@gitkraken/core-gitlens 0.6.0 → 0.7.1

package/dist/plus/integrations/providers/azureDevOpsServer.js

@@ -0,0 +1,560 @@
+import { CancellationError } from "../../../utils/cancellation.js";
+import { mapBounded } from "../../../utils/promise.js";
+import { PromiseCache } from "../../../utils/promiseCache.js";
+import { RequestNotFoundError } from "../../../git/errors.js";
+import { uuid } from "../../../utils/crypto.js";
+import "../../../git/models/pullRequest.js";
+import { IntegrationReadUnavailableError } from "../errors.js";
+import "../constants.js";
+import { toTokenWithInfo } from "../authentication/models.js";
+import { compareAzurePullRequestSearchPositions, getInvalidAzureSearchDate, isAzureWorkItemSearchFirstPage, parseAzurePullRequestSearchCursor, toAzurePullRequestSearchCursorKey, toAzurePullRequestSearchFilter, toAzurePullRequestSearchPosition, toAzureSearchPageSize } from "./azure/search.js";
+import { fromProviderPullRequest, getProviderPullRequestIdentity, providersMetadata, toProviderPullRequestStates } from "./models.js";
+import { AzureDevOpsIntegrationBase, getAzureRepositoryApiBaseUrl, getAzureRepositoryIdentity, sameAzureName, uniqueAzureNames } from "./azureDevOps.js";
+//#region ../plus/integrations/src/providers/azureDevOpsServer.ts
+/**
+* Whether `value` can stand as one route segment. Encoding keeps `.` and `..` as they are, and a URL resolves them
+* as directory steps, so a name of either would address a different route than the one named.
+*/
+function isAzureRouteSegment(value) {
+	return value.length > 0 && value !== "." && value !== "..";
+}
+/**
+* Runs one scope of a count probe, answering a refusal of THAT scope (see `searchUnavailable`) as the error itself,
+* which the facade reports and drops without failing the scopes around it. Anything else — a rejected credential,
+* a failed request — still rejects, so the batch reports it.
+*/
+async function refusalAsCount(count) {
+	try {
+		return await count();
+	} catch (ex) {
+		if (ex instanceof IntegrationReadUnavailableError) return ex;
+		throw ex;
+	}
+}
+function findAzureCollection(collections, name) {
+	return collections.find((c) => sameAzureName(c.name, name) || c.id === name);
+}
+/**
+* The most pull requests one facet of a filtered pull-request search drains. Azure has no server-side text, date or
+* draft filter and no ordering, so a facet is read in full before any of them apply; past this bound the facet's
+* unread rows could sort anywhere, and the search reports itself truncated instead of guessing.
+*/
+const azurePullRequestSearchFacetLimit = 1e3;
+/**
+* The page size a facet drain reads. The SDK's own default for both pull request reads, and the size it sizes
+* `$skip` by, so the budget above counts what was actually read.
+*/
+const azurePullRequestSearchPageSize = 100;
+/**
+* How many scopes of one work-item count batch query at once. The facade already runs several batches concurrently,
+* so this multiplies with it: kept small, so a large count preview can't flood a self-hosted server.
+*/
+const azureIssueCountConcurrency = 2;
+/**
+* How long a drained pull-request search keeps serving its continuation pages after the last one was read, and the
+* most it lives however actively it is paged. A pagination that keeps reading stays on one consistent drain; one
+* left idle, or paged for longer than that, is read again.
+*/
+const pullRequestSearchIdleTtl = 3e5;
+const pullRequestSearchMaxTtl = 18e5;
+/**
+* How long a count reuses the drain a search of its query just read. Long enough for a count shown next to the
+* search it previews to agree with it, short enough that a count polled next to an unapplied filter stays live: the
+* window runs from the drain, not from the last count, so polling never extends it.
+*/
+const pullRequestCountReuseTtl = 6e4;
+/**
+* Everything that decides a pull-request search's result set and order, as the value its cursor is fingerprinted
+* from. `pageSize` is left out on purpose: it only decides where a page ends, which the keyset cursor already
+* carries.
