@gitkraken/core-gitlens 0.6.0 → 0.7.1

package/dist/plus/integrations/providers/gitlab.js

@@ -1,539 +1,455 @@
-import { CancellationError } from '../../../utils/cancellation.js';
-import { uniqueBy } from '../../../utils/iterable.js';
-import { batch } from '../../../utils/promise.js';
-import { toTokenWithInfo } from '../authentication/models.js';
-import { toCollectionScopeFailure } from '../collectionMetadata.js';
-import { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId } from '../constants.js';
-import { IntegrationReadUnavailableError } from '../errors.js';
-import { GitHostIntegration } from '../models/gitHostIntegration.js';
-import { getGitLabPullRequestIdentityFromMaybeUrl, matchesGitLabOrgNamespace } from './gitlab/gitlab.utils.js';
-import { fromGitLabMergeRequestProvidersApi } from './gitlab/models.js';
-import { getProviderPullRequestIdentity, IssueFilter, ProviderPullRequestReviewState, providersMetadata, PullRequestFilter, toIssueShape, toProviderPullRequestStates, } from './models.js';
-import { collectProviderPagedResult, mergeCollectionMetadata } from './utils/providerPaging.js';
-const metadata = providersMetadata[GitCloudHostIntegrationId.GitLab];
+import { uniqueBy } from "../../../utils/iterable.js";
+import { CancellationError } from "../../../utils/cancellation.js";
+import { batch } from "../../../utils/promise.js";
+import "../../../git/models/pullRequest.js";
+import { IntegrationReadUnavailableError } from "../errors.js";
+import { toCollectionScopeFailure } from "../collectionMetadata.js";
+import "../constants.js";
+import { toTokenWithInfo } from "../authentication/models.js";
+import "../providerFilters.js";
+import { collectProviderPagedResult, mergeCollectionMetadata } from "./utils/providerPaging.js";
+import { ProviderPullRequestReviewState, getProviderPullRequestIdentity, providersMetadata, toIssueShape, toProviderPullRequestStates } from "./models.js";
+import { getGitLabPullRequestIdentityFromMaybeUrl, matchesGitLabOrgNamespace } from "./gitlab/gitlab.utils.js";
+import { fromGitLabMergeRequestProvidersApi } from "./gitlab/models.js";
+import { GitHostIntegration } from "../models/gitHostIntegration.js";
+import * as l10n from "@vscode/l10n";
+//#region ../plus/integrations/src/providers/gitlab.ts
+const metadata = providersMetadata["gitlab"];
 const authProvider = Object.freeze({
-    id: metadata.id,
-    scopes: metadata.scopes,
+	id: metadata.id,
+	scopes: metadata.scopes
 });
-const cloudEnterpriseMetadata = providersMetadata[GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted];
+const cloudEnterpriseMetadata = providersMetadata["cloud-gitlab-self-hosted"];
 const cloudEnterpriseAuthProvider = Object.freeze({
-    id: cloudEnterpriseMetadata.id,
-    scopes: cloudEnterpriseMetadata.scopes,
+	id: cloudEnterpriseMetadata.id,
+	scopes: cloudEnterpriseMetadata.scopes
 });
 /**
- * The account-wide relationships GitLab can express, and the `scope` each maps to. `undefined` means GitLab has
- * no equivalent axis (it has neither `Mention` nor `reviewed-by`), and this map is the single declaration of
- * that. Exhaustive over `PullRequestFilter` on purpose: a new member must be decided for GitLab here rather
- * than compiling through as silently unsupported. Exported for the advertised-vs-expressible capability test,
- * which is what keeps it agreeing with `supportedAccountWidePullRequestFilters`; no runtime consumer imports it.
- */
-export const gitLabAssociationForFilter = {
-    [PullRequestFilter.Assignee]: 'assigned',
-    [PullRequestFilter.Author]: 'authored',
-    [PullRequestFilter.ReviewRequested]: 'reviewRequested',
-    [PullRequestFilter.Reviewed]: undefined,
-    [PullRequestFilter.Mention]: undefined,
+* The account-wide relationships GitLab can express, and the `scope` each maps to. `undefined` means GitLab has
+* no equivalent axis (it has neither `Mention` nor `reviewed-by`), and this map is the single declaration of
+* that. Exhaustive over `PullRequestFilter` on purpose: a new member must be decided for GitLab here rather
+* than compiling through as silently unsupported. Exported for the advertised-vs-expressible capability test,
+* which is what keeps it agreeing with `supportedAccountWidePullRequestFilters`; no runtime consumer imports it.
+*/
+const gitLabAssociationForFilter = {
+	["assignee"]: "assigned",
+	["author"]: "authored",
+	["review-requested"]: "reviewRequested",
+	["reviewed-by"]: void 0,
+	["mention"]: void 0
 };
 function parseGitLabPullRequestFacetCursor(cursor) {
-    if (!cursor)
-        return {};
-    try {
-        const parsed = JSON.parse(cursor);
-        if (parsed.type !== 'gitlab-associations' || parsed.cursors == null || typeof parsed.cursors !== 'object') {
-            return {};
-        }
-        const cursors = parsed.cursors;
-        return Object.fromEntries(['assigned', 'authored', 'reviewRequested']
-            .filter(association => typeof cursors[association] === 'string' && cursors[association] !== '')
-            .map(association => [association, cursors[association]]));
-    }
-    catch {
-        return {};
-    }
+	if (!cursor) return {};
+	try {
+		const parsed = JSON.parse(cursor);
+		if (parsed.type !== "gitlab-associations" || parsed.cursors == null || typeof parsed.cursors !== "object") return {};
+		const cursors = parsed.cursors;
+		return Object.fromEntries([
+			"assigned",
+			"authored",
+			"reviewRequested"
+		].filter((association) => typeof cursors[association] === "string" && cursors[association] !== "").map((association) => [association, cursors[association]]));
+	} catch {
+		return {};
+	}
 }
 /** How many SSH signing-key lookups (account resolve + keys fetch) to run concurrently, to avoid a request burst. */
 const sshSigningKeyResolveBatchSize = 10;
-class GitLabIntegrationBase extends GitHostIntegration {
-    /** Self-hosted GitLab uses PAT semantics and a domain-based API base; gitlab.com does not. */
-    get isEnterprise() {
-        return this.id === GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted;
-    }
-    async getProviderAccountForCommit(session, repo, rev, options) {
-        return (await this.authenticationService.apis.gitlab)?.getAccountForCommit(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, rev, {
-            ...options,
-            baseUrl: this.apiBaseUrl,
-        });
-    }
-    async getProviderAccountForEmail(session, repo, email, options) {
-        return (await this.authenticationService.apis.gitlab)?.getAccountForEmail(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, email, {
-            ...options,
-            baseUrl: this.apiBaseUrl,
-        });
-    }
-    async getProviderSshSigningKeysForEmails(session, repo, emails) {
-        const result = new Map();
-        const api = await this.authenticationService.apis.gitlab;
-        if (api == null)
-            return result;
-        const token = toTokenWithInfo(this.id, session);
-        // GitLab resolves users one email at a time (no batch search). Run them in bounded batches rather than firing all
-        // (up to providerVerifyLimit) account + key lookups at once, to avoid a request burst that trips rate limiting.
