npm - @gitkraken/core-gitlens - Versions diffs - 0.7.0 → 0.7.2 - Mend

@gitkraken/core-gitlens 0.7.0 → 0.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (125) hide show

package/dist/plus/integrations/providers/azure/azure.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"azure.js","names":["Logger"],"sources":["../../../../../../plus/integrations/src/providers/azure/azure.ts"],"sourcesContent":["import * as l10n from '@vscode/l10n';\nimport type { UnidentifiedAuthor } from '@gitlens/git/models/author.js';\nimport type { DefaultBranch } from '@gitlens/git/models/defaultBranch.js';\nimport type { Issue } from '@gitlens/git/models/issue.js';\nimport type { IssueOrPullRequest, IssueOrPullRequestType } from '@gitlens/git/models/issueOrPullRequest.js';\nimport type { PullRequest } from '@gitlens/git/models/pullRequest.js';\nimport type { Provider } from '@gitlens/git/models/remoteProvider.js';\nimport type { RepositoryMetadata } from '@gitlens/git/models/repositoryMetadata.js';\nimport { base64 } from '@gitlens/utils/base64.js';\nimport { CancellationError, isCancellationError } from '@gitlens/utils/cancellation.js';\nimport { sha256 } from '@gitlens/utils/crypto.js';\nimport { trace } from '@gitlens/utils/decorators/log.js';\nimport type { Disposable } from '@gitlens/utils/disposable.js';\nimport { Logger } from '@gitlens/utils/logger.js';\nimport type { ScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport { getScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport type { CacheController } from '@gitlens/utils/promiseCache.js';\nimport { PromiseCache } from '@gitlens/utils/promiseCache.js';\nimport { maybeStopWatch } from '@gitlens/utils/stopwatch.js';\nimport type { TokenWithInfo } from '../../authentication/models.js';\nimport type { IntegrationServiceContext } from '../../context.js';\nimport {\n\tAuthenticationError,\n\tAuthenticationErrorReason,\n\tisRateLimitResponse,\n\tProviderFetchError,\n\tRequestClientError,\n\tRequestNotFoundError,\n\ttoRateLimitError,\n} from '../../errors.js';\nimport type { ProviderApiConfig } from '../apiConfig.js';\nimport { baseProviderApiConfig } from '../apiConfig.js';\nimport type {\n\tAzureForkRepositoryUrls,\n\tAzureGitCommit,\n\tAzureProjectDescriptor,\n\tAzurePullRequest,\n\tAzurePullRequestWithLinks,\n\tAzureRepositoryReference,\n\tAzureRepositoryUrls,\n\tAzureRepositoryWithMetadata,\n\tAzureWorkItemState,\n\tAzureWorkItemStateCategory,\n\tWorkItem,\n} from './models.js';\nimport {\n\tazurePullRequestStatusToState,\n\tazureWorkItemsStateCategoryToState,\n\tfromAzurePullRequest,\n\tfromAzureWorkItem,\n\tgetAzurePullRequestWebUrl,\n\tisClosedAzurePullRequestStatus,\n\tisClosedAzureWorkItemStateCategory,\n\tnormalizeAzureBranchName,\n\tsanitizeAzureRepositoryUrl,\n} from './models.js';\n\nconst forkRepositoryUrlCacheTtl = 5 * 60 * 1000;\n\nfunction parseAzureRepositoryDescriptor(repo: string): { projectName: string; repoName: string } {\n\tconst parts = repo.split('/');\n\tconst [projectName, segment, repoName] = parts;\n\tif (parts.length !== 3 \|\| segment !== '_git' \|\| !projectName \|\| !repoName) {\n\t\tthrow new Error(`Invalid Azure repository descriptor '${repo}'; expected '{project}/_git/{repoName}'.`);\n\t}\n\n\treturn { projectName: projectName, repoName: repoName };\n}\n\nclass WorkItemStates {\n\tprivate readonly _categories = new Map<string, AzureWorkItemStateCategory>();\n\tprivate readonly _types = new Map<string, AzureWorkItemState[]>();\n\n\t// TODO@sergeibbb: we might need some logic for invalidating\n\tpublic getStateCategory(\n\t\tproject: string,\n\t\tworkItemType: string,\n\t\tstateName: string,\n\t): AzureWorkItemStateCategory \| undefined {\n\t\treturn this._categories.get(this.getStateKey(project, workItemType, stateName));\n\t}\n\n\tpublic clear(): void {\n\t\tthis._categories.clear();\n\t\tthis._types.clear();\n\t}\n\n\tpublic saveTypeStates(project: string, workItemType: string, states: AzureWorkItemState[]): void {\n\t\tthis.clearTypeStates(project, workItemType);\n\t\tthis._types.set(this.getTypeKey(project, workItemType), states);\n\t\tfor (const state of states) {\n\t\t\tthis._categories.set(this.getStateKey(project, workItemType, state.name), state.category);\n\t\t}\n\t}\n\n\tpublic hasTypeStates(project: string, workItemType: string): boolean {\n\t\treturn this._types.has(this.getTypeKey(project, workItemType));\n\t}\n\n\tprivate clearTypeStates(project: string, workItemType: string): void {\n\t\tconst states = this._types.get(this.getTypeKey(project, workItemType));\n\t\tif (states == null) return;\n\n\t\tfor (const state of states) {\n\t\t\tthis._categories.delete(this.getStateKey(project, workItemType, state.name));\n\t\t}\n\t}\n\n\tprivate getStateKey(project: string, workItemType: string, stateName: string): string {\n\t\t// By stringifying the pair as JSON we make sure that all possible special characters are escaped\n\t\treturn JSON.stringify([project, workItemType, stateName]);\n\t}\n\n\tprivate getTypeKey(project: string, workItemType: string): string {\n\t\treturn JSON.stringify([project, workItemType]);\n\t}\n}\n\nexport class AzureDevOpsApi implements Disposable {\n\tprivate readonly _disposable: Disposable \| undefined;\n\tprivate _workItemStates: WorkItemStates = new WorkItemStates();\n\tprivate readonly _forkRepositoryUrls = new PromiseCache<string, AzureForkRepositoryUrls \| undefined>({\n\t\tcapacity: 100,\n\t\tcreateTTL: forkRepositoryUrlCacheTtl,\n\t});\n\n\tconstructor(private readonly config: ProviderApiConfig) {\n\t\tthis._disposable = config.onConfigChanged?.(() => this.resetCaches());\n\t}\n\n\tdispose(): void {\n\t\tthis._disposable?.dispose();\n\t}\n\n\tprivate resetCaches(): void {\n\t\tthis._workItemStates.clear();\n\t\tthis._forkRepositoryUrls.clear();\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, branch) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tbranch: branch,\n\t\t}),\n\t})\n\tpublic async getPullRequestForBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbranch: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<PullRequest \| undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ value: AzurePullRequest[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${owner}/${projectName}/_apis/git/repositories/${repoName}/pullRequests?searchCriteria.status=all&searchCriteria.sourceRefName=refs/heads/${branch}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\t// Sort PRs: open PRs first, then by most recent activity (creation or closure date)\n\t\t\tconst sortedPRs = prResult?.value.sort((a, b) => {\n\t\t\t\t// First, prioritize open PRs (active/notSet) over closed ones (abandoned/completed)\n\t\t\t\tconst aIsOpen = a.status === 'active' \|\| a.status === 'notSet';\n\t\t\t\tconst bIsOpen = b.status === 'active' \|\| b.status === 'notSet';\n\n\t\t\t\tif (aIsOpen !== bIsOpen) {\n\t\t\t\t\treturn aIsOpen ? -1 : 1; // Open PRs come first\n\t\t\t\t}\n\n\t\t\t\t// Among PRs with the same status, sort by most recent activity\n\t\t\t\t// Use closedDate if available, otherwise use creationDate\n\t\t\t\tconst aDate = new Date(a.closedDate \|\| a.creationDate);\n\t\t\t\tconst bDate = new Date(b.closedDate \|\| b.creationDate);\n\n\t\t\t\treturn bDate.getTime() - aDate.getTime(); // Most recent first\n\t\t\t});\n\n\t\t\tconst pr = sortedPRs?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getPullRequestForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest \| undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ results: Record<string, AzurePullRequest[]>[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${owner}/${projectName}/_apis/git/repositories/${repoName}/pullrequestquery?api-version=4.1`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\tqueries: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\titems: [rev],\n\t\t\t\t\t\t\t\ttype: 'commit',\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\n\t\t\tconst pr = prResult?.results[0]?.[rev]?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\tconst pullRequest = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${owner}/${encodeURIComponent(pr.repository.project.id)}/_apis/git/repositories/${encodeURIComponent(pr.repository.id)}/pullRequests/${encodeURIComponent(pr.pullRequestId.toString())}`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (pullRequest == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pullRequest, provider, token, owner, baseUrl, scope, cancellation);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssueOrPullRequest(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t\ttype?: IssueOrPullRequestType;\n\t\t},\n\t): Promise<IssueOrPullRequest \| undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\tif (options?.type === undefined \|\| options?.type === 'issue') {\n\t\t\ttry {\n\t\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${owner}/${projectName}/_apis/wit/workItems/${id}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (issueResult != null) {\n\t\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\t\tissueType,\n\t\t\t\t\t\tstate,\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken,\n\t\t\t\t\t\towner,\n\t\t\t\t\t\tprojectName,\n\t\t\t\t\t\toptions,\n\t\t\t\t\t);\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: issueResult.id.toString(),\n\t\t\t\t\t\ttype: 'issue',\n\t\t\t\t\t\tnodeId: issueResult.id.toString(),\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(issueResult.fields['System.CreatedDate']),\n\t\t\t\t\t\tupdatedDate: new Date(issueResult.fields['System.ChangedDate']),\n\t\t\t\t\t\tstate: azureWorkItemsStateCategoryToState(stateCategory),\n\t\t\t\t\t\tclosed: isClosedAzureWorkItemStateCategory(stateCategory),\n\t\t\t\t\t\ttitle: issueResult.fields['System.Title'],\n\t\t\t\t\t\turl: issueResult._links.html.href,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (options?.type === undefined \|\| options?.type === 'pullrequest') {\n\t\t\ttry {\n\t\t\t\tconst prResult = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${owner}/${projectName}/_apis/git/repositories/${repoName}/pullRequests/${id}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (prResult != null) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: prResult.pullRequestId.toString(),\n\t\t\t\t\t\ttype: 'pullrequest',\n\t\t\t\t\t\tnodeId: prResult.pullRequestId.toString(), // prResult.artifactId maybe?\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tupdatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tstate: azurePullRequestStatusToState(prResult.status),\n\t\t\t\t\t\tclosed: isClosedAzurePullRequestStatus(prResult.status),\n\t\t\t\t\t\ttitle: prResult.title,\n\t\t\t\t\t\turl: getAzurePullRequestWebUrl(prResult, options.baseUrl, owner),\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\treturn undefined;\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, project, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tproject: project,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssue(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tproject: AzureProjectDescriptor,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<Issue \| undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${project.resourceName}/${project.name}/_apis/wit/workItems/${id}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tif (issueResult != null) {\n\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\tissueType,\n\t\t\t\t\tstate,\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\tproject.resourceName,\n\t\t\t\t\tproject.name,\n\t\t\t\t\toptions,\n\t\t\t\t);\n\t\t\t\treturn fromAzureWorkItem(issueResult, provider, project, stateCategory);\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getAccountForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t): Promise<UnidentifiedAuthor \| undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst commit = await this.request<AzureGitCommit>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${owner}/${projectName}/_apis/git/repositories/${repoName}/commits/${rev}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\t\t\tconst author = commit?.author;\n\t\t\tif (!author) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\t// Azure API never gives us an id/username we can use, therefore we always return UnidentifiedAuthor\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tid: undefined,\n\t\t\t\tusername: undefined,\n\t\t\t\tname: author?.name,\n\t\t\t\temail: author?.email,\n\t\t\t\tavatarUrl: undefined,\n\t\t\t} satisfies UnidentifiedAuthor;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getCurrentUserOnServer(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string,\n\t): Promise<{ id: string; name?: string; email?: string; username?: string; avatarUrl?: string } \| undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst connectionData = await this.request<{\n\t\t\t\tauthenticatedUser?: {\n\t\t\t\t\tid: string;\n\t\t\t\t\tdescriptor: string;\n\t\t\t\t\tisActive: boolean;\n\t\t\t\t\tmetTypeId: number;\n\t\t\t\t\tproviderDisplayName?: string;\n\t\t\t\t\temailAddress?: string;\n\t\t\t\t\tresourceVersion: 2;\n\t\t\t\t\tsubjectDescriptor: string;\n\t\t\t\t\tproperties?: {\n\t\t\t\t\t\tAccount?: {\n\t\t\t\t\t\t\t$type: string;\n\t\t\t\t\t\t\t$value: string;\n\t\t\t\t\t\t};\n\t\t\t\t\t};\n\t\t\t\t};\n\t\t\t}>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t'_apis/connectionData',\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tconst user = connectionData?.authenticatedUser;\n\t\t\tconst username = user?.properties?.Account?.