@gitkraken/core-gitlens 0.7.1 → 0.8.0

package/dist/plus/integrations/models/integration.d.ts

@@ -3,13 +3,15 @@ import { Emitter, Event } from "../../../utils/event.js";
 import { ResourceDescriptor } from "../../../git/models/resourceDescriptor.js";
 import { AutolinkReference, DynamicAutolinkReference } from "../../../git/models/autolink.js";
 import { IssueOrPullRequest, IssueOrPullRequestType } from "../../../git/models/issueOrPullRequest.js";
-import { Issue, IssueShape } from "../../../git/models/issue.js";
+import { Issue as Issue$1, IssueShape } from "../../../git/models/issue.js";
 import { PullRequest } from "../../../git/models/pullRequest.js";
 import { ScopedLogger } from "../../../utils/logger.scoped.js";
-import { Account } from "../../../git/models/author.js";
+import { Account as Account$1 } from "../../../git/models/author.js";
 import { ProviderAuthenticationSession } from "../authentication/models.js";
 import { GitCloudHostIntegrationId, IntegrationIds, IssuesCloudHostIntegrationId, IssuesHostIntegrationIds } from "../constants.js";
 import { Sources } from "../telemetry.js";
+import { ProviderWarningCause, ProviderWarningScope } from "../results.js";
+import { ProviderRefusal, ProviderScopeFailure } from "../collectionMetadata.js";
 import { ProviderPullRequestCount, ProviderPullRequestSearchPage } from "./pullRequestReads.js";
 import { ProvidersApi } from "../providers/providersApi.js";
 import { AccountWideIssuesResult, ProviderIssueSearchPage, ProviderSearchCount, SearchMyIssuesOptions } from "./issueReads.js";
@@ -19,6 +21,7 @@ import { IntegrationConnectionChangeEvent } from "../integrationService.js";
 import { IntegrationAuthenticationService } from "../authentication/integrationAuthenticationService.js";
 import { IntegrationAuthenticationProviderDescriptor, IntegrationAuthenticationSessionDescriptor } from "../authentication/integrationAuthenticationProvider.js";
 import { IntegrationServiceContext } from "../context.js";
+import { CollectionMetadata } from "@gitkraken/provider-apis";
 //#region ../plus/integrations/src/models/integration.d.ts
 export type Integration = GitHostIntegration | IssuesIntegration;
 export type IntegrationById<T extends IntegrationIds> = T extends IssuesHostIntegrationIds ? IssuesIntegration : GitHostIntegration;
@@ -34,7 +37,22 @@ export type IntegrationResult<T> = {
   duration?: number;
   value?: never;
 } | undefined;
-type SyncReqUsecase = Exclude<'getAccountForCommit' | 'getAccountForEmail' | 'getAccountForResource' | 'getCurrentAccount' | 'getDefaultBranch' | 'getIssue' | 'getIssueOrPullRequest' | 'getIssuesBatch' | 'getIssuesForProject' | 'getIssuesForRepos' | 'getMyPullRequestsForUser' | 'getOrganizationsForUser' | 'getProjectsForOrg' | 'getProjectsForResources' | 'getPullRequest' | 'getRepositoriesForOrg' | 'getRepositoriesForUser' | 'getPullRequestForBranch' | 'getPullRequestForCommit' | 'getPullRequestsForRepos' | 'getRepositoryMetadata' | 'getResourcesForUser' | 'getSshSigningKeysForEmails' | 'countIssues' | 'countPullRequests' | 'mergePullRequest' | 'searchIssuesPage' | 'searchPullRequestsPage' | 'searchMyIssues' | 'searchMyPullRequests' | 'searchPullRequests', 'all'>;
+/**
+ * One target's answer in a batch read. A slot rejected by an authentication refusal carries the scope failure it was
+ * recorded as (see `IntegrationBase.settleBatchRefusals`).
