@gitkraken/core-gitlens 0.7.0 → 0.7.1

package/dist/plus/integrations/lite.js

@@ -78,15 +78,16 @@ function stripScheme(domain) {
 * GitHub's base URL, which `@gitkraken/provider-apis` derives BOTH the REST and the GraphQL endpoint from by
 * appending GitHub Enterprise's paths (`/api/v3`, `/api/graphql`). Cloud must therefore pass nothing rather than
 * `https://api.github.com`, which would build `https://api.github.com/api/graphql` and get a 404; omitting it is
-* what selects the cloud endpoints. Mirrors the cloud `GitHubIntegration.apiBaseUrl` getter.
+* what selects the cloud endpoints. Mirrors the cloud `GitHubIntegration.apiBaseUrlFor`.
 */
 function resolveGitHubApiBaseUrl(id, host) {
 	return id === "github" ? void 0 : `https://${host}/api/v3`;
 }
 /**
-* Mirrors the per-provider `apiBaseUrl` getters on the `GitHostIntegration` subclasses, for every family whose
-* base URL is always concrete (GitHub's is not — see {@link resolveGitHubApiBaseUrl}). `rawDomain` may carry a
-* scheme (only Azure DevOps Server honors it); `host` is the bare host used everywhere else.
+* Mirrors the per-provider `apiBaseUrlFor` methods on the `GitHostIntegration` subclasses for an installation at
+* the host root. Covers every family whose base URL is always concrete (GitHub's is not — see
+* {@link resolveGitHubApiBaseUrl}). `rawDomain` may carry a scheme (only Azure DevOps Server honors it); `host` is
+* the bare host used everywhere else.
 */
 function resolveApiBaseUrl(id, rawDomain, host) {
 	switch (id) {

package/dist/plus/integrations/lite.js.map

@@ -1 +1 @@
-{"version":3,"file":"lite.js","names":[],"sources":["../../../../plus/integrations/src/lite.ts"],"sourcesContent":["// A lightweight, token-scoped entry point for stateless single-shot provider reads.\n//\n// Unlike `createIntegrationManager`, this does NOT build an `IntegrationServiceContext`\n// (no storage/account/config/cache/repositories/hooks) and runs no session/OAuth lifecycle.\n// A consumer that already holds a provider access token (obtained by its own means, e.g.\n// the GitKraken account backend's `v1/provider-tokens/{provider}` endpoint) can call the\n// per-provider API client directly and get back the same DTOs the session-managed\n// `GitHostIntegration` returns.\n//\n// Provider notes:\n// - Azure DevOps encodes the repository as the composite string `\"{project}/_git/{repoName}\"`\n//   in the `repo` argument (matching the descriptor `GitHostIntegration` uses); `owner` is the\n//   organization. Pass `repo` in that shape for Azure.\n// - Bitbucket Cloud `getDefaultBranch`/`getRepositoryMetadata` depend on `mainbranch`/`parent`\n//   fields the API may omit for some repos; they resolve to `undefined` when absent.\n// - Bitbucket Server (`bitbucket-server`) is not supported here — its reads use a different\n//   REST surface that this token-scoped path doesn't wire up.\n\nimport type { GitHubApiConfig } from '@gitlens/git-github/api/config.js';\nimport { GitHubApi } from '@gitlens/git-github/api/github.js';\nimport type { DefaultBranch } from '@gitlens/git/models/defaultBranch.js';\nimport type { Provider } from '@gitlens/git/models/remoteProvider.js';\nimport type { RepositoryMetadata } from '@gitlens/git/models/repositoryMetadata.js';\nimport type { TokenWithInfo } from './authentication/models.js';\nimport { toTokenInfo } from './authentication/models.js';\nimport { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId } from './constants.js';\nimport type { ProviderApiConfig } from './providers/apiConfig.js';\nimport { AzureDevOpsApi } from './providers/azure/azure.js';\nimport { BitbucketApi } from './providers/bitbucket/bitbucket.js';\nimport { GitLabApi } from './providers/gitlab/gitlab.js';\nimport { providersMetadata } from './providers/models.js';\n\n/** The git-hosting integrations that expose a token-scoped read path here. */\nexport type TokenScopedGitHostId =\n\t| GitCloudHostIntegrationId.GitHub\n\t| GitCloudHostIntegrationId.GitLab\n\t| GitCloudHostIntegrationId.Bitbucket\n\t| GitCloudHostIntegrationId.AzureDevOps\n\t| GitSelfManagedHostIntegrationId.CloudGitHubEnterprise\n\t| GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted\n\t| GitSelfManagedHostIntegrationId.AzureDevOpsServer;\n\nexport interface TokenScopedGitHostToken {\n\t/** The provider access token the consumer already holds. */\n\treadonly accessToken: string;\n\t/**\n\t * Host domain for self-managed instances (e.g. `git.example.com`). Ignored for cloud ids. For an Azure\n\t * DevOps Server reachable over plain HTTP, include the scheme (e.g. `http://tfs.example.com`); otherwise\n\t * `https` is assumed.\n\t */\n\treadonly domain?: string;\n\t/** Optional scopes carried by the token, surfaced only in logging metadata. */\n\treadonly scopes?: readonly string[];\n\t/** Whether the token came from a GK-cloud connection (vs a raw PAT). Defaults to `true`. */\n\treadonly cloud?: boolean;\n}\n\nexport interface TokenScopedHttpConfig {\n\t/** The `fetch` implementation to use for HTTP requests. */\n\tfetch(input: string | URL, init?: RequestInit): Promise<Response>;\n\t/**\n\t * Wrap an async op so TLS validation is disabled when `ignoreSSLErrors` is `'force'`. Optional —\n\t * defaults to a pass-through, which is correct for the browser and for any consumer not toggling SSL.\n\t */\n\twrapForForcedInsecureSSL?<T>(ignoreSSLErrors: boolean | 'force', fn: () => Promise<T> | PromiseLike<T>): Promise<T>;\n\t/** Whether to ignore SSL certificate errors on requests. Defaults to `false`. */\n\tignoreSSLErrors?: boolean | 'force';\n\t/**\n\t * Whether the consumer runs in a web worker / browser (vs Node.js). GitHub uses this to drop the\n\t * `user-agent` header, which browsers reject and warn about. Defaults to `false`.\n\t */\n\tisWeb?: boolean;\n}\n\n/** The stateless reads a token-scoped integration exposes. */\nexport interface TokenScopedGitHostIntegration {\n\tgetRepositoryMetadata(\n\t\towner: string,\n\t\trepo: string,\n\t\tcancellation?: AbortSignal,\n\t): Promise<RepositoryMetadata | undefined>;\n\tgetDefaultBranch(owner: string, repo: string, cancellation?: AbortSignal): Promise<DefaultBranch | undefined>;\n}\n\n/**\n * Build a token-scoped git-host integration for a single provider, backed only by a `fetch` + a token —\n * no `IntegrationServiceContext`, no session/OAuth lifecycle. The returned DTOs match those from the\n * session-managed {@link GitHostIntegration}.\n */\nexport function createTokenScopedGitHostIntegration(\n\tid: TokenScopedGitHostId,\n\ttoken: TokenScopedGitHostToken,\n\thttp: TokenScopedHttpConfig,\n): TokenScopedGitHostIntegration {\n\t// `token.domain` only applies to self-managed ids; cloud ids always use their canonical domain.