$value;\n\t\t\tif (!username) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\tid: user.id,\n\t\t\t\tname: user.providerDisplayName,\n\t\t\t\temail: user.emailAddress,\n\t\t\t\tusername: username,\n\t\t\t};\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is the whole point of this read failing; reporting \"no user\" instead hides it.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex, `Failed to get current user from ${baseUrl}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tasync getWorkItemStateCategory(\n\t\tissueType: string,\n\t\tstate: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemStateCategory \| undefined> {\n\t\tconst project = `${owner}/${projectName}`;\n\t\tconst category = this._workItemStates.getStateCategory(project, issueType, state);\n\t\tif (category != null) return category;\n\n\t\tconst states = await this.retrieveWorkItemTypeStates(issueType, provider, token, owner, projectName, options);\n\t\tthis._workItemStates.saveTypeStates(project, issueType, states);\n\n\t\treturn this._workItemStates.getStateCategory(project, issueType, state);\n\t}\n\n\tprivate async retrieveWorkItemTypeStates(\n\t\tworkItemType: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemState[]> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst issueResult = await this.request<{ value: AzureWorkItemState[]; count: number }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${owner}/${projectName}/_apis/wit/workItemTypes/${workItemType}/states`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\treturn issueResult?.value ?? [];\n\t\t} catch (ex) {\n\t\t\t// A rejected credential must not be degraded to an empty state list: the caller caches whatever this\n\t\t\t// returns, so an empty list would pin every work item of this type to an unknown state until the\n\t\t\t// cache is dropped — long after the session recovery this error is supposed to trigger.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn [];\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getRepositoryMetadata(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<RepositoryMetadata \| undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response == null) return undefined;\n\n\t\t\t// Azure's `parentRepository` only reliably carries the repo name and its project; a fork's parent\n\t\t\t// lives in the same organization, so the org (`owner`) is the parent owner. Only report `parent`\n\t\t\t// when the parent's name is actually present — never fall back to the fork's own name.\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\towner: owner,\n\t\t\t\t// Prefer the API's canonical name over parsing the composite `repo` descriptor string.\n\t\t\t\tname: response.name,\n\t\t\t\tisFork: response.isFork ?? false,\n\t\t\t\tparent:\n\t\t\t\t\tresponse.isFork && response.parentRepository?.name != null\n\t\t\t\t\t\t? { owner: owner, name: response.parentRepository.name }\n\t\t\t\t\t\t: undefined,\n\t\t\t} satisfies RepositoryMetadata;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getDefaultBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<DefaultBranch \| undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response?.defaultBranch == null) return undefined;\n\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tname: normalizeAzureBranchName(response.defaultBranch),\n\t\t\t} satisfies DefaultBranch;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tprivate getRepository(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger \| undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureRepositoryWithMetadata \| undefined> {\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\treturn this.request<AzureRepositoryWithMetadata>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t`${owner}/${projectName}/_apis/git/repositories/${repoName}?api-version=7.1`,\n\t\t\t{ method: 'GET' },\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t}\n\n\tprivate async toPullRequest(\n\t\tpr: AzurePullRequest,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger \| undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest> {\n\t\tconst forkRepositoryUrls = await this.getForkRepositoryUrls(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\towner,\n\t\t\tbaseUrl,\n\t\t\tpr.forkSource?.repository,\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t\treturn fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls);\n\t}\n\n\t/*\n\t Resolves the web and HTTPS clone URLs of the fork a cross-repository pull request comes from. Every other\n\t * repository URL the model reports is rebuilt from the pull request payload; only a fork reference lacks the\n\t * project to do that, so only a fork costs a request.\n\t \n\t Best-effort by contract: a fork in a project the token cannot read, a deleted fork, or a throttled request\n\t * leaves the head ref without a URL. It must never cost the pull request itself, which is what makes swallowing\n\t * the failure here the right call rather than a shortcut.\n\t /\n\tprivate async getForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepository: AzureRepositoryReference \| undefined,\n\t\tscope: ScopedLogger \| undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls \| undefined> {\n\t\tif (repository == null) return undefined;\n\n\t\tlet tokenHash: string;\n\t\ttry {\n\t\t\ttokenHash = await sha256(token.accessToken);\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst cacheKey = JSON.stringify([tokenHash, baseUrl, owner, repository.id]);\n\t\t// The request is shared, so the factory is handed the cache's aggregate signal rather than this caller's: it\n\t\t// aborts only once every caller waiting on the entry has cancelled.\n\t\treturn this._forkRepositoryUrls.getOrCreate(\n\t\t\tcacheKey,\n\t\t\t(cacheable, aggregate) =>\n\t\t\t\tthis.fetchForkRepositoryUrls(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\towner,\n\t\t\t\t\tbaseUrl,\n\t\t\t\t\trepository.id,\n\t\t\t\t\tcacheable,\n\t\t\t\t\tscope,\n\t\t\t\t\taggregate,\n\t\t\t\t),\n\t\t\t{ cancellation: cancellation },\n\t\t);\n\t}\n\n\tprivate async fetchForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepositoryId: string,\n\t\tcacheable: CacheController,\n\t\tscope: ScopedLogger \| undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls \| undefined> {\n\t\ttry {\n\t\t\tconst response = await this.request<AzureRepositoryUrls>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${owner}/_apis/git/repositories/${encodeURIComponent(repositoryId)}?api-version=4.1`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tconst webUrl = sanitizeAzureRepositoryUrl(response?.webUrl, baseUrl, owner);\n\t\t\tconst cloneHttps = sanitizeAzureRepositoryUrl(response?.remoteUrl, baseUrl, owner);\n\n\t\t\t// The clone URL stands in for the web URL when the response omits it — an older `api-version` promises\n\t\t\t// neither field, and naming the fork by the URL git would use beats naming it not at all.\n\t\t\tconst url = webUrl ?? cloneHttps;\n\t\t\tif (url == null) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn { url: url, cloneHttps: cloneHttps };\n\t\t} catch (ex) {\n\t\t\t// Missing or inaccessible forks are cached briefly; transient failures retry on the next read.\n\t\t\tif (!(ex instanceof RequestNotFoundError) && !(ex instanceof AuthenticationError)) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t}\n\n\t\t\tconst status = ex instanceof ProviderFetchError ? ` (${ex.status})` : '';\n\t\t\tscope?.warn(`Unable to resolve the fork repository URLs${status}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tprivate async request<T>(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string \| undefined,\n\t\troute: string,\n\t\toptions: { method: RequestInit['method'] } & Record<string, unknown>,\n\t\tscope: ScopedLogger \| undefined,\n\t\tcancellation?: AbortSignal \| undefined,\n\t): Promise<T \| undefined> {\n\t\tconst { accessToken } = token;\n\t\tconst url = baseUrl ? `${baseUrl}/${route}` : route;\n\n\t\tlet rsp: Response;\n\t\ttry {\n\t\t\tconst sw = maybeStopWatch(`[AZURE] ${options?.method ?? 'GET'} request`, { log: { onlyExit: true } });\n\n\t\t\ttry {\n\t\t\t\tif (cancellation?.aborted) throw new CancellationError();\n\n\t\t\t\trsp = await this.config.wrapForForcedInsecureSSL(provider.getIgnoreSSLErrors(), () =>\n\t\t\t\t\tthis.config.fetch(url, {\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\tAuthorization: `Basic ${base64(`PAT:${accessToken}`)}`,\n\t\t\t\t\t\t\t'Content-Type': 'application/json',\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsignal: cancellation,\n\t\t\t\t\t\t...options,\n\t\t\t\t\t}),\n\t\t\t\t);\n\n\t\t\t\tif (rsp.ok) {\n\t\t\t\t\t// Azure answers a rejected credential by redirecting to its sign-in page, which returns `203\n\t\t\t\t\t// text/html` rather than `401`. `rsp.ok` spans 200-299, so that page used to reach `json()` and\n\t\t\t\t\t// die as a bare `SyntaxError` — which `getIssue` and friends catch and report as \"not found\",\n\t\t\t\t\t// making an invalid credential indistinguishable from a missing work item (GKDEV-3617).\n\t\t\t\t\tconst contentType = rsp.headers.get('content-type')?.toLowerCase() ?? '';\n\t\t\t\t\tif (contentType.startsWith('text/html')) {\n\t\t\t\t\t\tconst { accessToken: _accessToken, ...tokenInfo } = token;\n\t\t\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t\t\ttokenInfo,\n\t\t\t\t\t\t\tAuthenticationErrorReason.Unauthorized,\n\t\t\t\t\t\t\tnew Error(`(${rsp.status}) Azure DevOps returned a sign-in page instead of data`),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\treturn (await rsp.json()) as T;\n\t\t\t\t}\n\n\t\t\t\t// Reads the body so the 403 branch below can tell a throttled request from a permission failure.\n\t\t\t\tthrow await ProviderFetchError.fromResponse('AzureDevOps', rsp);\n\t\t\t} finally {\n\t\t\t\tsw?.stop();\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\tif (ex instanceof ProviderFetchError \|\| ex.name === 'AbortError') {\n\t\t\t\tthis.handleRequestError(provider, token, ex, scope);\n\t\t\t} else if (Logger.isDebugging) {\n\t\t\t\tthis.config.onError?.(`AzureDevOps request failed: ${ex.message}`);\n\t\t\t}\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\tprivate handleRequestError(\n\t\tprovider: Provider \| undefined,\n\t\ttoken: TokenWithInfo,\n\t\tex: ProviderFetchError \| (Error & { name: 'AbortError' }),\n\t\tscope: ScopedLogger \| undefined,\n\t): void {\n\t\tif (ex.name === 'AbortError' \|\| !(ex instanceof ProviderFetchError)) throw new CancellationError(ex);\n\n\t\tconst { accessToken, ...tokenInfo } = token;\n\t\tswitch (ex.status) {\n\t\t\tcase 404: // Not found\n\t\t\tcase 410: // Gone\n\t\t\tcase 422: // Unprocessable Entity\n\t\t\t\tthrow new RequestNotFoundError(ex);\n\t\t\tcase 401: // Unauthorized\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Unauthorized, ex);\n\t\t\tcase 429: // Too Many Requests\n\t\t\t\tthrow toRateLimitError(ex, accessToken);\n\t\t\tcase 403: // Forbidden\n\t\t\t\t// Azure returns 403 for both a permission failure and a throttled request (\"Request was blocked\n\t\t\t\t// due to exceeding usage of resource 'RateLimit'\"), so the message is the discriminant. Reporting\n\t\t\t\t// a throttle as `auth` would prompt the user to re-authenticate a healthy connection instead of\n\t\t\t\t// retrying (see `isRateLimitResponse`).\n\t\t\t\tif (isRateLimitResponse(ex)) throw toRateLimitError(ex, accessToken);\n\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Forbidden, ex);\n\t\t\tcase 500: // Internal Server Error\n\t\t\t\tscope?.error(ex);\n\t\t\t\tif (ex.response != null) {\n\t\t\t\t\tprovider?.trackRequestException();\n\t\t\t\t\tthis.config.onRequestFailed?.(\n\t\t\t\t\t\tprovider == null \|\| provider.id === 'azure'\n\t\t\t\t\t\t\t? l10n.t(\n\t\t\t\t\t\t\t\t\t'{0} failed to respond and might be experiencing issues. Please visit the [AzureDevOps status page](https://status.dev.azure.com) for more information.',\n\t\t\t\t\t\t\t\t\tprovider?.name ?? 