+*/
+function toPullRequestSearchQuery(options, sort) {
+	const criteria = options.criteria;
+	return {
+		repos: options.repos?.map((r) => [
+			r.namespace,
+			r.project ?? null,
+			r.name
+		]),
+		org: options.org ?? null,
+		relationships: [...new Set(criteria?.relationships ?? [])].sort(),
+		states: [...new Set(criteria?.states ?? [])].sort(),
+		text: criteria?.text?.trim() ?? null,
+		draft: criteria?.draft ?? null,
+		updatedAfter: criteria?.updatedAfter ?? null,
+		createdAfter: criteria?.createdAfter ?? null,
+		sort
+	};
+}
+const serverMetadata = providersMetadata["azure-devops-server"];
+const serverAuthProvider = Object.freeze({
+	id: serverMetadata.id,
+	scopes: serverMetadata.scopes
+});
+var AzureDevOpsServerIntegration = class extends AzureDevOpsIntegrationBase {
+	domain;
+	authProvider = serverAuthProvider;
+	id = "azure-devops-server";
+	key;
+	name = "Azure DevOps Server";
+	constructor(ctx, authenticationService, getProvidersApi, didChangeConnection, domain) {
+		super(ctx, authenticationService, getProvidersApi, didChangeConnection);
+		this.domain = domain;
+		this.key = `${this.id}:${this.domain}`;
+	}
+	apiBaseUrlFor(session) {
+		return this.getSelfManagedApiBaseUrl(session);
+	}
+	/**
+	* The credential AND the installation it is used against: one integration instance serves every installation on
+	* its host (context paths differ, the host doesn't), and the same token connected to two of them must not reuse
+	* one installation's collections or projects on the other.
+	*/
+	discoveryKey(session) {
+		return `${session.accessToken}:${this.apiBaseUrlFor(session)}`;
+	}
+	getRepositoriesApiBaseUrl(session, repos) {
+		const owners = new Set(repos.map((r) => typeof r === "object" ? r.namespace : void 0));
+		const [owner] = owners;
+		const baseUrl = this.apiBaseUrlFor(session);
+		return owners.size === 1 && owner != null ? getAzureRepositoryApiBaseUrl(baseUrl, {
+			owner,
+			virtualDirectory: void 0
+		}) : baseUrl;
+	}
+	getApiOptions(session, doNotConvertToPat = false) {
+		const { options, ...rest } = super.getApiOptions(session, doNotConvertToPat);
+		return {
+			...rest,
+			options: {
+				...options,
+				baseUrl: this.apiBaseUrlFor(session)
+			}
+		};
+	}
+	getCollectionApiOptions(session, collection) {
+		return {
+			...super.getCollectionApiOptions(session, collection),
+			baseUrl: this.collectionApiBaseUrl(session, collection)
+		};
+	}
+	/** The base a request below `collection` appends to: the installation, whichever the address already ends in. */
+	collectionApiBaseUrl(session, collection) {
+		return getAzureRepositoryApiBaseUrl(this.apiBaseUrlFor(session), {
+			owner: collection,
+			virtualDirectory: void 0
+		});
+	}
+	/**
+	* Only the server level lists the collections: below one, Azure DevOps Server answers `projectCollections` with a
+	* 404 page. On that 404 an address that names a collection reads the collection's own connection data, whose
+	* `webApplicationRelativeDirectory` spells it, and reports it as the one collection visible there.
+	*/
+	async requestResourcesForUser(session, userId) {
+		try {
+			return await super.requestResourcesForUser(session, userId);
+		} catch (ex) {
+			if (!(ex instanceof RequestNotFoundError)) throw ex;
+			const addressed = await (await this.authenticationService.apis.azure)?.getAddressedCollection(this, toTokenWithInfo(this.id, session), this.apiBaseUrlFor(session));
+			if (addressed == null) throw ex;
+			return [addressed];
+		}
+	}
+	/**
+	* The filtered work-item search: one WIQL query per page over ONE collection, then one detail read for the
+	* page's slice. See {@link resolveWorkItemSearchScope} for why a search never spans several collections.
