@gitkraken/core-gitlens 0.7.0 → 0.7.2

package/dist/plus/integrations/models/issuesIntegration.js.map

@@ -1 +1 @@
-{"version":3,"file":"issuesIntegration.js","names":[],"sources":["../../../../../plus/integrations/src/models/issuesIntegration.ts"],"sourcesContent":["import type { Account } from '@gitlens/git/models/author.js';\nimport type { Issue, IssueShape } from '@gitlens/git/models/issue.js';\nimport type { ResourceDescriptor } from '@gitlens/git/models/resourceDescriptor.js';\nimport { gate } from '@gitlens/utils/decorators/gate.js';\nimport { trace } from '@gitlens/utils/decorators/log.js';\nimport { getScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport type { ProviderAuthenticationSession } from '../authentication/models.js';\nimport type { IntegrationIds } from '../constants.js';\nimport { IntegrationReadUnavailableError, toError } from '../errors.js';\nimport type { ProviderApiCollectionResult } from '../providers/models.js';\nimport type { Integration, IntegrationResult, IntegrationType } from './integration.js';\nimport { IntegrationBase } from './integration.js';\nimport type { IssuesForProjectOptions, ProjectIssuesDrain } from './issueReads.js';\n\nexport function isIssuesIntegration(integration: Integration): integration is IssuesIntegration {\n\treturn integration.type === 'issues';\n}\n\nexport abstract class IssuesIntegration<\n\tID extends IntegrationIds = IntegrationIds,\n\tT extends ResourceDescriptor = ResourceDescriptor,\n> extends IntegrationBase<ID> {\n\treadonly type: IntegrationType = 'issues';\n\n\tget supportsIssueLookupByResourceId(): boolean {\n\t\treturn this.getProviderIssueByResourceId != null;\n\t}\n\n\tgetIssueByResourceIdResult(\n\t\tresourceId: string,\n\t\tid: string,\n\t\toptions?: { connectionId?: string; expiryOverride?: boolean | number; resourceUrl?: string },\n\t): Promise<IntegrationResult<Issue | undefined>> {\n\t\tconst getProviderIssue = this.getProviderIssueByResourceId;\n\t\tif (getProviderIssue == null) {\n\t\t\treturn Promise.resolve({\n\t\t\t\terror: new IntegrationReadUnavailableError(\n\t\t\t\t\tthis.name,\n\t\t\t\t\t'does not support direct issue reads by resource id',\n\t\t\t\t),\n\t\t\t});\n\t\t}\n\n\t\tconst { resourceUrl, ...readOptions } = options ?? {};\n\t\tconst resource = { key: resourceId, resourceId: resourceId, resourceUrl: resourceUrl };\n\t\treturn this.getIssueResultCore(resource, id, readOptions, session =>\n\t\t\tgetProviderIssue.call(this, session, resourceId, id, resourceUrl),\n\t\t);\n\t}\n\n\tprotected getProviderIssueByResourceId?(\n\t\t_session: ProviderAuthenticationSession,\n\t\t_resourceId: string,\n\t\t_id: string,\n\t\t_resourceUrl: string | undefined,\n\t): Promise<Issue | undefined>;\n\n\t@trace()\n\tasync getAccountForResource(resource: T, connectionId?: string): Promise<Account | undefined> {\n\t\treturn (await this.getAccountForResourceResult(resource, connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getAccountForResource}. Recovers a thrown error into `{ error }` so\n\t * callers can preserve its classification (e.g. a 401/403 → an `auth` warning that drives re-auth)\n\t * instead of collapsing every failure into an untyped `undefined`. Gated here (not on the wrapper) so\n\t * direct callers such as the ProviderBackend facade share the same dedup as `getAccountForResource`.\n\t */\n\t@gate()\n\tasync getAccountForResourceResult(\n\t\tresource: T,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<Account | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst account = await this.getProviderAccountForResource(session, resource);\n\t\t\tthis.resetRequestExceptionCount('getAccountForResource');\n\t\t\treturn { value: account };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getAccountForResource', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderAccountForResource(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresource: T,\n\t): Promise<Account | undefined>;\n\n\t@trace()\n\tasync getResourcesForUser(connectionId?: string): Promise<T[] | undefined> {\n\t\treturn (await this.getResourcesForUserResult(connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getResourcesForUser}. Recovers thrown errors into `{ error }` so callers\n\t * can surface them as warnings rather than silently swallowing them to `undefined`. Gated here (not on the\n\t * wrapper) so direct callers such as the ProviderBackend facade share the same dedup as `getResourcesForUser`.\n\t */\n\t@gate()\n\tasync getResourcesForUserResult(connectionId?: string): Promise<IntegrationResult<T[] | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst resources = await this.getProviderResourcesForUser(session);\n\t\t\tthis.resetRequestExceptionCount('getResourcesForUser');\n\t\t\treturn { value: resources };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getResourcesForUser', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderResourcesForUser(session: ProviderAuthenticationSession): Promise<T[] | undefined>;\n\n\t/**\n\t * Project discovery for a set of resources, returning the SDK collection `{ values, metadata }` (completeness\n\t * + per-resource failures) so callers can warn on failed resources and set `fetchFailed` without discarding\n\t * the resources that succeeded. Thrown errors are recovered into `{ error }` for the same reason: a caller\n\t * surfaces them as a warning rather than swallowing them to `undefined`.\n\t */\n\t@trace()\n\tasync getProjectsForResourcesWithMetadataResult(\n\t\tresources: T[],\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<ProviderApiCollectionResult<T> | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst projects = await this.getProviderProjectsForResourcesWithMetadata(session, resources);\n\t\t\tthis.resetRequestExceptionCount('getProjectsForResources');\n\t\t\treturn { value: projects };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getProjectsForResources', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\t/**\n\t * Metadata-aware provider project discovery. The default wraps the array-returning\n\t * {@link getProviderProjectsForResources} in `{ values }` with no metadata, so providers without a\n\t * fan-out completeness signal (Linear, Trello) need no change; Jira overrides it to preserve the SDK's\n\t * per-resource completeness/failures.