\n\tconst selfManaged =\n\t\tid === GitSelfManagedHostIntegrationId.CloudGitHubEnterprise ||\n\t\tid === GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted ||\n\t\tid === GitSelfManagedHostIntegrationId.AzureDevOpsServer;\n\t// Self-managed ids carry no canonical domain (`providersMetadata[id].domain` is empty), so a missing\n\t// `token.domain` would silently build a malformed base URL (e.g. `https:///api/v3`). Fail fast instead.\n\tif (selfManaged && !token.domain) {\n\t\tthrow new Error(`A token-scoped integration for the self-managed host '${id}' requires 'token.domain'.`);\n\t}\n\n\tconst rawDomain = (selfManaged && token.domain) || providersMetadata[id].domain;\n\t// The provider/DTO domain drops the scheme (a subpath/collection is preserved for Azure Server and subpath\n\t// installs); only Azure DevOps Server's base URL honors an explicit scheme (per its doc). Stripping keeps a\n\t// scheme out of the DTO and prevents a malformed base URL (e.g. `https://http://host/api/v3`) if one is\n\t// accidentally passed for GHE/GitLab.\n\tconst host = stripScheme(rawDomain);\n\tconst provider = createProviderStub(id, host, http.ignoreSSLErrors ?? false);\n\tconst tokenInfo = buildTokenWithInfo(id, token);\n\n\tconst wrapForForcedInsecureSSL: NonNullable<TokenScopedHttpConfig['wrapForForcedInsecureSSL']> =\n\t\t// `Promise.resolve().then(fn)` (not `Promise.resolve(fn())`) so a synchronous throw in `fn` surfaces as\n\t\t// a rejected promise, honoring the `Promise<T>` contract.\n\t\thttp.wrapForForcedInsecureSSL ?? ((_ignore, fn) => Promise.resolve().then(fn));\n\n\t// GitHub has its own VS Code-free config type and a `getDefaultBranch` without a cancellation param.\n\tif (id === GitCloudHostIntegrationId.GitHub || id === GitSelfManagedHostIntegrationId.CloudGitHubEnterprise) {\n\t\tconst config: GitHubApiConfig = {\n\t\t\tisWeb: http.isWeb ?? false,\n\t\t\tfetch: (url, init) => http.fetch(url, init),\n\t\t\twrapForForcedInsecureSSL: wrapForForcedInsecureSSL,\n\t\t};\n\t\tconst api = new GitHubApi(config);\n\t\t// GitHub is the one family whose base URL can legitimately be absent — see `resolveGitHubApiBaseUrl`.\n\t\tconst baseUrl = resolveGitHubApiBaseUrl(id, host);\n\t\treturn {\n\t\t\tgetRepositoryMetadata: (owner, repo, cancellation) =>\n\t\t\t\tapi.getRepositoryMetadata(provider, tokenInfo, owner, repo, { baseUrl: baseUrl }, cancellation),\n\t\t\t// `GitHubApi.getDefaultBranch` has no cancellation param; accept and intentionally ignore it here so\n\t\t\t// the signature matches the other providers and the drop is explicit at the call site.\n\t\t\tgetDefaultBranch: (owner, repo, _cancellation) =>\n\t\t\t\tapi.getDefaultBranch(provider, tokenInfo, owner, repo, { baseUrl: baseUrl }),\n\t\t};\n\t}\n\n\t// GitLab, Bitbucket, and Azure DevOps share the `ProviderApiConfig` client shape and identical read signatures.\n\tconst baseUrl = resolveApiBaseUrl(id, rawDomain, host);\n\tconst config = toProviderApiConfig(http, wrapForForcedInsecureSSL);\n\tconst api =\n\t\tid === GitCloudHostIntegrationId.GitLab || id === GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted\n\t\t\t? new GitLabApi(config)\n\t\t\t: id === GitCloudHostIntegrationId.Bitbucket\n\t\t\t\t? new BitbucketApi(config)\n\t\t\t\t: new AzureDevOpsApi(config);\n\treturn {\n\t\tgetRepositoryMetadata: (owner, repo, cancellation) =>\n\t\t\tapi.getRepositoryMetadata(provider, tokenInfo, owner, repo, { baseUrl: baseUrl }, cancellation),\n\t\tgetDefaultBranch: (owner, repo, cancellation) =>\n\t\t\tapi.getDefaultBranch(provider, tokenInfo, owner, repo, { baseUrl: baseUrl }, cancellation),\n\t};\n}\n\nfunction toProviderApiConfig(\n\thttp: TokenScopedHttpConfig,\n\twrapForForcedInsecureSSL: NonNullable<TokenScopedHttpConfig['wrapForForcedInsecureSSL']>,\n): ProviderApiConfig {\n\treturn {\n\t\tfetch: (input, init) => http.fetch(input, init),\n\t\twrapForForcedInsecureSSL: wrapForForcedInsecureSSL,\n\t};\n}\n\nfunction buildTokenWithInfo(id: TokenScopedGitHostId, token: TokenScopedGitHostToken): TokenWithInfo {\n\tconst cloud = token.cloud ?? true;\n\treturn {\n\t\t...toTokenInfo(id, token.accessToken, { cloud: cloud, type: undefined, scopes: token.scopes }),\n\t\taccessToken: token.accessToken,\n\t};\n}\n\n/** A minimal {@link Provider} for the API clients: identity + no-op reauth/telemetry, SSL from config. */\nfunction createProviderStub(id: TokenScopedGitHostId, domain: string, ignoreSSLErrors: boolean | 'force'): Provider {\n\tconst metadata = providersMetadata[id];\n\treturn {\n\t\tid: id,\n\t\tname: metadata.name,\n\t\tdomain: domain,\n\t\ticon: metadata.iconKey,\n\t\tgetIgnoreSSLErrors: () => ignoreSSLErrors,\n\t\treauthenticate: () => Promise.resolve(),\n\t\ttrackRequestException: () => {},\n\t};\n}\n\n/** Strips a leading `scheme://` and any trailing slashes; a subpath/collection (e.g. `host/tfs/Col`) is preserved. */\nfunction stripScheme(domain: string): string {\n\treturn domain.replace(/^[a-z][\\w+.-]*:\\/\\//i, '').replace(/\\/+$/, '');\n}\n\n/**\n * GitHub's base URL, which `@gitkraken/provider-apis` derives BOTH the REST and the GraphQL endpoint from by\n * appending GitHub Enterprise's paths (`/api/v3`, `/api/graphql`). Cloud must therefore pass nothing rather than\n * `https://api.github.com`, which would build `https://api.github.com/api/graphql` and get a 404; omitting it is\n * what selects the cloud endpoints. Mirrors the cloud `GitHubIntegration.apiBaseUrl` getter.\n */\nfunction resolveGitHubApiBaseUrl(\n\tid: GitCloudHostIntegrationId.GitHub | GitSelfManagedHostIntegrationId.CloudGitHubEnterprise,\n\thost: string,\n): string | undefined {\n\treturn id === GitCloudHostIntegrationId.GitHub ? undefined : `https://${host}/api/v3`;\n}\n\n/**\n * Mirrors the per-provider `apiBaseUrl` getters on the `GitHostIntegration` subclasses, for every family whose\n * base URL is always concrete (GitHub's is not — see {@link resolveGitHubApiBaseUrl}). `rawDomain` may carry a\n * scheme (only Azure DevOps Server honors it); `host` is the bare host used everywhere else.\n */\nfunction resolveApiBaseUrl(\n\tid: Exclude<\n\t\tTokenScopedGitHostId,\n\t\tGitCloudHostIntegrationId.GitHub | GitSelfManagedHostIntegrationId.CloudGitHubEnterprise\n\t>,\n\trawDomain: string,\n\thost: string,\n): string {\n\tswitch (id) {\n\t\tcase GitCloudHostIntegrationId.GitLab:\n\t\t\treturn 'https://gitlab.com/api';\n\t\tcase GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted:\n\t\t\treturn `https://${host}/api`;\n\t\tcase GitCloudHostIntegrationId.Bitbucket:\n\t\t\treturn 'https://api.bitbucket.org/2.0';\n\t\tcase GitCloudHostIntegrationId.AzureDevOps:\n\t\t\treturn 'https://dev.azure.com';\n\t\tcase GitSelfManagedHostIntegrationId.AzureDevOpsServer:\n\t\t\t// Mirror the session-managed getter, which honors the connection protocol; default to https.