+	*/
+	async searchProviderIssuesPage(session, options, cancellation) {
+		const azure = await this.authenticationService.apis.azure;
+		if (azure == null) return void 0;
+		this.assertSearchDates(options.criteria);
+		const scope = await this.resolveWorkItemSearchScope(session, options.repos, options.org, isAzureWorkItemSearchFirstPage(options.cursor));
+		return azure.searchWorkItemsPage(this, toTokenWithInfo(this.id, session), scope.collection, {
+			baseUrl: this.collectionApiBaseUrl(session, scope.collection),
+			criteria: options.criteria,
+			projectNames: scope.projectNames,
+			resolveProject: (name) => scope.projects.find((p) => sameAzureName(p.name, name)),
+			cursor: options.cursor,
+			pageSize: options.pageSize
+		}, cancellation);
+	}
+	/**
+	* Counts each scope with the WIQL its search would page through, so a count never previews constraints the read
+	* doesn't apply. A scope this provider refuses (see {@link resolveWorkItemSearchScope}) is answered as that
+	* refusal, so the facade drops only it; a request failure still fails the batch, which the facade isolates from
+	* the other batches.
+	*/
+	async countProviderIssues(session, scopes, cancellation) {
+		const azure = await this.authenticationService.apis.azure;
+		if (azure == null) return void 0;
+		const tokenWithInfo = toTokenWithInfo(this.id, session);
+		return mapBounded(scopes, azureIssueCountConcurrency, (s) => refusalAsCount(async () => {
+			this.assertSearchDates(s.criteria);
+			const scope = await this.resolveWorkItemSearchScope(session, s.repos, s.org, true);
+			return azure.countWorkItems(this, tokenWithInfo, scope.collection, {
+				baseUrl: this.collectionApiBaseUrl(session, scope.collection),
+				criteria: s.criteria,
+				projectNames: scope.projectNames
+			}, cancellation);
+		}));
+	}
+	/**
+	* The ONE collection a work-item search runs in, and the projects that bound it.
+	*
+	* A WIQL query is collection-scoped, and ordering a union of several would need every match's details rather
+	* than one page's, so a search never spans collections. `org` names the collection; without it the repositories'
+	* collection is used, and without either the only collection the account can see. Anything else — repositories
+	* in two collections, or several visible collections and nothing to choose one — is refused rather than
+	* narrowed to whichever came first.
+	*
+	* Repositories bound the query by their PROJECT, since Azure work items belong to projects rather than to
+	* repositories, and every project must be one the collection actually has: WIQL answers an unknown project name
+	* with an empty result, which would read as "nothing matched".
+	*/
+	async resolveWorkItemSearchScope(session, repos, org, refreshProjects = false) {
+		const repoCollections = uniqueAzureNames(repos?.map((r) => r.namespace) ?? []);
+		if (repoCollections.length > 1) throw this.searchUnavailable("the repositories span several collections; search each collection separately");
+		if (org && repoCollections.length === 1 && !sameAzureName(org, repoCollections[0])) throw this.searchUnavailable(`the repositories are not in the '${org}' collection`);
+		const collections = await this.getSearchCollections(session);
+		const name = org || repoCollections[0] || (collections.length === 1 ? collections[0].name : void 0);
+		if (name == null) throw this.searchUnavailable(`the account can see ${collections.length} collections; pass \`org\` to choose the one to search`);
+		const collection = findAzureCollection(collections, name);
+		if (collection == null) throw this.searchUnavailable(`the '${name}' collection is not visible`);
+		const projects = await this.getSearchProjects(session, collection, refreshProjects);
+		if (!repos?.length) return {
+			collection: collection.name,
+			projects
+		};
+		const projectNames = uniqueAzureNames(repos.map((r) => {
+			const projectName = getAzureRepositoryIdentity({
+				owner: r.namespace,
+				name: r.name,
+				project: r.project
+			}).projectName;
+			if (projectName == null) throw this.searchUnavailable(`repository '${r.namespace}/${r.name}' names no project`);
+			const project = projects.find((p) => sameAzureName(p.name, projectName));
+			if (project == null) throw this.searchUnavailable(`project '${projectName}' is not visible in '${collection.name}'`);
+			return project.name;
+		}));
+		return {
+			collection: collection.name,
+			projects,
+			projectNames
+		};
+	}
+	/**
+	* The filtered pull-request search. Azure's pull request query can only narrow by creator, reviewer, status and
+	* repository, so every facet is drained (see {@link drainPullRequestSearch}) and the criteria it can't express
+	* are applied to the complete facets; the union is then ordered and served from a keyset cursor.
