@gitkraken/core-gitlens 0.9.3 → 0.9.5

package/dist/plus/integrations/providers/azure/azure.js.map

@@ -1 +1 @@
-{"version":3,"file":"azure.js","names":["Logger"],"sources":["../../../../../../plus/integrations/src/providers/azure/azure.ts"],"sourcesContent":["import * as l10n from '@vscode/l10n';\nimport type { UnidentifiedAuthor } from '@gitlens/git/models/author.js';\nimport type { DefaultBranch } from '@gitlens/git/models/defaultBranch.js';\nimport type { Issue, IssueSearchCriteria } from '@gitlens/git/models/issue.js';\nimport type { IssueOrPullRequest, IssueOrPullRequestType } from '@gitlens/git/models/issueOrPullRequest.js';\nimport type { PullRequest } from '@gitlens/git/models/pullRequest.js';\nimport type { Provider } from '@gitlens/git/models/remoteProvider.js';\nimport type { RepositoryMetadata } from '@gitlens/git/models/repositoryMetadata.js';\nimport { effectiveIssueSort } from '@gitlens/git/utils/issue.utils.js';\nimport { base64 } from '@gitlens/utils/base64.js';\nimport { CancellationError, isCancellationError } from '@gitlens/utils/cancellation.js';\nimport { sha256, uuid } from '@gitlens/utils/crypto.js';\nimport { trace } from '@gitlens/utils/decorators/log.js';\nimport type { Disposable } from '@gitlens/utils/disposable.js';\nimport { Logger } from '@gitlens/utils/logger.js';\nimport type { ScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport { getScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport type { CacheController } from '@gitlens/utils/promiseCache.js';\nimport { PromiseCache } from '@gitlens/utils/promiseCache.js';\nimport { maybeStopWatch } from '@gitlens/utils/stopwatch.js';\nimport type { TokenWithInfo } from '../../authentication/models.js';\nimport type { IntegrationServiceContext } from '../../context.js';\nimport {\n\tAuthenticationError,\n\tAuthenticationErrorReason,\n\tisRateLimitResponse,\n\tProviderFetchError,\n\tRequestClientError,\n\tRequestNotFoundError,\n\ttoRateLimitError,\n} from '../../errors.js';\nimport type { ProviderIssueSearchPage } from '../../models/issueReads.js';\nimport { decodePathSegment } from '../../utils/domain.utils.js';\nimport type { ProviderApiConfig } from '../apiConfig.js';\nimport { baseProviderApiConfig } from '../apiConfig.js';\nimport type {\n\tAzureForkRepositoryUrls,\n\tAzureGitCommit,\n\tAzureProjectDescriptor,\n\tAzurePullRequest,\n\tAzurePullRequestWithLinks,\n\tAzureRepositoryReference,\n\tAzureRepositoryUrls,\n\tAzureRepositoryWithMetadata,\n\tAzureWorkItemState,\n\tAzureWorkItemStateCategory,\n\tWorkItem,\n} from './models.js';\nimport {\n\tazurePullRequestStatusToState,\n\tazureWorkItemsStateCategoryToState,\n\tencodeAzurePathSegment,\n\tfromAzurePullRequest,\n\tfromAzureWorkItem,\n\tgetAzurePullRequestWebUrl,\n\tisClosedAzurePullRequestStatus,\n\tisClosedAzureWorkItemStateCategory,\n\tnormalizeAzureBranchName,\n\tsanitizeAzureRepositoryUrl,\n} from './models.js';\nimport type { AzureWorkItemSearchCursor } from './search.js';\nimport {\n\tazureWorkItemBatchLimit,\n\tazureWorkItemSearchResultLimit,\n\tparseAzureWorkItemSearchCursor,\n\ttoAzureSearchPageSize,\n\ttoAzureWorkItemSearchCursorKey,\n\ttoAzureWorkItemSearchWiql,\n} from './search.js';\n\nconst forkRepositoryUrlCacheTtl = 5 * 60 * 1000;\n/** How long a work-item search's id snapshot outlives the last page read from it, and the most it lives at all. */\nconst workItemSearchSnapshotTtl = 5 * 60 * 1000;\nconst workItemSearchSnapshotMaxTtl = 30 * 60 * 1000;\n\n/** Whether Azure refused a WIQL query for matching more work items than it will return (`VS402337`). */\nfunction isWorkItemLimitRefusal(ex: unknown): boolean {\n\treturn ex instanceof RequestClientError && ex.message.includes('VS402337');\n}\n\nfunction parseAzureRepositoryDescriptor(repo: string): { projectName: string; repoName: string } {\n\tconst parts = repo.split('/');\n\tconst [projectName, segment, repoName] = parts;\n\tif (parts.length !== 3 || segment !== '_git' || !projectName || !repoName) {\n\t\tthrow new Error(`Invalid Azure repository descriptor '${repo}'; expected '{project}/_git/{repoName}'.`);\n\t}\n\n\treturn { projectName: projectName, repoName: repoName };\n}\n\nclass WorkItemStates {\n\tprivate readonly _categories = new Map<string, AzureWorkItemStateCategory>();\n\tprivate readonly _types = new Map<string, AzureWorkItemState[]>();\n\n\t// TODO@sergeibbb: we might need some logic for invalidating\n\tpublic getStateCategory(\n\t\tproject: string,\n\t\tworkItemType: string,\n\t\tstateName: string,\n\t): AzureWorkItemStateCategory | undefined {\n\t\treturn this._categories.get(this.getStateKey(project, workItemType, stateName));\n\t}\n\n\tpublic clear(): void {\n\t\tthis._categories.clear();\n\t\tthis._types.clear();\n\t}\n\n\tpublic saveTypeStates(project: string, workItemType: string, states: AzureWorkItemState[]): void {\n\t\tthis.clearTypeStates(project, workItemType);\n\t\tthis._types.set(this.getTypeKey(project, workItemType), states);\n\t\tfor (const state of states) {\n\t\t\tthis._categories.set(this.getStateKey(project, workItemType, state.name), state.category);\n\t\t}\n\t}\n\n\tpublic hasTypeStates(project: string, workItemType: string): boolean {\n\t\treturn this._types.has(this.getTypeKey(project, workItemType));\n\t}\n\n\tprivate clearTypeStates(project: string, workItemType: string): void {\n\t\tconst states = this._types.get(this.getTypeKey(project, workItemType));\n\t\tif (states == null) return;\n\n\t\tfor (const state of states) {\n\t\t\tthis._categories.delete(this.getStateKey(project, workItemType, state.name));\n\t\t}\n\t}\n\n\tprivate getStateKey(project: string, workItemType: string, stateName: string): string {\n\t\t// By stringifying the pair as JSON we make sure that all possible special characters are escaped\n\t\treturn JSON.stringify([project, workItemType, stateName]);\n\t}\n\n\tprivate getTypeKey(project: string, workItemType: string): string {\n\t\treturn JSON.stringify([project, workItemType]);\n\t}\n}\n\nexport class AzureDevOpsApi implements Disposable {\n\tprivate readonly _disposable: Disposable | undefined;\n\tprivate _workItemStates: WorkItemStates = new WorkItemStates();\n\tprivate readonly _forkRepositoryUrls = new PromiseCache<string, AzureForkRepositoryUrls | undefined>({\n\t\tcapacity: 100,\n\t\tcreateTTL: forkRepositoryUrlCacheTtl,\n\t});\n\t/**\n\t * The ordered ids each filtered work-item search's first page queried, paged through by its continuations. Kept\n\t * alive while a pagination keeps reading them (see `workItemSearchSnapshotTtl`). Every first page adds one, so\n\t * the capacity leaves room for repeated first pages before an idle pagination's snapshot is the one evicted.