\n\t\t\treturn rawDomain.includes('://') ? rawDomain.replace(/\\/+$/, '') : `https://${host}`;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;AAyFA,SAAgB,oCACf,IACA,OACA,MACgC;CAEhC,MAAM,cACL,OAAA,6BACA,OAAA,8BACA,OAAA;CAGD,IAAI,eAAe,CAAC,MAAM,QACzB,MAAM,IAAI,MAAM,yDAAyD,GAAG,2BAA2B;CAGxG,MAAM,YAAa,eAAe,MAAM,UAAW,kBAAkB,GAAG,CAAC;CAKzE,MAAM,OAAO,YAAY,SAAS;CAClC,MAAM,WAAW,mBAAmB,IAAI,MAAM,KAAK,mBAAmB,KAAK;CAC3E,MAAM,YAAY,mBAAmB,IAAI,KAAK;CAE9C,MAAM,2BAGL,KAAK,8BAA8B,SAAS,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,EAAE;CAG7E,IAAI,OAAA,YAA2C,OAAA,2BAA8D;EAC5G,MAAM,SAA0B;GAC/B,OAAO,KAAK,SAAS;GACrB,QAAQ,KAAK,SAAS,KAAK,MAAM,KAAK,IAAI;GAChB;EAC3B;EACA,MAAM,MAAM,IAAI,UAAU,MAAM;EAEhC,MAAM,UAAU,wBAAwB,IAAI,IAAI;EAChD,OAAO;GACN,wBAAwB,OAAO,MAAM,iBACpC,IAAI,sBAAsB,UAAU,WAAW,OAAO,MAAM,EAAW,QAAQ,GAAG,YAAY;GAG/F,mBAAmB,OAAO,MAAM,kBAC/B,IAAI,iBAAiB,UAAU,WAAW,OAAO,MAAM,EAAW,QAAQ,CAAC;EAC7E;CACD;CAGA,MAAM,UAAU,kBAAkB,IAAI,WAAW,IAAI;CACrD,MAAM,SAAS,oBAAoB,MAAM,wBAAwB;CACjE,MAAM,MACL,OAAA,YAA2C,OAAA,6BACxC,IAAI,UAAU,MAAM,IACpB,OAAA,cACC,IAAI,aAAa,MAAM,IACvB,IAAI,eAAe,MAAM;CAC9B,OAAO;EACN,wBAAwB,OAAO,MAAM,iBACpC,IAAI,sBAAsB,UAAU,WAAW,OAAO,MAAM,EAAW,QAAQ,GAAG,YAAY;EAC/F,mBAAmB,OAAO,MAAM,iBAC/B,IAAI,iBAAiB,UAAU,WAAW,OAAO,MAAM,EAAW,QAAQ,GAAG,YAAY;CAC3F;AACD;AAEA,SAAS,oBACR,MACA,0BACoB;CACpB,OAAO;EACN,QAAQ,OAAO,SAAS,KAAK,MAAM,OAAO,IAAI;EACpB;CAC3B;AACD;AAEA,SAAS,mBAAmB,IAA0B,OAA+C;CACpG,MAAM,QAAQ,MAAM,SAAS;CAC7B,OAAO;EACN,GAAG,YAAY,IAAI,MAAM,aAAa;GAAS;GAAO,MAAM,KAAA;GAAW,QAAQ,MAAM;EAAO,CAAC;EAC7F,aAAa,MAAM;CACpB;AACD;;AAGA,SAAS,mBAAmB,IAA0B,QAAgB,iBAA8C;CACnH,MAAM,WAAW,kBAAkB;CACnC,OAAO;EACF;EACJ,MAAM,SAAS;EACP;EACR,MAAM,SAAS;EACf,0BAA0B;EAC1B,sBAAsB,QAAQ,QAAQ;EACtC,6BAA6B,CAAC;CAC/B;AACD;;AAGA,SAAS,YAAY,QAAwB;CAC5C,OAAO,OAAO,QAAQ,wBAAwB,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;AACrE;;;;;;;AAQA,SAAS,wBACR,IACA,MACqB;CACrB,OAAO,OAAA,WAA0C,KAAA,IAAY,WAAW,KAAK;AAC9E;;;;;;AAOA,SAAS,kBACR,IAIA,WACA,MACS;CACT,QAAQ,IAAR;EACC,KAAA,UACC,OAAO;EACR,KAAA,4BACC,OAAO,WAAW,KAAK;EACxB,KAAA,aACC,OAAO;EACR,KAAA,eACC,OAAO;EACR,KAAA,uBAEC,OAAO,UAAU,SAAS,KAAK,IAAI,UAAU,QAAQ,QAAQ,EAAE,IAAI,WAAW;CAChF;AACD"}
+{"version":3,"file":"lite.js","names":[],"sources":["../../../../plus/integrations/src/lite.ts"],"sourcesContent":["// A lightweight, token-scoped entry point for stateless single-shot provider reads.\n//\n// Unlike `createIntegrationManager`, this does NOT build an `IntegrationServiceContext`\n// (no storage/account/config/cache/repositories/hooks) and runs no session/OAuth lifecycle.\n// A consumer that already holds a provider access token (obtained by its own means, e.g.\n// the GitKraken account backend's `v1/provider-tokens/{provider}` endpoint) can call the\n// per-provider API client directly and get back the same DTOs the session-managed\n// `GitHostIntegration` returns.\n//\n// Provider notes:\n// - Azure DevOps encodes the repository as the composite string `\"{project}/_git/{repoName}\"`\n//   in the `repo` argument (matching the descriptor `GitHostIntegration` uses); `owner` is the\n//   organization. Pass `repo` in that shape for Azure.\n// - Bitbucket Cloud `getDefaultBranch`/`getRepositoryMetadata` depend on `mainbranch`/`parent`\n//   fields the API may omit for some repos; they resolve to `undefined` when absent.\n// - Bitbucket Server (`bitbucket-server`) is not supported here — its reads use a different\n//   REST surface that this token-scoped path doesn't wire up.\n\nimport type { GitHubApiConfig } from '@gitlens/git-github/api/config.js';\nimport { GitHubApi } from '@gitlens/git-github/api/github.js';\nimport type { DefaultBranch } from '@gitlens/git/models/defaultBranch.js';\nimport type { Provider } from '@gitlens/git/models/remoteProvider.js';\nimport type { RepositoryMetadata } from '@gitlens/git/models/repositoryMetadata.js';\nimport type { TokenWithInfo } from './authentication/models.js';\nimport { toTokenInfo } from './authentication/models.js';\nimport { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId } from './constants.js';\nimport type { ProviderApiConfig } from './providers/apiConfig.js';\nimport { AzureDevOpsApi } from './providers/azure/azure.js';\nimport { BitbucketApi } from './providers/bitbucket/bitbucket.js';\nimport { GitLabApi } from './providers/gitlab/gitlab.js';\nimport { providersMetadata } from './providers/models.js';\n\n/** The git-hosting integrations that expose a token-scoped read path here. */\nexport type TokenScopedGitHostId =\n\t| GitCloudHostIntegrationId.GitHub\n\t| GitCloudHostIntegrationId.GitLab\n\t| GitCloudHostIntegrationId.Bitbucket\n\t| GitCloudHostIntegrationId.AzureDevOps\n\t| GitSelfManagedHostIntegrationId.CloudGitHubEnterprise\n\t| GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted\n\t| GitSelfManagedHostIntegrationId.AzureDevOpsServer;\n\nexport interface TokenScopedGitHostToken {\n\t/** The provider access token the consumer already holds. */\n\treadonly accessToken: string;\n\t/**\n\t * Host domain for self-managed instances (e.g. `git.example.com`). Ignored for cloud ids. For an Azure\n\t * DevOps Server reachable over plain HTTP, include the scheme (e.g. `http://tfs.example.com`); otherwise\n\t * `https` is assumed.\n\t */\n\treadonly domain?: string;\n\t/** Optional scopes carried by the token, surfaced only in logging metadata. */\n\treadonly scopes?: readonly string[];\n\t/** Whether the token came from a GK-cloud connection (vs a raw PAT). Defaults to `true`. */\n\treadonly cloud?: boolean;\n}\n\nexport interface TokenScopedHttpConfig {\n\t/** The `fetch` implementation to use for HTTP requests. */\n\tfetch(input: string | URL, init?: RequestInit): Promise<Response>;\n\t/**\n\t * Wrap an async op so TLS validation is disabled when `ignoreSSLErrors` is `'force'`. Optional —\n\t * defaults to a pass-through, which is correct for the browser and for any consumer not toggling SSL.\n\t */\n\twrapForForcedInsecureSSL?<T>(ignoreSSLErrors: boolean | 'force', fn: () => Promise<T> | PromiseLike<T>): Promise<T>;\n\t/** Whether to ignore SSL certificate errors on requests. Defaults to `false`. */\n\tignoreSSLErrors?: boolean | 'force';\n\t/**\n\t * Whether the consumer runs in a web worker / browser (vs Node.js). GitHub uses this to drop the\n\t * `user-agent` header, which browsers reject and warn about. Defaults to `false`.\n\t */\n\tisWeb?: boolean;\n}\n\n/** The stateless reads a token-scoped integration exposes. */\nexport interface TokenScopedGitHostIntegration {\n\tgetRepositoryMetadata(\n\t\towner: string,\n\t\trepo: string,\n\t\tcancellation?: AbortSignal,\n\t): Promise<RepositoryMetadata | undefined>;\n\tgetDefaultBranch(owner: string, repo: string, cancellation?: AbortSignal): Promise<DefaultBranch | undefined>;\n}\n\n/**\n * Build a token-scoped git-host integration for a single provider, backed only by a `fetch` + a token —\n * no `IntegrationServiceContext`, no session/OAuth lifecycle. The returned DTOs match those from the\n * session-managed {@link GitHostIntegration}.