+ */
+export type BatchSlot<T> = PromiseFulfilledResult<T> | (PromiseRejectedResult & {
+  failure?: ProviderScopeFailure;
+});
+/** A batch read's target, in the form its provider addresses it by: a repository coordinate, or a tracker's resource. */
+type BatchTarget = {
+  owner: string;
+  repo: string;
+  project?: string;
+} | {
+  resourceId: string;
+};
+type SyncReqUsecase = Exclude<'getAccountForCommit' | 'getAccountForEmail' | 'getAccountForResource' | 'getCurrentAccount' | 'getDefaultBranch' | 'getIssue' | 'getIssueOrPullRequest' | 'getIssuesBatch' | 'getIssuesForProject' | 'getIssuesForRepos' | 'getMyPullRequestsForUser' | 'getOrganizationsForUser' | 'getProjectsForOrg' | 'getProjectsForResources' | 'getPullRequest' | 'getPullRequestsBatch' | 'getPullRequestsForBranches' | 'getRepositoriesForOrg' | 'getRepositoriesForUser' | 'getPullRequestForBranch' | 'getPullRequestForCommit' | 'getPullRequestsForRepos' | 'getRepositoryMetadata' | 'getResourcesForUser' | 'getSshSigningKeysForEmails' | 'countIssues' | 'countPullRequests' | 'mergePullRequest' | 'searchIssuesPage' | 'searchPullRequestsPage' | 'searchMyIssues' | 'searchMyPullRequests' | 'searchPullRequests', 'all'>;
 export declare abstract class IntegrationBase<ID extends IntegrationIds = IntegrationIds, T extends ResourceDescriptor = ResourceDescriptor> implements Disposable {
   protected readonly ctx: IntegrationServiceContext;
   protected readonly authenticationService: IntegrationAuthenticationService;
@@ -130,11 +148,97 @@ export declare abstract class IntegrationBase<ID extends IntegrationIds = Integr
   private refreshAfterSwitch;
   private skippedNonCloudReported;
   syncCloudConnection(state: 'connected' | 'disconnected', forceSync: boolean): Promise<void>;
+  /**
+   * Proves the credential with an uncached check, rejecting with the provider's `AuthenticationError` when it is
+   * refused, and with anything else when the check proves nothing. A `403` proves nothing either: the credential
+   * authenticated and was only denied the check's request.
+   *
+   * Implemented by the providers whose reads can reach their scopes without an uncached request to the connection
+   * first: discovery served from a per-token cache (Azure DevOps, Bitbucket, Jira Cloud), or an SDK fan-out across
+   * the requested repositories (Bitbucket Data Center). There, a dead token comes back as scoped refusals with no
+   * failure of the connection: the same shape as one scope refusing a sound credential.
+   * {@link confirmScopedAuthFailures} uses this to tell the two apart.
+   */
+  protected validateCredential?(session: ProviderAuthenticationSession): Promise<void>;
+  /**
+   * Credentials that passed {@link validateCredential} within the last minute. A probe already in flight is
+   * shared rather than repeated, and a refused one is not kept. Cleared whenever a credential is refused (see
+   * {@link handleProviderException}), so a pass is never vouched for past a refusal this instance has seen.
+   */
+  private readonly _validatedCredentials;
+  /**
+   * Whether a scope's refusal is the credential's own, by the provider's account of it: e.g. a token missing the
+   * OAuth scopes the read needs. The probe cannot see that, because it proves the token authenticates, not that
+   * it is authorized. So {@link confirmScopedAuthFailures} publishes one for the connection, unscoped, which asks
+   * for the reconnect (consenting to the scopes again) that fixes it, and keeps the results of the scopes that
+   * answered.
+   */
+  protected isCredentialRefusal?(refusal: ProviderRefusal): boolean;
+  /**
+   * Names why a confirmed credential was refused by one scope, from what the refusal said (see
+   * `ProviderWarning.cause`). Called only by {@link confirmScopedAuthFailures}, once the credential passed: the
+   * refusals this names are indistinguishable from a dead credential until then.
+   */
+  protected describeRefusal?(session: ProviderAuthenticationSession, refusal: ProviderRefusal, scope: ProviderWarningScope): ProviderWarningCause | undefined;
+  /**
+   * Settles what a read's only-scoped authentication failures mean, when the provider can tell (see
+   * {@link validateCredential}).
+   *
+   * A refused credential is thrown: the caller's `catch` then fails the read as a whole, exactly as it does when
+   * discovery is not cached and the first request is the one refused. Without this, a token revoked after
+   * discovery would publish scoped `auth` warnings, which a consumer must not answer with a reconnect (see
+   * `ProviderWarning.scope`), next to results served from the cache, for as long as the token stays stored.
+   *
+   * A confirmed credential makes each refusal the scope's own, so its cause is named through
+   * {@link describeRefusal}. A probe that fails for another reason proves nothing either way and leaves the read
+   * as it was.
+   *
+   * A refusal the provider pins on the credential itself (see {@link isCredentialRefusal}) is published for the
+   * connection instead, without a probe.