\n\t */\n\tprivate readonly _workItemSearches = new PromiseCache<string, number[]>({\n\t\tcapacity: 50,\n\t\taccessTTL: workItemSearchSnapshotTtl,\n\t\tcreateTTL: workItemSearchSnapshotMaxTtl,\n\t});\n\n\tconstructor(private readonly config: ProviderApiConfig) {\n\t\tthis._disposable = config.onConfigChanged?.(() => this.resetCaches());\n\t}\n\n\tdispose(): void {\n\t\tthis._disposable?.dispose();\n\t}\n\n\tprivate resetCaches(): void {\n\t\tthis._workItemStates.clear();\n\t\tthis._forkRepositoryUrls.clear();\n\t\tthis._workItemSearches.clear();\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, branch) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tbranch: branch,\n\t\t}),\n\t})\n\tpublic async getPullRequestForBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbranch: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ value: AzurePullRequest[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullRequests?searchCriteria.status=all&searchCriteria.sourceRefName=${encodeURIComponent(`refs/heads/${branch}`)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\t// Sort PRs: open PRs first, then by most recent activity (creation or closure date)\n\t\t\tconst sortedPRs = prResult?.value.sort((a, b) => {\n\t\t\t\t// First, prioritize open PRs (active/notSet) over closed ones (abandoned/completed)\n\t\t\t\tconst aIsOpen = a.status === 'active' || a.status === 'notSet';\n\t\t\t\tconst bIsOpen = b.status === 'active' || b.status === 'notSet';\n\n\t\t\t\tif (aIsOpen !== bIsOpen) {\n\t\t\t\t\treturn aIsOpen ? -1 : 1; // Open PRs come first\n\t\t\t\t}\n\n\t\t\t\t// Among PRs with the same status, sort by most recent activity\n\t\t\t\t// Use closedDate if available, otherwise use creationDate\n\t\t\t\tconst aDate = new Date(a.closedDate || a.creationDate);\n\t\t\t\tconst bDate = new Date(b.closedDate || b.creationDate);\n\n\t\t\t\treturn bDate.getTime() - aDate.getTime(); // Most recent first\n\t\t\t});\n\n\t\t\tconst pr = sortedPRs?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getPullRequestForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ results: Record<string, AzurePullRequest[]>[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullrequestquery?api-version=4.1`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\tqueries: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\titems: [rev],\n\t\t\t\t\t\t\t\ttype: 'commit',\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\n\t\t\tconst pr = prResult?.results[0]?.[rev]?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\tconst pullRequest = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(pr.repository.project.id)}/_apis/git/repositories/${encodeAzurePathSegment(pr.repository.id)}/pullRequests/${encodeAzurePathSegment(pr.pullRequestId.toString())}`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (pullRequest == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pullRequest, provider, token, owner, baseUrl, scope, cancellation);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, projectOrName, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\tprojectOrName: projectOrName,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getPullRequest(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectOrName: string,\n\t\tid: string,\n\t\toptions: { baseUrl: string },\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\t// A pull request id is unique within the organization, so no repository is required here — only the\n\t\t// project. `projectOrName` is either a bare project name or a `{project}/_git/{repo}` descriptor; either\n\t\t// way the project is its first segment.\n\t\tconst projectName = projectOrName.split('/')[0];\n\n\t\ttry {\n\t\t\tconst pr = await this.request<AzurePullRequest>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/pullrequests/${encodeAzurePathSegment(id)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\treturn pr != null\n\t\t\t\t? await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope)\n\t\t\t\t: undefined;\n\t\t} catch (ex) {\n\t\t\t// Only a 404 is a proven absence; `Integration.getPullRequest` handles every other failure, so it is not\n\t\t\t// cached as a miss\n\t\t\tif (ex.original?.status === 404) return undefined;\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssueOrPullRequest(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t\ttype?: IssueOrPullRequestType;\n\t\t},\n\t): Promise<IssueOrPullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\tif (options?.type === undefined || options?.type === 'issue') {\n\t\t\ttry {\n\t\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/wit/workItems/${encodeAzurePathSegment(id)}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (issueResult != null) {\n\t\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\t\tissueType,\n\t\t\t\t\t\tstate,\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken,\n\t\t\t\t\t\towner,\n\t\t\t\t\t\tprojectName,\n\t\t\t\t\t\toptions,\n\t\t\t\t\t);\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: issueResult.id.toString(),\n\t\t\t\t\t\ttype: 'issue',\n\t\t\t\t\t\tnodeId: issueResult.id.toString(),\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(issueResult.fields['System.CreatedDate']),\n\t\t\t\t\t\tupdatedDate: new Date(issueResult.fields['System.ChangedDate']),\n\t\t\t\t\t\tstate: azureWorkItemsStateCategoryToState(stateCategory),\n\t\t\t\t\t\tclosed: isClosedAzureWorkItemStateCategory(stateCategory),\n\t\t\t\t\t\ttitle: issueResult.fields['System.Title'],\n\t\t\t\t\t\turl: issueResult._links.html.href,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (options?.type === undefined || options?.type === 'pullrequest') {\n\t\t\ttry {\n\t\t\t\tconst prResult = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullRequests/${encodeAzurePathSegment(id)}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (prResult != null) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: prResult.pullRequestId.toString(),\n\t\t\t\t\t\ttype: 'pullrequest',\n\t\t\t\t\t\tnodeId: prResult.pullRequestId.toString(), // prResult.artifactId maybe?