-        await batch(emails, sshSigningKeyResolveBatchSize, async (email) => {
-            const account = await this.getProviderAccountForEmail(session, repo, email);
-            if (account?.id == null)
-                return;
-            const keys = await api.getUserSigningKeys(this, token, account.id, { baseUrl: this.apiBaseUrl });
-            result.set(email.toLowerCase(), keys.map(k => k.key));
-        });
-        return result;
-    }
-    async getProviderDefaultBranch(session, repo) {
-        return (await this.authenticationService.apis.gitlab)?.getDefaultBranch(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, {
-            baseUrl: this.apiBaseUrl,
-        });
-    }
-    async getProviderLinkedIssueOrPullRequest(session, repo, { id }) {
-        return (await this.authenticationService.apis.gitlab)?.getIssueOrPullRequest(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, Number(id), {
-            baseUrl: this.apiBaseUrl,
-        });
-    }
-    async getProviderIssue(session, repo, id) {
-        const api = await this.authenticationService.apis.gitlab;
-        const providerApi = await this.getProvidersApi();
-        if (!api || !repo || !id) {
-            return undefined;
-        }
-        const repoId = await api.getProjectId(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, this.apiBaseUrl, undefined);
-        if (!repoId) {
-            return undefined;
-        }
-        const apiResult = await providerApi.getIssue(toTokenWithInfo(this.id, session), { namespace: repo.owner, name: repo.name, number: id }, {
-            isPAT: this.isEnterprise,
-            baseUrl: this.isEnterprise ? `https://${this.domain}` : undefined,
-        });
-        const issue = apiResult != null ? toIssueShape(apiResult, this) : undefined;
-        return issue != null ? { ...issue, type: 'issue' } : undefined;
-    }
-    async getProviderPullRequestForBranch(session, repo, branch, options) {
-        const { include, ...opts } = options ?? {};
-        const toGitLabMergeRequestState = (await import(/* webpackChunkName: "integrations" */ './gitlab/models.js'))
-            .toGitLabMergeRequestState;
-        return (await this.authenticationService.apis.gitlab)?.getPullRequestForBranch(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, branch, {
-            ...opts,
-            include: include?.map(s => toGitLabMergeRequestState(s)),
-            baseUrl: this.apiBaseUrl,
-        });
-    }
-    async getProviderPullRequestForCommit(session, repo, rev) {
-        return (await this.authenticationService.apis.gitlab)?.getPullRequestForCommit(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, rev, {
-            baseUrl: this.apiBaseUrl,
-        });
-    }
-    async getProviderPullRequest(session, resource, id) {
-        return (await this.authenticationService.apis.gitlab)?.getPullRequest(this, toTokenWithInfo(this.id, session), resource.owner, resource.name, parseInt(id, 10), {
-            baseUrl: this.apiBaseUrl,
-        });
-    }
-    async getRepoInfo(repo) {
-        const api = await this.getProvidersApi();
-        // `connectionId` targets a specific account (multi-account); omitted reads the primary.
-        const session = await this.resolveReadSession(repo.connectionId, undefined);
-        if (session == null)
-            return undefined;
-        return api.getRepo(toTokenWithInfo(this.id, session), repo.owner, repo.name, repo.project, {
-            isPAT: this.isEnterprise,
-            baseUrl: this.isEnterprise ? `https://${this.domain}` : undefined,
-        });
-    }
-    async getProviderRepositoryMetadata(session, repo, cancellation) {
-        return (await this.authenticationService.apis.gitlab)?.getRepositoryMetadata(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, {
-            baseUrl: this.apiBaseUrl,
-        }, cancellation);
-    }
-    async getProviderOrganizationsForUser(session) {
-        const api = await this.getProvidersApi();
-        const result = await api.getGitlabGroupsForCurrentUser(toTokenWithInfo(this.id, session), {
-            isPAT: this.isEnterprise,
-            baseUrl: this.isEnterprise ? `https://${this.domain}` : undefined,
-        });
-        return {
-            values: result.values.map(g => ({ id: g.id, providerId: this.id, name: g.fullPath, url: g.webUrl })),
-            ...(result.truncated ? { truncated: true } : {}),
-            ...(result.metadata != null ? { metadata: result.metadata } : {}),
-        };
-    }
-    /**
-     * GitLab has no group-scoped repos endpoint, so each page is a page of the current user's member repos
-     * across all namespaces, filtered to `org` and its subgroups (mirroring gkcli's `gitlabOrgMatches`).
-     * Follow `paging.cursor` to page the full list; repos the user isn't a member of aren't returned.
-     * Because the filter is applied per page, a page can come back with `values: []` while
-     * `paging.more` is still `true` (e.g. a page full of repos outside `org`) — don't treat an empty
-     * page as the end of pagination, only `paging.more`/`collectPagedResults` reaching exhaustion.