\n */\nexport function createTokenScopedGitHostIntegration(\n\tid: TokenScopedGitHostId,\n\ttoken: TokenScopedGitHostToken,\n\thttp: TokenScopedHttpConfig,\n): TokenScopedGitHostIntegration {\n\t// `token.domain` only applies to self-managed ids; cloud ids always use their canonical domain.\n\tconst selfManaged =\n\t\tid === GitSelfManagedHostIntegrationId.CloudGitHubEnterprise ||\n\t\tid === GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted ||\n\t\tid === GitSelfManagedHostIntegrationId.AzureDevOpsServer;\n\t// Self-managed ids carry no canonical domain (`providersMetadata[id].domain` is empty), so a missing\n\t// `token.domain` would silently build a malformed base URL (e.g. `https:///api/v3`). Fail fast instead.\n\tif (selfManaged && !token.domain) {\n\t\tthrow new Error(`A token-scoped integration for the self-managed host '${id}' requires 'token.domain'.`);\n\t}\n\n\tconst rawDomain = (selfManaged && token.domain) || providersMetadata[id].domain;\n\t// The provider/DTO domain drops the scheme (a subpath/collection is preserved for Azure Server and subpath\n\t// installs); only Azure DevOps Server's base URL honors an explicit scheme (per its doc). Stripping keeps a\n\t// scheme out of the DTO and prevents a malformed base URL (e.g. `https://http://host/api/v3`) if one is\n\t// accidentally passed for GHE/GitLab.\n\tconst host = stripScheme(rawDomain);\n\tconst provider = createProviderStub(id, host, http.ignoreSSLErrors ?? false);\n\tconst tokenInfo = buildTokenWithInfo(id, token);\n\n\tconst wrapForForcedInsecureSSL: NonNullable<TokenScopedHttpConfig['wrapForForcedInsecureSSL']> =\n\t\t// `Promise.resolve().then(fn)` (not `Promise.resolve(fn())`) so a synchronous throw in `fn` surfaces as\n\t\t// a rejected promise, honoring the `Promise<T>` contract.\n\t\thttp.wrapForForcedInsecureSSL ?? ((_ignore, fn) => Promise.resolve().then(fn));\n\n\t// GitHub has its own VS Code-free config type and a `getDefaultBranch` without a cancellation param.\n\tif (id === GitCloudHostIntegrationId.GitHub || id === GitSelfManagedHostIntegrationId.CloudGitHubEnterprise) {\n\t\tconst config: GitHubApiConfig = {\n\t\t\tisWeb: http.isWeb ?? false,\n\t\t\tfetch: (url, init) => http.fetch(url, init),\n\t\t\twrapForForcedInsecureSSL: wrapForForcedInsecureSSL,\n\t\t};\n\t\tconst api = new GitHubApi(config);\n\t\t// GitHub is the one family whose base URL can legitimately be absent — see `resolveGitHubApiBaseUrl`.\n\t\tconst baseUrl = resolveGitHubApiBaseUrl(id, host);\n\t\treturn {\n\t\t\tgetRepositoryMetadata: (owner, repo, cancellation) =>\n\t\t\t\tapi.getRepositoryMetadata(provider, tokenInfo, owner, repo, { baseUrl: baseUrl }, cancellation),\n\t\t\t// `GitHubApi.getDefaultBranch` has no cancellation param; accept and intentionally ignore it here so\n\t\t\t// the signature matches the other providers and the drop is explicit at the call site.\n\t\t\tgetDefaultBranch: (owner, repo, _cancellation) =>\n\t\t\t\tapi.getDefaultBranch(provider, tokenInfo, owner, repo, { baseUrl: baseUrl }),\n\t\t};\n\t}\n\n\t// GitLab, Bitbucket, and Azure DevOps share the `ProviderApiConfig` client shape and identical read signatures.\n\tconst baseUrl = resolveApiBaseUrl(id, rawDomain, host);\n\tconst config = toProviderApiConfig(http, wrapForForcedInsecureSSL);\n\tconst api =\n\t\tid === GitCloudHostIntegrationId.GitLab || id === GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted\n\t\t\t? new GitLabApi(config)\n\t\t\t: id === GitCloudHostIntegrationId.Bitbucket\n\t\t\t\t? new BitbucketApi(config)\n\t\t\t\t: new AzureDevOpsApi(config);\n\treturn {\n\t\tgetRepositoryMetadata: (owner, repo, cancellation) =>\n\t\t\tapi.getRepositoryMetadata(provider, tokenInfo, owner, repo, { baseUrl: baseUrl }, cancellation),\n\t\tgetDefaultBranch: (owner, repo, cancellation) =>\n\t\t\tapi.getDefaultBranch(provider, tokenInfo, owner, repo, { baseUrl: baseUrl }, cancellation),\n\t};\n}\n\nfunction toProviderApiConfig(\n\thttp: TokenScopedHttpConfig,\n\twrapForForcedInsecureSSL: NonNullable<TokenScopedHttpConfig['wrapForForcedInsecureSSL']>,\n): ProviderApiConfig {\n\treturn {\n\t\tfetch: (input, init) => http.fetch(input, init),\n\t\twrapForForcedInsecureSSL: wrapForForcedInsecureSSL,\n\t};\n}\n\nfunction buildTokenWithInfo(id: TokenScopedGitHostId, token: TokenScopedGitHostToken): TokenWithInfo {\n\tconst cloud = token.cloud ?? true;\n\treturn {\n\t\t...toTokenInfo(id, token.accessToken, { cloud: cloud, type: undefined, scopes: token.scopes }),\n\t\taccessToken: token.accessToken,\n\t};\n}\n\n/** A minimal {@link Provider} for the API clients: identity + no-op reauth/telemetry, SSL from config. */\nfunction createProviderStub(id: TokenScopedGitHostId, domain: string, ignoreSSLErrors: boolean | 'force'): Provider {\n\tconst metadata = providersMetadata[id];\n\treturn {\n\t\tid: id,\n\t\tname: metadata.name,\n\t\tdomain: domain,\n\t\ticon: metadata.iconKey,\n\t\tgetIgnoreSSLErrors: () => ignoreSSLErrors,\n\t\treauthenticate: () => Promise.resolve(),\n\t\ttrackRequestException: () => {},\n\t};\n}\n\n/** Strips a leading `scheme://` and any trailing slashes; a subpath/collection (e.g. `host/tfs/Col`) is preserved. */\nfunction stripScheme(domain: string): string {\n\treturn domain.replace(/^[a-z][\\w+.-]*:\\/\\//i, '').replace(/\\/+$/, '');\n}\n\n/**\n * GitHub's base URL, which `@gitkraken/provider-apis` derives BOTH the REST and the GraphQL endpoint from by\n * appending GitHub Enterprise's paths (`/api/v3`, `/api/graphql`). Cloud must therefore pass nothing rather than\n * `https://api.github.com`, which would build `https://api.github.com/api/graphql` and get a 404; omitting it is\n * what selects the cloud endpoints. Mirrors the cloud `GitHubIntegration.apiBaseUrlFor`.\n */\nfunction resolveGitHubApiBaseUrl(\n\tid: GitCloudHostIntegrationId.GitHub | GitSelfManagedHostIntegrationId.CloudGitHubEnterprise,\n\thost: string,\n): string | undefined {\n\treturn id === GitCloudHostIntegrationId.GitHub ? undefined : `https://${host}/api/v3`;\n}\n\n/**\n * Mirrors the per-provider `apiBaseUrlFor` methods on the `GitHostIntegration` subclasses for an installation at\n * the host root. Covers every family whose base URL is always concrete (GitHub's is not — see\n * {@link resolveGitHubApiBaseUrl}). `rawDomain` may carry a scheme (only Azure DevOps Server honors it); `host` is\n * the bare host used everywhere else.