\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tupdatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tstate: azurePullRequestStatusToState(prResult.status),\n\t\t\t\t\t\tclosed: isClosedAzurePullRequestStatus(prResult.status),\n\t\t\t\t\t\ttitle: prResult.title,\n\t\t\t\t\t\turl: getAzurePullRequestWebUrl(prResult, options.baseUrl, owner),\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\treturn undefined;\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, project, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tproject: project,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssue(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tproject: AzureProjectDescriptor,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<Issue | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(project.resourceName)}/${encodeAzurePathSegment(project.name)}/_apis/wit/workItems/${encodeAzurePathSegment(id)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tif (issueResult != null) {\n\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\tissueType,\n\t\t\t\t\tstate,\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\tproject.resourceName,\n\t\t\t\t\tproject.name,\n\t\t\t\t\toptions,\n\t\t\t\t);\n\t\t\t\treturn fromAzureWorkItem(issueResult, provider, project, stateCategory);\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getAccountForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t): Promise<UnidentifiedAuthor | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst commit = await this.request<AzureGitCommit>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/commits/${encodeAzurePathSegment(rev)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\t\t\tconst author = commit?.author;\n\t\t\tif (!author) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\t// Azure API never gives us an id/username we can use, therefore we always return UnidentifiedAuthor\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tid: undefined,\n\t\t\t\tusername: undefined,\n\t\t\t\tname: author?.name,\n\t\t\t\temail: author?.email,\n\t\t\t\tavatarUrl: undefined,\n\t\t\t} satisfies UnidentifiedAuthor;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t/**\n\t * The collection an Azure DevOps Server address names, or `undefined` when it names the installation.\n\t *\n\t * Below a collection, `connectionData` describes that collection: its `instanceId` is the collection's id, and its\n\t * `webApplicationRelativeDirectory` ends in the collection's path segment (`DefaultCollection/`); it is empty or\n\t * absent at the server level. As measured against Azure DevOps Server 2020. The directory may also carry the\n\t * installation's own virtual directory before the collection (`tfs/DefaultCollection/`), so only its LAST segment\n\t * names the collection, and only when it is the last segment of the address asked about.\n\t */\n\t@trace({\n\t\targs: (provider, token, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getAddressedCollection(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string,\n\t): Promise<{ id: string; name: string } | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst connectionData = await this.request<{ instanceId?: string; webApplicationRelativeDirectory?: string }>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t'_apis/connectionData',\n\t\t\t{ method: 'GET' },\n\t\t\tscope,\n\t\t);\n\t\tconst segment = connectionData?.webApplicationRelativeDirectory?.split('/').findLast(Boolean);\n\t\tconst addressed = new URL(baseUrl).pathname.split('/').findLast(Boolean);\n\t\tif (segment == null || addressed == null || connectionData?.instanceId == null) return undefined;\n\n\t\tconst name = decodePathSegment(segment);\n\t\tif (name.toLowerCase() !== decodePathSegment(addressed).toLowerCase()) return undefined;\n\n\t\treturn { id: connectionData.instanceId, name: name };\n\t}\n\n\t@trace({\n\t\targs: (provider, token, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getCurrentUserOnServer(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string,\n\t): Promise<{ id: string; name?: string; email?: string; username?: string; avatarUrl?: string } | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst connectionData = await this.request<{\n\t\t\t\tauthenticatedUser?: {\n\t\t\t\t\tid: string;\n\t\t\t\t\tdescriptor: string;\n\t\t\t\t\tisActive: boolean;\n\t\t\t\t\tmetTypeId: number;\n\t\t\t\t\tproviderDisplayName?: string;\n\t\t\t\t\temailAddress?: string;\n\t\t\t\t\tresourceVersion: 2;\n\t\t\t\t\tsubjectDescriptor: string;\n\t\t\t\t\tproperties?: {\n\t\t\t\t\t\tAccount?: {\n\t\t\t\t\t\t\t$type: string;\n\t\t\t\t\t\t\t$value: string;\n\t\t\t\t\t\t};\n\t\t\t\t\t};\n\t\t\t\t};\n\t\t\t}>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t'_apis/connectionData',\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tconst user = connectionData?.authenticatedUser;\n\t\t\tconst username = user?.properties?.Account?.$value;\n\t\t\tif (!username) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\tid: user.id,\n\t\t\t\tname: user.providerDisplayName,\n\t\t\t\temail: user.emailAddress,\n\t\t\t\tusername: username,\n\t\t\t};\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is the whole point of this read failing; reporting \"no user\" instead hides it.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex, `Failed to get current user from ${baseUrl}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tasync getWorkItemStateCategory(\n\t\tissueType: string,\n\t\tstate: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemStateCategory | undefined> {\n\t\t// By installation too: this API is shared by every connection, and two installations can each have a\n\t\t// collection and project of the same name whose process maps a state to a different category.\n\t\tconst project = JSON.stringify([options.baseUrl, owner, projectName]);\n\t\tconst category = this._workItemStates.getStateCategory(project, issueType, state);\n\t\tif (category != null) return category;\n\n\t\tconst states = await this.retrieveWorkItemTypeStates(issueType, provider, token, owner, projectName, options);\n\t\tthis._workItemStates.saveTypeStates(project, issueType, states);\n\n\t\treturn this._workItemStates.getStateCategory(project, issueType, state);\n\t}\n\n\tprivate async retrieveWorkItemTypeStates(\n\t\tworkItemType: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemState[]> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst issueResult = await this.request<{ value: AzureWorkItemState[]; count: number }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/wit/workItemTypes/${encodeAzurePathSegment(workItemType)}/states`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\treturn issueResult?.value ?? [];\n\t\t} catch (ex) {\n\t\t\t// A rejected credential must not be degraded to an empty state list: the caller caches whatever this\n\t\t\t// returns, so an empty list would pin every work item of this type to an unknown state until the\n\t\t\t// cache is dropped — long after the session recovery this error is supposed to trigger.