-     */
-    async getProviderRepositoriesForOrg(session, org, options) {
-        const api = await this.getProvidersApi();
-        const result = await api.getReposForCurrentUser(toTokenWithInfo(this.id, session), {
-            isPAT: this.isEnterprise,
-            baseUrl: this.isEnterprise ? `https://${this.domain}` : undefined,
-            cursor: options?.cursor,
-        });
-        return {
-            values: result.values.filter(r => matchesGitLabOrgNamespace(r.namespace, org)),
-            ...(result.paging != null ? { paging: result.paging } : {}),
-        };
-    }
-    async getProviderRepositoriesForUser(session, options) {
-        const api = await this.getProvidersApi();
-        // GitLab's membership read is already user-affiliated, so the account-wide walk is the unfiltered
-        // version of the per-org read above (which pages the same source and filters by namespace).
-        return api.getReposForCurrentUser(toTokenWithInfo(this.id, session), {
-            isPAT: this.isEnterprise,
-            baseUrl: this.isEnterprise ? `https://${this.domain}` : undefined,
-            cursor: options?.cursor,
-        });
-    }
-    async searchProviderMyPullRequests(session, repos, _cancellation, options) {
-        const api = await this.getProvidersApi();
-        // Resolve the username from THIS session's token (multi-account: `session` may be a non-primary
-        // connection); `getCurrentAccount()` would use the primary `_session` and filter by the wrong user.
-        const username = (await this.getProviderCurrentAccount(session))?.username;
-        if (!username) {
-            return Promise.resolve([]);
-        }
-        const apiResult = await api.getPullRequestsForUser(toTokenWithInfo(this.id, session), username, {
-            isPAT: this.isEnterprise,
-            baseUrl: this.isEnterprise ? `https://${this.domain}` : undefined,
-            states: toProviderPullRequestStates(options?.state),
-        });
-        if (apiResult == null) {
-            return Promise.resolve([]);
-        }
-        // now I'm going to filter prs from the result according to the repos parameter
-        let prs;
-        if (repos != null) {
-            const repoMap = new Map();
-            for (const repo of repos) {
-                repoMap.set(`${repo.owner}/${repo.name}`, repo);
-            }
-            prs = apiResult.values.filter(pr => {
-                const repo = repoMap.get(`${pr.repository.owner.login}/${pr.repository.name}`);
-                return repo != null;
-            });
-        }
-        else {
-            prs = apiResult.values;
-        }
-        const results = uniqueBy([
-            ...prs
-                .filter(pr => {
-                const isAssignee = pr.assignees?.some(a => a.username === username);
-                const isRequestedReviewer = pr.reviews?.some(
-                // Match only reviews assigned to the current user; a bare `state === ReviewRequested`
-                // check would also match reviews requested from OTHER people, leaking their MRs in.
-                review => review.reviewer?.username === username &&
-                    review.state === ProviderPullRequestReviewState.ReviewRequested);
-                const isAuthor = pr.author?.username === username;
-                // It seems like GitLab doesn't give us mentioned PRs.
-                // const isMentioned = ???;
-                return isAssignee || isRequestedReviewer || isAuthor;
-            })
-                .map(pr => fromGitLabMergeRequestProvidersApi(pr, this)),
-        ], r => r.url, (original, _current) => original);
-        return [...results];
-    }
-    async getProviderMyPullRequestsForUser(session, options) {
-        // Resolve the username from THIS session's token (multi-account safe) to scope the account-wide read.
-        const username = (await this.getProviderCurrentAccount(session))?.username;
-        if (username == null)
-            return undefined;
-        const api = await this.getProvidersApi();
-        const requested = options?.filters?.length ? new Set(options.filters) : undefined;
-        // The filter contract is all-or-nothing, so refuse as soon as ONE requested member is inexpressible rather
-        // than only when every one is: dropping the rest would answer a narrower question than was asked
-        // (`[Author, Mention]` becoming `authored`). Throw rather than return `undefined`, which the facade reads
-        // as "no session could be resolved" and a drain turns into a not-connected warning, misattributing a
-        // refusal; `getMyPullRequestsForUserResult` recovers the throw into `{ error }`. Defense in depth:
-        // `resolveAccountWidePullRequestFilters` already refuses such a set, so only a direct caller of the public
-        // method reaches this.
-        const unsupported = requested == null ? [] : [...requested].filter(f => gitLabAssociationForFilter[f] == null);
-        if (unsupported.length > 0) {
-            throw new IntegrationReadUnavailableError(this.name, `account-wide pull request filters not expressible by GitLab: ${unsupported.join(', ')}`);
-        }
-        const associations = requested == null
-            ? ['authored', 'assigned', 'reviewRequested']
-            : Array.from(requested, f => gitLabAssociationForFilter[f]).filter(a => a != null);
-        const cursors = parseGitLabPullRequestFacetCursor(options?.cursor);
-        const resumable = associations.filter(association => cursors[association] != null);
-        const associationsToQuery = options?.cursor != null && resumable.length > 0 ? resumable : associations;
-        const tokenWithInfo = toTokenWithInfo(this.id, session);
-        const settled = await Promise.allSettled(associationsToQuery.map(async (association) => ({
-            association: association,
-            result: await api.getGitLabPullRequestsForUserAssociation(tokenWithInfo, username, association, {
-                isPAT: this.isEnterprise,
-                baseUrl: this.isEnterprise ? `https://${this.domain}` : undefined,
-                states: toProviderPullRequestStates(options?.state),
-                cursor: cursors[association],
-            }),
-        })));
-        if (settled.every(outcome => outcome.status === 'rejected')) {
-            const first = settled[0];
-            if (first?.status === 'rejected')
-                throw first.reason;
-        }
-        const values = new Map();
-        const nextCursors = {};
-        const failures = [];
-        let aggregateMetadata;
-        let truncated = false;
-        let unkeyedPullRequest = 0;
-        for (let index = 0; index < settled.length; index++) {
-            const outcome = settled[index];
-            const association = associationsToQuery[index];
-            if (outcome == null || association == null)