'AzureDevOps',\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: l10n.t('{0} failed to respond and might be experiencing issues.', provider.name),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\tcase 502: // Bad Gateway\n\t\t\t\tscope?.error(ex);\n\t\t\t\t// TODO: Learn the Azure API docs and put it in order:\n\t\t\t\t// if (ex.message.includes('timeout')) {\n\t\t\t\t// \tprovider?.trackRequestException();\n\t\t\t\t// \tvoid showIntegrationRequestTimedOutWarningMessage(provider?.name ?? 'Azure');\n\t\t\t\t// \treturn;\n\t\t\t\t// }\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tif (ex.status >= 400 && ex.status < 500) throw new RequestClientError(ex);\n\t\t\t\tbreak;\n\t\t}\n\n\t\tscope?.error(ex);\n\t\tif (Logger.isDebugging) {\n\t\t\tthis.config.onError?.(\n\t\t\t\t`AzureDevOps request failed: ${(ex.response as any)?.errors?.[0]?.message ?? ex.message}`,\n\t\t\t);\n\t\t}\n\t}\n}\n\n/* Wires an {@link AzureDevOpsApi} from the full runtime context, mapping `ctx` down to the narrow config. */\nexport function createAzureDevOpsApi(ctx: IntegrationServiceContext): AzureDevOpsApi {\n\treturn new AzureDevOpsApi(baseProviderApiConfig(ctx));\n}\n"],"mappings":";;;;;;;;;;;;;;;AAyDA,MAAM,4BAA4B;AAElC,SAAS,+BAA+B,MAAyD;CAChG,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,MAAM,CAAC,aAAa,SAAS,YAAY;CACzC,IAAI,MAAM,WAAW,KAAK,YAAY,UAAU,CAAC,eAAe,CAAC,UAChE,MAAM,IAAI,MAAM,wCAAwC,KAAK,yCAAyC;CAGvG,OAAO;EAAe;EAAuB;CAAS;AACvD;AAEA,IAAM,iBAAN,MAAqB;CACpB,8BAA+B,IAAI,IAAwC;CAC3E,yBAA0B,IAAI,IAAkC;CAGhE,iBACC,SACA,cACA,WACyC;EACzC,OAAO,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,SAAS,CAAC;CAC/E;CAEA,QAAqB;EACpB,KAAK,YAAY,MAAM;EACvB,KAAK,OAAO,MAAM;CACnB;CAEA,eAAsB,SAAiB,cAAsB,QAAoC;EAChG,KAAK,gBAAgB,SAAS,YAAY;EAC1C,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,GAAG,MAAM;EAC9D,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,GAAG,MAAM,QAAQ;CAE1F;CAEA,cAAqB,SAAiB,cAA+B;EACpE,OAAO,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;CAC9D;CAEA,gBAAwB,SAAiB,cAA4B;EACpE,MAAM,SAAS,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;EACrE,IAAI,UAAU,MAAM;EAEpB,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,OAAO,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,CAAC;CAE7E;CAEA,YAAoB,SAAiB,cAAsB,WAA2B;EAErF,OAAO,KAAK,UAAU;GAAC;GAAS;GAAc;EAAS,CAAC;CACzD;CAEA,WAAmB,SAAiB,cAA8B;EACjE,OAAO,KAAK,UAAU,CAAC,SAAS,YAAY,CAAC;CAC9C;AACD;AAEA,IAAa,iBAAb,MAAkD;CAQpB;CAP7B;CACA,kBAA0C,IAAI,eAAe;CAC7D,sBAAuC,IAAI,aAA0D;EACpG,UAAU;EACV,WAAW;CACZ,CAAC;CAED,YAAY,QAA4C;EAA3B,KAAA,SAAA;EAC5B,KAAK,cAAc,OAAO,wBAAwB,KAAK,YAAY,CAAC;CACrE;CAEA,UAAgB;EACf,KAAK,aAAa,QAAQ;CAC3B;CAEA,cAA4B;EAC3B,KAAK,gBAAgB,MAAM;EAC3B,KAAK,oBAAoB,MAAM;CAChC;CAEA,MASa,wBACZ,UACA,OACA,OACA,MACA,QACA,SAGmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GA8BH,MAAM,OAjBY,MAZK,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,MAAM,GAAG,YAAY,0BAA0B,SAAS,kFAAkF,UAC7I,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAG4B,MAAM,MAAM,GAAG,MAAM;IAEhD,MAAM,UAAU,EAAE,WAAW,YAAY,EAAE,WAAW;IAGtD,IAAI,aAFY,EAAE,WAAW,YAAY,EAAE,WAAW,WAGrD,OAAO,UAAU,KAAK;IAKvB,MAAM,QAAQ,IAAI,KAAK,EAAE,cAAc,EAAE,YAAY;IAGrD,OAAO,IAFW,KAAK,EAAE,cAAc,EAAE,YAE9B,CAAC,CAAC,QAAQ,IAAI,MAAM,QAAQ;GACxC,CAAC,EAAA,GAEsB;GACvB,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,OAAO,MAAM,KAAK,cAAc,IAAI,UAAU,OAAO,OAAO,QAAQ,SAAS,KAAK;EACnF,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MAUM,wBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAGA,cACmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,IAAI;GAqBH,MAAM,MAAK,MApBY,KAAK,QAC3B,UACA,OACA,SACA,GAAG,MAAM,GAAG,YAAY,0BAA0B,SAAS,oCAC3D;IACC,QAAQ;IACR,MAAM,KAAK,UAAU,EACpB,SAAS,CACR;KACC,OAAO,CAAC,GAAG;KACX,MAAM;IACP,CACD,EACD,CAAC;GACF,GACA,OACA,YACD,EAAA,EAEqB,QAAQ,EAAE,GAAG,IAAI,GAAG;GACzC,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SACA,GAAG,MAAM,GAAG,mBAAmB,GAAG,WAAW,QAAQ,EAAE,EAAE,0BAA0B,mBAAmB,GAAG,WAAW,EAAE,EAAE,gBAAgB,mBAAmB,GAAG,cAAc,SAAS,CAAC,KACtL,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,IAAI,eAAe,MAAM,OAAO,KAAA;GAEhC,OAAO,MAAM,KAAK,cAAc,aAAa,UAAU,OAAO,OAAO,SAAS,OAAO,YAAY;EAClG,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MASa,sBACZ,UACA,OACA,OACA,MACA,IACA,SAI0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,SACpD,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,MAAM,GAAG,YAAY,uBAAuB,MAC/C,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,OACA,aACA,OACD;IAEA,OAAO;KACN,IAAI,YAAY,GAAG,SAAS;KAC5B,MAAM;KACN,QAAQ,YAAY,GAAG,SAAS;KACtB;KACV,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,OAAO,mCAAmC,aAAa;KACvD,QAAQ,mCAAmC,aAAa;KACxD,OAAO,YAAY,OAAO;KAC1B,KAAK,YAAY,OAAO,KAAK;IAC9B;GACD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;EAGD,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,eACpD,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,MAAM,GAAG,YAAY,0BAA0B,SAAS,gBAAgB,MAC3E,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,YAAY,MACf,OAAO;IACN,IAAI,SAAS,cAAc,SAAS;IACpC,MAAM;IACN,QAAQ,SAAS,cAAc,SAAS;IAC9B;IACV,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,OAAO,8BAA8B,SAAS,MAAM;IACpD,QAAQ,+BAA+B,SAAS,MAAM;IACtD,OAAO,SAAS;IAChB,KAAK,0BAA0B,UAAU,QAAQ,SAAS,KAAK;GAChE;GAGD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGF;CAEA,MAQa,SACZ,UACA,OACA,SACA,IACA,SAG6B;EAC7B,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,QAAQ,aAAa,GAAG,QAAQ,KAAK,uBAAuB,MAC/D,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,QAAQ,cACR,QAAQ,MACR,OACD;IACA,OAAO,kBAAkB,aAAa,UAAU,SAAS,aAAa;GACvE;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;CAEA,MAUM,oBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAG0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GAYH,MAAM,UAAS,MAVM,KAAK,QACzB,UACA,OACA,SACA,GAAG,MAAM,GAAG,YAAY,0BAA0B,SAAS,WAAW,OACtE,EACC,QAAQ,MACT,GACA,KACD,EAAA,EACuB;GACvB,IAAI,CAAC,QACJ;GAGD,OAAO;IACI;IACV,IAAI,KAAA;IACJ,UAAU,KAAA;IACV,MAAM,QAAQ;IACd,OAAO,QAAQ;IACf,WAAW,KAAA;GACZ;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;CAEA,MAOM,uBACL,UACA,OACA,SAC4G;EAC5G,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GA6BH,MAAM,QAAO,MA5BgB,KAAK,QAkBjC,UACA,OACA,SACA,wBACA,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAE6B;GAC7B,MAAM,WAAW,MAAM,YAAY,SAAS;GAC5C,IAAI,CAAC,UACJ;GAGD,OAAO;IACN,IAAI,KAAK;IACT,MAAM,KAAK;IACX,OAAO,KAAK;IACF;GACX;EACD,SAAS,IAAI;GAEZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,IAAI,mCAAmC,SAAS;GAC7D;EACD;CACD;CAEA,MAAM,yBACL,WACA,OACA,UACA,OACA,OACA,aACA,SAGkD;EAClD,MAAM,UAAU,GAAG,MAAM,GAAG;EAC5B,MAAM,WAAW,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;EAChF,IAAI,YAAY,MAAM,OAAO;EAE7B,MAAM,SAAS,MAAM,KAAK,2BAA2B,WAAW,UAAU,OAAO,OAAO,aAAa,OAAO;EAC5G,KAAK,gBAAgB,eAAe,SAAS,WAAW,MAAM;EAE9D,OAAO,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;CACvE;CAEA,MAAc,2BACb,cACA,UACA,OACA,OACA,aACA,SAGgC;EAChC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAYH,QAAO,MAXmB,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,MAAM,GAAG,YAAY,2BAA2B,aAAa,UAChE,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAEoB,SAAS,CAAC;EAC/B,SAAS,IAAI;GAIZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf,OAAO,CAAC;EACT;CACD;CAEA,MAQM,sBACL,UACA,OACA,OACA,MACA,SAGA,cAC0C;EAC1C,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,YAAY,MAAM,OAAO,KAAA;GAK7B,OAAO;IACI;IACH;IAEP,MAAM,SAAS;IACf,QAAQ,SAAS,UAAU;IAC3B,QACC,SAAS,UAAU,SAAS,kBAAkB,QAAQ,OACnD;KAAS;KAAO,MAAM,SAAS,iBAAiB;IAAK,IACrD,KAAA;GACL;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;CAEA,MAQM,iBACL,UACA,OACA,OACA,MACA,SAGA,cACqC;EACrC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,UAAU,iBAAiB,MAAM,OAAO,KAAA;GAE5C,OAAO;IACI;IACV,MAAM,yBAAyB,SAAS,aAAa;GACtD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;CAEA,cACC,UACA,OACA,OACA,MACA,SACA,OACA,cACmD;EACnD,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,OAAO,KAAK,QACX,UACA,OACA,SACA,GAAG,MAAM,GAAG,YAAY,0BAA0B,SAAS,mBAC3D,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;CACD;CAEA,MAAc,cACb,IACA,UACA,OACA,OACA,SACA,OACA,cACuB;EACvB,MAAM,qBAAqB,MAAM,KAAK,sBACrC,UACA,OACA,OACA,SACA,GAAG,YAAY,YACf,OACA,YACD;EACA,OAAO,qBAAqB,IAAI,UAAU,OAAO,SAAS,kBAAkB;CAC7E;;;;;;;;;;CAWA,MAAc,sBACb,UACA,OACA,OACA,SACA,YACA,OACA,cAC+C;EAC/C,IAAI,cAAc,MAAM,OAAO,KAAA;EAE/B,IAAI;EACJ,IAAI;GACH,YAAY,MAAM,OAAO,MAAM,WAAW;EAC3C,QAAQ;GACP;EACD;EAEA,MAAM,WAAW,KAAK,UAAU;GAAC;GAAW;GAAS;GAAO,WAAW;EAAE,CAAC;EAG1E,OAAO,KAAK,oBAAoB,YAC/B,WACC,WAAW,cACX,KAAK,wBACJ,UACA,OACA,OACA,SACA,WAAW,IACX,WACA,OACA,SACD,GACD,EAAgB,aAAa,CAC9B;CACD;CAEA,MAAc,wBACb,UACA,OACA,OACA,SACA,cACA,WACA,OACA,cAC+C;EAC/C,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SACA,GAAG,MAAM,0BAA0B,mBAAmB,YAAY,EAAE,mBACpE,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,MAAM,SAAS,2BAA2B,UAAU,QAAQ,SAAS,KAAK;GAC1E,MAAM,aAAa,2BAA2B,UAAU,WAAW,SAAS,KAAK;GAIjF,MAAM,MAAM,UAAU;GACtB,IAAI,OAAO,MAAM;IAChB,UAAU,WAAW;IACrB;GACD;GAEA,OAAO;IAAO;IAAiB;GAAW;EAC3C,SAAS,IAAI;GAEZ,IAAI,EAAE,cAAc,yBAAyB,EAAE,cAAc,sBAC5D,UAAU,WAAW;GAGtB,MAAM,SAAS,cAAc,qBAAqB,KAAK,GAAG,OAAO,KAAK;GACtE,OAAO,KAAK,6CAA6C,QAAQ;GACjE;EACD;CACD;CAEA,MAAc,QACb,UACA,OACA,SACA,OACA,SACA,OACA,cACyB;EACzB,MAAM,EAAE,gBAAgB;EACxB,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,UAAU;EAE9C,IAAI;EACJ,IAAI;GACH,MAAM,KAAK,eAAe,WAAW,SAAS,UAAU,MAAM,WAAW,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,CAAC;GAEpG,IAAI;IACH,IAAI,cAAc,SAAS,MAAM,IAAI,kBAAkB;IAEvD,MAAM,MAAM,KAAK,OAAO,yBAAyB,SAAS,mBAAmB,SAC5E,KAAK,OAAO,MAAM,KAAK;KACtB,SAAS;MACR,eAAe,SAAS,OAAO,OAAO,aAAa;MACnD,gBAAgB;KACjB;KACA,QAAQ;KACR,GAAG;IACJ,CAAC,CACF;IAEA,IAAI,IAAI,IAAI;KAMX,KADoB,IAAI,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY,KAAK,GAAA,CACtD,WAAW,WAAW,GAAG;MACxC,MAAM,EAAE,aAAa,cAAc,GAAG,cAAc;MACpD,MAAM,IAAI,oBACT,WAAA,mBAEA,IAAI,MAAM,IAAI,IAAI,OAAO,uDAAuD,CACjF;KACD;KAEA,OAAQ,MAAM,IAAI,KAAK;IACxB;IAGA,MAAM,MAAM,mBAAmB,aAAa,eAAe,GAAG;GAC/D,UAAU;IACT,IAAI,KAAK;GACV;EACD,SAAS,IAAI;GACZ,IAAI,cAAc,sBAAsB,GAAG,SAAS,cACnD,KAAK,mBAAmB,UAAU,OAAO,IAAI,KAAK;QAC5C,IAAIA,QAAO,aACjB,KAAK,OAAO,UAAU,+BAA+B,GAAG,SAAS;GAGlE,MAAM;EACP;CACD;CAEA,mBACC,UACA,OACA,IACA,OACO;EACP,IAAI,GAAG,SAAS,gBAAgB,EAAE,cAAc,qBAAqB,MAAM,IAAI,kBAAkB,EAAE;EAEnG,MAAM,EAAE,aAAa,GAAG,cAAc;EACtC,QAAQ,GAAG,QAAX;GACC,KAAK;GACL,KAAK;GACL,KAAK,KACJ,MAAM,IAAI,qBAAqB,EAAE;GAClC,KAAK,KACJ,MAAM,IAAI,oBAAoB,WAAA,GAAmD,EAAE;GACpF,KAAK,KACJ,MAAM,iBAAiB,IAAI,WAAW;GACvC,KAAK;IAKJ,IAAI,oBAAoB,EAAE,GAAG,MAAM,iBAAiB,IAAI,WAAW;IAEnE,MAAM,IAAI,oBAAoB,WAAA,GAAgD,EAAE;GACjF,KAAK;IACJ,OAAO,MAAM,EAAE;IACf,IAAI,GAAG,YAAY,MAAM;KACxB,UAAU,sBAAsB;KAChC,KAAK,OAAO,kBACX,YAAY,QAAQ,SAAS,OAAO,UACjC,KAAK,EACL,0JACA,UAAU,QAAQ,aACnB,IACC,KAAK,EAAE,2DAA2D,SAAS,IAAI,CACnF;IACD;IACA;GACD,KAAK;IACJ,OAAO,MAAM,EAAE;IAOf;GACD,SACC,IAAI,GAAG,UAAU,OAAO,GAAG,SAAS,KAAK,MAAM,IAAI,mBAAmB,EAAE;EAE1E;EAEA,OAAO,MAAM,EAAE;EACf,IAAIA,QAAO,aACV,KAAK,OAAO,UACX,+BAAgC,GAAG,UAAkB,SAAS,EAAE,EAAE,WAAW,GAAG,SACjF;CAEF;AACD;AAh2BE,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,YAAY;CAChD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACE;AACT,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA0DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA6DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,QAAQ;CAC5C,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACF;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AA8GA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,SAAS,QAAQ;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;CACL;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,YAAA,IAAA;AAqDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,uBAAA,IAAA;AAsDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,aAAa;CACpC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,0BAAA,IAAA;AAmHA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AAoDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,oBAAA,IAAA;;AA+SF,SAAgB,qBAAqB,KAAgD;CACpF,OAAO,IAAI,eAAe,sBAAsB,GAAG,CAAC;AACrD"}