+   *
+   * A token that passed within the last minute is not probed again, so a scope that keeps refusing it costs one
+   * probe a minute, and a revocation right after a probe can take up to a minute to surface: until then its
+   * refusals stay scoped, and may be named. A probe that proved nothing is not remembered, so the next read probes
+   * again, and a credential no probe can confirm (e.g. a Bitbucket Data Center project access token) is probed on
+   * every read that has scoped refusals.
+   */
+  protected confirmScopedAuthFailures(session: ProviderAuthenticationSession, metadata: CollectionMetadata | undefined): Promise<void>;
+  /**
+   * Settles what a batch read's authentication refusals mean before the call is judged, as
+   * {@link confirmScopedAuthFailures} settles an account-wide read's: each refused slot comes back carrying the scope
+   * failure it was recorded as, against the scope its target names (see {@link batchTargetScope}), and a read
+   * publishes that instead of the bare reason.
+   *
+   * When any target answered, that proved the credential, so each refusal is its own target's. When every target
+   * failed, the call fails as a whole, as it always has, unless every failure is a refusal of a credential that checks
+   * out. Every target refusing is also what a dead credential looks like, so the credential is checked once first,
+   * with {@link validateCredential}. A check that proves nothing leaves the refusals scoped and unnamed, as it leaves
+   * an account-wide read's. A provider with no check cannot tell, and a refusal it pins on the credential (see
+   * {@link isCredentialRefusal}) needs none, so either still fails the call.
+   */
+  protected settleBatchRefusals<T>(session: ProviderAuthenticationSession, targets: readonly BatchTarget[], slots: PromiseSettledResult<T>[]): Promise<BatchSlot<T>[]>;
+  /**
+   * Shows one notice, and spends at most one strike, for a batch read whose targets failed with a server error or a
+   * timeout. Our own clients leave both to the batch (see `reportRequestFailure`) instead of spending them per
+   * target. `strike` is true only when every target failed and the call's own failure spent none: a call that
+   * answered some targets showed the host is up, and budgets strikes the same way as the rest of its failures.
+   */
+  protected reportDeferredRequestFailures(slots: readonly PromiseSettledResult<unknown>[] | undefined, strike: boolean): void;
+  /** Marks the scoped refusals the provider pins on the credential (see {@link isCredentialRefusal}). */
+  private markCredentialRefusals;
+  /**
+   * Checks the credential with {@link validateCredential}, rethrowing the provider's refusal when it is refused.
+   * `undefined` when the provider has no check, and `'unproven'` when the check proved nothing either way.
+   */
+  private confirmCredential;
+  /** Names each scoped refusal's cause (see {@link describeRefusal}); only once the credential is proven. */
+  private nameRefusalCauses;
+  /** Returns whether it spent a strike toward disconnecting (see {@link trackRequestException}). */
   protected handleProviderException(syncReqUsecase: SyncReqUsecase, ex: Error, options?: {
     scope?: ScopedLogger | undefined;
     silent?: boolean;
     connectionId?: string;
-  }): void;
+  }): boolean;
   private missingExpirityReported;
   protected refreshSessionIfExpired(scope?: ScopedLogger): Promise<void>;
   trackRequestException(options?: {
@@ -176,30 +280,32 @@ export declare abstract class IntegrationBase<ID extends IntegrationIds = Integr
   getIssue(resource: T, id: string, options?: {
     connectionId?: string;
     expiryOverride?: boolean | number;
-  }): Promise<Issue | undefined>;
+  }): Promise<Issue$1 | undefined>;
   getIssueResult(resource: T, id: string, options?: {
     connectionId?: string;
     expiryOverride?: boolean | number;
-  }): Promise<IntegrationResult<Issue | undefined>>;
+  }): Promise<IntegrationResult<Issue$1 | undefined>>;
   protected getIssueResultCore(resource: ResourceDescriptor, id: string, options: {
     connectionId?: string;
     expiryOverride?: boolean | number;
-  } | undefined, getProviderIssue: (session: ProviderAuthenticationSession) => Promise<Issue | undefined>): Promise<IntegrationResult<Issue | undefined>>;
-  protected abstract getProviderIssue(session: ProviderAuthenticationSession, resource: T, id: string): Promise<Issue | undefined>;
+  } | undefined, getProviderIssue: (session: ProviderAuthenticationSession) => Promise<Issue$1 | undefined>): Promise<IntegrationResult<Issue$1 | undefined>>;
+  protected abstract getProviderIssue(session: ProviderAuthenticationSession, resource: T, id: string): Promise<Issue$1 | undefined>;
   getCurrentAccount(options?: {
     avatarSize?: number;
     connectionId?: string;
     expiryOverride?: boolean | number;
-  }): Promise<Account | undefined>;
+  }): Promise<Account$1 | undefined>;
   protected getProviderCurrentAccount?(session: ProviderAuthenticationSession, options?: {
     avatarSize?: number;
-  }): Promise<Account | undefined>;
+  }): Promise<Account$1 | undefined>;
+  /** Whether this integration can answer {@link getCurrentAccount} at all — Jira, Linear and Trello cannot. */
+  get supportsCurrentAccount(): boolean;
   /**
    * Resolves the account for a specific session/token — including connections other than the current
    * primary (multi-account) — using this integration's provider API base URL and auth type. Returns
    * undefined when the provider doesn't support account lookup. Uncached (callers cache per connection).