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn [];\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getRepositoryMetadata(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<RepositoryMetadata | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response == null) return undefined;\n\n\t\t\t// Azure's `parentRepository` only reliably carries the repo name and its project; a fork's parent\n\t\t\t// lives in the same organization, so the org (`owner`) is the parent owner. Only report `parent`\n\t\t\t// when the parent's name is actually present — never fall back to the fork's own name.\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\towner: owner,\n\t\t\t\t// Prefer the API's canonical name over parsing the composite `repo` descriptor string.\n\t\t\t\tname: response.name,\n\t\t\t\tisFork: response.isFork ?? false,\n\t\t\t\tparent:\n\t\t\t\t\tresponse.isFork && response.parentRepository?.name != null\n\t\t\t\t\t\t? { owner: owner, name: response.parentRepository.name }\n\t\t\t\t\t\t: undefined,\n\t\t\t} satisfies RepositoryMetadata;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getDefaultBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<DefaultBranch | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response?.defaultBranch == null) return undefined;\n\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tname: normalizeAzureBranchName(response.defaultBranch),\n\t\t\t} satisfies DefaultBranch;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t/**\n\t * One page of a filtered work-item search over a collection: a WIQL query for the ordered ids, then one detail\n\t * read for the page's slice of them.\n\t *\n\t * The ids a first page queried are kept as the snapshot its continuations page through, for as long as the\n\t * pagination keeps reading it, so it reads a consistent set rather than re-running a query whose rows move under\n\t * an `updated` order. Each first page queries its own snapshot, so paginations of one query never share one, and\n\t * a continuation whose snapshot is gone is refused (see {@link AzureWorkItemSearchCursor}).\n\t *\n\t * The query asks for one id more than {@link azureWorkItemSearchResultLimit}, bounded by `$top`: the extra id is\n\t * what tells \"exactly the limit\" from \"past it\". Past it, the page is `truncated` with `limitReached` and no total,\n\t * since the true count is unknowable here. A server that refuses the match set even so fails the page with a\n\t * \"narrow the search\" error: no bounded query could serve that order's first window.\n\t *\n\t * `resolveProject` maps each result's project name to its descriptor. A work item in a project it doesn't know\n\t * fails the page rather than being dropped or mis-attributed, since either would leave the page disagreeing with\n\t * the count of the same query; the caller refreshes its project discovery before a search so that means a\n\t * project created during the pagination.\n\t */\n\t@trace({\n\t\targs: (provider, token, collection) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tcollection: collection,\n\t\t}),\n\t})\n\tasync searchWorkItemsPage(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t\tcriteria?: IssueSearchCriteria;\n\t\t\tprojectNames?: readonly string[];\n\t\t\tresolveProject: (name: string) => AzureProjectDescriptor | undefined;\n\t\t\tcursor?: string;\n\t\t\tpageSize?: number;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<ProviderIssueSearchPage> {\n\t\tconst scope = getScopedLogger();\n\t\tconst wiql = toAzureWorkItemSearchWiql(\n\t\t\toptions.criteria,\n\t\t\teffectiveIssueSort(options.criteria?.sort),\n\t\t\toptions.projectNames,\n\t\t);\n\t\tconst key = toAzureWorkItemSearchCursorKey(collection, wiql);\n\t\tconst pageSize = toAzureSearchPageSize(options.pageSize, 100, azureWorkItemBatchLimit);\n\t\tconst cursor = parseAzureWorkItemSearchCursor(options.cursor, key, pageSize);\n\t\tconst page = cursor?.page ?? 1;\n\n\t\t// Keyed by credential and address, and by the query itself rather than its fingerprint: two accounts on one\n\t\t// installation must never page through each other's matches, and two queries whose fingerprints collide must\n\t\t// never share a snapshot. The full credential digest, since the token's `microHash` is truncated for logs.\n\t\t// And by the snapshot's own id: a first page queries a new snapshot rather than replacing the query's, so a\n\t\t// pagination still reading an earlier one keeps it (see `AzureWorkItemSearchCursor`).\n\t\tconst snapshot = cursor?.snapshot ?? uuid();\n\t\tconst snapshotKey = JSON.stringify([\n\t\t\tawait sha256(token.accessToken),\n\t\t\toptions.baseUrl,\n\t\t\tcollection,\n\t\t\twiql,\n\t\t\tsnapshot,\n\t\t]);\n\t\t// A continuation only ever READS its snapshot: resuming against a fresh query could skip a work item silently.\n\t\tconst snapshotFound = cursor?.snapshot != null ? this._workItemSearches.get(snapshotKey) : undefined;\n\t\tif (cursor?.snapshot != null && snapshotFound == null) {\n\t\t\tthrow new Error('Work item search results expired; restart the read without a cursor');\n\t\t}\n\n\t\tconst result = await (snapshotFound ??\n\t\t\tthis._workItemSearches.getOrCreate(\n\t\t\t\tsnapshotKey,\n\t\t\t\t(_cacheable, signal) =>\n\t\t\t\t\tthis.queryWorkItemIds(\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken,\n\t\t\t\t\t\tcollection,\n\t\t\t\t\t\toptions.baseUrl,\n\t\t\t\t\t\twiql,\n\t\t\t\t\t\tazureWorkItemSearchResultLimit + 1,\n\t\t\t\t\t\tscope,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t).catch((ex: unknown) => {\n\t\t\t\t\t\t// `$top` is expected to bound the answer; should a server refuse the match set regardless, say\n\t\t\t\t\t\t// what happened rather than surfacing a bare client error.\n\t\t\t\t\t\tif (isWorkItemLimitRefusal(ex)) {\n\t\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t\t`${provider.name} refused a work item search matching more than ${azureWorkItemSearchResultLimit} results; narrow the search`,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tthrow ex;\n\t\t\t\t\t}),\n\t\t\t\t{ cancellation: cancellation },\n\t\t\t));\n\t\tconst limitReached = result.length > azureWorkItemSearchResultLimit;\n\t\tconst ids = limitReached ? result.slice(0, azureWorkItemSearchResultLimit) : result;\n\n\t\tconst offset = cursor?.offset ?? 