\n\t */\n\tprotected async getProviderProjectsForResourcesWithMetadata(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresources: T[],\n\t): Promise<ProviderApiCollectionResult<T>> {\n\t\tconst projects = await this.getProviderProjectsForResources(session, resources);\n\t\treturn { values: projects ?? [] };\n\t}\n\n\tprotected abstract getProviderProjectsForResources(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresources: T[],\n\t): Promise<T[] | undefined>;\n\n\t@trace()\n\tasync getIssuesForProject(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IssueShape[] | undefined> {\n\t\treturn (await this.getIssuesForProjectResult(project, options, connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getIssuesForProject}. Recovers thrown errors into `{ error }` so callers\n\t * (e.g. the ProviderBackend facade) can surface a per-provider warning instead of a silent empty read —\n\t * important for providers that throw on unsupported operations (e.g. Linear's not-implemented issue read).\n\t */\n\tasync getIssuesForProjectResult(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<IssueShape[] | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst issues = await this.getProviderIssuesForProject(session, project, options);\n\t\t\tthis.resetRequestExceptionCount('getIssuesForProject');\n\t\t\treturn { value: issues };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\t/**\n\t * Truncation-aware variant of {@link getIssuesForProjectResult}. A provider that drains a project's issues\n\t * with an internal page backstop (Jira/Linear) overrides {@link getProviderIssuesForProjectWithTruncation}\n\t * to report when that backstop was hit, so the facade can surface an incomplete project read instead of\n\t * publishing it as complete. The default reports `truncated: false`.\n\t */\n\tasync getIssuesForProjectWithTruncationResult(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<ProjectIssuesDrain | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst result = await this.getProviderIssuesForProjectWithTruncation(session, project, options);\n\t\t\tthis.resetRequestExceptionCount('getIssuesForProject');\n\t\t\treturn { value: result };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderIssuesForProject(\n\t\tsession: ProviderAuthenticationSession,\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t): Promise<IssueShape[] | undefined>;\n\n\t/**\n\t * Truncation-aware core of {@link getProviderIssuesForProject}. The default wraps the plain read and\n\t * reports `truncated: false`; a provider whose per-project drain is capped by a page backstop overrides\n\t * this to report incompleteness. Optional metadata lets providers surface structured per-project failures\n\t * (e.g. a page-level auth rejection) without discarding the already-fetched prefix.\n\t */\n\tprotected async getProviderIssuesForProjectWithTruncation(\n\t\tsession: ProviderAuthenticationSession,\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t): Promise<ProjectIssuesDrain | undefined> {\n\t\tconst values = await this.getProviderIssuesForProject(session, project, options);\n\t\tif (values == null) return undefined;\n\t\treturn { values: values, truncated: false };\n\t}\n}\n"],"mappings":";;;;;;;AAcA,SAAgB,oBAAoB,aAA4D;CAC/F,OAAO,YAAY,SAAS;AAC7B;AAEA,IAAsB,oBAAtB,cAGU,gBAAoB;CAC7B,OAAiC;CAEjC,IAAI,kCAA2C;EAC9C,OAAO,KAAK,gCAAgC;CAC7C;CAEA,2BACC,YACA,IACA,SACgD;EAChD,MAAM,mBAAmB,KAAK;EAC9B,IAAI,oBAAoB,MACvB,OAAO,QAAQ,QAAQ,EACtB,OAAO,IAAI,gCACV,KAAK,MACL,oDACD,EACD,CAAC;EAGF,MAAM,EAAE,aAAa,GAAG,gBAAgB,WAAW,CAAC;EACpD,MAAM,WAAW;GAAE,KAAK;GAAwB;GAAyB;EAAY;EACrF,OAAO,KAAK,mBAAmB,UAAU,IAAI,cAAa,YACzD,iBAAiB,KAAK,MAAM,SAAS,YAAY,IAAI,WAAW,CACjE;CACD;CASA,MACM,sBAAsB,UAAa,cAAqD;EAC7F,QAAQ,MAAM,KAAK,4BAA4B,UAAU,YAAY,EAAA,EAAI;CAC1E;;;;;;;CAQA,MACM,4BACL,UACA,cACkD;EAClD,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,UAAU,MAAM,KAAK,8BAA8B,SAAS,QAAQ;GAC1E,KAAK,2BAA2B,uBAAuB;GACvD,OAAO,EAAE,OAAO,QAAQ;EACzB,SAAS,IAAI;GACZ,KAAK,wBAAwB,yBAAyB,IAAI,EAAgB,aAAa,CAAC;GACxF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;CAOA,MACM,oBAAoB,cAAiD;EAC1E,QAAQ,MAAM,KAAK,0BAA0B,YAAY,EAAA,EAAI;CAC9D;;;;;;CAOA,MACM,0BAA0B,cAAoE;EACnG,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,YAAY,MAAM,KAAK,4BAA4B,OAAO;GAChE,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,UAAU;EAC3B,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAUA,MACM,0CACL,WACA,cACyE;EACzE,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,4CAA4C,SAAS,SAAS;GAC1F,KAAK,2BAA2B,yBAAyB;GACzD,OAAO,EAAE,OAAO,SAAS;EAC1B,SAAS,IAAI;GACZ,KAAK,wBAAwB,2BAA2B,IAAI,EAAgB,aAAa,CAAC;GAC1F,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAQA,MAAgB,4CACf,SACA,WAC0C;EAE1C,OAAO,EAAE,QAAQ,MADM,KAAK,gCAAgC,SAAS,SAAS,KACjD,CAAC,EAAE;CACjC;CAOA,MACM,oBACL,SACA,SACA,cACoC;EACpC,QAAQ,MAAM,KAAK,0BAA0B,SAAS,SAAS,YAAY,EAAA,EAAI;CAChF;;;;;;CAOA,MAAM,0BACL,SACA,SACA,cACuD;EACvD,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,SAAS,MAAM,KAAK,4BAA4B,SAAS,SAAS,OAAO;GAC/E,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,OAAO;EACxB,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAQA,MAAM,wCACL,SACA,SACA,cAC6D;EAC7D,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,SAAS,MAAM,KAAK,0CAA0C,SAAS,SAAS,OAAO;GAC7F,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,OAAO;EACxB,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAcA,MAAgB,0CACf,SACA,SACA,SAC0C;EAC1C,MAAM,SAAS,MAAM,KAAK,4BAA4B,SAAS,SAAS,OAAO;EAC/E,IAAI,UAAU,MAAM,OAAO,KAAA;EAC3B,OAAO;GAAU;GAAQ,WAAW;EAAM;CAC3C;AACD;AA9LE,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,yBAAA,IAAA;AAWN,WAAA,CAAA,KAAK,CAAA,GAAA,kBAAA,WAAA,+BAAA,IAAA;AAyBL,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,uBAAA,IAAA;AAUN,WAAA,CAAA,KAAK,CAAA,GAAA,kBAAA,WAAA,6BAAA,IAAA;AAyBL,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,6CAAA,IAAA;AAuCN,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,uBAAA,IAAA"}