-                continue;
-            if (outcome.status === 'rejected') {
-                const failure = toCollectionScopeFailure({ providerId: this.id }, outcome.reason);
-                failures.push({
-                    ...failure,
-                    message: `GitLab ${association} pull requests could not be read${failure.message != null ? `: ${failure.message}` : ''}`,
-                });
-                truncated = true;
-                continue;
-            }
-            const result = outcome.value.result;
-            aggregateMetadata = mergeCollectionMetadata(aggregateMetadata, result.metadata);
-            truncated ||=
-                result.paging?.truncated === true ||
-                    (result.metadata != null && result.metadata.completeness !== 'complete');
-            for (const pr of result.values) {
-                const identity = getProviderPullRequestIdentity(pr) ?? `unkeyed:${unkeyedPullRequest++}`;
-                if (!values.has(identity)) {
-                    values.set(identity, pr);
-                }
-            }
-            if (result.paging?.more && result.paging.cursor != null && result.paging.cursor !== '{}') {
-                nextCursors[association] = result.paging.cursor;
-            }
-        }
-        aggregateMetadata = mergeCollectionMetadata(aggregateMetadata, failures.length > 0 ? { completeness: 'partial', failures: failures } : undefined);
-        const hasMore = Object.keys(nextCursors).length > 0;
-        return {
-            values: [...values.values()],
-            paging: {
-                more: hasMore,
-                cursor: hasMore ? JSON.stringify({ type: 'gitlab-associations', cursors: nextCursors }) : '{}',
-                truncated: truncated || undefined,
-            },
-            ...(aggregateMetadata != null ? { metadata: aggregateMetadata } : {}),
-        };
-    }
-    async searchProviderMyIssues(session, repos) {
-        const api = await this.authenticationService.apis.gitlab;
-        const providerApi = await this.getProvidersApi();
-        if (!api || !repos) {
-            return undefined;
-        }
-        const repoIdsResult = await Promise.allSettled(repos.map((r) => api.getProjectId(this, toTokenWithInfo(this.id, session), r.owner, r.name, this.apiBaseUrl, undefined)) ?? []);
-        const repoInput = repoIdsResult
-            .map(result => (result.status === 'fulfilled' ? result.value : undefined))
-            .filter((r) => r != null);
-        const apiResult = await providerApi.getIssuesForRepos(toTokenWithInfo(this.id, session), repoInput, {
-            isPAT: this.isEnterprise,
-            baseUrl: this.isEnterprise ? `https://${this.domain}` : undefined,
-        });
-        return apiResult.values
-            .map(issue => toIssueShape(issue, this))
-            .filter((result) => result != null);
-    }
-    /**
-     * Account-wide "my issues" for GitLab. GitLab's repo-scoped issue read bails without repos, and GitLab has
-     * no GraphQL cross-project issue field, so this goes through the SDK's REST `GET /issues` read
-     * ({@link ProvidersApi.getIssuesForCurrentUser}). Open issues only (matching GitHub's baked `is:open`).
-     *
-     * Default scope is the current user's assigned issues; `includeAllAssignees` broadens to `scope=all` (every
-     * visible issue, any assignee). The read is numbered-paged, so each page is drained to exhaustion, bounded by
-     * a defensive backstop — a hit backstop is reported as `truncated` so the facade surfaces an incomplete read
-     * rather than publishing a partial list as complete.
-     *
-     * `options.filters` selects which relationships to read: `Assignee` (the default when omitted) and `Author`,
-     * each its own drain, unioned by url — see the comment on `passes` for why they can't be one request. Mention
-     * is absent because GitLab's REST read exposes no first-class mention filter, and approximating it via `search`
-     * would return a different set than asked for; the facade refuses it
-     * (see `ProviderMetadata.supportedAccountWideIssueFilters`).
-     */
-    async searchProviderMyIssuesWithTruncation(session, _resources, cancellation, options) {
-        if (cancellation?.aborted)
-            throw new CancellationError();
-        const api = await this.getProvidersApi();
-        // Resolve the username from THIS session's token (multi-account safe), matching the PR account-wide read.
-        // Only needed to scope the default (assigned-to-me) read; the all-assignees broaden drops it.
-        const username = options?.includeAllAssignees
-            ? undefined
-            : (await this.getProviderCurrentAccount(session))?.username;
-        if (!options?.includeAllAssignees && username == null)
-            return undefined;
-        if (cancellation?.aborted)
-            throw new CancellationError();
-        const baseUrl = this.isEnterprise ? `https://${this.domain}` : undefined;
-        const maxPages = 20;
-        // Dedupe by `url`, not `IssueShape.id`: for GitLab `id` is the per-project `iid`, which collides across
-        // projects in an account-wide read (two repos both have issue `#1`), so an id-keyed map would silently
-        // drop distinct issues. `url` is globally unique. Matches the GitHub/GitLab account-wide PR reads.
-        const issuesByUrl = new Map();
-        let truncated = false;
-        let collectionMetadata;
-        // One drain PER requested relationship, unioned by url. The account-wide filter contract is a union
-        // (`authored ∪ assigned`, matching GitHub's three searches and Azure's two drains), and GitLab can express
-        // only one relationship per REST call: `assignee_username` and `author_username` on the same request
-        // compose with AND, so a single combined call would return the intersection — issues the user both opened
-        // and is assigned to — instead of either set. Overlap between the passes is collapsed by the url map.
-        const passes = [];
-        if (options?.includeAllAssignees) {
-            // Broadens past "mine" entirely: every visible issue, any assignee. Contradicts `filters`, which the
-            // facade refuses before reaching here.
-            passes.push({ scope: 'all' });
-        }
-        else {
-            const filters = options?.filters;
-            // Assignee is this read's default relationship, so it runs unless the caller narrowed to author alone.
-            if (filters == null || filters.length === 0 || filters.includes(IssueFilter.Assignee)) {
-                passes.push({ scope: 'assigned_to_me', assigneeUsername: username });
-            }
-            // `scope: 'all'` is required for the author axis: paired with `assigned_to_me` GitLab would intersect
-            // the two rather than read authored issues.