0;\n\n\t\tconst slice = ids.slice(offset, offset + pageSize);\n\t\tconst values: Issue[] = [];\n\t\tif (slice.length > 0) {\n\t\t\tconst workItems = await this.request<{ value: (WorkItem | null)[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(collection)}/_apis/wit/workitemsbatch?api-version=5.0`,\n\t\t\t\t{ method: 'POST', body: JSON.stringify({ ids: slice, $expand: 'Links', errorPolicy: 'Omit' }) },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tconst byId = new Map((workItems?.value ?? []).filter(w => w != null).map(w => [w.id, w]));\n\t\t\tfor (const id of slice) {\n\t\t\t\t// A work item deleted since the ids were queried is gone, not a failure: skipping it keeps the page\n\t\t\t\t// honest, since it no longer matches anything.\n\t\t\t\tconst workItem = byId.get(id);\n\t\t\t\tif (workItem == null) continue;\n\n\t\t\t\tconst projectName = workItem.fields['System.TeamProject'];\n\t\t\t\tconst project = options.resolveProject(projectName);\n\t\t\t\tif (project == null) {\n\t\t\t\t\tthrow new Error(`Azure DevOps work item ${id} is in project '${projectName}', which isn't visible`);\n\t\t\t\t}\n\n\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\tworkItem.fields['System.WorkItemType'],\n\t\t\t\t\tworkItem.fields['System.State'],\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\tcollection,\n\t\t\t\t\tproject.name,\n\t\t\t\t\toptions,\n\t\t\t\t);\n\t\t\t\tvalues.push(fromAzureWorkItem(workItem, provider, project, stateCategory));\n\t\t\t}\n\t\t}\n\n\t\tconst nextOffset = offset + slice.length;\n\t\tconst hasMore = nextOffset < ids.length;\n\t\tconst next: AzureWorkItemSearchCursor = { key: key, snapshot: snapshot, offset: nextOffset, page: page + 1 };\n\t\treturn {\n\t\t\tvalues: values,\n\t\t\tcursor: hasMore ? JSON.stringify(next) : undefined,\n\t\t\thasMore: hasMore,\n\t\t\tpage: page,\n\t\t\ttruncated: limitReached,\n\t\t\ttotalCount: limitReached ? undefined : ids.length,\n\t\t\tlimitReached: limitReached || undefined,\n\t\t};\n\t}\n\n\t/**\n\t * How many work items the same WIQL {@link searchWorkItemsPage} would page through match, reading no details.\n\t *\n\t * Asks for one id more than the result ceiling, so the count is exact up to it and `'exceeds-limit'` past it —\n\t * never the ceiling itself, which would understate the match set.\n\t */\n\t@trace({\n\t\targs: (provider, token, collection) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tcollection: collection,\n\t\t}),\n\t})\n\tasync countWorkItems(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\toptions: { baseUrl: string; criteria?: IssueSearchCriteria; projectNames?: readonly string[] },\n\t\tcancellation?: AbortSignal,\n\t): Promise<number | 'exceeds-limit'> {\n\t\tconst scope = getScopedLogger();\n\t\tconst wiql = toAzureWorkItemSearchWiql(\n\t\t\toptions.criteria,\n\t\t\teffectiveIssueSort(options.criteria?.sort),\n\t\t\toptions.projectNames,\n\t\t);\n\t\ttry {\n\t\t\tconst ids = await this.queryWorkItemIds(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tcollection,\n\t\t\t\toptions.baseUrl,\n\t\t\t\twiql,\n\t\t\t\tazureWorkItemSearchResultLimit + 1,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\treturn ids.length > azureWorkItemSearchResultLimit ? 'exceeds-limit' : ids.length;\n\t\t} catch (ex) {\n\t\t\tif (isWorkItemLimitRefusal(ex)) return 'exceeds-limit';\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\t/**\n\t * The ids a collection-level WIQL query matches, in its order.\n\t *\n\t * `api-version=5.0` is the oldest version every Azure DevOps Server release this search supports (2019 and later)\n\t * answers; `timePrecision=true` is what lets the criteria's dates compare as instants — see `toWiqlDate`.\n\t */\n\tprivate async queryWorkItemIds(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\tbaseUrl: string,\n\t\twiql: string,\n\t\ttop: number,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<number[]> {\n\t\tconst result = await this.request<{ workItems?: { id: number }[] }>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t`${encodeAzurePathSegment(collection)}/_apis/wit/wiql?$top=${top}&timePrecision=true&api-version=5.0`,\n\t\t\t{ method: 'POST', body: JSON.stringify({ query: wiql }) },\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t\tif (result?.workItems == null) throw new Error('Azure DevOps returned no work item query result');\n\n\t\treturn result.workItems.map(w => w.id);\n\t}\n\n\tprivate getRepository(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureRepositoryWithMetadata | undefined> {\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\treturn this.request<AzureRepositoryWithMetadata>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}?api-version=7.1`,\n\t\t\t{ method: 'GET' },\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t}\n\n\tprivate async toPullRequest(\n\t\tpr: AzurePullRequest,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest> {\n\t\tconst forkRepositoryUrls = await this.getForkRepositoryUrls(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\towner,\n\t\t\tbaseUrl,\n\t\t\tpr.forkSource?.repository,\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t\treturn fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls);\n\t}\n\n\t/**\n\t * Resolves the web and HTTPS clone URLs of the fork a cross-repository pull request comes from. Every other\n\t * repository URL the model reports is rebuilt from the pull request payload; only a fork reference lacks the\n\t * project to do that, so only a fork costs a request.\n\t *\n\t * Best-effort by contract: a fork in a project the token cannot read, a deleted fork, or a throttled request\n\t * leaves the head ref without a URL. It must never cost the pull request itself, which is what makes swallowing\n\t * the failure here the right call rather than a shortcut.\n\t */\n\tprivate async getForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepository: AzureRepositoryReference | undefined,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls | undefined> {\n\t\tif (repository == null) return undefined;\n\n\t\tlet tokenHash: string;\n\t\ttry {\n\t\t\ttokenHash = await sha256(token.accessToken);\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst cacheKey = JSON.stringify([tokenHash, baseUrl, owner, repository.id]);\n\t\t// The request is shared, so the factory is handed the cache's aggregate signal rather than this caller's: it\n\t\t// aborts only once every caller waiting on the entry has cancelled.