+{"version":3,"file":"issuesIntegration.js","names":[],"sources":["../../../../../plus/integrations/src/models/issuesIntegration.ts"],"sourcesContent":["import type { Account } from '@gitlens/git/models/author.js';\nimport type { Issue, IssueShape } from '@gitlens/git/models/issue.js';\nimport type { ResourceDescriptor } from '@gitlens/git/models/resourceDescriptor.js';\nimport { gate } from '@gitlens/utils/decorators/gate.js';\nimport { trace } from '@gitlens/utils/decorators/log.js';\nimport { getScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport type { ProviderAuthenticationSession } from '../authentication/models.js';\nimport type { IntegrationIds } from '../constants.js';\nimport { IntegrationReadUnavailableError, toError } from '../errors.js';\nimport type { ProviderApiCollectionResult } from '../providers/models.js';\nimport type { Integration, IntegrationResult, IntegrationType } from './integration.js';\nimport { IntegrationBase } from './integration.js';\nimport type { IssuesForProjectOptions, ProjectIssuesDrain } from './issueReads.js';\n\nexport function isIssuesIntegration(integration: Integration): integration is IssuesIntegration {\n\treturn integration.type === 'issues';\n}\n\nexport abstract class IssuesIntegration<\n\tID extends IntegrationIds = IntegrationIds,\n\tT extends ResourceDescriptor = ResourceDescriptor,\n> extends IntegrationBase<ID> {\n\treadonly type: IntegrationType = 'issues';\n\n\tget supportsIssueLookupByResourceId(): boolean {\n\t\treturn this.getProviderIssueByResourceId != null;\n\t}\n\n\tgetIssueByResourceIdResult(\n\t\tresourceId: string,\n\t\tid: string,\n\t\toptions?: { connectionId?: string; expiryOverride?: boolean | number; resourceUrl?: string },\n\t): Promise<IntegrationResult<Issue | undefined>> {\n\t\tconst getProviderIssue = this.getProviderIssueByResourceId;\n\t\tif (getProviderIssue == null) {\n\t\t\treturn Promise.resolve({\n\t\t\t\terror: new IntegrationReadUnavailableError(\n\t\t\t\t\tthis.name,\n\t\t\t\t\t'does not support direct issue reads by resource id',\n\t\t\t\t),\n\t\t\t});\n\t\t}\n\n\t\tconst { resourceUrl, ...readOptions } = options ?? {};\n\t\tconst resource = { key: resourceId, resourceId: resourceId, resourceUrl: resourceUrl };\n\t\treturn this.getIssueResultCore(resource, id, readOptions, session =>\n\t\t\tgetProviderIssue.call(this, session, resourceId, id, resourceUrl),\n\t\t);\n\t}\n\n\tprotected getProviderIssueByResourceId?(\n\t\t_session: ProviderAuthenticationSession,\n\t\t_resourceId: string,\n\t\t_id: string,\n\t\t_resourceUrl: string | undefined,\n\t): Promise<Issue | undefined>;\n\n\t@trace()\n\tasync getAccountForResource(resource: T, connectionId?: string): Promise<Account | undefined> {\n\t\treturn (await this.getAccountForResourceResult(resource, connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getAccountForResource}. Recovers a thrown error into `{ error }` so\n\t * callers can preserve its classification (e.g. a 401/403 → an `auth` warning that drives re-auth)\n\t * instead of collapsing every failure into an untyped `undefined`. Gated here (not on the wrapper) so\n\t * direct callers such as the ProviderBackend facade share the same dedup as `getAccountForResource`.\n\t */\n\t@gate()\n\tasync getAccountForResourceResult(\n\t\tresource: T,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<Account | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst account = await this.getProviderAccountForResource(session, resource);\n\t\t\tthis.resetRequestExceptionCount('getAccountForResource');\n\t\t\treturn { value: account };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getAccountForResource', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderAccountForResource(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresource: T,\n\t): Promise<Account | undefined>;\n\n\t@trace()\n\tasync getResourcesForUser(connectionId?: string): Promise<T[] | undefined> {\n\t\treturn (await this.getResourcesForUserResult(connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getResourcesForUser}. Recovers thrown errors into `{ error }` so callers\n\t * can surface them as warnings rather than silently swallowing them to `undefined`. Gated here (not on the\n\t * wrapper) so direct callers such as the ProviderBackend facade share the same dedup as `getResourcesForUser`.\n\t */\n\t@gate()\n\tasync getResourcesForUserResult(connectionId?: string): Promise<IntegrationResult<T[] | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst resources = await this.getProviderResourcesForUser(session);\n\t\t\tthis.resetRequestExceptionCount('getResourcesForUser');\n\t\t\treturn { value: resources };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getResourcesForUser', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderResourcesForUser(session: ProviderAuthenticationSession): Promise<T[] | undefined>;\n\n\t/**\n\t * Project discovery for a set of resources, returning the SDK collection `{ values, metadata }` (completeness\n\t * + per-resource failures) so callers can warn on failed resources and set `fetchFailed` without discarding\n\t * the resources that succeeded. Thrown errors are recovered into `{ error }` for the same reason: a caller\n\t * surfaces them as a warning rather than swallowing them to `undefined`.\n\t */\n\t@trace()\n\tasync getProjectsForResourcesWithMetadataResult(\n\t\tresources: T[],\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<ProviderApiCollectionResult<T> | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst projects = await this.getProviderProjectsForResourcesWithMetadata(session, resources);\n\t\t\tawait this.confirmScopedAuthFailures(session, projects.metadata);\n\t\t\tthis.resetRequestExceptionCount('getProjectsForResources');\n\t\t\treturn { value: projects };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getProjectsForResources', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\t/**\n\t * Metadata-aware provider project discovery. The default wraps the array-returning\n\t * {@link getProviderProjectsForResources} in `{ values }` with no metadata, so providers without a\n\t * fan-out completeness signal (Linear, Trello) need no change; Jira overrides it to preserve the SDK's\n\t * per-resource completeness/failures.\n\t */\n\tprotected async getProviderProjectsForResourcesWithMetadata(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresources: T[],\n\t): Promise<ProviderApiCollectionResult<T>> {\n\t\tconst projects = await this.getProviderProjectsForResources(session, resources);\n\t\treturn { values: projects ?? [] };\n\t}\n\n\tprotected abstract getProviderProjectsForResources(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresources: T[],\n\t): Promise<T[] | undefined>;\n\n\t@trace()\n\tasync getIssuesForProject(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IssueShape[] | undefined> {\n\t\treturn (await this.getIssuesForProjectResult(project, options, connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getIssuesForProject}. Recovers thrown errors into `{ error }` so callers\n\t * (e.g. the ProviderBackend facade) can surface a per-provider warning instead of a silent empty read —\n\t * important for providers that throw on unsupported operations (e.g. Linear's not-implemented issue read).