-            if (filters?.includes(IssueFilter.Author)) {
-                passes.push({ scope: 'all', authorUsername: username });
-            }
-        }
-        for (const pass of passes) {
-            const result = await collectProviderPagedResult(async (cursor) => {
-                if (cancellation?.aborted)
-                    throw new CancellationError();
-                const page = await api.getIssuesForCurrentUser(toTokenWithInfo(this.id, session), {
-                    ...pass,
-                    isPAT: this.isEnterprise,
-                    baseUrl: baseUrl,
-                    cursor: cursor,
-                    sort: options?.sort,
-                });
-                if (cancellation?.aborted)
-                    throw new CancellationError();
-                return page;
-            }, maxPages, { providerId: this.id });
-            for (const issue of result.values) {
-                const shape = toIssueShape(issue, this);
-                if (shape != null && !issuesByUrl.has(shape.url)) {
-                    issuesByUrl.set(shape.url, shape);
-                }
-            }
-            truncated ||= result.truncated === true;
-            collectionMetadata = mergeCollectionMetadata(collectionMetadata, result.metadata);
-        }
-        return {
-            values: [...issuesByUrl.values()],
-            truncated: truncated,
-            ...(collectionMetadata != null ? { metadata: collectionMetadata } : {}),
-        };
-    }
-    async searchProviderPullRequests(session, searchQuery, repos, cancellation, options) {
-        const api = await this.authenticationService.apis.gitlab;
-        if (!api) {
-            return undefined;
-        }
-        return api.searchPullRequests(this, toTokenWithInfo(this.id, session), {
-            search: searchQuery,
-            repos: repos?.map(r => `${r.owner}/${r.name}`),
-            baseUrl: this.apiBaseUrl,
-            include: options?.include,
-        }, cancellation);
-    }
-    async mergeProviderPullRequest(session, pr, options) {
-        if (!this.isPullRequest(pr))
-            return false;
-        const api = await this.getProvidersApi();
-        try {
-            const res = await api.mergePullRequest(toTokenWithInfo(this.id, session), pr, {
-                ...options,
-                isPAT: this.isEnterprise,
-                baseUrl: this.isEnterprise ? `https://${this.domain}` : undefined,
-            });
-            return res;
-        }
-        catch (ex) {
-            void this.showMergeErrorMessage(ex);
-            return false;
-        }
-    }
-    async showMergeErrorMessage(ex) {
-        // Unfortunately, providers-api does not let us know the exact reason for the error,
-        // so we show the same message to everything.
-        // When we update the library, we can improve the error handling here.
-        const reauthenticate = await this.ctx.hooks?.onReauthenticationRequired?.(`${ex.message}. Would you like to try reauthenticating to provide additional access? Your token needs to have the 'api' scope to perform merge.`);
-        if (reauthenticate) {
-            await this.reauthenticate();
-        }
-    }
-    isPullRequest(pr) {
-        return pr.refs != null;
-    }
-    async getProviderCurrentAccount(session) {
-        const api = await this.getProvidersApi();
-        const currentUser = await api.getCurrentUser(toTokenWithInfo(this.id, session), {
-            isPAT: this.isEnterprise,
-            baseUrl: this.isEnterprise ? `https://${this.domain}` : undefined,
-        });
-        if (currentUser == null)
-            return undefined;
-        return {
-            provider: {
-                id: this.id,
-                name: this.name,
-                domain: this.domain,
-                icon: this.icon,
-            },
-            id: currentUser.id,
-            name: currentUser.name || undefined,
-            email: currentUser.email || undefined,
-            avatarUrl: currentUser.avatarUrl || undefined,
-            username: currentUser.username || undefined,
-        };
-    }
-    getProviderPullRequestIdentityFromMaybeUrl(search) {
-        return getGitLabPullRequestIdentityFromMaybeUrl(search, this.id);
-    }
-}
-export class GitLabIntegration extends GitLabIntegrationBase {
-    authProvider = authProvider;
-    id = GitCloudHostIntegrationId.GitLab;
-    key = this.id;
-    name = 'GitLab';
-    get domain() {
-        return metadata.domain;
-    }
-    get apiBaseUrl() {
-        return 'https://gitlab.com/api';
-    }
-    access() {
-        // Always allow GitHub cloud integration access
-        return Promise.resolve(true);
-    }
-}
-export class GitLabSelfHostedIntegration extends GitLabIntegrationBase {
-    _domain;
-    authProvider = cloudEnterpriseAuthProvider;
-    id = GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted;
-    key;
-    name = 'GitLab Self-Hosted';
-    get domain() {
-        return this._domain;
-    }
-    get apiBaseUrl() {
-        return `https://${this._domain}/api`;
-    }
-    constructor(ctx, authenticationService, getProvidersApi, didChangeConnection, _domain) {
-        super(ctx, authenticationService, getProvidersApi, didChangeConnection);
-        this._domain = _domain;
-        this.key = `${this.id}:${this.domain}`;
-    }
-}
+var GitLabIntegrationBase = class extends GitHostIntegration {
+	/** The installation base the PAT-based reads take on self-hosted GitLab; gitlab.com passes none. */