+	*/
+	async searchProviderPullRequestsPage(session, options, cancellation) {
+		this.assertSearchDates(options.criteria);
+		const sort = options.criteria?.sort ?? "updated:desc";
+		const query = toPullRequestSearchQuery(options, sort);
+		const key = toAzurePullRequestSearchCursorKey(query);
+		const cursor = parseAzurePullRequestSearchCursor(options.cursor, key);
+		const drainId = cursor?.drain ?? uuid();
+		const drainKey = this.pullRequestSearchCacheKey(session, query, drainId);
+		const drainFound = cursor != null ? this._pullRequestSearches.get(drainKey) : this.getPullRequestSearch(this._pullRequestSearches, drainKey, session, options, sort, cancellation);
+		if (drainFound == null) throw new Error("Pull request search results expired or belong to another connection; restart the read without a cursor");
+		const drain = await drainFound;
+		if (cursor == null) {
+			const latestKey = this.pullRequestSearchCacheKey(session, query);
+			this._latestPullRequestSearches.delete(latestKey);
+			this._latestPullRequestSearches.getOrCreate(latestKey, () => Promise.resolve(drain));
+		}
+		const pageSize = toAzureSearchPageSize(options.pageSize, 50, 100);
+		const start = cursor == null ? 0 : drain.rows.findIndex((r) => compareAzurePullRequestSearchPositions(r.position, cursor.after, sort) > 0);
+		const slice = start < 0 ? [] : drain.rows.slice(start, start + pageSize);
+		const page = cursor?.page ?? 1;
+		const last = slice.at(-1);
+		const hasMore = last != null && start + slice.length < drain.rows.length;
+		return {
+			values: slice.map((r) => r.pr),
+			cursor: hasMore ? JSON.stringify({
+				key,
+				drain: drainId,
+				page: page + 1,
+				after: last.position
+			}) : void 0,
+			hasMore,
+			page,
+			truncated: drain.truncated,
+			totalCount: drain.truncated ? void 0 : drain.rows.length
+		};
+	}
+	/**
+	* Counts each scope from the latest drain of its query, the one a search's first page just read, or drains it; see
+	* {@link searchProviderPullRequestsPage}.
+	*/
+	async countProviderPullRequests(session, scopes, cancellation) {
+		return mapBounded(scopes, 1, (s) => refusalAsCount(async () => {
+			this.assertSearchDates(s.criteria);
+			const sort = s.criteria?.sort ?? "updated:desc";
+			const drain = await this.getPullRequestSearch(this._latestPullRequestSearches, this.pullRequestSearchCacheKey(session, toPullRequestSearchQuery(s, sort)), session, s, sort, cancellation);
+			return { count: drain.truncated ? void 0 : drain.rows.length };
+		}));
+	}
+	/**
+	* The drain each pagination pages through, one per first page (see {@link searchProviderPullRequestsPage}), so
+	* the 50 most recently read paginations are kept for as long as they keep reading.
+	*/
+	_pullRequestSearches = new PromiseCache({
+		capacity: 50,
+		accessTTL: pullRequestSearchIdleTtl,
+		createTTL: pullRequestSearchMaxTtl
+	});
+	/**
+	* Each query's latest drain, which its count reads for {@link pullRequestCountReuseTtl}. Apart from the
+	* paginations' drains, so counting and starting searches never evicts a pagination still being read.