\n\t */\n\tasync getIssuesForProjectResult(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<IssueShape[] | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst issues = await this.getProviderIssuesForProject(session, project, options);\n\t\t\tthis.resetRequestExceptionCount('getIssuesForProject');\n\t\t\treturn { value: issues };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\t/**\n\t * Truncation-aware variant of {@link getIssuesForProjectResult}. A provider that drains a project's issues\n\t * with an internal page backstop (Jira/Linear) overrides {@link getProviderIssuesForProjectWithTruncation}\n\t * to report when that backstop was hit, so the facade can surface an incomplete project read instead of\n\t * publishing it as complete. The default reports `truncated: false`.\n\t */\n\tasync getIssuesForProjectWithTruncationResult(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<ProjectIssuesDrain | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst result = await this.getProviderIssuesForProjectWithTruncation(session, project, options);\n\t\t\tawait this.confirmScopedAuthFailures(session, result?.metadata);\n\t\t\tthis.resetRequestExceptionCount('getIssuesForProject');\n\t\t\treturn { value: result };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderIssuesForProject(\n\t\tsession: ProviderAuthenticationSession,\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t): Promise<IssueShape[] | undefined>;\n\n\t/**\n\t * Truncation-aware core of {@link getProviderIssuesForProject}. The default wraps the plain read and\n\t * reports `truncated: false`; a provider whose per-project drain is capped by a page backstop overrides\n\t * this to report incompleteness. Optional metadata lets providers surface structured per-project failures\n\t * (e.g. a page-level auth rejection) without discarding the already-fetched prefix.\n\t */\n\tprotected async getProviderIssuesForProjectWithTruncation(\n\t\tsession: ProviderAuthenticationSession,\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t): Promise<ProjectIssuesDrain | undefined> {\n\t\tconst values = await this.getProviderIssuesForProject(session, project, options);\n\t\tif (values == null) return undefined;\n\t\treturn { values: values, truncated: false };\n\t}\n}\n"],"mappings":";;;;;;;AAcA,SAAgB,oBAAoB,aAA4D;CAC/F,OAAO,YAAY,SAAS;AAC7B;AAEA,IAAsB,oBAAtB,cAGU,gBAAoB;CAC7B,OAAiC;CAEjC,IAAI,kCAA2C;EAC9C,OAAO,KAAK,gCAAgC;CAC7C;CAEA,2BACC,YACA,IACA,SACgD;EAChD,MAAM,mBAAmB,KAAK;EAC9B,IAAI,oBAAoB,MACvB,OAAO,QAAQ,QAAQ,EACtB,OAAO,IAAI,gCACV,KAAK,MACL,oDACD,EACD,CAAC;EAGF,MAAM,EAAE,aAAa,GAAG,gBAAgB,WAAW,CAAC;EACpD,MAAM,WAAW;GAAE,KAAK;GAAwB;GAAyB;EAAY;EACrF,OAAO,KAAK,mBAAmB,UAAU,IAAI,cAAa,YACzD,iBAAiB,KAAK,MAAM,SAAS,YAAY,IAAI,WAAW,CACjE;CACD;CASA,MACM,sBAAsB,UAAa,cAAqD;EAC7F,QAAQ,MAAM,KAAK,4BAA4B,UAAU,YAAY,EAAA,EAAI;CAC1E;;;;;;;CAQA,MACM,4BACL,UACA,cACkD;EAClD,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,UAAU,MAAM,KAAK,8BAA8B,SAAS,QAAQ;GAC1E,KAAK,2BAA2B,uBAAuB;GACvD,OAAO,EAAE,OAAO,QAAQ;EACzB,SAAS,IAAI;GACZ,KAAK,wBAAwB,yBAAyB,IAAI,EAAgB,aAAa,CAAC;GACxF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;CAOA,MACM,oBAAoB,cAAiD;EAC1E,QAAQ,MAAM,KAAK,0BAA0B,YAAY,EAAA,EAAI;CAC9D;;;;;;CAOA,MACM,0BAA0B,cAAoE;EACnG,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,YAAY,MAAM,KAAK,4BAA4B,OAAO;GAChE,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,UAAU;EAC3B,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAUA,MACM,0CACL,WACA,cACyE;EACzE,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,4CAA4C,SAAS,SAAS;GAC1F,MAAM,KAAK,0BAA0B,SAAS,SAAS,QAAQ;GAC/D,KAAK,2BAA2B,yBAAyB;GACzD,OAAO,EAAE,OAAO,SAAS;EAC1B,SAAS,IAAI;GACZ,KAAK,wBAAwB,2BAA2B,IAAI,EAAgB,aAAa,CAAC;GAC1F,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAQA,MAAgB,4CACf,SACA,WAC0C;EAE1C,OAAO,EAAE,QAAQ,MADM,KAAK,gCAAgC,SAAS,SAAS,KACjD,CAAC,EAAE;CACjC;CAOA,MACM,oBACL,SACA,SACA,cACoC;EACpC,QAAQ,MAAM,KAAK,0BAA0B,SAAS,SAAS,YAAY,EAAA,EAAI;CAChF;;;;;;CAOA,MAAM,0BACL,SACA,SACA,cACuD;EACvD,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,SAAS,MAAM,KAAK,4BAA4B,SAAS,SAAS,OAAO;GAC/E,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,OAAO;EACxB,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAQA,MAAM,wCACL,SACA,SACA,cAC6D;EAC7D,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,SAAS,MAAM,KAAK,0CAA0C,SAAS,SAAS,OAAO;GAC7F,MAAM,KAAK,0BAA0B,SAAS,QAAQ,QAAQ;GAC9D,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,OAAO;EACxB,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAcA,MAAgB,0CACf,SACA,SACA,SAC0C;EAC1C,MAAM,SAAS,MAAM,KAAK,4BAA4B,SAAS,SAAS,OAAO;EAC/E,IAAI,UAAU,MAAM,OAAO,KAAA;EAC3B,OAAO;GAAU;GAAQ,WAAW;EAAM;CAC3C;AACD;AAhME,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,yBAAA,IAAA;AAWN,WAAA,CAAA,KAAK,CAAA,GAAA,kBAAA,WAAA,+BAAA,IAAA;AAyBL,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,uBAAA,IAAA;AAUN,WAAA,CAAA,KAAK,CAAA,GAAA,kBAAA,WAAA,6BAAA,IAAA;AAyBL,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,6CAAA,IAAA;AAwCN,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,uBAAA,IAAA"}

package/dist/plus/integrations/models/pullRequestReads.d.ts

@@ -1,4 +1,5 @@
 import { PullRequestShape } from "../../../git/models/pullRequest.js";
+import { CollectionMetadata } from "@gitkraken/provider-apis";
 //#region ../plus/integrations/src/models/pullRequestReads.d.ts
 /**
  * One provider page of the filtered pull-request search, before the facade turns it into a neutral
@@ -7,6 +8,14 @@ import { PullRequestShape } from "../../../git/models/pullRequest.js";
  * `totalCount` is the provider-reported pre-ceiling facet count, not the number of rows that remain reachable
  * after a provider limit. It stays optional because absence means "not reported", never zero. Together with
  * `truncated` it lets the facade distinguish GitHub's quantified ceiling from another unusable continuation.
+ *
+ * `metadata` carries the facets whose rows are missing from the walk so far — Bitbucket Data Center reads every
+ * facet as its own request, so one can be refused (a repository the token can't see) without the others. It
+ * describes the whole walk rather than one page: a facet that failed on this page is reported here and retried on
+ * the next, and one whose retry failed too is dropped and reported on every later page, since its hole is still in
+ * the result. A retry that succeeds recovers the rows, so it drops out. The last page read is therefore the one to
+ * assess; the facade reports each failure as a warning with `fetchFailed`, and a page where EVERY facet failed
+ * throws instead.