+	enterpriseBaseUrlFor(session) {
+		return this.isEnterprise ? this.getSelfManagedApiBaseUrl(session) : void 0;
+	}
+	/** Self-hosted GitLab uses PAT semantics and a domain-based API base; gitlab.com does not. */
+	get isEnterprise() {
+		return this.id === "cloud-gitlab-self-hosted";
+	}
+	async getProviderAccountForCommit(session, repo, rev, options) {
+		return (await this.authenticationService.apis.gitlab)?.getAccountForCommit(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, rev, {
+			...options,
+			baseUrl: this.apiBaseUrlFor(session)
+		});
+	}
+	async getProviderAccountForEmail(session, repo, email, options) {
+		return (await this.authenticationService.apis.gitlab)?.getAccountForEmail(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, email, {
+			...options,
+			baseUrl: this.apiBaseUrlFor(session)
+		});
+	}
+	async getProviderSshSigningKeysForEmails(session, repo, emails) {
+		const result = /* @__PURE__ */ new Map();
+		const api = await this.authenticationService.apis.gitlab;
+		if (api == null) return result;
+		const token = toTokenWithInfo(this.id, session);
+		await batch(emails, sshSigningKeyResolveBatchSize, async (email) => {
+			const account = await this.getProviderAccountForEmail(session, repo, email);
+			if (account?.id == null) return;
+			const keys = await api.getUserSigningKeys(this, token, account.id, { baseUrl: this.apiBaseUrlFor(session) });
+			result.set(email.toLowerCase(), keys.map((k) => k.key));
+		});
+		return result;
+	}
+	async getProviderDefaultBranch(session, repo) {
+		return (await this.authenticationService.apis.gitlab)?.getDefaultBranch(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, { baseUrl: this.apiBaseUrlFor(session) });
+	}
+	async getProviderLinkedIssueOrPullRequest(session, repo, { id }) {
+		return (await this.authenticationService.apis.gitlab)?.getIssueOrPullRequest(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, Number(id), { baseUrl: this.apiBaseUrlFor(session) });
+	}
+	async getProviderIssue(session, repo, id) {
+		const api = await this.authenticationService.apis.gitlab;
+		const providerApi = await this.getProvidersApi();
+		if (!api || !repo || !id) return;
+		if (!await api.getProjectId(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, this.apiBaseUrlFor(session), void 0)) return;
+		const apiResult = await providerApi.getIssue(toTokenWithInfo(this.id, session), {
+			namespace: repo.owner,
+			name: repo.name,
+			number: id
+		}, {
+			isPAT: this.isEnterprise,
+			baseUrl: this.enterpriseBaseUrlFor(session)
+		});
+		const issue = apiResult != null ? toIssueShape(apiResult, this) : void 0;
+		return issue != null ? {
+			...issue,
+			type: "issue"
+		} : void 0;
+	}
+	async getProviderPullRequestForBranch(session, repo, branch, options) {
+		const { include, ...opts } = options ?? {};
+		const toGitLabMergeRequestState = (await import(
+			/* webpackChunkName: "integrations" */
+			"./gitlab/models.js"
+)).toGitLabMergeRequestState;
+		return (await this.authenticationService.apis.gitlab)?.getPullRequestForBranch(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, branch, {
+			...opts,
+			include: include?.map((s) => toGitLabMergeRequestState(s)),
+			baseUrl: this.apiBaseUrlFor(session)
+		});
+	}
+	async getProviderPullRequestForCommit(session, repo, rev) {
+		return (await this.authenticationService.apis.gitlab)?.getPullRequestForCommit(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, rev, { baseUrl: this.apiBaseUrlFor(session) });
+	}
+	async getProviderPullRequest(session, resource, id) {
+		return (await this.authenticationService.apis.gitlab)?.getPullRequest(this, toTokenWithInfo(this.id, session), resource.owner, resource.name, parseInt(id, 10), { baseUrl: this.apiBaseUrlFor(session) });
+	}
+	async getRepoInfo(repo) {
+		const api = await this.getProvidersApi();
+		const session = await this.resolveReadSession(repo.connectionId, void 0);
+		if (session == null) return void 0;
+		return api.getRepo(toTokenWithInfo(this.id, session), repo.owner, repo.name, repo.project, {
+			isPAT: this.isEnterprise,
+			baseUrl: this.enterpriseBaseUrlFor(session)
+		});
+	}
+	async getProviderRepositoryMetadata(session, repo, cancellation) {
+		return (await this.authenticationService.apis.gitlab)?.getRepositoryMetadata(this, toTokenWithInfo(this.id, session), repo.owner, repo.name, { baseUrl: this.apiBaseUrlFor(session) }, cancellation);
+	}
+	async getProviderOrganizationsForUser(session) {
+		const result = await (await this.getProvidersApi()).getGitlabGroupsForCurrentUser(toTokenWithInfo(this.id, session), {
+			isPAT: this.isEnterprise,
+			baseUrl: this.enterpriseBaseUrlFor(session)
+		});
+		return {
+			values: result.values.map((g) => ({
+				id: g.id,
+				providerId: this.id,
+				name: g.fullPath,
+				url: g.webUrl
+			})),
+			...result.truncated ? { truncated: true } : {},
+			...result.metadata != null ? { metadata: result.metadata } : {}
+		};
+	}
+	/**
+	* GitLab has no group-scoped repos endpoint, so each page is a page of the current user's member repos
+	* across all namespaces, filtered to `org` and its subgroups (mirroring gkcli's `gitlabOrgMatches`).
+	* Follow `paging.cursor` to page the full list; repos the user isn't a member of aren't returned.
+	* Because the filter is applied per page, a page can come back with `values: []` while
+	* `paging.more` is still `true` (e.g. a page full of repos outside `org`) — don't treat an empty
+	* page as the end of pagination, only `paging.more`/`collectPagedResults` reaching exhaustion.