+	*/
+	_latestPullRequestSearches = new PromiseCache({
+		capacity: 20,
+		createTTL: pullRequestCountReuseTtl
+	});
+	/**
+	* Keyed by the query itself, not its cursor fingerprint, so two queries whose fingerprints collide can never share
+	* a drain; by credential and installation, so two accounts or installations never read each other's results; and
+	* by `drainId` for a pagination's own drain, left out for the query's latest one.
+	*/
+	pullRequestSearchCacheKey(session, query, drainId) {
+		return JSON.stringify([
+			session.accessToken,
+			this.apiBaseUrlFor(session),
+			query,
+			drainId ?? null
+		]);
+	}
+	getPullRequestSearch(cache, cacheKey, session, options, sort, cancellation) {
+		return cache.getOrCreate(cacheKey, (_cacheable, signal) => this.drainPullRequestSearch(session, options, sort, signal), { cancellation });
+	}
+	/**
+	* Every pull request matching the search, filtered, deduplicated and ordered.
+	*
+	* One facet per (repository or project) × relationship: `Author` reads by creator, while `Assignee` and
+	* `ReviewRequested` both read by reviewer, since Azure has no assignee distinct from its reviewers. Each facet is
+	* drained to {@link azurePullRequestSearchFacetLimit}; a facet that still has more marks the whole result
+	* truncated, because its unread rows could sort anywhere in the union. A facet that fails fails the search: a
+	* union missing one facet would be served in an order it doesn't have.
+	*/
+	async drainPullRequestSearch(session, options, sort, cancellation) {
+		const criteria = options.criteria;
+		const matches = toAzurePullRequestSearchFilter(criteria);
+		const relationships = new Set(criteria?.relationships ?? []);
+		const wantAuthored = relationships.has("author");
+		const wantReviewed = relationships.has("assignee") || relationships.has("review-requested");
+		const facets = await this.resolvePullRequestSearchFacets(session, options.repos, options.org);
+		const userIds = /* @__PURE__ */ new Map();
+		if (relationships.size > 0) for (const collection of uniqueAzureNames(facets.map((f) => f.collection))) {
+			const userId = await this.getFilterUserId(session, collection);
+			if (userId == null) throw this.searchUnavailable(`the current user could not be resolved in '${collection}'`);
+			userIds.set(collection, userId);
+		}
+		const filtersFor = (collection) => {
+			if (relationships.size === 0) return [{}];
+			const userId = userIds.get(collection);
+			return [...wantAuthored ? [{ authorLogin: userId }] : [], ...wantReviewed ? [{ reviewerId: userId }] : []];
+		};
+		const api = await this.getProvidersApi();
+		const { tokenWithInfo, options: apiOptions } = this.getApiOptions(session);
+		const states = toProviderPullRequestStates(criteria?.states?.length ? criteria.states : "open");
+		const drains = await mapBounded(facets.flatMap((facet) => filtersFor(facet.collection).map((filter) => ({
+			facet,
+			filter
+		}))), 6, async ({ facet, filter }) => {
+			const baseUrl = this.collectionApiBaseUrl(session, facet.collection);
+			const values = [];
+			let page = 1;
+			for (let read = 1;; read++) {
+				if (cancellation?.aborted) throw new CancellationError();
+				const input = {
+					...apiOptions,
+					...filter,
+					states,
+					page,
+					pageSize: azurePullRequestSearchPageSize,
+					baseUrl
+				};
+				const result = facet.repository != null ? await api.getPullRequestsForRepo(tokenWithInfo, {
+					namespace: facet.collection,
+					name: facet.repository,
+					project: facet.project.name
+				}, input).then((r) => ({
+					values: r.values,
+					more: r.paging?.more === true,
+					nextPage: r.paging?.nextPage
+				})) : await api.getPullRequestsForAzureProject(tokenWithInfo, {
+					namespace: facet.collection,
+					project: facet.project.name
+				}, input).then((r) => r != null ? {
+					values: r.data,
+					more: r.hasMore,
+					nextPage: r.nextPage ?? void 0
+				} : void 0);