\n */\nfunction resolveApiBaseUrl(\n\tid: Exclude<\n\t\tTokenScopedGitHostId,\n\t\tGitCloudHostIntegrationId.GitHub | GitSelfManagedHostIntegrationId.CloudGitHubEnterprise\n\t>,\n\trawDomain: string,\n\thost: string,\n): string {\n\tswitch (id) {\n\t\tcase GitCloudHostIntegrationId.GitLab:\n\t\t\treturn 'https://gitlab.com/api';\n\t\tcase GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted:\n\t\t\treturn `https://${host}/api`;\n\t\tcase GitCloudHostIntegrationId.Bitbucket:\n\t\t\treturn 'https://api.bitbucket.org/2.0';\n\t\tcase GitCloudHostIntegrationId.AzureDevOps:\n\t\t\treturn 'https://dev.azure.com';\n\t\tcase GitSelfManagedHostIntegrationId.AzureDevOpsServer:\n\t\t\t// Mirror the session-managed getter, which honors the connection protocol; default to https.\n\t\t\treturn rawDomain.includes('://') ? rawDomain.replace(/\\/+$/, '') : `https://${host}`;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;AAyFA,SAAgB,oCACf,IACA,OACA,MACgC;CAEhC,MAAM,cACL,OAAA,6BACA,OAAA,8BACA,OAAA;CAGD,IAAI,eAAe,CAAC,MAAM,QACzB,MAAM,IAAI,MAAM,yDAAyD,GAAG,2BAA2B;CAGxG,MAAM,YAAa,eAAe,MAAM,UAAW,kBAAkB,GAAG,CAAC;CAKzE,MAAM,OAAO,YAAY,SAAS;CAClC,MAAM,WAAW,mBAAmB,IAAI,MAAM,KAAK,mBAAmB,KAAK;CAC3E,MAAM,YAAY,mBAAmB,IAAI,KAAK;CAE9C,MAAM,2BAGL,KAAK,8BAA8B,SAAS,OAAO,QAAQ,QAAQ,CAAC,CAAC,KAAK,EAAE;CAG7E,IAAI,OAAA,YAA2C,OAAA,2BAA8D;EAC5G,MAAM,SAA0B;GAC/B,OAAO,KAAK,SAAS;GACrB,QAAQ,KAAK,SAAS,KAAK,MAAM,KAAK,IAAI;GAChB;EAC3B;EACA,MAAM,MAAM,IAAI,UAAU,MAAM;EAEhC,MAAM,UAAU,wBAAwB,IAAI,IAAI;EAChD,OAAO;GACN,wBAAwB,OAAO,MAAM,iBACpC,IAAI,sBAAsB,UAAU,WAAW,OAAO,MAAM,EAAW,QAAQ,GAAG,YAAY;GAG/F,mBAAmB,OAAO,MAAM,kBAC/B,IAAI,iBAAiB,UAAU,WAAW,OAAO,MAAM,EAAW,QAAQ,CAAC;EAC7E;CACD;CAGA,MAAM,UAAU,kBAAkB,IAAI,WAAW,IAAI;CACrD,MAAM,SAAS,oBAAoB,MAAM,wBAAwB;CACjE,MAAM,MACL,OAAA,YAA2C,OAAA,6BACxC,IAAI,UAAU,MAAM,IACpB,OAAA,cACC,IAAI,aAAa,MAAM,IACvB,IAAI,eAAe,MAAM;CAC9B,OAAO;EACN,wBAAwB,OAAO,MAAM,iBACpC,IAAI,sBAAsB,UAAU,WAAW,OAAO,MAAM,EAAW,QAAQ,GAAG,YAAY;EAC/F,mBAAmB,OAAO,MAAM,iBAC/B,IAAI,iBAAiB,UAAU,WAAW,OAAO,MAAM,EAAW,QAAQ,GAAG,YAAY;CAC3F;AACD;AAEA,SAAS,oBACR,MACA,0BACoB;CACpB,OAAO;EACN,QAAQ,OAAO,SAAS,KAAK,MAAM,OAAO,IAAI;EACpB;CAC3B;AACD;AAEA,SAAS,mBAAmB,IAA0B,OAA+C;CACpG,MAAM,QAAQ,MAAM,SAAS;CAC7B,OAAO;EACN,GAAG,YAAY,IAAI,MAAM,aAAa;GAAS;GAAO,MAAM,KAAA;GAAW,QAAQ,MAAM;EAAO,CAAC;EAC7F,aAAa,MAAM;CACpB;AACD;;AAGA,SAAS,mBAAmB,IAA0B,QAAgB,iBAA8C;CACnH,MAAM,WAAW,kBAAkB;CACnC,OAAO;EACF;EACJ,MAAM,SAAS;EACP;EACR,MAAM,SAAS;EACf,0BAA0B;EAC1B,sBAAsB,QAAQ,QAAQ;EACtC,6BAA6B,CAAC;CAC/B;AACD;;AAGA,SAAS,YAAY,QAAwB;CAC5C,OAAO,OAAO,QAAQ,wBAAwB,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE;AACrE;;;;;;;AAQA,SAAS,wBACR,IACA,MACqB;CACrB,OAAO,OAAA,WAA0C,KAAA,IAAY,WAAW,KAAK;AAC9E;;;;;;;AAQA,SAAS,kBACR,IAIA,WACA,MACS;CACT,QAAQ,IAAR;EACC,KAAA,UACC,OAAO;EACR,KAAA,4BACC,OAAO,WAAW,KAAK;EACxB,KAAA,aACC,OAAO;EACR,KAAA,eACC,OAAO;EACR,KAAA,uBAEC,OAAO,UAAU,SAAS,KAAK,IAAI,UAAU,QAAQ,QAAQ,EAAE,IAAI,WAAW;CAChF;AACD"}

package/dist/plus/integrations/manager.d.ts

@@ -343,7 +343,8 @@ export interface IntegrationManager {
    * scope.
    *
    * This is a separate read from {@link listPullRequestsPage}: free text reaches the provider instead of filtering
-   * whichever rows happened to be loaded, and every cursor-threaded page costs exactly one upstream request.
+   * whichever rows happened to be loaded, and on GitHub/GHE every cursor-threaded page costs exactly one upstream
+   * request (Bitbucket Data Center spends one per repository × relationship facet it is still reading).
    * `criteria.relationships` and `criteria.states` are OR sets, so `[closed, merged]` expresses the complete
    * terminal set and `[Author, Assignee, ReviewRequested]` matches the visible PR list without falling back to
    * GitHub's mismatched `involves:@me`. Omit relationships only with a repository/organization scope to search
@@ -353,14 +354,24 @@ export interface IntegrationManager {
    * criterion — a key not in `getSupportedFilters().pullRequestSearch.sorts` refuses the whole read rather than
    * falling back, because at a bounded result window another order reaches another subset. The page is a union of
    * the provider's relationship × state facets, so it is re-ordered as a whole rather than served as concatenated
-   * per-facet runs. Changing the sort invalidates a threaded cursor (it is part of the cursor's fingerprint,
-   * alongside the text and the scope); drop the cursor when you change the order.
+   * per-facet runs. The order holds within a page, not across pages: each facet advances by its own continuation, so
+   * a later page can hold a row that sorts before the last row of an earlier one — sort the accumulated rows when a
+   * surface shows several pages as one list. Changing the sort invalidates a threaded cursor (it is part of the
+   * cursor's fingerprint, alongside the text and the scope); drop the cursor when you change the order.
    *
    * If the provider's result ceiling is reached, the request still succeeds and carries a warning omission with
    * `totalCount`, `limit`, `sort`, and `recovery: 'none'`. `totalCount` is the largest provider-reported
    * pre-ceiling facet count, not the reachable or returned row count; this mirrors the per-search ceiling's own
    * unit.
    *
+   * **Azure DevOps Server** differs in how it gets there, because its pull request API can't filter by text, date or
+   * draft: the first page drains every facet (up to 1,000 rows each) and later pages are served from that drain,
+   * so a first page can cost many requests and a continuation none. A continuation whose drain expired is refused;
+   * restart without the cursor. `itemsPerPage` sizes the whole page, not a
+   * facet. Past a facet's drain bound the page is `truncated` with no `totalCount`. Scope names with spaces or
+   * quotes are accepted there, since they reach the provider as encoded URL segments. See
+   * `docs/integrations.md` §9.
+   *
    * Check `getSupportedFilters().pullRequestSearch` before calling. A provider that reports no relationships
    * refuses the read rather than returning a page that never honored the criteria or scope.
    */
@@ -378,7 +389,8 @@ export interface IntegrationManager {
      *
      * Held to a STRICTER rule than the free-form `criteria.text`, which is sanitized: a scope name carrying a
      * quote, or an inner space or control character, is REFUSED (warning + `fetchFailed`), and the refusal
-     * names the value. Leading and trailing whitespace and control characters are stripped and accepted,
+     * names the value — except on a provider whose scope names never enter a query string (Azure DevOps
+     * Server), where only blank names and control characters are. Leading and trailing whitespace and control characters are stripped and accepted,
      * since removing them cannot change which scope the query names. Sanitizing a scope would answer the wrong question — the sanitized value may name a real but
      * DIFFERENT organization, whose result looks entirely normal. Pass the name exactly as the provider spells
      * it; `''` means "no org supplied" and falls through to the other scopes.