+	*/
+	async getProviderRepositoriesForOrg(session, org, options) {
+		const result = await (await this.getProvidersApi()).getReposForCurrentUser(toTokenWithInfo(this.id, session), {
+			isPAT: this.isEnterprise,
+			baseUrl: this.enterpriseBaseUrlFor(session),
+			cursor: options?.cursor
+		});
+		return {
+			values: result.values.filter((r) => matchesGitLabOrgNamespace(r.namespace, org)),
+			...result.paging != null ? { paging: result.paging } : {}
+		};
+	}
+	async getProviderRepositoriesForUser(session, options) {
+		return (await this.getProvidersApi()).getReposForCurrentUser(toTokenWithInfo(this.id, session), {
+			isPAT: this.isEnterprise,
+			baseUrl: this.enterpriseBaseUrlFor(session),
+			cursor: options?.cursor
+		});
+	}
+	async searchProviderMyPullRequests(session, repos, _cancellation, options) {
+		const api = await this.getProvidersApi();
+		const username = (await this.getProviderCurrentAccount(session))?.username;
+		if (!username) return Promise.resolve([]);
+		const apiResult = await api.getPullRequestsForUser(toTokenWithInfo(this.id, session), username, {
+			isPAT: this.isEnterprise,
+			baseUrl: this.enterpriseBaseUrlFor(session),
+			states: toProviderPullRequestStates(options?.state)
+		});
+		if (apiResult == null) return Promise.resolve([]);
+		let prs;
+		if (repos != null) {
+			const repoMap = /* @__PURE__ */ new Map();
+			for (const repo of repos) repoMap.set(`${repo.owner}/${repo.name}`, repo);
+			prs = apiResult.values.filter((pr) => {
+				return repoMap.get(`${pr.repository.owner.login}/${pr.repository.name}`) != null;
+			});
+		} else prs = apiResult.values;
+		return [...uniqueBy([...prs.filter((pr) => {
+			const isAssignee = pr.assignees?.some((a) => a.username === username);
+			const isRequestedReviewer = pr.reviews?.some((review) => review.reviewer?.username === username && review.state === ProviderPullRequestReviewState.ReviewRequested);
+			const isAuthor = pr.author?.username === username;
+			return isAssignee || isRequestedReviewer || isAuthor;
+		}).map((pr) => fromGitLabMergeRequestProvidersApi(pr, this))], (r) => r.url, (original, _current) => original)];
+	}
+	async getProviderMyPullRequestsForUser(session, options) {
+		const username = (await this.getProviderCurrentAccount(session))?.username;
+		if (username == null) return void 0;
+		const api = await this.getProvidersApi();
+		const requested = options?.filters?.length ? new Set(options.filters) : void 0;
+		const unsupported = requested == null ? [] : [...requested].filter((f) => gitLabAssociationForFilter[f] == null);
+		if (unsupported.length > 0) throw new IntegrationReadUnavailableError(this.name, `account-wide pull request filters not expressible by GitLab: ${unsupported.join(", ")}`);
+		const associations = requested == null ? [
+			"authored",
+			"assigned",
+			"reviewRequested"
+		] : Array.from(requested, (f) => gitLabAssociationForFilter[f]).filter((a) => a != null);
+		const cursors = parseGitLabPullRequestFacetCursor(options?.cursor);
+		const resumable = associations.filter((association) => cursors[association] != null);
+		const associationsToQuery = options?.cursor != null && resumable.length > 0 ? resumable : associations;
+		const tokenWithInfo = toTokenWithInfo(this.id, session);
+		const settled = await Promise.allSettled(associationsToQuery.map(async (association) => ({
+			association,
+			result: await api.getGitLabPullRequestsForUserAssociation(tokenWithInfo, username, association, {
+				isPAT: this.isEnterprise,
+				baseUrl: this.enterpriseBaseUrlFor(session),
+				states: toProviderPullRequestStates(options?.state),
+				cursor: cursors[association]
+			})
+		})));
+		if (settled.every((outcome) => outcome.status === "rejected")) {
+			const first = settled[0];
+			if (first?.status === "rejected") throw first.reason;
+		}
+		const values = /* @__PURE__ */ new Map();
+		const nextCursors = {};
+		const failures = [];
+		let aggregateMetadata;
+		let truncated = false;
+		let unkeyedPullRequest = 0;
+		for (let index = 0; index < settled.length; index++) {
+			const outcome = settled[index];
+			const association = associationsToQuery[index];
+			if (outcome == null || association == null) continue;
+			if (outcome.status === "rejected") {
+				const failure = toCollectionScopeFailure({ providerId: this.id }, outcome.reason);
+				failures.push({
+					...failure,
+					message: `GitLab ${association} pull requests could not be read${failure.message != null ? `: ${failure.message}` : ""}`
+				});
+				truncated = true;
+				continue;
+			}
+			const result = outcome.value.result;
+			aggregateMetadata = mergeCollectionMetadata(aggregateMetadata, result.metadata);
+			truncated ||= result.paging?.truncated === true || result.metadata != null && result.metadata.completeness !== "complete";
+			for (const pr of result.values) {
+				const identity = getProviderPullRequestIdentity(pr) ?? `unkeyed:${unkeyedPullRequest++}`;
+				if (!values.has(identity)) values.set(identity, pr);
+			}
+			if (result.paging?.more && result.paging.cursor != null && result.paging.cursor !== "{}") nextCursors[association] = result.paging.cursor;
+		}
+		aggregateMetadata = mergeCollectionMetadata(aggregateMetadata, failures.length > 0 ? {
+			completeness: "partial",
+			failures
+		} : void 0);
+		const hasMore = Object.keys(nextCursors).length > 0;
+		return {
+			values: [...values.values()],
+			paging: {
+				more: hasMore,
+				cursor: hasMore ? JSON.stringify({
+					type: "gitlab-associations",
+					cursors: nextCursors
+				}) : "{}",
+				truncated: truncated || void 0
+			},
+			...aggregateMetadata != null ? { metadata: aggregateMetadata } : {}
+		};
+	}
+	async searchProviderMyIssues(session, repos) {
+		const api = await this.authenticationService.apis.gitlab;
+		const providerApi = await this.getProvidersApi();
+		if (!api || !repos) return;
+		const repoInput = (await Promise.allSettled(repos.map((r) => api.getProjectId(this, toTokenWithInfo(this.id, session), r.owner, r.name, this.apiBaseUrlFor(session), void 0)) ?? [])).map((result) => result.status === "fulfilled" ? result.value : void 0).filter((r) => r != null);
+		return (await providerApi.getIssuesForRepos(toTokenWithInfo(this.id, session), repoInput, {
+			isPAT: this.isEnterprise,
+			baseUrl: this.enterpriseBaseUrlFor(session)
+		})).values.map((issue) => toIssueShape(issue, this)).filter((result) => result != null);
+	}
+	/**
+	* Account-wide "my issues" for GitLab. GitLab's repo-scoped issue read bails without repos, and GitLab has
+	* no GraphQL cross-project issue field, so this goes through the SDK's REST `GET /issues` read
+	* ({@link ProvidersApi.getIssuesForCurrentUser}). Open issues only (matching GitHub's baked `is:open`).
+	*
+	* Default scope is the current user's assigned issues; `includeAllAssignees` broadens to `scope=all` (every
+	* visible issue, any assignee). The read is numbered-paged, so each page is drained to exhaustion, bounded by
+	* a defensive backstop — a hit backstop is reported as `truncated` so the facade surfaces an incomplete read
+	* rather than publishing a partial list as complete.