1	+ {"version":3,"file":"azure.js","names":["Logger"],"sources":["../../../../../../plus/integrations/src/providers/azure/azure.ts"],"sourcesContent":["import * as l10n from '@vscode/l10n';\nimport type { UnidentifiedAuthor } from '@gitlens/git/models/author.js';\nimport type { DefaultBranch } from '@gitlens/git/models/defaultBranch.js';\nimport type { Issue, IssueSearchCriteria } from '@gitlens/git/models/issue.js';\nimport type { IssueOrPullRequest, IssueOrPullRequestType } from '@gitlens/git/models/issueOrPullRequest.js';\nimport type { PullRequest } from '@gitlens/git/models/pullRequest.js';\nimport type { Provider } from '@gitlens/git/models/remoteProvider.js';\nimport type { RepositoryMetadata } from '@gitlens/git/models/repositoryMetadata.js';\nimport { effectiveIssueSort } from '@gitlens/git/utils/issue.utils.js';\nimport { base64 } from '@gitlens/utils/base64.js';\nimport { CancellationError, isCancellationError } from '@gitlens/utils/cancellation.js';\nimport { sha256, uuid } from '@gitlens/utils/crypto.js';\nimport { trace } from '@gitlens/utils/decorators/log.js';\nimport type { Disposable } from '@gitlens/utils/disposable.js';\nimport { Logger } from '@gitlens/utils/logger.js';\nimport type { ScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport { getScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport type { CacheController } from '@gitlens/utils/promiseCache.js';\nimport { PromiseCache } from '@gitlens/utils/promiseCache.js';\nimport { maybeStopWatch } from '@gitlens/utils/stopwatch.js';\nimport type { TokenWithInfo } from '../../authentication/models.js';\nimport type { IntegrationServiceContext } from '../../context.js';\nimport {\n\tAuthenticationError,\n\tAuthenticationErrorReason,\n\tisRateLimitResponse,\n\tProviderFetchError,\n\tRequestClientError,\n\tRequestNotFoundError,\n\ttoRateLimitError,\n} from '../../errors.js';\nimport type { ProviderIssueSearchPage } from '../../models/issueReads.js';\nimport { decodePathSegment } from '../../utils/domain.utils.js';\nimport type { ProviderApiConfig } from '../apiConfig.js';\nimport { baseProviderApiConfig } from '../apiConfig.js';\nimport type {\n\tAzureForkRepositoryUrls,\n\tAzureGitCommit,\n\tAzureProjectDescriptor,\n\tAzurePullRequest,\n\tAzurePullRequestWithLinks,\n\tAzureRepositoryReference,\n\tAzureRepositoryUrls,\n\tAzureRepositoryWithMetadata,\n\tAzureWorkItemState,\n\tAzureWorkItemStateCategory,\n\tWorkItem,\n} from './models.js';\nimport {\n\tazurePullRequestStatusToState,\n\tazureWorkItemsStateCategoryToState,\n\tfromAzurePullRequest,\n\tfromAzureWorkItem,\n\tgetAzurePullRequestWebUrl,\n\tisClosedAzurePullRequestStatus,\n\tisClosedAzureWorkItemStateCategory,\n\tnormalizeAzureBranchName,\n\tsanitizeAzureRepositoryUrl,\n} from './models.js';\nimport type { AzureWorkItemSearchCursor } from './search.js';\nimport {\n\tazureWorkItemBatchLimit,\n\tazureWorkItemSearchResultLimit,\n\tparseAzureWorkItemSearchCursor,\n\ttoAzureSearchPageSize,\n\ttoAzureWorkItemSearchCursorKey,\n\ttoAzureWorkItemSearchWiql,\n} from './search.js';\n\nconst forkRepositoryUrlCacheTtl = 5 * 60 * 1000;\n/** How long a work-item search's id snapshot outlives the last page read from it, and the most it lives at all. /\nconst workItemSearchSnapshotTtl = 5 60 * 1000;\nconst workItemSearchSnapshotMaxTtl = 30 * 60 * 1000;\n\nfunction encodePathSegment(value: string): string {\n\tif (value === '.' \|\| value === '..') throw new Error(`Invalid Azure path segment '${value}'.`);\n\n\treturn encodeURIComponent(value);\n}\n\n/** Whether Azure refused a WIQL query for matching more work items than it will return (`VS402337`). /\nfunction isWorkItemLimitRefusal(ex: unknown): boolean {\n\treturn ex instanceof RequestClientError && ex.message.includes('VS402337');\n}\n\nfunction parseAzureRepositoryDescriptor(repo: string): { projectName: string; repoName: string } {\n\tconst parts = repo.split('/');\n\tconst [projectName, segment, repoName] = parts;\n\tif (parts.length !== 3 \|\| segment !== '_git' \|\| !projectName \|\| !repoName) {\n\t\tthrow new Error(`Invalid Azure repository descriptor '${repo}'; expected '{project}/_git/{repoName}'.`);\n\t}\n\n\treturn { projectName: projectName, repoName: repoName };\n}\n\nclass WorkItemStates {\n\tprivate readonly _categories = new Map<string, AzureWorkItemStateCategory>();\n\tprivate readonly _types = new Map<string, AzureWorkItemState[]>();\n\n\t// TODO@sergeibbb: we might need some logic for invalidating\n\tpublic getStateCategory(\n\t\tproject: string,\n\t\tworkItemType: string,\n\t\tstateName: string,\n\t): AzureWorkItemStateCategory \| undefined {\n\t\treturn this._categories.get(this.getStateKey(project, workItemType, stateName));\n\t}\n\n\tpublic clear(): void {\n\t\tthis._categories.clear();\n\t\tthis._types.clear();\n\t}\n\n\tpublic saveTypeStates(project: string, workItemType: string, states: AzureWorkItemState[]): void {\n\t\tthis.clearTypeStates(project, workItemType);\n\t\tthis._types.set(this.getTypeKey(project, workItemType), states);\n\t\tfor (const state of states) {\n\t\t\tthis._categories.set(this.getStateKey(project, workItemType, state.name), state.category);\n\t\t}\n\t}\n\n\tpublic hasTypeStates(project: string, workItemType: string): boolean {\n\t\treturn this._types.has(this.getTypeKey(project, workItemType));\n\t}\n\n\tprivate clearTypeStates(project: string, workItemType: string): void {\n\t\tconst states = this._types.get(this.getTypeKey(project, workItemType));\n\t\tif (states == null) return;\n\n\t\tfor (const state of states) {\n\t\t\tthis._categories.delete(this.getStateKey(project, workItemType, state.name));\n\t\t}\n\t}\n\n\tprivate getStateKey(project: string, workItemType: string, stateName: string): string {\n\t\t// By stringifying the pair as JSON we make sure that all possible special characters are escaped\n\t\treturn JSON.stringify([project, workItemType, stateName]);\n\t}\n\n\tprivate getTypeKey(project: string, workItemType: string): string {\n\t\treturn JSON.stringify([project, workItemType]);\n\t}\n}\n\nexport class AzureDevOpsApi implements Disposable {\n\tprivate readonly _disposable: Disposable \| undefined;\n\tprivate _workItemStates: WorkItemStates = new WorkItemStates();\n\tprivate readonly _forkRepositoryUrls = new PromiseCache<string, AzureForkRepositoryUrls \| undefined>({\n\t\tcapacity: 100,\n\t\tcreateTTL: forkRepositoryUrlCacheTtl,\n\t});\n\t/\n\t The ordered ids each filtered work-item search's first page queried, paged through by its continuations. Kept\n\t * alive while a pagination keeps reading them (see `workItemSearchSnapshotTtl`). Every first page adds one, so\n\t * the capacity leaves room for repeated first pages before an idle pagination's snapshot is the one evicted.\n\t /\n\tprivate readonly _workItemSearches = new PromiseCache<string, number[]>({\n\t\tcapacity: 50,\n\t\taccessTTL: workItemSearchSnapshotTtl,\n\t\tcreateTTL: workItemSearchSnapshotMaxTtl,\n\t});\n\n\tconstructor(private readonly config: ProviderApiConfig) {\n\t\tthis._disposable = config.onConfigChanged?.(() => this.resetCaches());\n\t}\n\n\tdispose(): void {\n\t\tthis._disposable?.dispose();\n\t}\n\n\tprivate resetCaches(): void {\n\t\tthis._workItemStates.clear();\n\t\tthis._forkRepositoryUrls.clear();\n\t\tthis._workItemSearches.clear();\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, branch) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tbranch: branch,\n\t\t}),\n\t})\n\tpublic async getPullRequestForBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbranch: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<PullRequest \| undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ value: AzurePullRequest[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/pullRequests?searchCriteria.status=all&searchCriteria.sourceRefName=${encodeURIComponent(`refs/heads/${branch}`)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\t// Sort PRs: open PRs first, then by most recent activity (creation or closure date)\n\t\t\tconst sortedPRs = prResult?.value.sort((a, b) => {\n\t\t\t\t// First, prioritize open PRs (active/notSet) over closed ones (abandoned/completed)\n\t\t\t\tconst aIsOpen = a.status === 'active' \|\| a.status === 'notSet';\n\t\t\t\tconst bIsOpen = b.status === 'active' \|\| b.status === 'notSet';\n\n\t\t\t\tif (aIsOpen !== bIsOpen) {\n\t\t\t\t\treturn aIsOpen ? -1 : 1; // Open PRs come first\n\t\t\t\t}\n\n\t\t\t\t// Among PRs with the same status, sort by most recent activity\n\t\t\t\t// Use closedDate if available, otherwise use creationDate\n\t\t\t\tconst aDate = new Date(a.closedDate \|\| a.creationDate);\n\t\t\t\tconst bDate = new Date(b.closedDate \|\| b.creationDate);\n\n\t\t\t\treturn bDate.getTime() - aDate.getTime(); // Most recent first\n\t\t\t});\n\n\t\t\tconst pr = sortedPRs?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getPullRequestForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest \| undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ results: Record<string, AzurePullRequest[]>[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/pullrequestquery?api-version=4.1`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\tqueries: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\titems: [rev],\n\t\t\t\t\t\t\t\ttype: 'commit',\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\n\t\t\tconst pr = prResult?.results[0]?.[rev]?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\tconst pullRequest = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodePathSegment(owner)}/${encodePathSegment(pr.repository.project.id)}/_apis/git/repositories/${encodePathSegment(pr.repository.id)}/pullRequests/${encodePathSegment(pr.pullRequestId.toString())}`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (pullRequest == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pullRequest, provider, token, owner, baseUrl, scope, cancellation);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssueOrPullRequest(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t\ttype?: IssueOrPullRequestType;\n\t\t},\n\t): Promise<IssueOrPullRequest \| undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\tif (options?.type === undefined \|\| options?.type === 'issue') {\n\t\t\ttry {\n\t\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/wit/workItems/${encodePathSegment(id)}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (issueResult != null) {\n\t\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\t\tissueType,\n\t\t\t\t\t\tstate,\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken,\n\t\t\t\t\t\towner,\n\t\t\t\t\t\tprojectName,\n\t\t\t\t\t\toptions,\n\t\t\t\t\t);\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: issueResult.id.toString(),\n\t\t\t\t\t\ttype: 'issue',\n\t\t\t\t\t\tnodeId: issueResult.id.toString(),\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(issueResult.fields['System.CreatedDate']),\n\t\t\t\t\t\tupdatedDate: new Date(issueResult.fields['System.ChangedDate']),\n\t\t\t\t\t\tstate: azureWorkItemsStateCategoryToState(stateCategory),\n\t\t\t\t\t\tclosed: isClosedAzureWorkItemStateCategory(stateCategory),\n\t\t\t\t\t\ttitle: issueResult.fields['System.Title'],\n\t\t\t\t\t\turl: issueResult._links.html.href,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (options?.type === undefined \|\| options?.type === 'pullrequest') {\n\t\t\ttry {\n\t\t\t\tconst prResult = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/pullRequests/${encodePathSegment(id)}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (prResult != null) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: prResult.pullRequestId.toString(),\n\t\t\t\t\t\ttype: 'pullrequest',\n\t\t\t\t\t\tnodeId: prResult.pullRequestId.toString(), // prResult.artifactId maybe?\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tupdatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tstate: azurePullRequestStatusToState(prResult.status),\n\t\t\t\t\t\tclosed: isClosedAzurePullRequestStatus(prResult.status),\n\t\t\t\t\t\ttitle: prResult.title,\n\t\t\t\t\t\turl: getAzurePullRequestWebUrl(prResult, options.baseUrl, owner),\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\treturn undefined;\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, project, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tproject: project,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssue(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tproject: AzureProjectDescriptor,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<Issue \| undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodePathSegment(project.resourceName)}/${encodePathSegment(project.name)}/_apis/wit/workItems/${encodePathSegment(id)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tif (issueResult != null) {\n\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\tissueType,\n\t\t\t\t\tstate,\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\tproject.resourceName,\n\t\t\t\t\tproject.name,\n\t\t\t\t\toptions,\n\t\t\t\t);\n\t\t\t\treturn fromAzureWorkItem(issueResult, provider, project, stateCategory);\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getAccountForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t): Promise<UnidentifiedAuthor \| undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst commit = await this.request<AzureGitCommit>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}/commits/${encodePathSegment(rev)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\t\t\tconst author = commit?.author;\n\t\t\tif (!author) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\t// Azure API never gives us an id/username we can use, therefore we always return UnidentifiedAuthor\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tid: undefined,\n\t\t\t\tusername: undefined,\n\t\t\t\tname: author?.name,\n\t\t\t\temail: author?.email,\n\t\t\t\tavatarUrl: undefined,\n\t\t\t} satisfies UnidentifiedAuthor;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t/\n\t The collection an Azure DevOps Server address names, or `undefined` when it names the installation.