owner,
+	repo,
+	rev,
+	baseUrl
+}) })], AzureDevOpsApi.prototype, "getAccountForCommit", null);
+__decorate([trace({ args: (provider, token, baseUrl) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	baseUrl
+}) })], AzureDevOpsApi.prototype, "getAddressedCollection", null);
+__decorate([trace({ args: (provider, token, baseUrl) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	baseUrl
+}) })], AzureDevOpsApi.prototype, "getCurrentUserOnServer", null);
+__decorate([trace({ args: (provider, token, owner, repo) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	owner,
+	repo
+}) })], AzureDevOpsApi.prototype, "getRepositoryMetadata", null);
+__decorate([trace({ args: (provider, token, owner, repo) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	owner,
+	repo
+}) })], AzureDevOpsApi.prototype, "getDefaultBranch", null);
+__decorate([trace({ args: (provider, token, collection) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	collection
+}) })], AzureDevOpsApi.prototype, "searchWorkItemsPage", null);
+__decorate([trace({ args: (provider, token, collection) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	collection
+}) })], AzureDevOpsApi.prototype, "countWorkItems", null);
 /** Wires an {@link AzureDevOpsApi} from the full runtime context, mapping `ctx` down to the narrow config. */
-export function createAzureDevOpsApi(ctx) {
-    return new AzureDevOpsApi(baseProviderApiConfig(ctx));
+function createAzureDevOpsApi(ctx) {
+	return new AzureDevOpsApi(baseProviderApiConfig(ctx));
 }
+//#endregion
+export { AzureDevOpsApi, createAzureDevOpsApi };
+
 //# sourceMappingURL=azure.js.map