\n\t\treturn this._forkRepositoryUrls.getOrCreate(\n\t\t\tcacheKey,\n\t\t\t(cacheable, aggregate) =>\n\t\t\t\tthis.fetchForkRepositoryUrls(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\towner,\n\t\t\t\t\tbaseUrl,\n\t\t\t\t\trepository.id,\n\t\t\t\t\tcacheable,\n\t\t\t\t\tscope,\n\t\t\t\t\taggregate,\n\t\t\t\t),\n\t\t\t{ cancellation: cancellation },\n\t\t);\n\t}\n\n\tprivate async fetchForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepositoryId: string,\n\t\tcacheable: CacheController,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls | undefined> {\n\t\ttry {\n\t\t\tconst response = await this.request<AzureRepositoryUrls>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/_apis/git/repositories/${encodeAzurePathSegment(repositoryId)}?api-version=4.1`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tconst webUrl = sanitizeAzureRepositoryUrl(response?.webUrl, baseUrl, owner);\n\t\t\tconst cloneHttps = sanitizeAzureRepositoryUrl(response?.remoteUrl, baseUrl, owner);\n\n\t\t\t// The clone URL stands in for the web URL when the response omits it — an older `api-version` promises\n\t\t\t// neither field, and naming the fork by the URL git would use beats naming it not at all.\n\t\t\tconst url = webUrl ?? cloneHttps;\n\t\t\tif (url == null) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn { url: url, cloneHttps: cloneHttps };\n\t\t} catch (ex) {\n\t\t\t// Missing or inaccessible forks are cached briefly; transient failures retry on the next read.\n\t\t\tif (!(ex instanceof RequestNotFoundError) && !(ex instanceof AuthenticationError)) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t}\n\n\t\t\tconst status = ex instanceof ProviderFetchError ? ` (${ex.status})` : '';\n\t\t\tscope?.warn(`Unable to resolve the fork repository URLs${status}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tprivate async request<T>(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string | undefined,\n\t\troute: string,\n\t\toptions: { method: RequestInit['method'] } & Record<string, unknown>,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal | undefined,\n\t): Promise<T | undefined> {\n\t\tconst { accessToken } = token;\n\t\tconst url = baseUrl ? `${baseUrl}/${route}` : route;\n\n\t\tlet rsp: Response;\n\t\ttry {\n\t\t\tconst sw = maybeStopWatch(`[AZURE] ${options?.method ?? 'GET'} request`, { log: { onlyExit: true } });\n\n\t\t\ttry {\n\t\t\t\tif (cancellation?.aborted) throw new CancellationError();\n\n\t\t\t\trsp = await this.config.wrapForForcedInsecureSSL(provider.getIgnoreSSLErrors(), () =>\n\t\t\t\t\tthis.config.fetch(url, {\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\tAuthorization: `Basic ${base64(`PAT:${accessToken}`)}`,\n\t\t\t\t\t\t\t'Content-Type': 'application/json',\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsignal: cancellation,\n\t\t\t\t\t\t...options,\n\t\t\t\t\t}),\n\t\t\t\t);\n\n\t\t\t\tif (rsp.ok) {\n\t\t\t\t\t// Azure answers a rejected credential by redirecting to its sign-in page, which returns `203\n\t\t\t\t\t// text/html` rather than `401`. `rsp.ok` spans 200-299, so that page used to reach `json()` and\n\t\t\t\t\t// die as a bare `SyntaxError` — which `getIssue` and friends catch and report as \"not found\",\n\t\t\t\t\t// making an invalid credential indistinguishable from a missing work item (GKDEV-3617).\n\t\t\t\t\tconst contentType = rsp.headers.get('content-type')?.toLowerCase() ?? '';\n\t\t\t\t\tif (contentType.startsWith('text/html')) {\n\t\t\t\t\t\tconst { accessToken: _accessToken, ...tokenInfo } = token;\n\t\t\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t\t\ttokenInfo,\n\t\t\t\t\t\t\tAuthenticationErrorReason.Unauthorized,\n\t\t\t\t\t\t\tnew Error(`(${rsp.status}) Azure DevOps returned a sign-in page instead of data`),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\treturn (await rsp.json()) as T;\n\t\t\t\t}\n\n\t\t\t\t// Reads the body so the 403 branch below can tell a throttled request from a permission failure.\n\t\t\t\tthrow await ProviderFetchError.fromResponse('AzureDevOps', rsp);\n\t\t\t} finally {\n\t\t\t\tsw?.stop();\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\tif (ex instanceof ProviderFetchError || ex.name === 'AbortError') {\n\t\t\t\tthis.handleRequestError(provider, token, ex, scope);\n\t\t\t} else if (Logger.isDebugging) {\n\t\t\t\tthis.config.onError?.(`AzureDevOps request failed: ${ex.message}`);\n\t\t\t}\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\tprivate handleRequestError(\n\t\tprovider: Provider | undefined,\n\t\ttoken: TokenWithInfo,\n\t\tex: ProviderFetchError | (Error & { name: 'AbortError' }),\n\t\tscope: ScopedLogger | undefined,\n\t): void {\n\t\tif (ex.name === 'AbortError' || !(ex instanceof ProviderFetchError)) throw new CancellationError(ex);\n\n\t\tconst { accessToken, ...tokenInfo } = token;\n\t\tswitch (ex.status) {\n\t\t\tcase 404: // Not found\n\t\t\tcase 410: // Gone\n\t\t\tcase 422: // Unprocessable Entity\n\t\t\t\tthrow new RequestNotFoundError(ex);\n\t\t\tcase 401: // Unauthorized\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Unauthorized, ex);\n\t\t\tcase 429: // Too Many Requests\n\t\t\t\tthrow toRateLimitError(ex, accessToken);\n\t\t\tcase 403: // Forbidden\n\t\t\t\t// Azure returns 403 for both a permission failure and a throttled request (\"Request was blocked\n\t\t\t\t// due to exceeding usage of resource 'RateLimit'\"), so the message is the discriminant. Reporting\n\t\t\t\t// a throttle as `auth` would prompt the user to re-authenticate a healthy connection instead of\n\t\t\t\t// retrying (see `isRateLimitResponse`).\n\t\t\t\tif (isRateLimitResponse(ex)) throw toRateLimitError(ex, accessToken);\n\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Forbidden, ex);\n\t\t\tcase 500: // Internal Server Error\n\t\t\t\tscope?.error(ex);\n\t\t\t\tif (ex.response != null) {\n\t\t\t\t\tprovider?.trackRequestException();\n\t\t\t\t\tthis.config.onRequestFailed?.(\n\t\t\t\t\t\tprovider == null || provider.id === 'azure'\n\t\t\t\t\t\t\t? l10n.t(\n\t\t\t\t\t\t\t\t\t'{0} failed to respond and might be experiencing issues. Please visit the [AzureDevOps status page](https://status.dev.azure.com) for more information.',\n\t\t\t\t\t\t\t\t\tprovider?.name ?? 'AzureDevOps',\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: l10n.t('{0} failed to respond and might be experiencing issues.', provider.name),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\tcase 502: // Bad Gateway\n\t\t\t\tscope?.error(ex);\n\t\t\t\t// TODO: Learn the Azure API docs and put it in order:\n\t\t\t\t// if (ex.message.includes('timeout')) {\n\t\t\t\t// \tprovider?.trackRequestException();\n\t\t\t\t// \tvoid showIntegrationRequestTimedOutWarningMessage(provider?.name ?? 'Azure');\n\t\t\t\t// \treturn;\n\t\t\t\t// }\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tif (ex.status >= 400 && ex.status < 500) throw new RequestClientError(ex);\n\t\t\t\tbreak;\n\t\t}\n\n\t\tscope?.error(ex);\n\t\tif (Logger.isDebugging) {\n\t\t\tthis.config.onError?.(\n\t\t\t\t`AzureDevOps request failed: ${(ex.response as any)?.errors?.