    */
-  getProviderAccountForSession(session: ProviderAuthenticationSession): Promise<Account | undefined>;
+  getProviderAccountForSession(session: ProviderAuthenticationSession): Promise<Account$1 | undefined>;
   getPullRequest(resource: T, id: string, options?: {
     expiryOverride?: boolean | number;
     throwOnError?: boolean;

package/dist/plus/integrations/models/integration.js

@@ -2,19 +2,45 @@ import { isCancellationError } from "../../../utils/cancellation.js";
 import { Logger as _logger } from "../../../utils/logger.js";
 import { getScopedLogger } from "../../../utils/logger.scoped.js";
 import { debug, trace } from "../../../utils/decorators/log.js";
+import { PromiseCache } from "../../../utils/promiseCache.js";
 import __decorate from "../../../_virtual/@oxc-project+runtime/helpers/esm/decorate.js";
-import { AuthenticationError, RequestClientError } from "../../../git/errors.js";
+import { AuthenticationError, RequestClientError, getDeferredRequestFailure } from "../../../git/errors.js";
 import { Emitter } from "../../../utils/event.js";
 import { fnv1aHash64 } from "../../../utils/hash.js";
 import { gate } from "../../../utils/decorators/gate.js";
 import { toError } from "../errors.js";
 import "../constants.js";
+import { isAzureProviderId } from "../providers/providerErrors.js";
+import { attributeScopedAuthFailures, hasOnlyScopedAuthFailures, markCredentialRefusals, toCollectionScopeFailure } from "../collectionMetadata.js";
+import { throwIfAllSettledFailed } from "../providers/utils/providerPaging.js";
 import { areDomainsOnSameHost } from "../utils/domain.utils.js";
 import { isSelfManagedHostIntegrationId } from "../utils/integration.utils.js";
 import { providersMetadata } from "../providers/models.js";
 import { RejectedTokenTracker } from "../authentication/rejectedTokenTracker.js";
 import { getCachedIssue } from "./issueCache.js";
 //#region ../plus/integrations/src/models/integration.ts
+/**
+* The scope a batch read records a refused target under. It is decided here rather than in the read, which has the
+* same targets, because naming the refusal's cause (`describeRefusal`) needs it too. Azure DevOps: the organization
+* and project, since its refusals come from those (an organization's OAuth policy or tenant, a project's permissions)
+* and its work items belong to no repository. Every other git host: the repository, `owner/repo`, which is how its
+* repo-scoped reads record one. A tracker: the resource.
+*/
+function batchTargetScope(providerId, target) {
+	if ("resourceId" in target) return {
+		providerId,
+		resourceId: target.resourceId
+	};
+	if (isAzureProviderId(providerId)) return {
+		providerId,
+		resourceId: target.owner,
+		projectId: target.project
+	};
+	return {
+		providerId,
+		repositoryId: `${target.owner}/${target.repo}`
+	};
+}
 var IntegrationBase = class IntegrationBase {
 	ctx;
 	authenticationService;
@@ -284,23 +310,154 @@ var IntegrationBase = class IntegrationBase {
 			case "disconnected": await this.disconnect({ silent: true });
 		}
 	}
+	/**
+	* Credentials that passed {@link validateCredential} within the last minute. A probe already in flight is
+	* shared rather than repeated, and a refused one is not kept. Cleared whenever a credential is refused (see
+	* {@link handleProviderException}), so a pass is never vouched for past a refusal this instance has seen.