+				if (result == null) throw new Error("Azure DevOps returned no pull request page");
+				values.push(...result.values);
+				if (!result.more) return {
+					facet,
+					values,
+					truncated: false
+				};
+				if (result.nextPage == null || result.nextPage <= page) throw new Error("Azure DevOps returned no advancing pull request continuation");
+				if (read * azurePullRequestSearchPageSize >= azurePullRequestSearchFacetLimit) return {
+					facet,
+					values,
+					truncated: true
+				};
+				page = result.nextPage;
+			}
+		});
+		const rows = /* @__PURE__ */ new Map();
+		for (const { facet, values } of drains) for (const pr of values) {
+			if (!matches(pr)) continue;
+			const identity = getProviderPullRequestIdentity(pr) ?? `project:${facet.collection}/${facet.project.name}:${pr.id}`;
+			if (rows.has(identity)) continue;
+			rows.set(identity, {
+				pr: fromProviderPullRequest(pr, this, {
+					project: facet.project,
+					currentAccountId: userIds.get(facet.collection)
+				}),
+				position: toAzurePullRequestSearchPosition(pr, sort, identity)
+			});
+		}
+		return {
+			rows: [...rows.values()].sort((a, b) => compareAzurePullRequestSearchPositions(a.position, b.position, sort)),
+			truncated: drains.some((d) => d.truncated)
+		};
+	}
+	/**
+	* The repositories or projects a pull-request search reads, each with its collection and project descriptor.
+	*
+	* Repositories are read one by one; an `org` is its collection's projects; a search bounded only by the current
+	* user reads every project the account can see, the same breadth as the account-wide pull request read.
+	*/
+	async resolvePullRequestSearchFacets(session, repos, org) {
+		const collections = await this.getSearchCollections(session);
+		const collectionFor = (name) => {
+			const collection = findAzureCollection(collections, name);
+			if (collection == null) throw this.searchUnavailable(`the '${name}' collection is not visible`);
+			return collection;
+		};
+		if (repos?.length) {
+			if (org && repos.some((r) => !sameAzureName(r.namespace, org))) throw this.searchUnavailable(`the repositories are not all in the '${org}' collection`);
+			const projectsByCollection = /* @__PURE__ */ new Map();
+			const projectsOf = (collection) => {
+				let projects = projectsByCollection.get(collection.id);
+				if (projects == null) {
+					projects = this.getSearchProjects(session, collection, true);
+					projectsByCollection.set(collection.id, projects);
+				}
+				return projects;
+			};
+			return Promise.all(repos.map(async (r) => {
+				const collection = collectionFor(r.namespace);
+				const identity = getAzureRepositoryIdentity({
+					owner: r.namespace,
+					name: r.name,
+					project: r.project
+				});
+				if (identity.projectName == null) throw this.searchUnavailable(`repository '${r.namespace}/${r.name}' names no project`);
+				if (!isAzureRouteSegment(identity.repositoryName)) throw this.searchUnavailable(`repository '${r.namespace}/${r.name}' is not a valid name`);
+				const project = (await projectsOf(collection)).find((p) => sameAzureName(p.name, identity.projectName));
+				if (project == null) throw this.searchUnavailable(`project '${identity.projectName}' is not visible in '${collection.name}'`);
+				return {
+					collection: collection.name,
+					project,
+					repository: identity.repositoryName
+				};
+			}));
+		}
+		const scoped = org ? [collectionFor(org)] : collections;
+		return (await Promise.all(scoped.map((c) => this.getSearchProjects(session, c, true)))).flat().map((p) => ({
+			collection: p.resourceName,
+			project: p
+		}));
+	}
+	_collectionUserIds = new PromiseCache({ capacity: 50 });
+	/**
+	* The current user's identity id in `collection`, read from the collection's own connection data, which is
+	* what Azure's creator and reviewer filters compare against. Cached per credential and collection, since it
+	* can't change for either.