+	*
+	* `options.filters` selects which relationships to read: `Assignee` (the default when omitted) and `Author`,
+	* each its own drain, unioned by url — see the comment on `passes` for why they can't be one request. Mention
+	* is absent because GitLab's REST read exposes no first-class mention filter, and approximating it via `search`
+	* would return a different set than asked for; the facade refuses it
+	* (see `ProviderMetadata.supportedAccountWideIssueFilters`).
+	*/
+	async searchProviderMyIssuesWithTruncation(session, _resources, cancellation, options) {
+		if (cancellation?.aborted) throw new CancellationError();
+		const api = await this.getProvidersApi();
+		const username = options?.includeAllAssignees ? void 0 : (await this.getProviderCurrentAccount(session))?.username;
+		if (!options?.includeAllAssignees && username == null) return void 0;
+		if (cancellation?.aborted) throw new CancellationError();
+		const baseUrl = this.enterpriseBaseUrlFor(session);
+		const maxPages = 20;
+		const issuesByUrl = /* @__PURE__ */ new Map();
+		let truncated = false;
+		let collectionMetadata;
+		const passes = [];
+		if (options?.includeAllAssignees) passes.push({ scope: "all" });
+		else {
+			const filters = options?.filters;
+			if (filters == null || filters.length === 0 || filters.includes("assignee")) passes.push({
+				scope: "assigned_to_me",
+				assigneeUsername: username
+			});
+			if (filters?.includes("author")) passes.push({
+				scope: "all",
+				authorUsername: username
+			});
+		}
+		for (const pass of passes) {
+			const result = await collectProviderPagedResult(async (cursor) => {
+				if (cancellation?.aborted) throw new CancellationError();
+				const page = await api.getIssuesForCurrentUser(toTokenWithInfo(this.id, session), {
+					...pass,
+					isPAT: this.isEnterprise,
+					baseUrl,
+					cursor,
+					sort: options?.sort
+				});
+				if (cancellation?.aborted) throw new CancellationError();
+				return page;
+			}, maxPages, { providerId: this.id });
+			for (const issue of result.values) {
+				const shape = toIssueShape(issue, this);
+				if (shape != null && !issuesByUrl.has(shape.url)) issuesByUrl.set(shape.url, shape);
+			}
+			truncated ||= result.truncated === true;
+			collectionMetadata = mergeCollectionMetadata(collectionMetadata, result.metadata);
+		}
+		return {
+			values: [...issuesByUrl.values()],
+			truncated,
+			...collectionMetadata != null ? { metadata: collectionMetadata } : {}
+		};
+	}
+	async searchProviderPullRequests(session, searchQuery, repos, cancellation, options) {
+		const api = await this.authenticationService.apis.gitlab;
+		if (!api) return;
+		return api.searchPullRequests(this, toTokenWithInfo(this.id, session), {
+			search: searchQuery,
+			repos: repos?.map((r) => `${r.owner}/${r.name}`),
+			baseUrl: this.apiBaseUrlFor(session),
+			include: options?.include
+		}, cancellation);
+	}
+	async mergeProviderPullRequest(session, pr, options) {
+		if (!this.isPullRequest(pr)) return false;
+		const api = await this.getProvidersApi();
+		try {
+			return await api.mergePullRequest(toTokenWithInfo(this.id, session), pr, {
+				...options,
+				isPAT: this.isEnterprise,
+				baseUrl: this.enterpriseBaseUrlFor(session)
+			});
+		} catch (ex) {
+			this.showMergeErrorMessage(ex);
+			return false;
+		}
+	}
+	async showMergeErrorMessage(ex) {
+		if (await this.ctx.hooks?.onReauthenticationRequired?.(l10n.t("{0}. Would you like to try reauthenticating to provide additional access? Your token needs to have the 'api' scope to perform merge.", ex.message))) await this.reauthenticate();
+	}
+	isPullRequest(pr) {
+		return pr.refs != null;
+	}
+	async getProviderCurrentAccount(session) {
+		const currentUser = await (await this.getProvidersApi()).getCurrentUser(toTokenWithInfo(this.id, session), {
+			isPAT: this.isEnterprise,
+			baseUrl: this.enterpriseBaseUrlFor(session)
+		});
+		if (currentUser == null) return void 0;
+		return {
+			provider: {
+				id: this.id,
+				name: this.name,
+				domain: this.domain,
+				icon: this.icon
+			},
+			id: currentUser.id,
+			name: currentUser.name || void 0,
+			email: currentUser.email || void 0,
+			avatarUrl: currentUser.avatarUrl || void 0,
+			username: currentUser.username || void 0
+		};
+	}
+	getProviderPullRequestIdentityFromMaybeUrl(search) {
+		return getGitLabPullRequestIdentityFromMaybeUrl(search, this.id);
+	}
+};
+var GitLabIntegration = class extends GitLabIntegrationBase {
+	authProvider = authProvider;
+	id = "gitlab";
+	key = this.id;
+	name = "GitLab";
+	get domain() {
+		return metadata.domain;
+	}
+	apiBaseUrlFor(_session) {
+		return "https://gitlab.com/api";
+	}
+	access() {
+		return Promise.resolve(true);
+	}
+};
+var GitLabSelfHostedIntegration = class extends GitLabIntegrationBase {
+	_domain;
+	authProvider = cloudEnterpriseAuthProvider;
+	id = "cloud-gitlab-self-hosted";
+	key;
+	name = "GitLab Self-Hosted";
+	get domain() {
+		return this._domain;
+	}
+	apiBaseUrlFor(session) {
+		return `${this.getSelfManagedApiBaseUrl(session)}/api`;
+	}
+	constructor(ctx, authenticationService, getProvidersApi, didChangeConnection, _domain) {
+		super(ctx, authenticationService, getProvidersApi, didChangeConnection);
+		this._domain = _domain;
+		this.key = `${this.id}:${this.domain}`;
+	}
+};
+//#endregion
+export { GitLabIntegration, GitLabSelfHostedIntegration, gitLabAssociationForFilter };
+
 //# sourceMappingURL=gitlab.js.map