@@ -394,7 +406,8 @@ export interface IntegrationManager {
      * 2-state search returns up to `6 × itemsPerPage` items before deduplication, and fewer than that where
      * the facets overlap. Deduplication does NOT bring the page back to this size: it removes only the rows the
      * facets share. `page.itemsPerPage` reports what actually came back, so size the UI off that rather than
-     * off this. A provider may also cap it below what is asked for.
+     * off this. A provider may also cap it below what is asked for. Azure DevOps Server is the exception: it
+     * serves one merged page, so there this is the page size (at most 100).
      */
     itemsPerPage?: number;
     forceSync?: boolean;
@@ -497,7 +510,15 @@ export interface IntegrationManager {
    *   matched), `limit` (how many are reachable) and `sort` (the order that window was selected under) with
    *   `recovery: 'none'`, so a consumer can say "19.240 matched, showing the 1.000 most recent" — naming the
    *   order, since which 1.000 are reachable depends on it — and know not to offer a "load more". It never falls
-   *   back to a per-repository recovery walk.
+   *   back to a per-repository recovery walk. A provider that can prove the ceiling was reached without counting
+   *   past it (Azure DevOps Server, at 20,000) omits `totalCount`, so render the limit alone. An Azure DevOps Server
+   *   that refuses the match set even with the bounded query fails the page instead (warning + `fetchFailed`),
+   *   while its count still reports `exceedsProviderLimit`; narrow the search.
+   *
+   * On **Azure DevOps Server** every relationship is one WIQL query over one collection (`org`, or the
+   * repositories' collection), so `itemsPerPage` sizes the whole page. Continuations page through the ids the
+   * first page queried while the pagination keeps reading; one whose ids have expired is refused, and the read
+   * must restart without the cursor. See `docs/integrations.md` §9.
    *
    * Check `getSupportedFilters().issueSearch` first: a provider with no filtered issue search reports empty
    * relationships (and this read refuses), and a criterion or sort key it can't express refuses the whole read
@@ -517,7 +538,8 @@ export interface IntegrationManager {
      *
      * Held to a STRICTER rule than the free-form criteria, which are sanitized: a scope name carrying a quote,
      * or an inner space or control character, is REFUSED (warning + `fetchFailed`), and the refusal names the
-     * value. Leading and trailing whitespace and control characters are stripped and accepted, since removing
+     * value — except on Azure DevOps Server, whose scope names never enter a query string, where only blank
+     * names and control characters are. Leading and trailing whitespace and control characters are stripped and accepted, since removing
      * them cannot change which scope the query names.
      * The sanitized value may name a real but DIFFERENT org, whose result looks entirely normal. `''` means
      * "no org supplied" and falls through to the other scopes.
@@ -560,8 +582,8 @@ export interface IntegrationManager {
    *
    * `count: undefined` means the provider didn't report one — NOT zero, which is a real answer. Render the
    * difference: showing an unknown count as 0 tells the user a filter matches nothing when it may match
-   * thousands. A provider that can't count at all (only GitHub/GHE can today) refuses the probe outright rather
-   * than returning fabricated numbers.
+   * thousands. A provider that can't count at all (only GitHub/GHE and Azure DevOps Server can today) refuses the
+   * probe outright rather than returning fabricated numbers.
    */
   countIssues(options: {
     providerId: IntegrationIds;
@@ -601,31 +623,54 @@ export interface IntegrationManager {
    * {@link getIssuesBatch}, which cannot serve one.
    *
    * `issue: undefined` is a proven absence and may be cached. A failed read returns no item and sets
-   * `fetchFailed`. `resourceId` is required and trusted; Jira also requires the resource's site URL so the result
-   * retains its browser link. The read performs no resource discovery.
+   * `fetchFailed`. `resourceId` is required and trusted; Jira Cloud also requires the resource's site URL so the
+   * result retains its browser link. The read performs no resource discovery.
+   *
+   * Jira (Cloud and Data Center) and Linear only. Trello refuses: its single-issue read falls back to a capped
+   * board scan for a numeric identifier, so it cannot prove absence.
    *
-   * Jira and Linear only. Trello refuses: its single-issue read falls back to a capped board scan for a numeric
-   * identifier, so it cannot prove absence.
+   * Jira Data Center is addressed per host and, unlike the paged reads, this one never falls back to the primary
+   * connection: it requires a `domain` or a `connectionId` with a configured host and refuses otherwise, since two
+   * self-hosted instances routinely issue the same keys and a cached absence must name the host it was proven on.
    */
   getTrackerIssue(options: {
     providerId: IntegrationIds;
-    /** Provider resource ID for the Atlassian site or Linear workspace. */
+    /**
+     * Provider resource ID for the Atlassian site or Linear workspace. For Jira Data Center it is the host, the
+     * instance's single resource as `listOrgs` reports it, and must name the host the read resolves to.
+     */
     resourceId: string;
-    /** Jira site URL from resource discovery. Required for Jira so the result retains a browser link. */
+    /**
+     * Jira site URL from resource discovery. Required for Jira Cloud so the result retains a browser link; Jira
+     * Data Center builds it from the connection's own base URL.
+     */
     resourceUrl?: string;
     /** The provider's own key, e.g. `ABC-123`. Not a number. */
     key: string;
     connectionId?: string;
+    /**
+     * Self-managed tracker host; see {@link ProviderSweepTarget.domain}. Ignored for the cloud trackers. Required
+     * for Jira Data Center unless `connectionId` names a configured host — see above.
+     */
+    domain?: string;
   }): Promise<ProviderResult<TrackerIssueResult>>;
   /**
-   * How many pull requests match each scope, fetching none of them — the PR twin of {@link countIssues}, behind a
-   * "this will fetch ~N pull requests" preview and a live count next to an unapplied filter. Same cost model,
-   * per-scope isolation, `key`-echo, and `count: undefined` ≠ zero rule as the issue count; GitHub/GHE only.
-   *
-   * The one PR-specific difference: a scope's `states` are counted as independent searches, so the reported count
-   * is the LARGEST of them (the same total {@link searchPullRequestsPage} surfaces), not their sum. Several states
-   * in one scope are therefore fine; only several relationships are refused — one relationship per scope, see
-   * {@link PullRequestCountScope}.
+   * How many pull requests match each scope — the PR twin of {@link countIssues}, behind a "this will fetch ~N pull
+   * requests" preview and a live count next to an unapplied filter. Same per-scope isolation, `key`-echo, and
+   * `count: undefined` ≠ zero rule as the issue count; GitHub/GHE, Bitbucket Data Center and Azure DevOps Server.
+   *
+   * The one PR-specific difference: on GitHub/GHE a scope's `states` are counted as independent searches, so the
+   * reported count is the LARGEST of them (the same total {@link searchPullRequestsPage} surfaces), not their sum.
+   * Several states in one scope are therefore fine; only several relationships are refused — one relationship per
+   * scope, see {@link PullRequestCountScope}.
+   *
+   * Bitbucket Data Center has no count query: it counts by reading each facet's first page, so a count there costs
+   * requests rather than none, and one past that page comes back as a floor with `lowerBound: true`. Reading lets it
+   * deduplicate the rows, so it counts the exact union of the states AND of several relationships in one scope,
+   * matching what the search it previews returns.
+   *
+   * Azure DevOps Server counts from the same drain its search pages through (reusing one its search read in the
+   * last minute), so its count is the union of the states — for disjoint states their sum — and costs requests too.