+	*/
+	_validatedCredentials = new PromiseCache({
+		createTTL: 6e4,
+		capacity: 10
+	});
+	/**
+	* Settles what a read's only-scoped authentication failures mean, when the provider can tell (see
+	* {@link validateCredential}).
+	*
+	* A refused credential is thrown: the caller's `catch` then fails the read as a whole, exactly as it does when
+	* discovery is not cached and the first request is the one refused. Without this, a token revoked after
+	* discovery would publish scoped `auth` warnings, which a consumer must not answer with a reconnect (see
+	* `ProviderWarning.scope`), next to results served from the cache, for as long as the token stays stored.
+	*
+	* A confirmed credential makes each refusal the scope's own, so its cause is named through
+	* {@link describeRefusal}. A probe that fails for another reason proves nothing either way and leaves the read
+	* as it was.
+	*
+	* A refusal the provider pins on the credential itself (see {@link isCredentialRefusal}) is published for the
+	* connection instead, without a probe.
+	*
+	* A token that passed within the last minute is not probed again, so a scope that keeps refusing it costs one
+	* probe a minute, and a revocation right after a probe can take up to a minute to surface: until then its
+	* refusals stay scoped, and may be named. A probe that proved nothing is not remembered, so the next read probes
+	* again, and a credential no probe can confirm (e.g. a Bitbucket Data Center project access token) is probed on
+	* every read that has scoped refusals.
+	*/
+	async confirmScopedAuthFailures(session, metadata) {
+		if (!hasOnlyScopedAuthFailures(metadata)) return;
+		if (this.markCredentialRefusals(metadata)) return;
+		if (await this.confirmCredential(session) !== "confirmed") return;
+		this.nameRefusalCauses(session, metadata);
+	}
+	/**
+	* Settles what a batch read's authentication refusals mean before the call is judged, as
+	* {@link confirmScopedAuthFailures} settles an account-wide read's: each refused slot comes back carrying the scope
+	* failure it was recorded as, against the scope its target names (see {@link batchTargetScope}), and a read
+	* publishes that instead of the bare reason.
+	*
+	* When any target answered, that proved the credential, so each refusal is its own target's. When every target
+	* failed, the call fails as a whole, as it always has, unless every failure is a refusal of a credential that checks
+	* out. Every target refusing is also what a dead credential looks like, so the credential is checked once first,
+	* with {@link validateCredential}. A check that proves nothing leaves the refusals scoped and unnamed, as it leaves
+	* an account-wide read's. A provider with no check cannot tell, and a refusal it pins on the credential (see
+	* {@link isCredentialRefusal}) needs none, so either still fails the call.
+	*/
+	async settleBatchRefusals(session, targets, slots) {
+		const failures = slots.map((slot, i) => slot.status === "rejected" && slot.reason instanceof AuthenticationError ? toCollectionScopeFailure(batchTargetScope(this.id, targets[i]), slot.reason) : void 0);
+		const refused = failures.filter((f) => f != null);
+		if (!refused.length) {
+			throwIfAllSettledFailed(slots);
+			return slots;
+		}
+		const metadata = {
+			completeness: "partial",
+			failures: refused
+		};
+		const credentialRefused = this.markCredentialRefusals(metadata);
+		if (slots.some((slot) => slot.status === "fulfilled")) this.nameRefusalCauses(session, metadata);
+		else if (credentialRefused) throwIfAllSettledFailed(slots);
+		else if (refused.length < slots.length) throwIfAllSettledFailed(slots.filter((_, i) => failures[i] == null));
+		else {
+			const confirmation = await this.confirmCredential(session);
+			if (confirmation == null) throwIfAllSettledFailed(slots);
+			else if (confirmation === "confirmed") this.nameRefusalCauses(session, metadata);
+		}
+		return slots.map((slot, i) => {
+			const failure = failures[i];
+			return slot.status === "rejected" && failure != null ? {
+				...slot,
+				failure
+			} : slot;
+		});
+	}
+	/**
+	* Shows one notice, and spends at most one strike, for a batch read whose targets failed with a server error or a
+	* timeout. Our own clients leave both to the batch (see `reportRequestFailure`) instead of spending them per
+	* target. `strike` is true only when every target failed and the call's own failure spent none: a call that
+	* answered some targets showed the host is up, and budgets strikes the same way as the rest of its failures.