[0]?.message ?? ex.message}`,\n\t\t\t);\n\t\t}\n\t}\n}\n\n/** Wires an {@link AzureDevOpsApi} from the full runtime context, mapping `ctx` down to the narrow config. */\nexport function createAzureDevOpsApi(ctx: IntegrationServiceContext): AzureDevOpsApi {\n\treturn new AzureDevOpsApi(baseProviderApiConfig(ctx));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsEA,MAAM,4BAA4B;;AAElC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;;AAGrC,SAAS,uBAAuB,IAAsB;CACrD,OAAO,cAAc,sBAAsB,GAAG,QAAQ,SAAS,UAAU;AAC1E;AAEA,SAAS,+BAA+B,MAAyD;CAChG,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,MAAM,CAAC,aAAa,SAAS,YAAY;CACzC,IAAI,MAAM,WAAW,KAAK,YAAY,UAAU,CAAC,eAAe,CAAC,UAChE,MAAM,IAAI,MAAM,wCAAwC,KAAK,yCAAyC;CAGvG,OAAO;EAAe;EAAuB;CAAS;AACvD;AAEA,IAAM,iBAAN,MAAqB;CACpB,8BAA+B,IAAI,IAAwC;CAC3E,yBAA0B,IAAI,IAAkC;CAGhE,iBACC,SACA,cACA,WACyC;EACzC,OAAO,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,SAAS,CAAC;CAC/E;CAEA,QAAqB;EACpB,KAAK,YAAY,MAAM;EACvB,KAAK,OAAO,MAAM;CACnB;CAEA,eAAsB,SAAiB,cAAsB,QAAoC;EAChG,KAAK,gBAAgB,SAAS,YAAY;EAC1C,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,GAAG,MAAM;EAC9D,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,GAAG,MAAM,QAAQ;CAE1F;CAEA,cAAqB,SAAiB,cAA+B;EACpE,OAAO,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;CAC9D;CAEA,gBAAwB,SAAiB,cAA4B;EACpE,MAAM,SAAS,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;EACrE,IAAI,UAAU,MAAM;EAEpB,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,OAAO,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,CAAC;CAE7E;CAEA,YAAoB,SAAiB,cAAsB,WAA2B;EAErF,OAAO,KAAK,UAAU;GAAC;GAAS;GAAc;EAAS,CAAC;CACzD;CAEA,WAAmB,SAAiB,cAA8B;EACjE,OAAO,KAAK,UAAU,CAAC,SAAS,YAAY,CAAC;CAC9C;AACD;AAEA,IAAa,iBAAb,MAAkD;CAkBpB;CAjB7B;CACA,kBAA0C,IAAI,eAAe;CAC7D,sBAAuC,IAAI,aAA0D;EACpG,UAAU;EACV,WAAW;CACZ,CAAC;;;;;;CAMD,oBAAqC,IAAI,aAA+B;EACvE,UAAU;EACV,WAAW;EACX,WAAW;CACZ,CAAC;CAED,YAAY,QAA4C;EAA3B,KAAA,SAAA;EAC5B,KAAK,cAAc,OAAO,wBAAwB,KAAK,YAAY,CAAC;CACrE;CAEA,UAAgB;EACf,KAAK,aAAa,QAAQ;CAC3B;CAEA,cAA4B;EAC3B,KAAK,gBAAgB,MAAM;EAC3B,KAAK,oBAAoB,MAAM;EAC/B,KAAK,kBAAkB,MAAM;CAC9B;CAEA,MASa,wBACZ,UACA,OACA,OACA,MACA,QACA,SAGmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GA8BH,MAAM,OAjBY,MAZK,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,uEAAuE,mBAAmB,cAAc,QAAQ,KACnP,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAG4B,MAAM,MAAM,GAAG,MAAM;IAEhD,MAAM,UAAU,EAAE,WAAW,YAAY,EAAE,WAAW;IAGtD,IAAI,aAFY,EAAE,WAAW,YAAY,EAAE,WAAW,WAGrD,OAAO,UAAU,KAAK;IAKvB,MAAM,QAAQ,IAAI,KAAK,EAAE,cAAc,EAAE,YAAY;IAGrD,OAAO,IAFW,KAAK,EAAE,cAAc,EAAE,YAE9B,CAAC,CAAC,QAAQ,IAAI,MAAM,QAAQ;GACxC,CAAC,EAAA,GAEsB;GACvB,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,OAAO,MAAM,KAAK,cAAc,IAAI,UAAU,OAAO,OAAO,QAAQ,SAAS,KAAK;EACnF,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MAUM,wBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAGA,cACmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,IAAI;GAqBH,MAAM,MAAK,MApBY,KAAK,QAC3B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,oCACnI;IACC,QAAQ;IACR,MAAM,KAAK,UAAU,EACpB,SAAS,CACR;KACC,OAAO,CAAC,GAAG;KACX,MAAM;IACP,CACD,EACD,CAAC;GACF,GACA,OACA,YACD,EAAA,EAEqB,QAAQ,EAAE,GAAG,IAAI,GAAG;GACzC,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,GAAG,WAAW,QAAQ,EAAE,EAAE,0BAA0B,uBAAuB,GAAG,WAAW,EAAE,EAAE,gBAAgB,uBAAuB,GAAG,cAAc,SAAS,CAAC,KAC1N,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,IAAI,eAAe,MAAM,OAAO,KAAA;GAEhC,OAAO,MAAM,KAAK,cAAc,aAAa,UAAU,OAAO,OAAO,SAAS,OAAO,YAAY;EAClG,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MASa,eACZ,UACA,OACA,OACA,eACA,IACA,SACmC;EACnC,MAAM,QAAQ,gBAAgB;EAI9B,MAAM,cAAc,cAAc,MAAM,GAAG,CAAC,CAAC;EAE7C,IAAI;GACH,MAAM,KAAK,MAAM,KAAK,QACrB,UACA,OACA,QAAQ,SACR,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,EAAE,KAC3H,EACC,QAAQ,MACT,GACA,KACD;GAEA,OAAO,MAAM,OACV,MAAM,KAAK,cAAc,IAAI,UAAU,OAAO,OAAO,QAAQ,SAAS,KAAK,IAC3E,KAAA;EACJ,SAAS,IAAI;GAGZ,IAAI,GAAG,UAAU,WAAW,KAAK,OAAO,KAAA;GAExC,MAAM;EACP;CACD;CAEA,MASa,sBACZ,UACA,OACA,OACA,MACA,IACA,SAI0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,SACpD,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,uBAAuB,uBAAuB,EAAE,KACxH,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,OACA,aACA,OACD;IAEA,OAAO;KACN,IAAI,YAAY,GAAG,SAAS;KAC5B,MAAM;KACN,QAAQ,YAAY,GAAG,SAAS;KACtB;KACV,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,OAAO,mCAAmC,aAAa;KACvD,QAAQ,mCAAmC,aAAa;KACxD,OAAO,YAAY,OAAO;KAC1B,KAAK,YAAY,OAAO,KAAK;IAC9B;GACD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;EAGD,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,eACpD,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,gBAAgB,uBAAuB,EAAE,KAC5K,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,YAAY,MACf,OAAO;IACN,IAAI,SAAS,cAAc,SAAS;IACpC,MAAM;IACN,QAAQ,SAAS,cAAc,SAAS;IAC9B;IACV,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,OAAO,8BAA8B,SAAS,MAAM;IACpD,QAAQ,+BAA+B,SAAS,MAAM;IACtD,OAAO,SAAS;IAChB,KAAK,0BAA0B,UAAU,QAAQ,SAAS,KAAK;GAChE;GAGD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGF;CAEA,MAQa,SACZ,UACA,OACA,SACA,IACA,SAG6B;EAC7B,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,QAAQ,YAAY,EAAE,GAAG,uBAAuB,QAAQ,IAAI,EAAE,uBAAuB,uBAAuB,EAAE,KACxI,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,QAAQ,cACR,QAAQ,MACR,OACD;IACA,OAAO,kBAAkB,aAAa,UAAU,SAAS,aAAa;GACvE;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;CAEA,MAUM,oBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAG0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GAYH,MAAM,UAAS,MAVM,KAAK,QACzB,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,WAAW,uBAAuB,GAAG,KACxK,EACC,QAAQ,MACT,GACA,KACD,EAAA,EACuB;GACvB,IAAI,CAAC,QACJ;GAGD,OAAO;IACI;IACV,IAAI,KAAA;IACJ,UAAU,KAAA;IACV,MAAM,QAAQ;IACd,OAAO,QAAQ;IACf,WAAW,KAAA;GACZ;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;;;;;;;;;;CAWA,MAOM,uBACL,UACA,OACA,SACoD;EACpD,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,iBAAiB,MAAM,KAAK,QACjC,UACA,OACA,SACA,wBACA,EAAE,QAAQ,MAAM,GAChB,KACD;EACA,MAAM,UAAU,gBAAgB,iCAAiC,MAAM,GAAG,CAAC,CAAC,SAAS,OAAO;EAC5F,MAAM,YAAY,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,CAAC,CAAC,SAAS,OAAO;EACvE,IAAI,WAAW,QAAQ,aAAa,QAAQ,gBAAgB,cAAc,MAAM,OAAO,KAAA;EAEvF,MAAM,OAAO,kBAAkB,OAAO;EACtC,IAAI,KAAK,YAAY,MAAM,kBAAkB,SAAS,CAAC,CAAC,YAAY,GAAG,OAAO,KAAA;EAE9E,OAAO;GAAE,IAAI,eAAe;GAAkB;EAAK;CACpD;CAEA,MAOM,uBACL,UACA,OACA,SAC4G;EAC5G,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GA6BH,MAAM,QAAO,MA5BgB,KAAK,QAkBjC,UACA,OACA,SACA,wBACA,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAE6B;GAC7B,MAAM,WAAW,MAAM,YAAY,SAAS;GAC5C,IAAI,CAAC,UACJ;GAGD,OAAO;IACN,IAAI,KAAK;IACT,MAAM,KAAK;IACX,OAAO,KAAK;IACF;GACX;EACD,SAAS,IAAI;GAEZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,IAAI,mCAAmC,SAAS;GAC7D;EACD;CACD