    */
   countPullRequests(options: {
     providerId: IntegrationIds;

package/dist/plus/integrations/models/gitHostIntegration.d.ts

@@ -9,8 +9,8 @@ import { RepositoryMetadata } from "../../../git/models/repositoryMetadata.js";
 import { PullRequestUrlIdentity } from "../../../git/utils/pullRequest.utils.js";
 import { ProviderAuthenticationSession } from "../authentication/models.js";
 import { IntegrationIds } from "../constants.js";
-import { MyIssuesForReposOptions, ProviderIssueSearchPage } from "./issueReads.js";
-import { ProviderPullRequestSearchPage } from "./pullRequestReads.js";
+import { ProviderPullRequestCount, ProviderPullRequestSearchPage } from "./pullRequestReads.js";
+import { MyIssuesForReposOptions, ProviderIssueSearchPage, ProviderSearchCount } from "./issueReads.js";
 import { IntegrationBase, IntegrationResult, IntegrationType } from "./integration.js";
 import { ProviderOrganization } from "../results.js";
 import { ProviderApiPagedResult, ProviderHierarchyResult, ProviderIssue, ProviderPullRequest, ProviderRepoInput, ProviderReposInput, ProviderRepository } from "../providers/models.js";
@@ -45,6 +45,11 @@ type MyPullRequestsForReposOptions = {
 };
 export declare abstract class GitHostIntegration<ID extends IntegrationIds = IntegrationIds, T extends ResourceDescriptor = ResourceDescriptor> extends IntegrationBase<ID> {
   readonly type: IntegrationType;
+  /** The self-managed installation `session` addresses, validated against this integration's host. */
+  protected getSelfManagedInstallationUrl(session: ProviderAuthenticationSession): string;
+  protected getSelfManagedApiBaseUrl(session: ProviderAuthenticationSession): string;
+  /** The base the repository-list reads hand the provider client for a self-managed host. */
+  protected getRepositoriesApiBaseUrl(session: ProviderAuthenticationSession, _repos: ProviderReposInput): string;
   getAccountForEmail(repo: T, email: string, options?: {
     avatarSize?: number;
   }): Promise<Account$1 | undefined>;
@@ -86,7 +91,7 @@ export declare abstract class GitHostIntegration<ID extends IntegrationIds = Int
   protected abstract getProviderRepositoryMetadata(session: ProviderAuthenticationSession, repo: T, cancellation?: AbortSignal): Promise<RepositoryMetadata | undefined>;
   /**
    * Whether this git host implements generic org discovery. False for providers that register no
-   * {@link getProviderOrganizationsForUser} hook (e.g. Bitbucket Data Center) — the facade uses this to
+   * {@link getProviderOrganizationsForUser} hook — the facade uses this to
    * report `unsupported` instead of a silent empty list, which is indistinguishable from "has no orgs".
    */
   get supportsOrganizationDiscovery(): boolean;
@@ -366,25 +371,26 @@ export declare abstract class GitHostIntegration<ID extends IntegrationIds = Int
    * at all. Recovers thrown errors into `{ error }` like the reads around it.
    *
    * Counts come back POSITIONALLY — one per input scope, in order — because a caller's key must never reach the
-   * provider query. `undefined` in a slot means the provider didn't report a count for it, never zero matches.
+   * provider query. See {@link ProviderSearchCount} for what each slot can hold; `undefined` means the provider
+   * didn't report a count for it, never zero matches.
    */
   countIssuesResult(scopes: readonly {
     repos?: ProviderRepoInput[];
     org?: string;
     criteria?: IssueSearchCriteria;
-  }[], cancellation?: AbortSignal, connectionId?: string): Promise<IntegrationResult<(number | undefined)[] | undefined>>;
+  }[], cancellation?: AbortSignal, connectionId?: string): Promise<IntegrationResult<ProviderSearchCount[] | undefined>>;
   /**
    * OPTIONAL: only a provider that can answer "how many match" WITHOUT fetching the matches implements this.
-   * GitHub's search reports `issueCount` on a zero-node selection; GitLab's REST exposes a total on some
-   * endpoints but not for a search-shaped query, and Azure has no equivalent. A provider that can't answer
-   * doesn't implement it and the facade refuses the probe, so a consumer hides its count rather than being shown
-   * a fabricated one.
+   * GitHub's search reports `issueCount` on a zero-node selection, and Azure DevOps Server's WIQL returns the
+   * matching ids without their details; GitLab's REST exposes a total on some endpoints but not for a
+   * search-shaped query. A provider that can't answer doesn't implement it and the facade refuses the probe, so a
+   * consumer hides its count rather than being shown a fabricated one.
    */
   protected countProviderIssues?(session: ProviderAuthenticationSession, scopes: readonly {
     repos?: ProviderRepoInput[];
     org?: string;
     criteria?: IssueSearchCriteria;
-  }[], cancellation?: AbortSignal): Promise<(number | undefined)[] | undefined>;
+  }[], cancellation?: AbortSignal): Promise<ProviderSearchCount[] | undefined>;
   /**
    * Result-returning wrapper for the BATCH issue read: resolves several `(owner, repo, number)` coordinates in
    * one request. Recovers thrown errors into `{ error }` like the reads around it.
@@ -416,18 +422,28 @@ export declare abstract class GitHostIntegration<ID extends IntegrationIds = Int
     repo: string;
     number: number;
   }[], cancellation?: AbortSignal): Promise<(IssueShape | undefined)[] | undefined>;
-  /** The PR twin of {@link countIssuesResult}: counts each scope's pull requests, transferring none. */
+  /**
+   * The PR twin of {@link countIssuesResult}: counts each scope's pull requests, transferring none where the
+   * provider has a count query. Each slot is a {@link ProviderPullRequestCount}, so a provider that can only count
+   * by reading (Bitbucket Data Center) can mark a figure it stopped short of as a floor, or an `Error` refusing only
+   * that scope (Azure DevOps Server).
+   */
   countPullRequestsResult(scopes: readonly {
     repos?: ProviderRepoInput[];
     org?: string;
     criteria?: PullRequestSearchCriteria;
-  }[], cancellation?: AbortSignal, connectionId?: string): Promise<IntegrationResult<(number | undefined)[] | undefined>>;
-  /** OPTIONAL, like {@link countProviderIssues}: only a provider that can count without fetching implements it. */
+  }[], cancellation?: AbortSignal, connectionId?: string): Promise<IntegrationResult<(ProviderPullRequestCount | Error)[] | undefined>>;
+  /**
+   * OPTIONAL, like {@link countProviderIssues}: only a provider that can answer "how many match" implements it —
+   * GitHub/GHE with a zero-node search, Bitbucket Data Center by reading within a budget and reporting a floor
+   * past it, Azure DevOps Server from the drain its search reads. Must agree with
+   * `ProviderMetadata.supportedPullRequestSearch`, which the facade validates against.
+   */
   protected countProviderPullRequests?(session: ProviderAuthenticationSession, scopes: readonly {
     repos?: ProviderRepoInput[];
     org?: string;
     criteria?: PullRequestSearchCriteria;
-  }[], cancellation?: AbortSignal): Promise<(number | undefined)[] | undefined>;
+  }[], cancellation?: AbortSignal): Promise<(ProviderPullRequestCount | Error)[] | undefined>;
   getPullRequestIdentityFromMaybeUrl(search: string): PullRequestUrlIdentity | undefined;
   protected getProviderPullRequestIdentityFromMaybeUrl?(search: string): PullRequestUrlIdentity | undefined;
 }

package/dist/plus/integrations/models/gitHostIntegration.js

@@ -12,25 +12,25 @@ import { throwIfCallerContractError, toCollectionFailureError, toCollectionScope
 import "../constants.js";
 import { toTokenWithInfo } from "../authentication/models.js";
 import "../providerFilters.js";
-import { toIssueShape, toProviderIssueStates, toProviderPullRequestStates } from "../providers/models.js";
-import { baseUrlFromDomain } from "../utils/domain.utils.js";
 import { mergeCollectionMetadata, throwIfAllSettledFailed } from "../providers/utils/providerPaging.js";
+import { areDomainsOnSameHost } from "../utils/domain.utils.js";
+import { getSelfManagedBaseUrl, isGitSelfManagedHostIntegrationId } from "../utils/integration.utils.js";
+import { toIssueShape, toProviderIssueStates, toProviderPullRequestStates } from "../providers/models.js";
 import { IntegrationBase } from "./integration.js";
 //#region ../plus/integrations/src/models/gitHostIntegration.ts
+/**
+* Whether an SDK read for `providerId` must send the session's secret as an HTTP Basic credential.
+*
+* Azure DevOps authenticates a PAT only as Basic — Azure DevOps Server refuses one sent as a bearer token outright —
+* and the Azure integration's own reads already pass it that way (`AzureDevOpsIntegrationBase.getApiOptions`). The
+* reads here are shared by every host, so they have to ask; every other provider keeps the SDK's default.
+*/
+function sendsBasicCredential(providerId, session) {
+	return isAzureDevOpsProvider(providerId) ? session.type !== "oauth" : void 0;
+}
 function isAzureDevOpsProvider(providerId) {
 	return providerId === "azureDevOps" || providerId === "azure-devops-server";
 }
-function getSelfManagedApiBaseUrl(providerId, domain, protocol) {
-	const baseUrl = baseUrlFromDomain(domain, protocol);
-	if (baseUrl == null) return void 0;
-	switch (providerId) {
-		case "cloud-github-enterprise": return `${baseUrl.replace(/\/api(?:\/v\d+)?$/, "")}/api/v3`;
-		case "cloud-gitlab-self-hosted": return baseUrl.replace(/\/api(?:\/v\d+)?$/, "");
-		case "bitbucket-server": return `${baseUrl.replace(/\/rest\/api\/1\.0$/, "")}/rest/api/1.0`;
-		case "azure-devops-server": return baseUrl;
-		default: return;
-	}
-}
 /**
 * Rejects a read the provider can't serve as asked: logs the reason and returns it as the `{ error }` half of an
 * {@link IntegrationResult}, timed from `start`.