  */
 export type ProviderPullRequestSearchPage = {
   values: PullRequestShape[];
@@ -15,6 +24,23 @@ export type ProviderPullRequestSearchPage = {
   hasMore: boolean;
   page: number;
   totalCount?: number;
+  metadata?: CollectionMetadata;
+  /** See `ProviderIssueSearchPage.limitReached`. */
+  limitReached?: boolean;
+};
+/**
+ * One scope's pull-request count, as the provider reports it.
+ *
+ * `lowerBound` marks a count that stopped before the scope was exhausted: a provider with no count query
+ * (Bitbucket Data Center) counts by reading, within a budget, so past it `count` is how many matched in what was
+ * read — a floor, never the total.
+ *
+ * An `Error` in its place refuses that ONE scope for its own reasons (Azure DevOps Server refusing a scope it can't
+ * search): the facade warns and drops only it, as it does for a scope it refuses itself.
+ */
+export type ProviderPullRequestCount = {
+  count: number | undefined;
+  lowerBound?: boolean;
 };
 //#endregion
 //# sourceMappingURL=pullRequestReads.d.ts.map

package/dist/plus/integrations/providers/azure/azure.d.ts

@@ -1,12 +1,13 @@
 import { Disposable } from "../../../../utils/disposable.js";
 import { Provider } from "../../../../git/models/remoteProvider.js";
 import { IssueOrPullRequest, IssueOrPullRequestType } from "../../../../git/models/issueOrPullRequest.js";
-import { Issue } from "../../../../git/models/issue.js";
+import { Issue, IssueSearchCriteria } from "../../../../git/models/issue.js";
 import { PullRequest } from "../../../../git/models/pullRequest.js";
 import { UnidentifiedAuthor } from "../../../../git/models/author.js";
 import { DefaultBranch } from "../../../../git/models/defaultBranch.js";
 import { RepositoryMetadata } from "../../../../git/models/repositoryMetadata.js";
 import { TokenWithInfo } from "../../authentication/models.js";
+import { ProviderIssueSearchPage } from "../../models/issueReads.js";
 import { ProviderApiConfig } from "../apiConfig.js";
 import { AzureProjectDescriptor, AzureWorkItemStateCategory } from "./models.js";
 import { IntegrationServiceContext } from "../../context.js";
@@ -16,6 +17,12 @@ export declare class AzureDevOpsApi implements Disposable {
   private readonly _disposable;
   private _workItemStates;
   private readonly _forkRepositoryUrls;
+  /**
+   * The ordered ids each filtered work-item search's first page queried, paged through by its continuations. Kept
+   * alive while a pagination keeps reading them (see `workItemSearchSnapshotTtl`). Every first page adds one, so
+   * the capacity leaves room for repeated first pages before an idle pagination's snapshot is the one evicted.
+   */
+  private readonly _workItemSearches;
   constructor(config: ProviderApiConfig);
   dispose(): void;
   private resetCaches;
@@ -35,6 +42,19 @@ export declare class AzureDevOpsApi implements Disposable {
   getAccountForCommit(provider: Provider, token: TokenWithInfo, owner: string, repo: string, rev: string, baseUrl: string, _options?: {
     avatarSize?: number;
   }): Promise<UnidentifiedAuthor | undefined>;
+  /**
+   * The collection an Azure DevOps Server address names, or `undefined` when it names the installation.
+   *
+   * Below a collection, `connectionData` describes that collection: its `instanceId` is the collection's id, and its
+   * `webApplicationRelativeDirectory` ends in the collection's path segment (`DefaultCollection/`); it is empty or
+   * absent at the server level. As measured against Azure DevOps Server 2020. The directory may also carry the
+   * installation's own virtual directory before the collection (`tfs/DefaultCollection/`), so only its LAST segment
+   * names the collection, and only when it is the last segment of the address asked about.
+   */
+  getAddressedCollection(provider: Provider, token: TokenWithInfo, baseUrl: string): Promise<{
+    id: string;
+    name: string;
+  } | undefined>;
   getCurrentUserOnServer(provider: Provider, token: TokenWithInfo, baseUrl: string): Promise<{
     id: string;
     name?: string;
@@ -52,6 +72,51 @@ export declare class AzureDevOpsApi implements Disposable {
   getDefaultBranch(provider: Provider, token: TokenWithInfo, owner: string, repo: string, options: {
     baseUrl: string;
   }, cancellation?: AbortSignal): Promise<DefaultBranch | undefined>;
+  /**
+   * One page of a filtered work-item search over a collection: a WIQL query for the ordered ids, then one detail
+   * read for the page's slice of them.
+   *
+   * The ids a first page queried are kept as the snapshot its continuations page through, for as long as the
+   * pagination keeps reading it, so it reads a consistent set rather than re-running a query whose rows move under
+   * an `updated` order. Each first page queries its own snapshot, so paginations of one query never share one, and
+   * a continuation whose snapshot is gone is refused (see {@link AzureWorkItemSearchCursor}).
+   *
+   * The query asks for one id more than {@link azureWorkItemSearchResultLimit}, bounded by `$top`: the extra id is
+   * what tells "exactly the limit" from "past it". Past it, the page is `truncated` with `limitReached` and no total,
+   * since the true count is unknowable here. A server that refuses the match set even so fails the page with a
+   * "narrow the search" error: no bounded query could serve that order's first window.
+   *
+   * `resolveProject` maps each result's project name to its descriptor. A work item in a project it doesn't know
+   * fails the page rather than being dropped or mis-attributed, since either would leave the page disagreeing with
+   * the count of the same query; the caller refreshes its project discovery before a search so that means a
+   * project created during the pagination.
+   */
+  searchWorkItemsPage(provider: Provider, token: TokenWithInfo, collection: string, options: {
+    baseUrl: string;
+    criteria?: IssueSearchCriteria;
+    projectNames?: readonly string[];
+    resolveProject: (name: string) => AzureProjectDescriptor | undefined;
+    cursor?: string;
+    pageSize?: number;
+  }, cancellation?: AbortSignal): Promise<ProviderIssueSearchPage>;
+  /**
+   * How many work items the same WIQL {@link searchWorkItemsPage} would page through match, reading no details.
+   *
+   * Asks for one id more than the result ceiling, so the count is exact up to it and `'exceeds-limit'` past it —
+   * never the ceiling itself, which would understate the match set.
+   */
+  countWorkItems(provider: Provider, token: TokenWithInfo, collection: string, options: {
+    baseUrl: string;
+    criteria?: IssueSearchCriteria;
+    projectNames?: readonly string[];
+  }, cancellation?: AbortSignal): Promise<number | 'exceeds-limit'>;
+  /**
+   * The ids a collection-level WIQL query matches, in its order.
+   *
+   * `api-version=5.0` is the oldest version every Azure DevOps Server release this search supports (2019 and later)
+   * answers; `timePrecision=true` is what lets the criteria's dates compare as instants — see `toWiqlDate`.