\n\t \n\t Below a collection, `connectionData` describes that collection: its `instanceId` is the collection's id, and its\n\t * `webApplicationRelativeDirectory` ends in the collection's path segment (`DefaultCollection/`); it is empty or\n\t * absent at the server level. As measured against Azure DevOps Server 2020. The directory may also carry the\n\t * installation's own virtual directory before the collection (`tfs/DefaultCollection/`), so only its LAST segment\n\t * names the collection, and only when it is the last segment of the address asked about.\n\t /\n\t@trace({\n\t\targs: (provider, token, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getAddressedCollection(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string,\n\t): Promise<{ id: string; name: string } \| undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst connectionData = await this.request<{ instanceId?: string; webApplicationRelativeDirectory?: string }>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t'_apis/connectionData',\n\t\t\t{ method: 'GET' },\n\t\t\tscope,\n\t\t);\n\t\tconst segment = connectionData?.webApplicationRelativeDirectory?.split('/').findLast(Boolean);\n\t\tconst addressed = new URL(baseUrl).pathname.split('/').findLast(Boolean);\n\t\tif (segment == null \|\| addressed == null \|\| connectionData?.instanceId == null) return undefined;\n\n\t\tconst name = decodePathSegment(segment);\n\t\tif (name.toLowerCase() !== decodePathSegment(addressed).toLowerCase()) return undefined;\n\n\t\treturn { id: connectionData.instanceId, name: name };\n\t}\n\n\t@trace({\n\t\targs: (provider, token, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getCurrentUserOnServer(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string,\n\t): Promise<{ id: string; name?: string; email?: string; username?: string; avatarUrl?: string } \| undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst connectionData = await this.request<{\n\t\t\t\tauthenticatedUser?: {\n\t\t\t\t\tid: string;\n\t\t\t\t\tdescriptor: string;\n\t\t\t\t\tisActive: boolean;\n\t\t\t\t\tmetTypeId: number;\n\t\t\t\t\tproviderDisplayName?: string;\n\t\t\t\t\temailAddress?: string;\n\t\t\t\t\tresourceVersion: 2;\n\t\t\t\t\tsubjectDescriptor: string;\n\t\t\t\t\tproperties?: {\n\t\t\t\t\t\tAccount?: {\n\t\t\t\t\t\t\t$type: string;\n\t\t\t\t\t\t\t$value: string;\n\t\t\t\t\t\t};\n\t\t\t\t\t};\n\t\t\t\t};\n\t\t\t}>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t'_apis/connectionData',\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tconst user = connectionData?.authenticatedUser;\n\t\t\tconst username = user?.properties?.Account?.$value;\n\t\t\tif (!username) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\tid: user.id,\n\t\t\t\tname: user.providerDisplayName,\n\t\t\t\temail: user.emailAddress,\n\t\t\t\tusername: username,\n\t\t\t};\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is the whole point of this read failing; reporting \"no user\" instead hides it.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex, `Failed to get current user from ${baseUrl}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tasync getWorkItemStateCategory(\n\t\tissueType: string,\n\t\tstate: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemStateCategory \| undefined> {\n\t\t// By installation too: this API is shared by every connection, and two installations can each have a\n\t\t// collection and project of the same name whose process maps a state to a different category.\n\t\tconst project = JSON.stringify([options.baseUrl, owner, projectName]);\n\t\tconst category = this._workItemStates.getStateCategory(project, issueType, state);\n\t\tif (category != null) return category;\n\n\t\tconst states = await this.retrieveWorkItemTypeStates(issueType, provider, token, owner, projectName, options);\n\t\tthis._workItemStates.saveTypeStates(project, issueType, states);\n\n\t\treturn this._workItemStates.getStateCategory(project, issueType, state);\n\t}\n\n\tprivate async retrieveWorkItemTypeStates(\n\t\tworkItemType: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemState[]> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst issueResult = await this.request<{ value: AzureWorkItemState[]; count: number }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/wit/workItemTypes/${encodePathSegment(workItemType)}/states`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\treturn issueResult?.value ?? [];\n\t\t} catch (ex) {\n\t\t\t// A rejected credential must not be degraded to an empty state list: the caller caches whatever this\n\t\t\t// returns, so an empty list would pin every work item of this type to an unknown state until the\n\t\t\t// cache is dropped — long after the session recovery this error is supposed to trigger.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn [];\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getRepositoryMetadata(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<RepositoryMetadata \| undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response == null) return undefined;\n\n\t\t\t// Azure's `parentRepository` only reliably carries the repo name and its project; a fork's parent\n\t\t\t// lives in the same organization, so the org (`owner`) is the parent owner. Only report `parent`\n\t\t\t// when the parent's name is actually present — never fall back to the fork's own name.\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\towner: owner,\n\t\t\t\t// Prefer the API's canonical name over parsing the composite `repo` descriptor string.\n\t\t\t\tname: response.name,\n\t\t\t\tisFork: response.isFork ?? false,\n\t\t\t\tparent:\n\t\t\t\t\tresponse.isFork && response.parentRepository?.name != null\n\t\t\t\t\t\t? { owner: owner, name: response.parentRepository.name }\n\t\t\t\t\t\t: undefined,\n\t\t\t} satisfies RepositoryMetadata;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getDefaultBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<DefaultBranch \| undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response?.defaultBranch == null) return undefined;\n\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tname: normalizeAzureBranchName(response.defaultBranch),\n\t\t\t} satisfies DefaultBranch;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t/\n\t One page of a filtered work-item search over a collection: a WIQL query for the ordered ids, then one detail\n\t * read for the page's slice of them.\n\t \n\t The ids a first page queried are kept as the snapshot its continuations page through, for as long as the\n\t * pagination keeps reading it, so it reads a consistent set rather than re-running a query whose rows move under\n\t * an `updated` order. Each first page queries its own snapshot, so paginations of one query never share one, and\n\t * a continuation whose snapshot is gone is refused (see {@link AzureWorkItemSearchCursor}).\n\t \n\t The query asks for one id more than {@link azureWorkItemSearchResultLimit}, bounded by `$top`: the extra id is\n\t * what tells \"exactly the limit\" from \"past it\". Past it, the page is `truncated` with `limitReached` and no total,\n\t * since the true count is unknowable here. A server that refuses the match set even so fails the page with a\n\t * \"narrow the search\" error: no bounded query could serve that order's first window.\n\t \n\t `resolveProject` maps each result's project name to its descriptor. A work item in a project it doesn't know\n\t * fails the page rather than being dropped or mis-attributed, since either would leave the page disagreeing with\n\t * the count of the same query; the caller refreshes its project discovery before a search so that means a\n\t * project created during the pagination.\n\t /\n\t@trace({\n\t\targs: (provider, token, collection) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tcollection: collection,\n\t\t}),\n\t})\n\tasync searchWorkItemsPage(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t\tcriteria?: IssueSearchCriteria;\n\t\t\tprojectNames?: readonly string[];\n\t\t\tresolveProject: (name: string) => AzureProjectDescriptor \| undefined;\n\t\t\tcursor?: string;\n\t\t\tpageSize?: number;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<ProviderIssueSearchPage> {\n\t\tconst scope = getScopedLogger();\n\t\tconst wiql = toAzureWorkItemSearchWiql(\n\t\t\toptions.criteria,\n\t\t\teffectiveIssueSort(options.criteria?.sort),\n\t\t\toptions.projectNames,\n\t\t);\n\t\tconst key = toAzureWorkItemSearchCursorKey(collection, wiql);\n\t\tconst pageSize = toAzureSearchPageSize(options.pageSize, 100, azureWorkItemBatchLimit);\n\t\tconst cursor = parseAzureWorkItemSearchCursor(options.cursor, key, pageSize);\n\t\tconst page = cursor?.page ?? 1;\n\n\t\t// Keyed by credential and address, and by the query itself rather than its fingerprint: two accounts on one\n\t\t// installation must never page through each other's matches, and two queries whose fingerprints collide must\n\t\t// never share a snapshot. The full credential digest, since the token's `microHash` is truncated for logs.\n\t\t// And by the snapshot's own id: a first page queries a new snapshot rather than replacing the query's, so a\n\t\t// pagination still reading an earlier one keeps it (see `AzureWorkItemSearchCursor`).\n\t\tconst snapshot = cursor?.snapshot ?? uuid();\n\t\tconst snapshotKey = JSON.stringify([\n\t\t\tawait sha256(token.accessToken),\n\t\t\toptions.baseUrl,\n\t\t\tcollection,\n\t\t\twiql,\n\t\t\tsnapshot,\n\t\t]);\n\t\t// A continuation only ever READS its snapshot: resuming against a fresh query could skip a work item silently.\n\t\tconst snapshotFound = cursor?.snapshot != null ? this._workItemSearches.get(snapshotKey) : undefined;\n\t\tif (cursor?.snapshot != null && snapshotFound == null) {\n\t\t\tthrow new Error('Work item search results expired; restart the read without a cursor');\n\t\t}\n\n\t\tconst result = await (snapshotFound ??\n\t\t\tthis._workItemSearches.getOrCreate(\n\t\t\t\tsnapshotKey,\n\t\t\t\t(_cacheable, signal) =>\n\t\t\t\t\tthis.queryWorkItemIds(\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken,\n\t\t\t\t\t\tcollection,\n\t\t\t\t\t\toptions.baseUrl,\n\t\t\t\t\t\twiql,\n\t\t\t\t\t\tazureWorkItemSearchResultLimit + 1,\n\t\t\t\t\t\tscope,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t).catch((ex: unknown) => {\n\t\t\t\t\t\t// `$top` is expected to bound the answer; should a server refuse the match set regardless, say\n\t\t\t\t\t\t// what happened rather than surfacing a bare client error.\n\t\t\t\t\t\tif (isWorkItemLimitRefusal(ex)) {\n\t\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t\t`${provider.name} refused a work item search matching more than ${azureWorkItemSearchResultLimit} results; narrow the search`,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tthrow ex;\n\t\t\t\t\t}),\n\t\t\t\t{ cancellation: cancellation },\n\t\t\t));\n\t\tconst limitReached = result.length > azureWorkItemSearchResultLimit;\n\t\tconst ids = limitReached ? result.slice(0, azureWorkItemSearchResultLimit) : result;\n\n\t\tconst offset = cursor?.offset ?? 0;\n\n\t\tconst slice = ids.slice(offset, offset + pageSize);\n\t\tconst values: Issue[] = [];\n\t\tif (slice.length > 0) {\n\t\t\tconst workItems = await this.request<{ value: (WorkItem \| null)[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions.baseUrl,\n\t\t\t\t`${encodePathSegment(collection)}/_apis/wit/workitemsbatch?api-version=5.0`,\n\t\t\t\t{ method: 'POST', body: JSON.stringify({ ids: slice, $expand: 'Links', errorPolicy: 'Omit' }) },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tconst byId = new Map((workItems?.value ?? []).filter(w => w != null).map(w => [w.id, w]));\n\t\t\tfor (const id of slice) {\n\t\t\t\t// A work item deleted since the ids were queried is gone, not a failure: skipping it keeps the page\n\t\t\t\t// honest, since it no longer matches anything.