+	*/
+	getFilterUserId(session, collection) {
+		const baseUrl = this.collectionApiBaseUrl(session, collection);
+		return this._collectionUserIds.getOrCreate(JSON.stringify([
+			session.accessToken,
+			baseUrl,
+			collection.toLowerCase()
+		]), async (cacheable) => {
+			const user = await (await this.authenticationService.apis.azure)?.getCurrentUserOnServer(this, toTokenWithInfo(this.id, session), `${baseUrl}/${encodeURIComponent(collection)}`);
+			if (user?.id == null) cacheable.invalidate();
+			return user?.id;
+		});
+	}
+	/** Every collection the account can see, or a refusal when discovery itself failed. */
+	async getSearchCollections(session) {
+		const collections = await this.getProviderResourcesForUser(session);
+		if (collections == null) throw this.searchUnavailable("the account’s collections could not be read");
+		return collections;
+	}
+	/**
+	* A collection's projects, refused when discovery was incomplete: a search bounded by an incomplete project set
+	* would silently omit the missing projects' matches. `refresh` re-reads them rather than trusting the discovery
+	* cache, which lives for the whole connection and so doesn't know a project created since.
+	*/
+	async getSearchProjects(session, collection, refresh = false) {
+		const projects = refresh ? await this.refreshSearchProjects(session, collection) : await this.getProviderProjectsForResources(session, [collection]);
+		if (projects.metadata != null && projects.metadata.completeness !== "complete") throw this.searchUnavailable(`the projects of the '${collection.name}' collection could not all be read`);
+		return projects.values;
+	}
+	_projectRefreshes = /* @__PURE__ */ new Map();
+	/**
+	* Re-reads a collection's projects, sharing one read among the refreshes IN FLIGHT at once — a count batch or a
+	* multi-repository drain refreshes the same collection once per scope, and each would otherwise re-read every
+	* project page. Nothing outlives the read, so the next search still sees a project created after it.
+	*/
+	refreshSearchProjects(session, collection) {
+		const key = `${this.discoveryKey(session)}:${collection.id}`;
+		let pending = this._projectRefreshes.get(key);
+		if (pending == null) {
+			pending = this.getProviderProjectsForResources(session, [collection], true).finally(() => {
+				this._projectRefreshes.delete(key);
+			});
+			this._projectRefreshes.set(key, pending);
+		}
+		return pending;
+	}
+	/**
+	* Refuses dates the search can't apply before anything is read. The facade only checks that dates are
+	* supported, not their shape, and a refusal here stays with its own scope in a count batch.
+	*/
+	assertSearchDates(criteria) {
+		const invalid = getInvalidAzureSearchDate(criteria);
+		if (invalid != null) throw this.searchUnavailable(invalid);
+	}
+	searchUnavailable(reason) {
+		return new IntegrationReadUnavailableError(this.name, `search refused: ${reason}.`);
+	}
+	providerOnDisconnect() {
+		super.providerOnDisconnect();
+		this._pullRequestSearches.clear();
+		this._latestPullRequestSearches.clear();
+		this._collectionUserIds.clear();
+	}
+	async _requestForCurrentUser(session) {
+		const azure = await this.authenticationService.apis.azure;
+		const user = azure ? await azure.getCurrentUserOnServer(this, toTokenWithInfo(this.id, session), this.apiBaseUrlFor(session)) : void 0;
+		return user ? {
+			provider: this,
+			id: user.id,
+			name: user.name ?? void 0,
+			email: user.email ?? void 0,
+			avatarUrl: user.avatarUrl ?? void 0,
+			username: user.username ?? void 0
+		} : void 0;
+	}
+};
+//#endregion
+export { AzureDevOpsServerIntegration };
+
+//# sourceMappingURL=azureDevOpsServer.js.map