+   */
+  private queryWorkItemIds;
   private getRepository;
   private toPullRequest;
   /**

package/dist/plus/integrations/providers/azure/azure.js

@@ -7,13 +7,27 @@ import __decorate from "../../../../_virtual/@oxc-project+runtime/helpers/esm/de
 import { AuthenticationError, RequestClientError, RequestNotFoundError } from "../../../../git/errors.js";
 import { maybeStopWatch } from "../../../../utils/stopwatch.js";
 import { base64 } from "../../../../utils/base64.js";
-import { sha256 } from "../../../../utils/crypto.js";
+import { sha256, uuid } from "../../../../utils/crypto.js";
+import { effectiveIssueSort } from "../../../../git/utils/issue.utils.js";
 import { ProviderFetchError, isRateLimitResponse, toRateLimitError } from "../../errors.js";
+import { azureWorkItemSearchResultLimit, parseAzureWorkItemSearchCursor, toAzureSearchPageSize, toAzureWorkItemSearchCursorKey, toAzureWorkItemSearchWiql } from "./search.js";
+import { decodePathSegment } from "../../utils/domain.utils.js";
 import { baseProviderApiConfig } from "../apiConfig.js";
 import { azurePullRequestStatusToState, azureWorkItemsStateCategoryToState, fromAzurePullRequest, fromAzureWorkItem, getAzurePullRequestWebUrl, isClosedAzurePullRequestStatus, isClosedAzureWorkItemStateCategory, normalizeAzureBranchName, sanitizeAzureRepositoryUrl } from "./models.js";
 import * as l10n from "@vscode/l10n";
 //#region ../plus/integrations/src/providers/azure/azure.ts
 const forkRepositoryUrlCacheTtl = 3e5;
+/** How long a work-item search's id snapshot outlives the last page read from it, and the most it lives at all. */
+const workItemSearchSnapshotTtl = 3e5;
+const workItemSearchSnapshotMaxTtl = 18e5;
+function encodePathSegment(value) {
+	if (value === "." || value === "..") throw new Error(`Invalid Azure path segment '${value}'.`);
+	return encodeURIComponent(value);
+}
+/** Whether Azure refused a WIQL query for matching more work items than it will return (`VS402337`). */
+function isWorkItemLimitRefusal(ex) {
+	return ex instanceof RequestClientError && ex.message.includes("VS402337");
+}
 function parseAzureRepositoryDescriptor(repo) {
 	const parts = repo.split("/");
 	const [projectName, segment, repoName] = parts;
@@ -65,6 +79,16 @@ var AzureDevOpsApi = class {
 		capacity: 100,
 		createTTL: forkRepositoryUrlCacheTtl
 	});
+	/**
+	* The ordered ids each filtered work-item search's first page queried, paged through by its continuations. Kept
+	* alive while a pagination keeps reading them (see `workItemSearchSnapshotTtl`). Every first page adds one, so
+	* the capacity leaves room for repeated first pages before an idle pagination's snapshot is the one evicted.
+	*/
+	_workItemSearches = new PromiseCache({
+		capacity: 50,
+		accessTTL: workItemSearchSnapshotTtl,
+		createTTL: workItemSearchSnapshotMaxTtl
+	});
 	constructor(config) {
 		this.config = config;
 		this._disposable = config.onConfigChanged?.(() => this.resetCaches());
@@ -75,12 +99,13 @@ var AzureDevOpsApi = class {
 	resetCaches() {
 		this._workItemStates.clear();
 		this._forkRepositoryUrls.clear();
+		this._workItemSearches.clear();
 	}
 	async getPullRequestForBranch(provider, token, owner, repo, branch, options) {
 		const scope = getScopedLogger();
 		const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
 		try {
-			const pr = ((await this.request(provider, token, options?.baseUrl, `${owner}/${projectName}/_apis/git/repositories/${repoName}/pullRequests?searchCriteria.status=all&searchCriteria.sourceRefName=refs/heads/${branch}`, { method: "GET" }, scope))?.value.sort((a, b) => {
+			const pr = ((await this.request(provider, token, options?.baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/pullRequests?searchCriteria.status=all&searchCriteria.sourceRefName=${encodeURIComponent(`refs/heads/${branch}`)}`, { method: "GET" }, scope))?.value.sort((a, b) => {
 				const aIsOpen = a.status === "active" || a.status === "notSet";
 				if (aIsOpen !== (b.status === "active" || b.status === "notSet")) return aIsOpen ? -1 : 1;
 				const aDate = new Date(a.closedDate || a.creationDate);
@@ -98,7 +123,7 @@ var AzureDevOpsApi = class {
 		const scope = getScopedLogger();
 		const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
 		try {
-			const pr = (await this.request(provider, token, baseUrl, `${owner}/${projectName}/_apis/git/repositories/${repoName}/pullrequestquery?api-version=4.1`, {
+			const pr = (await this.request(provider, token, baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/pullrequestquery?api-version=4.1`, {
 				method: "POST",
 				body: JSON.stringify({ queries: [{
 					items: [rev],
@@ -106,7 +131,7 @@ var AzureDevOpsApi = class {
 				}] })
 			}, scope, cancellation))?.results[0]?.[rev]?.[0];
 			if (pr == null) return void 0;
-			const pullRequest = await this.request(provider, token, baseUrl, `${owner}/${encodeURIComponent(pr.repository.project.id)}/_apis/git/repositories/${encodeURIComponent(pr.repository.id)}/pullRequests/${encodeURIComponent(pr.pullRequestId.toString())}`, { method: "GET" }, scope, cancellation);
+			const pullRequest = await this.request(provider, token, baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(pr.repository.project.id)}/_apis/git/repositories/${encodePathSegment(pr.repository.id)}/pullRequests/${encodePathSegment(pr.pullRequestId.toString())}`, { method: "GET" }, scope, cancellation);
 			if (pullRequest == null) return void 0;
 			return await this.toPullRequest(pullRequest, provider, token, owner, baseUrl, scope, cancellation);
 		} catch (ex) {
@@ -119,7 +144,7 @@ var AzureDevOpsApi = class {
 		const scope = getScopedLogger();
 		const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
 		if (options?.type === void 0 || options?.type === "issue") try {
-			const issueResult = await this.request(provider, token, options?.baseUrl, `${owner}/${projectName}/_apis/wit/workItems/${id}`, { method: "GET" }, scope);
+			const issueResult = await this.request(provider, token, options?.baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/wit/workItems/${encodePathSegment(id)}`, { method: "GET" }, scope);
 			if (issueResult != null) {
 				const issueType = issueResult.fields["System.WorkItemType"];
 				const state = issueResult.fields["System.State"];
@@ -145,7 +170,7 @@ var AzureDevOpsApi = class {
 			}
 		}
 		if (options?.type === void 0 || options?.type === "pullrequest") try {
-			const prResult = await this.request(provider, token, options?.baseUrl, `${owner}/${projectName}/_apis/git/repositories/${repoName}/pullRequests/${id}`, { method: "GET" }, scope);
+			const prResult = await this.request(provider, token, options?.baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/pullRequests/${encodePathSegment(id)}`, { method: "GET" }, scope);
 			if (prResult != null) return {
 				id: prResult.pullRequestId.toString(),
 				type: "pullrequest",
@@ -170,7 +195,7 @@ var AzureDevOpsApi = class {
 	async getIssue(provider, token, project, id, options) {
 		const scope = getScopedLogger();
 		try {
-			const issueResult = await this.request(provider, token, options?.baseUrl, `${project.resourceName}/${project.name}/_apis/wit/workItems/${id}`, { method: "GET" }, scope);
+			const issueResult = await this.request(provider, token, options?.baseUrl, `${encodePathSegment(project.resourceName)}/${encodePathSegment(project.name)}/_apis/wit/workItems/${encodePathSegment(id)}`, { method: "GET" }, scope);
 			if (issueResult != null) {
 				const issueType = issueResult.fields["System.WorkItemType"];
 				const state = issueResult.fields["System.State"];
@@ -189,7 +214,7 @@ var AzureDevOpsApi = class {
 		const scope = getScopedLogger();
 		const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
 		try {
-			const author = (await this.request(provider, token, baseUrl, `${owner}/${projectName}/_apis/git/repositories/${repoName}/commits/${rev}`, { method: "GET" }, scope))?.author;
+			const author = (await this.request(provider, token, baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/commits/${encodePathSegment(rev)}`, { method: "GET" }, scope))?.author;
 			if (!author) return;
 			return {
 				provider,
@@ -207,6 +232,28 @@ var AzureDevOpsApi = class {
 			}
 		}
 	}
+	/**
+	* The collection an Azure DevOps Server address names, or `undefined` when it names the installation.