@@ -58,6 +58,24 @@ const summaryPullRequestFields = {
 };
 var GitHostIntegration = class extends IntegrationBase {
 	type = "git";
+	/** The self-managed installation `session` addresses, validated against this integration's host. */
+	getSelfManagedInstallationUrl(session) {
+		const baseUrl = getSelfManagedBaseUrl(this.id, session.baseUrl ?? (session.domain || this.domain), session.protocol);
+		if (baseUrl == null || !areDomainsOnSameHost(baseUrl, this.domain)) throw new Error("Invalid self-managed integration base URL");
+		return baseUrl;
+	}
+	getSelfManagedApiBaseUrl(session) {
+		const baseUrl = this.getSelfManagedInstallationUrl(session);
+		switch (this.id) {
+			case "cloud-github-enterprise": return `${baseUrl}/api/v3`;
+			case "bitbucket-server": return `${baseUrl}/rest/api/1.0`;
+			default: return baseUrl;
+		}
+	}
+	/** The base the repository-list reads hand the provider client for a self-managed host. */
+	getRepositoriesApiBaseUrl(session, _repos) {
+		return this.getSelfManagedApiBaseUrl(session);
+	}
 	async getAccountForEmail(repo, email, options) {
 		const scope = getScopedLogger();
 		if (!(this.maybeConnected ?? await this.isConnected())) return void 0;
@@ -138,7 +156,7 @@ var GitHostIntegration = class extends IntegrationBase {
 	}
 	/**
 	* Whether this git host implements generic org discovery. False for providers that register no
-	* {@link getProviderOrganizationsForUser} hook (e.g. Bitbucket Data Center) — the facade uses this to
+	* {@link getProviderOrganizationsForUser} hook — the facade uses this to
 	* report `unsupported` instead of a silent empty list, which is indistinguishable from "has no orgs".
 	*/
 	get supportsOrganizationDiscovery() {
@@ -192,7 +210,12 @@ var GitHostIntegration = class extends IntegrationBase {
 		const start = performance.now();
 		try {
 			const result = await this.getProviderOrganizationsForUser?.(session);
-			this.resetRequestExceptionCount("getOrganizationsForUser");
+			const authFailure = result?.metadata?.failures?.find((failure) => failure.kind === "authentication" && failure.scope != null && failure.scope.providerId === this.id && Object.keys(failure.scope).length === 1);
+			if (authFailure != null) this.handleProviderException("getOrganizationsForUser", toCollectionFailureError(authFailure, toTokenWithInfo(this.id, session)), {
+				scope,
+				connectionId
+			});
+			else this.resetRequestExceptionCount("getOrganizationsForUser");
 			return {
 				value: result,
 				duration: performance.now() - start
@@ -386,7 +409,10 @@ var GitHostIntegration = class extends IntegrationBase {
 		let pending = this._filterAccounts.get(key);
 		if (pending == null) {
 			const tokenWithInfo = toTokenWithInfo(this.authProvider.id, session);
-			pending = (organization != null ? api.getCurrentUserForInstance(tokenWithInfo, organization, { baseUrl: customUrl }) : api.getCurrentUser(tokenWithInfo, { baseUrl: customUrl })).catch((ex) => {
+			pending = (organization != null ? api.getCurrentUserForInstance(tokenWithInfo, organization, {
+				baseUrl: customUrl,
+				isPAT: sendsBasicCredential(this.id, session)
+			}) : api.getCurrentUser(tokenWithInfo, { baseUrl: customUrl })).catch((ex) => {
 				this._filterAccounts.delete(key);
 				throw ex;
 			});
@@ -410,9 +436,10 @@ var GitHostIntegration = class extends IntegrationBase {
 		const session = await this.resolveReadSession(connectionId, scope);
 		if (session == null) return void 0;
 		const start = performance.now();
-		const customUrl = options?.customUrl ?? getSelfManagedApiBaseUrl(providerId, session.domain || this.domain, session.protocol);
+		let customUrl;
 		let api;
 		try {
+			customUrl = options?.customUrl ?? (isGitSelfManagedHostIntegrationId(providerId) ? this.getRepositoriesApiBaseUrl(session, reposOrRepoIds) : void 0);
 			api = await this.getProvidersApi();
 		} catch (ex) {
 			this.handleProviderException("getIssuesForRepos", ex, {
@@ -481,6 +508,7 @@ var GitHostIntegration = class extends IntegrationBase {
 							...getIssuesOptions,
 							cursor: projectInput.cursor,
 							baseUrl: customUrl,
+							isPAT: sendsBasicCredential(providerId, session),
 							page: projectInput.cursor == null ? options?.page : void 0,
 							pageSize: options?.pageSize,
 							states,
@@ -653,6 +681,7 @@ var GitHostIntegration = class extends IntegrationBase {
 				...getIssuesOptions,
 				cursor: options?.cursor,
 				baseUrl: customUrl,
+				isPAT: sendsBasicCredential(providerId, session),
 				page: options?.page,
 				pageSize: options?.pageSize,
 				states,
@@ -732,9 +761,10 @@ var GitHostIntegration = class extends IntegrationBase {
 		const session = await this.resolveReadSession(connectionId, scope);
 		if (session == null) return void 0;
 		const start = performance.now();
-		const customUrl = options?.customUrl ?? getSelfManagedApiBaseUrl(providerId, session.domain || this.domain, session.protocol);
+		let customUrl;
 		let api;
 		try {
+			customUrl = options?.customUrl ?? (isGitSelfManagedHostIntegrationId(providerId) ? this.getRepositoriesApiBaseUrl(session, reposOrRepoIds) : void 0);
 			api = await this.getProvidersApi();
 		} catch (ex) {
 			this.handleProviderException("getPullRequestsForRepos", ex, {
@@ -840,7 +870,8 @@ var GitHostIntegration = class extends IntegrationBase {
 						results: await api.getPullRequestsForRepo(toTokenWithInfo(providerId, session), repoInput.repo, {
 							...getPullRequestsOptions,
 							cursor: repoInput.cursor,
-							baseUrl: customUrl,
+							isPAT: sendsBasicCredential(providerId, session),
+							baseUrl: options?.customUrl == null && isGitSelfManagedHostIntegrationId(providerId) ? this.getRepositoriesApiBaseUrl(session, [repoInput.repo]) : customUrl,
 							page: repoInput.cursor == null ? options?.page : void 0,
 							pageSize: options?.pageSize,
 							states,
@@ -904,6 +935,7 @@ var GitHostIntegration = class extends IntegrationBase {
 			const result = await api.getPullRequestsForRepos(toTokenWithInfo(providerId, session), reposOrRepoIds, {
 				...getPullRequestsOptions,
 				cursor: options?.cursor,
+				isPAT: sendsBasicCredential(providerId, session),
 				baseUrl: customUrl,
 				page: options?.page,
 				pageSize: options?.pageSize,
@@ -1082,7 +1114,8 @@ var GitHostIntegration = class extends IntegrationBase {
 	* at all. Recovers thrown errors into `{ error }` like the reads around it.
 	*
 	* Counts come back POSITIONALLY — one per input scope, in order — because a caller's key must never reach the
-	* provider query. `undefined` in a slot means the provider didn't report a count for it, never zero matches.
+	* provider query. See {@link ProviderSearchCount} for what each slot can hold; `undefined` means the provider
+	* didn't report a count for it, never zero matches.
 	*/
 	async countIssuesResult(scopes, cancellation, connectionId) {
 		const scope = getScopedLogger();
@@ -1144,7 +1177,12 @@ var GitHostIntegration = class extends IntegrationBase {
 			};
 		}
 	}
-	/** The PR twin of {@link countIssuesResult}: counts each scope's pull requests, transferring none. */
+	/**
+	* The PR twin of {@link countIssuesResult}: counts each scope's pull requests, transferring none where the
+	* provider has a count query. Each slot is a {@link ProviderPullRequestCount}, so a provider that can only count
+	* by reading (Bitbucket Data Center) can mark a figure it stopped short of as a floor, or an `Error` refusing only
+	* that scope (Azure DevOps Server).
+	*/
 	async countPullRequestsResult(scopes, cancellation, connectionId) {
 		const scope = getScopedLogger();
 		const session = await this.resolveReadSession(connectionId, scope);