\n\t\t\t\tconst workItem = byId.get(id);\n\t\t\t\tif (workItem == null) continue;\n\n\t\t\t\tconst projectName = workItem.fields['System.TeamProject'];\n\t\t\t\tconst project = options.resolveProject(projectName);\n\t\t\t\tif (project == null) {\n\t\t\t\t\tthrow new Error(`Azure DevOps work item ${id} is in project '${projectName}', which isn't visible`);\n\t\t\t\t}\n\n\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\tworkItem.fields['System.WorkItemType'],\n\t\t\t\t\tworkItem.fields['System.State'],\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\tcollection,\n\t\t\t\t\tproject.name,\n\t\t\t\t\toptions,\n\t\t\t\t);\n\t\t\t\tvalues.push(fromAzureWorkItem(workItem, provider, project, stateCategory));\n\t\t\t}\n\t\t}\n\n\t\tconst nextOffset = offset + slice.length;\n\t\tconst hasMore = nextOffset < ids.length;\n\t\tconst next: AzureWorkItemSearchCursor = { key: key, snapshot: snapshot, offset: nextOffset, page: page + 1 };\n\t\treturn {\n\t\t\tvalues: values,\n\t\t\tcursor: hasMore ? JSON.stringify(next) : undefined,\n\t\t\thasMore: hasMore,\n\t\t\tpage: page,\n\t\t\ttruncated: limitReached,\n\t\t\ttotalCount: limitReached ? undefined : ids.length,\n\t\t\tlimitReached: limitReached \|\| undefined,\n\t\t};\n\t}\n\n\t/\n\t How many work items the same WIQL {@link searchWorkItemsPage} would page through match, reading no details.\n\t \n\t Asks for one id more than the result ceiling, so the count is exact up to it and `'exceeds-limit'` past it —\n\t * never the ceiling itself, which would understate the match set.\n\t /\n\t@trace({\n\t\targs: (provider, token, collection) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tcollection: collection,\n\t\t}),\n\t})\n\tasync countWorkItems(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\toptions: { baseUrl: string; criteria?: IssueSearchCriteria; projectNames?: readonly string[] },\n\t\tcancellation?: AbortSignal,\n\t): Promise<number \| 'exceeds-limit'> {\n\t\tconst scope = getScopedLogger();\n\t\tconst wiql = toAzureWorkItemSearchWiql(\n\t\t\toptions.criteria,\n\t\t\teffectiveIssueSort(options.criteria?.sort),\n\t\t\toptions.projectNames,\n\t\t);\n\t\ttry {\n\t\t\tconst ids = await this.queryWorkItemIds(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tcollection,\n\t\t\t\toptions.baseUrl,\n\t\t\t\twiql,\n\t\t\t\tazureWorkItemSearchResultLimit + 1,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\treturn ids.length > azureWorkItemSearchResultLimit ? 'exceeds-limit' : ids.length;\n\t\t} catch (ex) {\n\t\t\tif (isWorkItemLimitRefusal(ex)) return 'exceeds-limit';\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\t/\n\t The ids a collection-level WIQL query matches, in its order.\n\t \n\t `api-version=5.0` is the oldest version every Azure DevOps Server release this search supports (2019 and later)\n\t * answers; `timePrecision=true` is what lets the criteria's dates compare as instants — see `toWiqlDate`.\n\t /\n\tprivate async queryWorkItemIds(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\tbaseUrl: string,\n\t\twiql: string,\n\t\ttop: number,\n\t\tscope: ScopedLogger \| undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<number[]> {\n\t\tconst result = await this.request<{ workItems?: { id: number }[] }>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t`${encodePathSegment(collection)}/_apis/wit/wiql?$top=${top}&timePrecision=true&api-version=5.0`,\n\t\t\t{ method: 'POST', body: JSON.stringify({ query: wiql }) },\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t\tif (result?.workItems == null) throw new Error('Azure DevOps returned no work item query result');\n\n\t\treturn result.workItems.map(w => w.id);\n\t}\n\n\tprivate getRepository(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger \| undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureRepositoryWithMetadata \| undefined> {\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\treturn this.request<AzureRepositoryWithMetadata>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t`${encodePathSegment(owner)}/${encodePathSegment(projectName)}/_apis/git/repositories/${encodePathSegment(repoName)}?api-version=7.1`,\n\t\t\t{ method: 'GET' },\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t}\n\n\tprivate async toPullRequest(\n\t\tpr: AzurePullRequest,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger \| undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest> {\n\t\tconst forkRepositoryUrls = await this.getForkRepositoryUrls(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\towner,\n\t\t\tbaseUrl,\n\t\t\tpr.forkSource?.repository,\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t\treturn fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls);\n\t}\n\n\t/\n\t Resolves the web and HTTPS clone URLs of the fork a cross-repository pull request comes from. Every other\n\t * repository URL the model reports is rebuilt from the pull request payload; only a fork reference lacks the\n\t * project to do that, so only a fork costs a request.\n\t \n\t Best-effort by contract: a fork in a project the token cannot read, a deleted fork, or a throttled request\n\t * leaves the head ref without a URL. It must never cost the pull request itself, which is what makes swallowing\n\t * the failure here the right call rather than a shortcut.\n\t /\n\tprivate async getForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepository: AzureRepositoryReference \| undefined,\n\t\tscope: ScopedLogger \| undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls \| undefined> {\n\t\tif (repository == null) return undefined;\n\n\t\tlet tokenHash: string;\n\t\ttry {\n\t\t\ttokenHash = await sha256(token.accessToken);\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst cacheKey = JSON.stringify([tokenHash, baseUrl, owner, repository.id]);\n\t\t// The request is shared, so the factory is handed the cache's aggregate signal rather than this caller's: it\n\t\t// aborts only once every caller waiting on the entry has cancelled.\n\t\treturn this._forkRepositoryUrls.getOrCreate(\n\t\t\tcacheKey,\n\t\t\t(cacheable, aggregate) =>\n\t\t\t\tthis.fetchForkRepositoryUrls(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\towner,\n\t\t\t\t\tbaseUrl,\n\t\t\t\t\trepository.id,\n\t\t\t\t\tcacheable,\n\t\t\t\t\tscope,\n\t\t\t\t\taggregate,\n\t\t\t\t),\n\t\t\t{ cancellation: cancellation },\n\t\t);\n\t}\n\n\tprivate async fetchForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepositoryId: string,\n\t\tcacheable: CacheController,\n\t\tscope: ScopedLogger \| undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls \| undefined> {\n\t\ttry {\n\t\t\tconst response = await this.request<AzureRepositoryUrls>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodePathSegment(owner)}/_apis/git/repositories/${encodePathSegment(repositoryId)}?api-version=4.1`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tconst webUrl = sanitizeAzureRepositoryUrl(response?.webUrl, baseUrl, owner);\n\t\t\tconst cloneHttps = sanitizeAzureRepositoryUrl(response?.remoteUrl, baseUrl, owner);\n\n\t\t\t// The clone URL stands in for the web URL when the response omits it — an older `api-version` promises\n\t\t\t// neither field, and naming the fork by the URL git would use beats naming it not at all.\n\t\t\tconst url = webUrl ?? cloneHttps;\n\t\t\tif (url == null) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn { url: url, cloneHttps: cloneHttps };\n\t\t} catch (ex) {\n\t\t\t// Missing or inaccessible forks are cached briefly; transient failures retry on the next read.\n\t\t\tif (!(ex instanceof RequestNotFoundError) && !(ex instanceof AuthenticationError)) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t}\n\n\t\t\tconst status = ex instanceof ProviderFetchError ? ` (${ex.status})` : '';\n\t\t\tscope?.warn(`Unable to resolve the fork repository URLs${status}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tprivate async request<T>(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string \| undefined,\n\t\troute: string,\n\t\toptions: { method: RequestInit['method'] } & Record<string, unknown>,\n\t\tscope: ScopedLogger \| undefined,\n\t\tcancellation?: AbortSignal \| undefined,\n\t): Promise<T \| undefined> {\n\t\tconst { accessToken } = token;\n\t\tconst url = baseUrl ? `${baseUrl}/${route}` : route;\n\n\t\tlet rsp: Response;\n\t\ttry {\n\t\t\tconst sw = maybeStopWatch(`[AZURE] ${options?.method ?? 'GET'} request`, { log: { onlyExit: true } });\n\n\t\t\ttry {\n\t\t\t\tif (cancellation?.aborted) throw new CancellationError();\n\n\t\t\t\trsp = await this.config.wrapForForcedInsecureSSL(provider.getIgnoreSSLErrors(), () =>\n\t\t\t\t\tthis.config.fetch(url, {\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\tAuthorization: `Basic ${base64(`PAT:${accessToken}`)}`,\n\t\t\t\t\t\t\t'Content-Type': 'application/json',\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsignal: cancellation,\n\t\t\t\t\t\t...options,\n\t\t\t\t\t}),\n\t\t\t\t);\n\n\t\t\t\tif (rsp.ok) {\n\t\t\t\t\t// Azure answers a rejected credential by redirecting to its sign-in page, which returns `203\n\t\t\t\t\t// text/html` rather than `401`. `rsp.ok` spans 200-299, so that page used to reach `json()` and\n\t\t\t\t\t// die as a bare `SyntaxError` — which `getIssue` and friends catch and report as \"not found\",\n\t\t\t\t\t// making an invalid credential indistinguishable from a missing work item (GKDEV-3617).\n\t\t\t\t\tconst contentType = rsp.headers.get('content-type')?.toLowerCase() ?? '';\n\t\t\t\t\tif (contentType.startsWith('text/html')) {\n\t\t\t\t\t\tconst { accessToken: _accessToken, ...tokenInfo } = token;\n\t\t\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t\t\ttokenInfo,\n\t\t\t\t\t\t\tAuthenticationErrorReason.Unauthorized,\n\t\t\t\t\t\t\tnew Error(`(${rsp.status}) Azure DevOps returned a sign-in page instead of data`),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\treturn (await rsp.json()) as T;\n\t\t\t\t}\n\n\t\t\t\t// Reads the body so the 403 branch below can tell a throttled request from a permission failure.\n\t\t\t\tthrow await ProviderFetchError.fromResponse('AzureDevOps', rsp);\n\t\t\t} finally {\n\t\t\t\tsw?.stop();\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\tif (ex instanceof ProviderFetchError \|\| ex.name === 'AbortError') {\n\t\t\t\tthis.handleRequestError(provider, token, ex, scope);\n\t\t\t} else if (Logger.isDebugging) {\n\t\t\t\tthis.config.onError?.(`AzureDevOps request failed: ${ex.message}`);\n\t\t\t}\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\tprivate handleRequestError(\n\t\tprovider: Provider \| undefined,\n\t\ttoken: TokenWithInfo,\n\t\tex: ProviderFetchError \| (Error & { name: 'AbortError' }),\n\t\tscope: ScopedLogger \| undefined,\n\t): void {\n\t\tif (ex.name === 'AbortError' \|\| !(ex instanceof ProviderFetchError)) throw new CancellationError(ex);\n\n\t\tconst { accessToken, ...tokenInfo } = token;\n\t\tswitch (ex.status) {\n\t\t\tcase 404: // Not found\n\t\t\tcase 410: // Gone\n\t\t\tcase 422: // Unprocessable Entity\n\t\t\t\tthrow new RequestNotFoundError(ex);\n\t\t\tcase 401: // Unauthorized\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Unauthorized, ex);\n\t\t\tcase 429: // Too Many Requests\n\t\t\t\tthrow toRateLimitError(ex, accessToken);\n\t\t\tcase 403: // Forbidden\n\t\t\t\t// Azure returns 403 for both a permission failure and a throttled request (\"Request was blocked\n\t\t\t\t// due to exceeding usage of resource 'RateLimit'\"), so the message is the discriminant. Reporting\n\t\t\t\t// a throttle as `auth` would prompt the user to re-authenticate a healthy connection instead of\n\t\t\t\t// retrying (see `isRateLimitResponse`).\n\t\t\t\tif (isRateLimitResponse(ex)) throw toRateLimitError(ex, accessToken);\n\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Forbidden, ex);\n\t\t\tcase 500: // Internal Server Error\n\t\t\t\tscope?.error(ex);\n\t\t\t\tif (ex.response != null) {\n\t\t\t\t\tprovider?.trackRequestException();\n\t\t\t\t\tthis.config.onRequestFailed?.(\n\t\t\t\t\t\tprovider == null \|\| provider.id === 'azure'\n\t\t\t\t\t\t\t? l10n.t(\n\t\t\t\t\t\t\t\t\t'{0} failed to respond and might be experiencing issues. Please visit the [AzureDevOps status page](https://status.dev.azure.com) for more information.',\n\t\t\t\t\t\t\t\t\tprovider?.name ?? 'AzureDevOps',\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: l10n.t('{0} failed to respond and might be experiencing issues.', provider.name),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\tcase 502: // Bad Gateway\n\t\t\t\tscope?.error(ex);\n\t\t\t\t// TODO: Learn the Azure API docs and put it in order:\n\t\t\t\t// if (ex.message.includes('timeout')) {\n\t\t\t\t// \tprovider?.trackRequestException();\n\t\t\t\t// \tvoid showIntegrationRequestTimedOutWarningMessage(provider?.name ?? 