+	*
+	* Below a collection, `connectionData` describes that collection: its `instanceId` is the collection's id, and its
+	* `webApplicationRelativeDirectory` ends in the collection's path segment (`DefaultCollection/`); it is empty or
+	* absent at the server level. As measured against Azure DevOps Server 2020. The directory may also carry the
+	* installation's own virtual directory before the collection (`tfs/DefaultCollection/`), so only its LAST segment
+	* names the collection, and only when it is the last segment of the address asked about.
+	*/
+	async getAddressedCollection(provider, token, baseUrl) {
+		const scope = getScopedLogger();
+		const connectionData = await this.request(provider, token, baseUrl, "_apis/connectionData", { method: "GET" }, scope);
+		const segment = connectionData?.webApplicationRelativeDirectory?.split("/").findLast(Boolean);
+		const addressed = new URL(baseUrl).pathname.split("/").findLast(Boolean);
+		if (segment == null || addressed == null || connectionData?.instanceId == null) return void 0;
+		const name = decodePathSegment(segment);
+		if (name.toLowerCase() !== decodePathSegment(addressed).toLowerCase()) return void 0;
+		return {
+			id: connectionData.instanceId,
+			name
+		};
+	}
 	async getCurrentUserOnServer(provider, token, baseUrl) {
 		const scope = getScopedLogger();
 		try {
@@ -226,7 +273,11 @@ var AzureDevOpsApi = class {
 		}
 	}
 	async getWorkItemStateCategory(issueType, state, provider, token, owner, projectName, options) {
-		const project = `${owner}/${projectName}`;
+		const project = JSON.stringify([
+			options.baseUrl,
+			owner,
+			projectName
+		]);
 		const category = this._workItemStates.getStateCategory(project, issueType, state);
 		if (category != null) return category;
 		const states = await this.retrieveWorkItemTypeStates(issueType, provider, token, owner, projectName, options);
@@ -236,7 +287,7 @@ var AzureDevOpsApi = class {
 	async retrieveWorkItemTypeStates(workItemType, provider, token, owner, projectName, options) {
 		const scope = getScopedLogger();
 		try {
-			return (await this.request(provider, token, options?.baseUrl, `${owner}/${projectName}/_apis/wit/workItemTypes/${workItemType}/states`, { method: "GET" }, scope))?.value ?? [];
+			return (await this.request(provider, token, options?.baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/wit/workItemTypes/${encodePathSegment(workItemType)}/states`, { method: "GET" }, scope))?.value ?? [];
 		} catch (ex) {
 			if (ex instanceof AuthenticationError) throw ex;
 			scope?.error(ex);
@@ -279,9 +330,123 @@ var AzureDevOpsApi = class {
 			return;
 		}
 	}
+	/**
+	* One page of a filtered work-item search over a collection: a WIQL query for the ordered ids, then one detail
+	* read for the page's slice of them.
+	*
+	* The ids a first page queried are kept as the snapshot its continuations page through, for as long as the
+	* pagination keeps reading it, so it reads a consistent set rather than re-running a query whose rows move under
+	* an `updated` order. Each first page queries its own snapshot, so paginations of one query never share one, and
+	* a continuation whose snapshot is gone is refused (see {@link AzureWorkItemSearchCursor}).
+	*
+	* The query asks for one id more than {@link azureWorkItemSearchResultLimit}, bounded by `$top`: the extra id is
+	* what tells "exactly the limit" from "past it". Past it, the page is `truncated` with `limitReached` and no total,
+	* since the true count is unknowable here. A server that refuses the match set even so fails the page with a
+	* "narrow the search" error: no bounded query could serve that order's first window.
+	*
+	* `resolveProject` maps each result's project name to its descriptor. A work item in a project it doesn't know
+	* fails the page rather than being dropped or mis-attributed, since either would leave the page disagreeing with
+	* the count of the same query; the caller refreshes its project discovery before a search so that means a
+	* project created during the pagination.