+	*/
+	reportDeferredRequestFailures(slots, strike) {
+		let notify;
+		for (const slot of slots ?? []) {
+			if (slot.status !== "rejected") continue;
+			notify = getDeferredRequestFailure(slot.reason);
+			if (notify != null) break;
+		}
+		if (notify == null) return;
+		if (strike) this.trackRequestException();
+		notify();
+	}
+	/** Marks the scoped refusals the provider pins on the credential (see {@link isCredentialRefusal}). */
+	markCredentialRefusals(metadata) {
+		const isCredentialRefusal = this.isCredentialRefusal?.bind(this);
+		return isCredentialRefusal != null && markCredentialRefusals(metadata, isCredentialRefusal);
+	}
+	/**
+	* Checks the credential with {@link validateCredential}, rethrowing the provider's refusal when it is refused.
+	* `undefined` when the provider has no check, and `'unproven'` when the check proved nothing either way.
+	*/
+	async confirmCredential(session) {
+		const validateCredential = this.validateCredential?.bind(this);
+		if (validateCredential == null) return void 0;
+		const key = [
+			session.domain,
+			session.baseUrl ?? "",
+			session.accessToken
+		].join("\n");
+		try {
+			await this._validatedCredentials.getOrCreate(key, () => validateCredential(session));
+		} catch (ex) {
+			if (ex instanceof AuthenticationError && ex.reason !== 3) throw ex;
+			return "unproven";
+		}
+		return "confirmed";
+	}
+	/** Names each scoped refusal's cause (see {@link describeRefusal}); only once the credential is proven. */
+	nameRefusalCauses(session, metadata) {
+		const describeRefusal = this.describeRefusal?.bind(this);
+		if (describeRefusal == null) return;
+		attributeScopedAuthFailures(metadata, (refusal, scope) => describeRefusal(session, refusal, scope));
+	}
+	/** Returns whether it spent a strike toward disconnecting (see {@link trackRequestException}). */
 	handleProviderException(syncReqUsecase, ex, options) {
-		if (isCancellationError(ex)) return;
+		if (isCancellationError(ex)) return false;
+		if (ex instanceof AuthenticationError) this._validatedCredentials.clear();
 		if (options?.scope != null) options.scope.error(ex);
 		else _logger.error(ex);
 		if (ex instanceof AuthenticationError && options?.connectionId) {
-			if (!this._rejectedTokens.recordRejection(options.connectionId)) this.trackRequestException(options);
-			return;
+			if (this._rejectedTokens.recordRejection(options.connectionId)) return false;
+			this.trackRequestException(options);
+			return true;
 		}
-		if (ex instanceof AuthenticationError && this._session?.cloud) {
-			if (!this.hasSessionSyncRequests()) {
-				this.requestSessionSyncForUsecase(syncReqUsecase);
-				this._session = {
-					...this._session,
-					expiresAt: /* @__PURE__ */ new Date(Date.now() - 1)
-				};
-			} else this.trackRequestException(options);
-		} else if (ex instanceof AuthenticationError || ex instanceof RequestClientError) this.trackRequestException(options);
+		if (ex instanceof AuthenticationError && this._session?.cloud && !this.hasSessionSyncRequests()) {
+			this.requestSessionSyncForUsecase(syncReqUsecase);
+			this._session = {
+				...this._session,
+				expiresAt: /* @__PURE__ */ new Date(Date.now() - 1)
+			};
+			return false;
+		}
+		if (!(ex instanceof AuthenticationError) && !(ex instanceof RequestClientError)) return false;
+		this.trackRequestException(options);
+		return true;
 	}
 	missingExpirityReported = false;
 	async refreshSessionIfExpired(scope) {
@@ -438,6 +595,7 @@ var IntegrationBase = class IntegrationBase {
 		if (session == null) return void 0;
 		try {
 			const result = await this.searchProviderMyIssuesWithTruncation(session, resources != null ? Array.isArray(resources) ? resources : [resources] : void 0, cancellation, options);
+			await this.confirmScopedAuthFailures(session, result?.metadata);
 			this.resetRequestExceptionCount("searchMyIssues");
 			return { value: result };
 		} catch (ex) {
@@ -535,6 +693,10 @@ var IntegrationBase = class IntegrationBase {
 			etag: `${this.id}:${this.maybeConnected ?? false}:${sessionFingerprint}`
 		});
 	}
+	/** Whether this integration can answer {@link getCurrentAccount} at all — Jira, Linear and Trello cannot. */
+	get supportsCurrentAccount() {
+		return this.getProviderCurrentAccount != null;
+	}
 	/**
 	* Resolves the account for a specific session/token — including connections other than the current
 	* primary (multi-account) — using this integration's provider API base URL and auth type. Returns