'Azure');\n\t\t\t\t// \treturn;\n\t\t\t\t// }\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tif (ex.status >= 400 && ex.status < 500) throw new RequestClientError(ex);\n\t\t\t\tbreak;\n\t\t}\n\n\t\tscope?.error(ex);\n\t\tif (Logger.isDebugging) {\n\t\t\tthis.config.onError?.(\n\t\t\t\t`AzureDevOps request failed: ${(ex.response as any)?.errors?.[0]?.message ?? ex.message}`,\n\t\t\t);\n\t\t}\n\t}\n}\n\n/* Wires an {@link AzureDevOpsApi} from the full runtime context, mapping `ctx` down to the narrow config. */\nexport function createAzureDevOpsApi(ctx: IntegrationServiceContext): AzureDevOpsApi {\n\treturn new AzureDevOpsApi(baseProviderApiConfig(ctx));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAqEA,MAAM,4BAA4B;;AAElC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AAErC,SAAS,kBAAkB,OAAuB;CACjD,IAAI,UAAU,OAAO,UAAU,MAAM,MAAM,IAAI,MAAM,+BAA+B,MAAM,GAAG;CAE7F,OAAO,mBAAmB,KAAK;AAChC;;AAGA,SAAS,uBAAuB,IAAsB;CACrD,OAAO,cAAc,sBAAsB,GAAG,QAAQ,SAAS,UAAU;AAC1E;AAEA,SAAS,+BAA+B,MAAyD;CAChG,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,MAAM,CAAC,aAAa,SAAS,YAAY;CACzC,IAAI,MAAM,WAAW,KAAK,YAAY,UAAU,CAAC,eAAe,CAAC,UAChE,MAAM,IAAI,MAAM,wCAAwC,KAAK,yCAAyC;CAGvG,OAAO;EAAe;EAAuB;CAAS;AACvD;AAEA,IAAM,iBAAN,MAAqB;CACpB,8BAA+B,IAAI,IAAwC;CAC3E,yBAA0B,IAAI,IAAkC;CAGhE,iBACC,SACA,cACA,WACyC;EACzC,OAAO,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,SAAS,CAAC;CAC/E;CAEA,QAAqB;EACpB,KAAK,YAAY,MAAM;EACvB,KAAK,OAAO,MAAM;CACnB;CAEA,eAAsB,SAAiB,cAAsB,QAAoC;EAChG,KAAK,gBAAgB,SAAS,YAAY;EAC1C,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,GAAG,MAAM;EAC9D,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,GAAG,MAAM,QAAQ;CAE1F;CAEA,cAAqB,SAAiB,cAA+B;EACpE,OAAO,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;CAC9D;CAEA,gBAAwB,SAAiB,cAA4B;EACpE,MAAM,SAAS,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;EACrE,IAAI,UAAU,MAAM;EAEpB,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,OAAO,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,CAAC;CAE7E;CAEA,YAAoB,SAAiB,cAAsB,WAA2B;EAErF,OAAO,KAAK,UAAU;GAAC;GAAS;GAAc;EAAS,CAAC;CACzD;CAEA,WAAmB,SAAiB,cAA8B;EACjE,OAAO,KAAK,UAAU,CAAC,SAAS,YAAY,CAAC;CAC9C;AACD;AAEA,IAAa,iBAAb,MAAkD;CAkBpB;CAjB7B;CACA,kBAA0C,IAAI,eAAe;CAC7D,sBAAuC,IAAI,aAA0D;EACpG,UAAU;EACV,WAAW;CACZ,CAAC;;;;;;CAMD,oBAAqC,IAAI,aAA+B;EACvE,UAAU;EACV,WAAW;EACX,WAAW;CACZ,CAAC;CAED,YAAY,QAA4C;EAA3B,KAAA,SAAA;EAC5B,KAAK,cAAc,OAAO,wBAAwB,KAAK,YAAY,CAAC;CACrE;CAEA,UAAgB;EACf,KAAK,aAAa,QAAQ;CAC3B;CAEA,cAA4B;EAC3B,KAAK,gBAAgB,MAAM;EAC3B,KAAK,oBAAoB,MAAM;EAC/B,KAAK,kBAAkB,MAAM;CAC9B;CAEA,MASa,wBACZ,UACA,OACA,OACA,MACA,QACA,SAGmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GA8BH,MAAM,OAjBY,MAZK,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,kBAAkB,KAAK,EAAE,GAAG,kBAAkB,WAAW,EAAE,0BAA0B,kBAAkB,QAAQ,EAAE,uEAAuE,mBAAmB,cAAc,QAAQ,KACpO,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAG4B,MAAM,MAAM,GAAG,MAAM;IAEhD,MAAM,UAAU,EAAE,WAAW,YAAY,EAAE,WAAW;IAGtD,IAAI,aAFY,EAAE,WAAW,YAAY,EAAE,WAAW,WAGrD,OAAO,UAAU,KAAK;IAKvB,MAAM,QAAQ,IAAI,KAAK,EAAE,cAAc,EAAE,YAAY;IAGrD,OAAO,IAFW,KAAK,EAAE,cAAc,EAAE,YAE9B,CAAC,CAAC,QAAQ,IAAI,MAAM,QAAQ;GACxC,CAAC,EAAA,GAEsB;GACvB,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,OAAO,MAAM,KAAK,cAAc,IAAI,UAAU,OAAO,OAAO,QAAQ,SAAS,KAAK;EACnF,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MAUM,wBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAGA,cACmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,IAAI;GAqBH,MAAM,MAAK,MApBY,KAAK,QAC3B,UACA,OACA,SACA,GAAG,kBAAkB,KAAK,EAAE,GAAG,kBAAkB,WAAW,EAAE,0BAA0B,kBAAkB,QAAQ,EAAE,oCACpH;IACC,QAAQ;IACR,MAAM,KAAK,UAAU,EACpB,SAAS,CACR;KACC,OAAO,CAAC,GAAG;KACX,MAAM;IACP,CACD,EACD,CAAC;GACF,GACA,OACA,YACD,EAAA,EAEqB,QAAQ,EAAE,GAAG,IAAI,GAAG;GACzC,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SACA,GAAG,kBAAkB,KAAK,EAAE,GAAG,kBAAkB,GAAG,WAAW,QAAQ,EAAE,EAAE,0BAA0B,kBAAkB,GAAG,WAAW,EAAE,EAAE,gBAAgB,kBAAkB,GAAG,cAAc,SAAS,CAAC,KACtM,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,IAAI,eAAe,MAAM,OAAO,KAAA;GAEhC,OAAO,MAAM,KAAK,cAAc,aAAa,UAAU,OAAO,OAAO,SAAS,OAAO,YAAY;EAClG,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MASa,sBACZ,UACA,OACA,OACA,MACA,IACA,SAI0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,SACpD,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,kBAAkB,KAAK,EAAE,GAAG,kBAAkB,WAAW,EAAE,uBAAuB,kBAAkB,EAAE,KACzG,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,OACA,aACA,OACD;IAEA,OAAO;KACN,IAAI,YAAY,GAAG,SAAS;KAC5B,MAAM;KACN,QAAQ,YAAY,GAAG,SAAS;KACtB;KACV,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,OAAO,mCAAmC,aAAa;KACvD,QAAQ,mCAAmC,aAAa;KACxD,OAAO,YAAY,OAAO;KAC1B,KAAK,YAAY,OAAO,KAAK;IAC9B;GACD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;EAGD,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,eACpD,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,kBAAkB,KAAK,EAAE,GAAG,kBAAkB,WAAW,EAAE,0BAA0B,kBAAkB,QAAQ,EAAE,gBAAgB,kBAAkB,EAAE,KACxJ,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,YAAY,MACf,OAAO;IACN,IAAI,SAAS,cAAc,SAAS;IACpC,MAAM;IACN,QAAQ,SAAS,cAAc,SAAS;IAC9B;IACV,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,OAAO,8BAA8B,SAAS,MAAM;IACpD,QAAQ,+BAA+B,SAAS,MAAM;IACtD,OAAO,SAAS;IAChB,KAAK,0BAA0B,UAAU,QAAQ,SAAS,KAAK;GAChE;GAGD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGF;CAEA,MAQa,SACZ,UACA,OACA,SACA,IACA,SAG6B;EAC7B,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,kBAAkB,QAAQ,YAAY,EAAE,GAAG,kBAAkB,QAAQ,IAAI,EAAE,uBAAuB,kBAAkB,EAAE,KACzH,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,QAAQ,cACR,QAAQ,MACR,OACD;IACA,OAAO,kBAAkB,aAAa,UAAU,SAAS,aAAa;GACvE;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;CAEA,MAUM,oBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAG0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GAYH,MAAM,UAAS,MAVM,KAAK,QACzB,UACA,OACA,SACA,GAAG,kBAAkB,KAAK,EAAE,GAAG,kBAAkB,WAAW,EAAE,0BAA0B,kBAAkB,QAAQ,EAAE,WAAW,kBAAkB,GAAG,KACpJ,EACC,QAAQ,MACT,GACA,KACD,EAAA,EACuB;GACvB,IAAI,CAAC,QACJ;GAGD,OAAO;IACI;IACV,IAAI,KAAA;IACJ,UAAU,KAAA;IACV,MAAM,QAAQ;IACd,OAAO,QAAQ;IACf,WAAW,KAAA;GACZ;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;;;;;;;;;;CAWA,MAOM,uBACL,UACA,OACA,SACoD;EACpD,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,iBAAiB,MAAM,KAAK,QACjC,UACA,OACA,SACA,wBACA,EAAE,QAAQ,MAAM,GAChB,KACD;EACA,MAAM,UAAU,gBAAgB,iCAAiC,MAAM,GAAG,CAAC,CAAC,SAAS,OAAO;EAC5F,MAAM,YAAY,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,CAAC,CAAC,SAAS,OAAO;EACvE,IAAI,WAAW,QAAQ,aAAa,QAAQ,gBAAgB,cAAc,MAAM,OAAO,KAAA;EAEvF,MAAM,OAAO,kBAAkB,OAAO;EACtC,IAAI,KAAK,YAAY,MAAM,kBAAkB,SAAS,CAAC,CAAC,YAAY,GAAG,OAAO,KAAA;EAE9E,OAAO;GAAE,IAAI,eAAe;GAAkB;EAAK;CACpD;CAEA,MAOM,uBACL,UACA,OACA,SAC4G;EAC5G,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GA6BH,MAAM,QAAO,MA5BgB,KAAK,QAkBjC,UACA,OACA,SACA,wBACA,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAE6B;GAC7B,MAAM,WAAW,MAAM,YAAY,SAAS;GAC5C,IAAI,CAAC,UACJ;GAGD,OAAO;IACN,IAAI,KAAK;IACT,MAAM,KAAK;IACX,OAAO,KAAK;IACF;GACX;EACD,SAAS,IAAI;GAEZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,IAAI,mCAAmC,SAAS;GAC7D;EACD;CACD;CAEA,MAAM,yBACL,WACA,OACA,UACA,OACA,OACA,aACA,SAGkD;EAGlD,MAAM,UAAU,KAAK,UAAU;GAAC,QAAQ;GAAS;GAAO;EAAW,CAAC;EACpE,MAAM,WAAW,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;EAChF,IAAI,YAAY,MAAM,OAAO;EAE7B,MAAM,SAAS,MAAM,KAAK,2BAA2B,WAAW,UAAU,OAAO,OAAO,aAAa,OAAO;EAC5G,KAAK,gBAAgB,eAAe,SAAS,WAAW,MAAM;EAE9D,OAAO,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;CACvE;CAEA,MAAc,2BACb,cACA,UACA,OACA,OACA,aACA,SAGgC;EAChC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAYH,QAAO,MAXmB,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,kBAAkB,KAAK,EAAE,GAAG,kBAAkB,WAAW,EAAE,2BAA2B,kBAAkB,YAAY,EAAE,UACzH,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAEoB,SAAS,CAAC;EAC/B,SAAS,IAAI;GAIZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf,OAAO,CAAC;EACT;CACD;CAEA,MAQM,sBACL,UACA,OACA,OACA,MACA,SAGA,cAC0C;EAC1C,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,YAAY,MAAM,OAAO,KAAA;GAK7B,OAAO;IACI;IACH;IAEP,MAAM,SAAS;IACf,QAAQ,SAAS,UAAU;IAC3B,QACC,SAAS,UAAU,SAAS,kBAAkB,QAAQ,OACnD;KAAS;KAAO,MAAM,SAAS,iBAAiB;IAAK,IACrD,KAAA;GACL;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;CAEA,MAQM,iBACL,UACA,OACA,OACA,MACA,SAGA,cACqC;EACrC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,UAAU,iBAAiB,MAAM,OAAO,KAAA;GAE5C,OAAO;IACI;IACV,MAAM,yBAAyB,SAAS,aAAa;GACtD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;;;;;;;;;;;;;;;;;;;;CAqBA,MAOM,oBACL,UACA,OACA,YACA,SAQA,cACmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,OAAO,0BACZ,QAAQ,UACR,mBAAmB,QAAQ,UAAU,IAAI,GACzC,QAAQ,YACT;EACA,MAAM,MAAM,+BAA+B,YAAY,IAAI;EAC3D,MAAM,WAAW,sBAAsB,QAAQ,UAAU,KAAA,GAA4B;EACrF,MAAM,SAAS,+BAA+B,QAAQ,QAAQ,KAAK,QAAQ;EAC3E,MAAM,OAAO,QAAQ,QAAQ;EAO7B,MAAM,WAAW,QAAQ,YAAY,KAAK;EAC1C,MAAM,cAAc,KAAK,UAAU;GAClC,MAAM,OAAO,MAAM,WAAW;GAC9B,QAAQ;GACR;GACA;GACA;EACD,CAAC;EAED,MAAM,gBAAgB,QAAQ,YAAY,OAAO,KAAK,kBAAkB,IAAI,WAAW,IAAI,KAAA;EAC3F,IAAI,QAAQ,YAAY,QAAQ,iBAAiB,MAChD,MAAM,IAAI,MAAM,qEAAqE;EAGtF,MAAM,SAAS,OAAO,iBACrB,KAAK,kBAAkB,YACtB,cACC,YAAY,WACZ,KAAK,iBACJ,UACA,OACA,YACA,QAAQ,SACR,MAAA,OAEA,OACA,MACD,CAAC,CAAC,OAAO,OAAgB;GAGxB,IAAI,uBAAuB,EAAE,GAC5B,MAAM,IAAI,MACT,GAAG,SAAS,KAAK,gFAClB;GAGD,MAAM;EACP,CAAC,GACF,EAAgB,aAAa,CAC9B;EACD,MAAM,eAAe,OAAO,SAAS;EACrC,MAAM,MAAM,eAAe,OAAO,MAAM,GAAG,8BAA8B,IAAI;EAE7E,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,QAAQ,IAAI,MAAM,QAAQ,SAAS,QAAQ;EACjD,MAAM,SAAkB,CAAC;EACzB,IAAI,MAAM,SAAS,GAAG;GACrB,MAAM,YAAY,MAAM,KAAK,QAC5B,UACA,OACA,QAAQ,SACR,GAAG,kBAAkB,UAAU,EAAE,4CACjC;IAAE,QAAQ;IAAQ,MAAM,KAAK,UAAU;KAAE,KAAK;KAAO,SAAS;KAAS,aAAa;IAAO,CAAC;GAAE,GAC9F,OACA,YACD;GACA,MAAM,OAAO,IAAI,KAAK,WAAW,SAAS,CAAC,EAAA,CAAG,QAAO,MAAK,KAAK,IAAI,CAAC,CAAC,KAAI,MAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;GACxF,KAAK,MAAM,MAAM,OAAO;IAGvB,MAAM,WAAW,KAAK,IAAI,EAAE;IAC5B,IAAI,YAAY,MAAM;IAEtB,MAAM,cAAc,SAAS,OAAO;IACpC,MAAM,UAAU,QAAQ,eAAe,WAAW;IAClD,IAAI,WAAW,MACd,MAAM,IAAI,MAAM,0BAA0B,GAAG,kBAAkB,YAAY,uBAAuB;IAGnG,MAAM,gBAAgB,MAAM,KAAK,yBAChC,SAAS,OAAO,wBAChB,SAAS,OAAO,iBAChB,UACA,OACA,YACA,QAAQ,MACR,OACD;IACA,OAAO,KAAK,kBAAkB,UAAU,UAAU,SAAS,aAAa,CAAC;GAC1E;EACD;EAEA,MAAM,aAAa,SAAS,MAAM;EAClC,MAAM,UAAU,aAAa,IAAI;EACjC,MAAM,OAAkC;GAAO;GAAe;GAAU,QAAQ;GAAY,MAAM,OAAO;EAAE;EAC3G,OAAO;GACE;GACR,QAAQ,UAAU,KAAK,UAAU,IAAI,IAAI,KAAA;GAChC;GACH;GACN,WAAW;GACX,YAAY,eAAe,KAAA,IAAY,IAAI;GAC3C,cAAc,gBAAgB,KAAA;EAC/B;CACD;;;;;;;CAQA,MAOM,eACL,UACA,OACA,YACA,SACA,cACoC;EACpC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,OAAO,0BACZ,QAAQ,UACR,mBAAmB,QAAQ,UAAU,IAAI,GACzC,QAAQ,YACT;EACA,IAAI;GACH,MAAM,MAAM,MAAM,KAAK,iBACtB,UACA,OACA,YACA,QAAQ,SACR,MACA,iCAAiC,GACjC,OACA,YACD;GACA,OAAO,IAAI,SAAA,MAA0C,kBAAkB,IAAI;EAC5E,SAAS,IAAI;GACZ,IAAI,uBAAuB,EAAE,GAAG,OAAO;GAEvC,MAAM;EACP;CACD;;;;;;;CAQA,MAAc,iBACb,UACA,OACA,YACA,SACA,MACA,KACA,OACA,cACoB;EACpB,MAAM,SAAS,MAAM,KAAK,QACzB,UACA,OACA,SACA,GAAG,kBAAkB,UAAU,EAAE,uBAAuB,IAAI,sCAC5D;GAAE,QAAQ;GAAQ,MAAM,KAAK,UAAU,EAAE,OAAO,KAAK,CAAC;EAAE,GACxD,OACA,YACD;EACA,IAAI,QAAQ,aAAa,MAAM,MAAM,IAAI,MAAM,iDAAiD;EAEhG,OAAO,OAAO,UAAU,KAAI,MAAK,EAAE,EAAE;CACtC;CAEA,cACC,UACA,OACA,OACA,MACA,SACA,OACA,cACmD;EACnD,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,OAAO,KAAK,QACX,UACA,OACA,SACA,GAAG,kBAAkB,KAAK,EAAE,GAAG,kBAAkB,WAAW,EAAE,0BAA0B,kBAAkB,QAAQ,EAAE,mBACpH,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;CACD;CAEA,MAAc,cACb,IACA,UACA,OACA,OACA,SACA,OACA,cACuB;EACvB,MAAM,qBAAqB,MAAM,KAAK,sBACrC,UACA,OACA,OACA,SACA,GAAG,YAAY,YACf,OACA,YACD;EACA,OAAO,qBAAqB,IAAI,UAAU,OAAO,SAAS,kBAAkB;CAC7E;;;;;;;;;;CAWA,MAAc,sBACb,UACA,OACA,OACA,SACA,YACA,OACA,cAC+C;EAC/C,IAAI,cAAc,MAAM,OAAO,KAAA;EAE/B,IAAI;EACJ,IAAI;GACH,YAAY,MAAM,OAAO,MAAM,WAAW;EAC3C,QAAQ;GACP;EACD;EAEA,MAAM,WAAW,KAAK,UAAU;GAAC;GAAW;GAAS;GAAO,WAAW;EAAE,CAAC;EAG1E,OAAO,KAAK,oBAAoB,YAC/B,WACC,WAAW,cACX,KAAK,wBACJ,UACA,OACA,OACA,SACA,WAAW,IACX,WACA,OACA,SACD,GACD,EAAgB,aAAa,CAC9B;CACD;CAEA,MAAc,wBACb,UACA,OACA,OACA,SACA,cACA,WACA,OACA,cAC+C;EAC/C,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SACA,GAAG,kBAAkB,KAAK,EAAE,0BAA0B,kBAAkB,YAAY,EAAE,mBACtF,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,MAAM,SAAS,2BAA2B,UAAU,QAAQ,SAAS,KAAK;GAC1E,MAAM,aAAa,2BAA2B,UAAU,WAAW,SAAS,KAAK;GAIjF,MAAM,MAAM,UAAU;GACtB,IAAI,OAAO,MAAM;IAChB,UAAU,WAAW;IACrB;GACD;GAEA,OAAO;IAAO;IAAiB;GAAW;EAC3C,SAAS,IAAI;GAEZ,IAAI,EAAE,cAAc,yBAAyB,EAAE,cAAc,sBAC5D,UAAU,WAAW;GAGtB,MAAM,SAAS,cAAc,qBAAqB,KAAK,GAAG,OAAO,KAAK;GACtE,OAAO,KAAK,6CAA6C,QAAQ;GACjE;EACD;CACD;CAEA,MAAc,QACb,UACA,OACA,SACA,OACA,SACA,OACA,cACyB;EACzB,MAAM,EAAE,gBAAgB;EACxB,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,UAAU;EAE9C,IAAI;EACJ,IAAI;GACH,MAAM,KAAK,eAAe,WAAW,SAAS,UAAU,MAAM,WAAW,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,CAAC;GAEpG,IAAI;IACH,IAAI,cAAc,SAAS,MAAM,IAAI,kBAAkB;IAEvD,MAAM,MAAM,KAAK,OAAO,yBAAyB,SAAS,mBAAmB,SAC5E,KAAK,OAAO,MAAM,KAAK;KACtB,SAAS;MACR,eAAe,SAAS,OAAO,OAAO,aAAa;MACnD,gBAAgB;KACjB;KACA,QAAQ;KACR,GAAG;IACJ,CAAC,CACF;IAEA,IAAI,IAAI,IAAI;KAMX,KADoB,IAAI,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY,KAAK,GAAA,CACtD,WAAW,WAAW,GAAG;MACxC,MAAM,EAAE,aAAa,cAAc,GAAG,cAAc;MACpD,MAAM,IAAI,oBACT,WAAA,mBAEA,IAAI,MAAM,IAAI,IAAI,OAAO,uDAAuD,CACjF;KACD;KAEA,OAAQ,MAAM,IAAI,KAAK;IACxB;IAGA,MAAM,MAAM,mBAAmB,aAAa,eAAe,GAAG;GAC/D,UAAU;IACT,IAAI,KAAK;GACV;EACD,SAAS,IAAI;GACZ,IAAI,cAAc,sBAAsB,GAAG,SAAS,cACnD,KAAK,mBAAmB,UAAU,OAAO,IAAI,KAAK;QAC5C,IAAIA,QAAO,aACjB,KAAK,OAAO,UAAU,+BAA+B,GAAG,SAAS;GAGlE,MAAM;EACP;CACD;CAEA,mBACC,UACA,OACA,IACA,OACO;EACP,IAAI,GAAG,SAAS,gBAAgB,EAAE,cAAc,qBAAqB,MAAM,IAAI,kBAAkB,EAAE;EAEnG,MAAM,EAAE,aAAa,GAAG,cAAc;EACtC,QAAQ,GAAG,QAAX;GACC,KAAK;GACL,KAAK;GACL,KAAK,KACJ,MAAM,IAAI,qBAAqB,EAAE;GAClC,KAAK,KACJ,MAAM,IAAI,oBAAoB,WAAA,GAAmD,EAAE;GACpF,KAAK,KACJ,MAAM,iBAAiB,IAAI,WAAW;GACvC,KAAK;IAKJ,IAAI,oBAAoB,EAAE,GAAG,MAAM,iBAAiB,IAAI,WAAW;IAEnE,MAAM,IAAI,oBAAoB,WAAA,GAAgD,EAAE;GACjF,KAAK;IACJ,OAAO,MAAM,EAAE;IACf,IAAI,GAAG,YAAY,MAAM;KACxB,UAAU,sBAAsB;KAChC,KAAK,OAAO,kBACX,YAAY,QAAQ,SAAS,OAAO,UACjC,KAAK,EACL,0JACA,UAAU,QAAQ,aACnB,IACC,KAAK,EAAE,2DAA2D,SAAS,IAAI,CACnF;IACD;IACA;GACD,KAAK;IACJ,OAAO,MAAM,EAAE;IAOf;GACD,SACC,IAAI,GAAG,UAAU,OAAO,GAAG,SAAS,KAAK,MAAM,IAAI,mBAAmB,EAAE;EAE1E;EAEA,OAAO,MAAM,EAAE;EACf,IAAIA,QAAO,aACV,KAAK,OAAO,UACX,+BAAgC,GAAG,UAAkB,SAAS,EAAE,EAAE,WAAW,GAAG,SACjF;CAEF;AACD;AA9mCE,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,YAAY;CAChD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACE;AACT,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA0DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA6DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,QAAQ;CAC5C,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACF;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AA8GA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,SAAS,QAAQ;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;CACL;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,YAAA,IAAA;AAqDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,uBAAA,IAAA;AA+DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,aAAa;CACpC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,0BAAA,IAAA;AAyBA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,aAAa;CACpC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,0BAAA,IAAA;AAqHA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AAoDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,oBAAA,IAAA;AA6DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,gBAAgB;CACvC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACrB;AACb,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,uBAAA,IAAA;AAsIA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,gBAAgB;CACvC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACrB;AACb,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,kBAAA,IAAA;;AAoUF,SAAgB,qBAAqB,KAAgD;CACpF,OAAO,IAAI,eAAe,sBAAsB,GAAG,CAAC;AACrD"}

package/dist/plus/integrations/providers/azure/search.d.ts ADDED Viewed

@@ -0,0 +1,144 @@
+import { IssueSearchCriteria, IssueSearchRelationship, IssueSorting } from "../../../../git/models/issue.js";
+import { PullRequestSearchCriteria, PullRequestSorting } from "../../../../git/models/pullRequest.js";
+import { ProviderPullRequest } from "../models.js";
+//#region ../plus/integrations/src/providers/azure/search.d.ts
+/**
+ * The most work items one filtered search can reach, however it is paged.
+ *
+ * Azure DevOps documents 20,000 work items as its query result limit, and may refuse a larger WIQL result set
+ * (`VS402337`) rather than truncate it. The page read therefore asks for a window bounded by `$top`, the first
+ * 20,000 matches under the requested order. Azure DevOps Server 2020 answers that bounded query with 20,014 matches
+ * (it even answered one without `$top`), so the ceiling is this read's, kept at the documented limit.
+ */
+export declare const azureWorkItemSearchResultLimit = 20000;
+/** The work items one detail read can resolve: `workitemsbatch` rejects more than 200 ids. */
+export declare const azureWorkItemBatchLimit = 200;
+/**
+ * A search page size from a caller's `itemsPerPage`, within `[1, max]`. A value that isn't a finite number takes the
+ * default: `NaN` would survive the clamp and serve empty pages that never advance.
+ */
+export declare function toAzureSearchPageSize(value: number | undefined, fallback: number, max: number): number;
+/** The relationships {@link toAzureWorkItemSearchWiql} can express. */
+export declare const azureWorkItemSearchRelationships: IssueSearchRelationship[];
+/** The sort keys {@link toAzureWorkItemSearchWiql} can express. */
+export declare const azureWorkItemSearchSorts: IssueSorting[];
+/**
+ * Translates filtered-search criteria into ONE WIQL query over a collection.
+ *
+ * Relationships are OR-ed inside one parenthesized group rather than run as separate queries, which is what lets a
+ * single query both page and count their union exactly: an item matching two relationships is one row, never two.
+ * The projects bound the query by name through `[System.TeamProject]`, so a repository scope reaches the work items
+ * of its project; with no project the collection itself is the scope.
+ *
+ * The open/closed split mirrors the SDK's WIQL, so this search and the ordinary project read agree on which work
+ * items are open. Free text is a `Contains` substring match on the title, and each label a `Contains` over the
+ * tags, which Azure matches against whole tags — AND-ed, like the criteria model's labels.
+ *
+ * Throws for a relationship or sort key it cannot express. The facade validates both against the declared
+ * capability first, so reaching here with one means the declaration and this translation disagree.
+ */
+export declare function toAzureWorkItemSearchWiql(criteria: IssueSearchCriteria | undefined, sort: IssueSorting, projects: readonly string[] | undefined): string;
+/**
+ * Why a search's dates can't be applied, or `undefined` when they can. The search checks this before any request,
+ * so a date it would refuse costs nothing, and in a count refuses only its own scope.
+ */
+export declare function getInvalidAzureSearchDate(criteria: {
+  updatedAfter?: string;
+  createdAfter?: string;
+} | undefined): string | undefined;
+/**
+ * The criteria a pull-request search applies AFTER the provider read, as one predicate.
+ *
+ * Azure's pull request query takes a creator, a reviewer, a status and a repository, and nothing else, so text,
+ * draft state and dates are matched here against each fully drained facet. Applying them to a complete facet is
+ * exact rather than a post-filter of a page: nothing the predicate removes was ever counted toward a page or a
+ * total, so a count and its list always agree.
+ *
+ * What each criterion matches is bounded by what the list endpoint returns, which is narrower than the web UI:
+ * - text is a case-insensitive substring of the title or of the description — which Azure truncates to its first
+ *   400 characters in a pull request list, so a term only found past that is not matched;
+ * - `updatedAfter` compares Azure's `updatedDate`, which the SDK derives from the close date, or the creation date
+ *   for a pull request still open, since Azure reports no last-activity date. An old but active pull request is
+ *   therefore matched by its creation date.
+ */
+export declare function toAzurePullRequestSearchFilter(criteria: PullRequestSearchCriteria | undefined): (pr: ProviderPullRequest) => boolean;
+/** The pull-request sort keys the search can order its merged facets by. */
+export declare const azurePullRequestSearchSorts: PullRequestSorting[];
+/**
+ * A pull request's position in the merged search result: the sort date plus the identity that breaks ties.
+ *
+ * The identity makes the order TOTAL, which is what lets a cursor resume strictly after the last row served rather
+ * than at a numeric offset. An offset would skip or repeat rows whenever a pull request changes state or date
+ * between two pages; a keyset position only moves past rows that sort before it.
+ */
+export interface AzurePullRequestSearchPosition {
+  time: number;
+  identity: string;
+}
+export declare function toAzurePullRequestSearchPosition(pr: ProviderPullRequest, sort: PullRequestSorting, identity: string): AzurePullRequestSearchPosition;
+/** Orders two positions under `sort`, ties broken by identity so no two rows ever compare equal. */
+export declare function compareAzurePullRequestSearchPositions(a: AzurePullRequestSearchPosition, b: AzurePullRequestSearchPosition, sort: PullRequestSorting): number;
+/**
+ * Where a filtered pull-request search resumes: after `after`, in the drain its first page read, under the query
+ * `key` fingerprints. Bound to its query and served only from its own drain for the same reasons
+ * {@link AzureWorkItemSearchCursor} is bound to its query and snapshot.
+ */
+export interface AzurePullRequestSearchCursor {
+  key: string;
+  drain: string;
+  page: number;
+  after: AzurePullRequestSearchPosition;
+}
+/**
+ * The fingerprint {@link AzurePullRequestSearchCursor.key} carries for a query.
+ *
+ * It only guards a caller threading a cursor under a different query, and keeps the query itself out of the opaque
+ * cursor. It never selects cached results: those are keyed by the full query (see the callers), so a fingerprint
+ * collision can at worst accept a cursor, never serve another query's rows.
+ */
+export declare function toAzurePullRequestSearchCursorKey(query: unknown): string;
+/** Reads a caller-supplied cursor for the query fingerprinted as `key`; see {@link parseAzureWorkItemSearchCursor}. */
+export declare function parseAzurePullRequestSearchCursor(cursor: string | undefined, key: string): AzurePullRequestSearchCursor | undefined;
+/**
+ * Where a filtered work-item search resumes: an offset into the id snapshot its first page queried, the id of that
+ * snapshot, and the fingerprint of the query that produced it.
+ *
+ * A continuation is only served from ITS snapshot, where the offset is exact. Each first page queries a snapshot of
+ * its own, so a pagination of the same query started later never replaces the one an earlier pagination is reading.
+ * The snapshot is kept for as long as the pagination keeps reading it; once it is gone the continuation is REFUSED
+ * rather than resumed against a fresh query, since under an `updated` order a re-query can move an unseen work item
+ * ahead of the offset, where it would be skipped without anything saying so. A cursor without a `snapshot` is the
+ * facade's own page marker, which names a page by number with no snapshot behind it and is read against a fresh
+ * query as exactly that.
+ *
+ * The fingerprint binds the cursor to its query (scope, criteria and order) without publishing any of them inside
+ * the opaque cursor. A cursor for another query is REFUSED rather than silently restarted: this read is cursor-only,
+ * so a restart would be served under the page number the caller supplied alongside it — page 1's rows labelled as
+ * page N.
+ */
+export interface AzureWorkItemSearchCursor {
+  key: string;
+  snapshot?: string;
+  offset: number;
+  page: number;
+}
+/** The fingerprint {@link AzureWorkItemSearchCursor.key} carries for a query; see {@link toAzurePullRequestSearchCursorKey}. */
+export declare function toAzureWorkItemSearchCursorKey(collection: string, wiql: string): string;
+/**
+ * Whether `cursor` starts a work-item search's first page: none at all, or the facade's page-1 marker, which
+ * {@link parseAzureWorkItemSearchCursor} reads the same way.
+ */
+export declare function isAzureWorkItemSearchFirstPage(cursor: string | undefined): boolean;
+/**
+ * Reads a caller-supplied cursor for the query fingerprinted as `key`.
+ *
+ * Returns `undefined` when there is no cursor, and throws when there is one this query can't resume, since treating
+ * a foreign or malformed cursor as page 1 would publish the first page's rows as the page the caller asked for.
+ *
+ * The one cursor it accepts without a fingerprint is the facade's own page marker (`{ value, type: 'page' }`), which
+ * `broadenIssues` sends to retry or reach a numbered page it holds no cursor for. It names a position rather than a
+ * query, so it is honored as the offset of that page at `pageSize` — page 1 being no cursor at all.
+ */
+export declare function parseAzureWorkItemSearchCursor(cursor: string | undefined, key: string, pageSize: number): AzureWorkItemSearchCursor | undefined;
+//#endregion
+//# sourceMappingURL=search.d.ts.map