+	*/
+	async searchWorkItemsPage(provider, token, collection, options, cancellation) {
+		const scope = getScopedLogger();
+		const wiql = toAzureWorkItemSearchWiql(options.criteria, effectiveIssueSort(options.criteria?.sort), options.projectNames);
+		const key = toAzureWorkItemSearchCursorKey(collection, wiql);
+		const pageSize = toAzureSearchPageSize(options.pageSize, 100, 200);
+		const cursor = parseAzureWorkItemSearchCursor(options.cursor, key, pageSize);
+		const page = cursor?.page ?? 1;
+		const snapshot = cursor?.snapshot ?? uuid();
+		const snapshotKey = JSON.stringify([
+			await sha256(token.accessToken),
+			options.baseUrl,
+			collection,
+			wiql,
+			snapshot
+		]);
+		const snapshotFound = cursor?.snapshot != null ? this._workItemSearches.get(snapshotKey) : void 0;
+		if (cursor?.snapshot != null && snapshotFound == null) throw new Error("Work item search results expired; restart the read without a cursor");
+		const result = await (snapshotFound ?? this._workItemSearches.getOrCreate(snapshotKey, (_cacheable, signal) => this.queryWorkItemIds(provider, token, collection, options.baseUrl, wiql, 20001, scope, signal).catch((ex) => {
+			if (isWorkItemLimitRefusal(ex)) throw new Error(`${provider.name} refused a work item search matching more than 20000 results; narrow the search`);
+			throw ex;
+		}), { cancellation }));
+		const limitReached = result.length > azureWorkItemSearchResultLimit;
+		const ids = limitReached ? result.slice(0, azureWorkItemSearchResultLimit) : result;
+		const offset = cursor?.offset ?? 0;
+		const slice = ids.slice(offset, offset + pageSize);
+		const values = [];
+		if (slice.length > 0) {
+			const workItems = await this.request(provider, token, options.baseUrl, `${encodePathSegment(collection)}/_apis/wit/workitemsbatch?api-version=5.0`, {
+				method: "POST",
+				body: JSON.stringify({
+					ids: slice,
+					$expand: "Links",
+					errorPolicy: "Omit"
+				})
+			}, scope, cancellation);
+			const byId = new Map((workItems?.value ?? []).filter((w) => w != null).map((w) => [w.id, w]));
+			for (const id of slice) {
+				const workItem = byId.get(id);
+				if (workItem == null) continue;
+				const projectName = workItem.fields["System.TeamProject"];
+				const project = options.resolveProject(projectName);
+				if (project == null) throw new Error(`Azure DevOps work item ${id} is in project '${projectName}', which isn't visible`);
+				const stateCategory = await this.getWorkItemStateCategory(workItem.fields["System.WorkItemType"], workItem.fields["System.State"], provider, token, collection, project.name, options);
+				values.push(fromAzureWorkItem(workItem, provider, project, stateCategory));
+			}
+		}
+		const nextOffset = offset + slice.length;
+		const hasMore = nextOffset < ids.length;
+		const next = {
+			key,
+			snapshot,
+			offset: nextOffset,
+			page: page + 1
+		};
+		return {
+			values,
+			cursor: hasMore ? JSON.stringify(next) : void 0,
+			hasMore,
+			page,
+			truncated: limitReached,
+			totalCount: limitReached ? void 0 : ids.length,
+			limitReached: limitReached || void 0
+		};
+	}
+	/**
+	* How many work items the same WIQL {@link searchWorkItemsPage} would page through match, reading no details.
+	*
+	* Asks for one id more than the result ceiling, so the count is exact up to it and `'exceeds-limit'` past it —
+	* never the ceiling itself, which would understate the match set.
+	*/
+	async countWorkItems(provider, token, collection, options, cancellation) {
+		const scope = getScopedLogger();
+		const wiql = toAzureWorkItemSearchWiql(options.criteria, effectiveIssueSort(options.criteria?.sort), options.projectNames);
+		try {
+			const ids = await this.queryWorkItemIds(provider, token, collection, options.baseUrl, wiql, azureWorkItemSearchResultLimit + 1, scope, cancellation);
+			return ids.length > 2e4 ? "exceeds-limit" : ids.length;
+		} catch (ex) {
+			if (isWorkItemLimitRefusal(ex)) return "exceeds-limit";
+			throw ex;
+		}
+	}
+	/**
+	* The ids a collection-level WIQL query matches, in its order.
+	*
+	* `api-version=5.0` is the oldest version every Azure DevOps Server release this search supports (2019 and later)
+	* answers; `timePrecision=true` is what lets the criteria's dates compare as instants — see `toWiqlDate`.
+	*/
+	async queryWorkItemIds(provider, token, collection, baseUrl, wiql, top, scope, cancellation) {
+		const result = await this.request(provider, token, baseUrl, `${encodePathSegment(collection)}/_apis/wit/wiql?$top=${top}&timePrecision=true&api-version=5.0`, {
+			method: "POST",
+			body: JSON.stringify({ query: wiql })
+		}, scope, cancellation);
+		if (result?.workItems == null) throw new Error("Azure DevOps returned no work item query result");
+		return result.workItems.map((w) => w.id);
+	}
 	getRepository(provider, token, owner, repo, baseUrl, scope, cancellation) {
 		const { projectName, repoName } = parseAzureRepositoryDescriptor(repo);
-		return this.request(provider, token, baseUrl, `${owner}/${projectName}/_apis/git/repositories/${repoName}?api-version=7.1`, { method: "GET" }, scope, cancellation);
+		return this.request(provider, token, baseUrl, `${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}?api-version=7.1`, { method: "GET" }, scope, cancellation);
 	}
 	async toPullRequest(pr, provider, token, owner, baseUrl, scope, cancellation) {
 		const forkRepositoryUrls = await this.getForkRepositoryUrls(provider, token, owner, baseUrl, pr.forkSource?.repository, scope, cancellation);
@@ -314,7 +479,7 @@ var AzureDevOpsApi = class {
 	}
 	async fetchForkRepositoryUrls(provider, token, owner, baseUrl, repositoryId, cacheable, scope, cancellation) {
 		try {
-			const response = await this.request(provider, token, baseUrl, `${owner}/_apis/git/repositories/${encodeURIComponent(repositoryId)}?api-version=4.1`, { method: "GET" }, scope, cancellation);
+			const response = await this.request(provider, token, baseUrl, `${encodePathSegment(owner)}/_apis/git/repositories/${encodePathSegment(repositoryId)}?api-version=4.1`, { method: "GET" }, scope, cancellation);
 			const webUrl = sanitizeAzureRepositoryUrl(response?.webUrl, baseUrl, owner);
 			const cloneHttps = sanitizeAzureRepositoryUrl(response?.remoteUrl, baseUrl, owner);
 			const url = webUrl ?? cloneHttps;
@@ -430,6 +595,11 @@ __decorate([trace({ args: (provider, token, owner, repo, rev, baseUrl) => ({
 	rev,
 	baseUrl
 }) })], AzureDevOpsApi.prototype, "getAccountForCommit", null);
+__decorate([trace({ args: (provider, token, baseUrl) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	baseUrl
+}) })], AzureDevOpsApi.prototype, "getAddressedCollection", null);
 __decorate([trace({ args: (provider, token, baseUrl) => ({
 	provider: provider.name,
 	token: `<token:${token.microHash}>`,
@@ -447,6 +617,16 @@ __decorate([trace({ args: (provider, token, owner, repo) => ({
 	owner,
 	repo
 }) })], AzureDevOpsApi.prototype, "getDefaultBranch", null);
+__decorate([trace({ args: (provider, token, collection) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	collection
+}) })], AzureDevOpsApi.prototype, "searchWorkItemsPage", null);
+__decorate([trace({ args: (provider, token, collection) => ({
+	provider: provider.name,
+	token: `<token:${token.microHash}>`,
+	collection
+}) })], AzureDevOpsApi.prototype, "countWorkItems", null);
 /** Wires an {@link AzureDevOpsApi} from the full runtime context, mapping `ctx` down to the narrow config. */
 function createAzureDevOpsApi(ctx) {
 	return new AzureDevOpsApi(baseProviderApiConfig(ctx));