;CAEA,MAAM,yBACL,WACA,OACA,UACA,OACA,OACA,aACA,SAGkD;EAGlD,MAAM,UAAU,KAAK,UAAU;GAAC,QAAQ;GAAS;GAAO;EAAW,CAAC;EACpE,MAAM,WAAW,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;EAChF,IAAI,YAAY,MAAM,OAAO;EAE7B,MAAM,SAAS,MAAM,KAAK,2BAA2B,WAAW,UAAU,OAAO,OAAO,aAAa,OAAO;EAC5G,KAAK,gBAAgB,eAAe,SAAS,WAAW,MAAM;EAE9D,OAAO,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;CACvE;CAEA,MAAc,2BACb,cACA,UACA,OACA,OACA,aACA,SAGgC;EAChC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAYH,QAAO,MAXmB,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,2BAA2B,uBAAuB,YAAY,EAAE,UACxI,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAEoB,SAAS,CAAC;EAC/B,SAAS,IAAI;GAIZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf,OAAO,CAAC;EACT;CACD;CAEA,MAQM,sBACL,UACA,OACA,OACA,MACA,SAGA,cAC0C;EAC1C,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,YAAY,MAAM,OAAO,KAAA;GAK7B,OAAO;IACI;IACH;IAEP,MAAM,SAAS;IACf,QAAQ,SAAS,UAAU;IAC3B,QACC,SAAS,UAAU,SAAS,kBAAkB,QAAQ,OACnD;KAAS;KAAO,MAAM,SAAS,iBAAiB;IAAK,IACrD,KAAA;GACL;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;CAEA,MAQM,iBACL,UACA,OACA,OACA,MACA,SAGA,cACqC;EACrC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,UAAU,iBAAiB,MAAM,OAAO,KAAA;GAE5C,OAAO;IACI;IACV,MAAM,yBAAyB,SAAS,aAAa;GACtD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;;;;;;;;;;;;;;;;;;;;CAqBA,MAOM,oBACL,UACA,OACA,YACA,SAQA,cACmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,OAAO,0BACZ,QAAQ,UACR,mBAAmB,QAAQ,UAAU,IAAI,GACzC,QAAQ,YACT;EACA,MAAM,MAAM,+BAA+B,YAAY,IAAI;EAC3D,MAAM,WAAW,sBAAsB,QAAQ,UAAU,KAAA,GAA4B;EACrF,MAAM,SAAS,+BAA+B,QAAQ,QAAQ,KAAK,QAAQ;EAC3E,MAAM,OAAO,QAAQ,QAAQ;EAO7B,MAAM,WAAW,QAAQ,YAAY,KAAK;EAC1C,MAAM,cAAc,KAAK,UAAU;GAClC,MAAM,OAAO,MAAM,WAAW;GAC9B,QAAQ;GACR;GACA;GACA;EACD,CAAC;EAED,MAAM,gBAAgB,QAAQ,YAAY,OAAO,KAAK,kBAAkB,IAAI,WAAW,IAAI,KAAA;EAC3F,IAAI,QAAQ,YAAY,QAAQ,iBAAiB,MAChD,MAAM,IAAI,MAAM,qEAAqE;EAGtF,MAAM,SAAS,OAAO,iBACrB,KAAK,kBAAkB,YACtB,cACC,YAAY,WACZ,KAAK,iBACJ,UACA,OACA,YACA,QAAQ,SACR,MAAA,OAEA,OACA,MACD,CAAC,CAAC,OAAO,OAAgB;GAGxB,IAAI,uBAAuB,EAAE,GAC5B,MAAM,IAAI,MACT,GAAG,SAAS,KAAK,gFAClB;GAGD,MAAM;EACP,CAAC,GACF,EAAgB,aAAa,CAC9B;EACD,MAAM,eAAe,OAAO,SAAS;EACrC,MAAM,MAAM,eAAe,OAAO,MAAM,GAAG,8BAA8B,IAAI;EAE7E,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,QAAQ,IAAI,MAAM,QAAQ,SAAS,QAAQ;EACjD,MAAM,SAAkB,CAAC;EACzB,IAAI,MAAM,SAAS,GAAG;GACrB,MAAM,YAAY,MAAM,KAAK,QAC5B,UACA,OACA,QAAQ,SACR,GAAG,uBAAuB,UAAU,EAAE,4CACtC;IAAE,QAAQ;IAAQ,MAAM,KAAK,UAAU;KAAE,KAAK;KAAO,SAAS;KAAS,aAAa;IAAO,CAAC;GAAE,GAC9F,OACA,YACD;GACA,MAAM,OAAO,IAAI,KAAK,WAAW,SAAS,CAAC,EAAA,CAAG,QAAO,MAAK,KAAK,IAAI,CAAC,CAAC,KAAI,MAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;GACxF,KAAK,MAAM,MAAM,OAAO;IAGvB,MAAM,WAAW,KAAK,IAAI,EAAE;IAC5B,IAAI,YAAY,MAAM;IAEtB,MAAM,cAAc,SAAS,OAAO;IACpC,MAAM,UAAU,QAAQ,eAAe,WAAW;IAClD,IAAI,WAAW,MACd,MAAM,IAAI,MAAM,0BAA0B,GAAG,kBAAkB,YAAY,uBAAuB;IAGnG,MAAM,gBAAgB,MAAM,KAAK,yBAChC,SAAS,OAAO,wBAChB,SAAS,OAAO,iBAChB,UACA,OACA,YACA,QAAQ,MACR,OACD;IACA,OAAO,KAAK,kBAAkB,UAAU,UAAU,SAAS,aAAa,CAAC;GAC1E;EACD;EAEA,MAAM,aAAa,SAAS,MAAM;EAClC,MAAM,UAAU,aAAa,IAAI;EACjC,MAAM,OAAkC;GAAO;GAAe;GAAU,QAAQ;GAAY,MAAM,OAAO;EAAE;EAC3G,OAAO;GACE;GACR,QAAQ,UAAU,KAAK,UAAU,IAAI,IAAI,KAAA;GAChC;GACH;GACN,WAAW;GACX,YAAY,eAAe,KAAA,IAAY,IAAI;GAC3C,cAAc,gBAAgB,KAAA;EAC/B;CACD;;;;;;;CAQA,MAOM,eACL,UACA,OACA,YACA,SACA,cACoC;EACpC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,OAAO,0BACZ,QAAQ,UACR,mBAAmB,QAAQ,UAAU,IAAI,GACzC,QAAQ,YACT;EACA,IAAI;GACH,MAAM,MAAM,MAAM,KAAK,iBACtB,UACA,OACA,YACA,QAAQ,SACR,MACA,iCAAiC,GACjC,OACA,YACD;GACA,OAAO,IAAI,SAAA,MAA0C,kBAAkB,IAAI;EAC5E,SAAS,IAAI;GACZ,IAAI,uBAAuB,EAAE,GAAG,OAAO;GAEvC,MAAM;EACP;CACD;;;;;;;CAQA,MAAc,iBACb,UACA,OACA,YACA,SACA,MACA,KACA,OACA,cACoB;EACpB,MAAM,SAAS,MAAM,KAAK,QACzB,UACA,OACA,SACA,GAAG,uBAAuB,UAAU,EAAE,uBAAuB,IAAI,sCACjE;GAAE,QAAQ;GAAQ,MAAM,KAAK,UAAU,EAAE,OAAO,KAAK,CAAC;EAAE,GACxD,OACA,YACD;EACA,IAAI,QAAQ,aAAa,MAAM,MAAM,IAAI,MAAM,iDAAiD;EAEhG,OAAO,OAAO,UAAU,KAAI,MAAK,EAAE,EAAE;CACtC;CAEA,cACC,UACA,OACA,OACA,MACA,SACA,OACA,cACmD;EACnD,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,OAAO,KAAK,QACX,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,mBACnI,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;CACD;CAEA,MAAc,cACb,IACA,UACA,OACA,OACA,SACA,OACA,cACuB;EACvB,MAAM,qBAAqB,MAAM,KAAK,sBACrC,UACA,OACA,OACA,SACA,GAAG,YAAY,YACf,OACA,YACD;EACA,OAAO,qBAAqB,IAAI,UAAU,OAAO,SAAS,kBAAkB;CAC7E;;;;;;;;;;CAWA,MAAc,sBACb,UACA,OACA,OACA,SACA,YACA,OACA,cAC+C;EAC/C,IAAI,cAAc,MAAM,OAAO,KAAA;EAE/B,IAAI;EACJ,IAAI;GACH,YAAY,MAAM,OAAO,MAAM,WAAW;EAC3C,QAAQ;GACP;EACD;EAEA,MAAM,WAAW,KAAK,UAAU;GAAC;GAAW;GAAS;GAAO,WAAW;EAAE,CAAC;EAG1E,OAAO,KAAK,oBAAoB,YAC/B,WACC,WAAW,cACX,KAAK,wBACJ,UACA,OACA,OACA,SACA,WAAW,IACX,WACA,OACA,SACD,GACD,EAAgB,aAAa,CAC9B;CACD;CAEA,MAAc,wBACb,UACA,OACA,OACA,SACA,cACA,WACA,OACA,cAC+C;EAC/C,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,0BAA0B,uBAAuB,YAAY,EAAE,mBAChG,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,MAAM,SAAS,2BAA2B,UAAU,QAAQ,SAAS,KAAK;GAC1E,MAAM,aAAa,2BAA2B,UAAU,WAAW,SAAS,KAAK;GAIjF,MAAM,MAAM,UAAU;GACtB,IAAI,OAAO,MAAM;IAChB,UAAU,WAAW;IACrB;GACD;GAEA,OAAO;IAAO;IAAiB;GAAW;EAC3C,SAAS,IAAI;GAEZ,IAAI,EAAE,cAAc,yBAAyB,EAAE,cAAc,sBAC5D,UAAU,WAAW;GAGtB,MAAM,SAAS,cAAc,qBAAqB,KAAK,GAAG,OAAO,KAAK;GACtE,OAAO,KAAK,6CAA6C,QAAQ;GACjE;EACD;CACD;CAEA,MAAc,QACb,UACA,OACA,SACA,OACA,SACA,OACA,cACyB;EACzB,MAAM,EAAE,gBAAgB;EACxB,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,UAAU;EAE9C,IAAI;EACJ,IAAI;GACH,MAAM,KAAK,eAAe,WAAW,SAAS,UAAU,MAAM,WAAW,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,CAAC;GAEpG,IAAI;IACH,IAAI,cAAc,SAAS,MAAM,IAAI,kBAAkB;IAEvD,MAAM,MAAM,KAAK,OAAO,yBAAyB,SAAS,mBAAmB,SAC5E,KAAK,OAAO,MAAM,KAAK;KACtB,SAAS;MACR,eAAe,SAAS,OAAO,OAAO,aAAa;MACnD,gBAAgB;KACjB;KACA,QAAQ;KACR,GAAG;IACJ,CAAC,CACF;IAEA,IAAI,IAAI,IAAI;KAMX,KADoB,IAAI,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY,KAAK,GAAA,CACtD,WAAW,WAAW,GAAG;MACxC,MAAM,EAAE,aAAa,cAAc,GAAG,cAAc;MACpD,MAAM,IAAI,oBACT,WAAA,mBAEA,IAAI,MAAM,IAAI,IAAI,OAAO,uDAAuD,CACjF;KACD;KAEA,OAAQ,MAAM,IAAI,KAAK;IACxB;IAGA,MAAM,MAAM,mBAAmB,aAAa,eAAe,GAAG;GAC/D,UAAU;IACT,IAAI,KAAK;GACV;EACD,SAAS,IAAI;GACZ,IAAI,cAAc,sBAAsB,GAAG,SAAS,cACnD,KAAK,mBAAmB,UAAU,OAAO,IAAI,KAAK;QAC5C,IAAIA,QAAO,aACjB,KAAK,OAAO,UAAU,+BAA+B,GAAG,SAAS;GAGlE,MAAM;EACP;CACD;CAEA,mBACC,UACA,OACA,IACA,OACO;EACP,IAAI,GAAG,SAAS,gBAAgB,EAAE,cAAc,qBAAqB,MAAM,IAAI,kBAAkB,EAAE;EAEnG,MAAM,EAAE,aAAa,GAAG,cAAc;EACtC,QAAQ,GAAG,QAAX;GACC,KAAK;GACL,KAAK;GACL,KAAK,KACJ,MAAM,IAAI,qBAAqB,EAAE;GAClC,KAAK,KACJ,MAAM,IAAI,oBAAoB,WAAA,GAAmD,EAAE;GACpF,KAAK,KACJ,MAAM,iBAAiB,IAAI,WAAW;GACvC,KAAK;IAKJ,IAAI,oBAAoB,EAAE,GAAG,MAAM,iBAAiB,IAAI,WAAW;IAEnE,MAAM,IAAI,oBAAoB,WAAA,GAAgD,EAAE;GACjF,KAAK;IACJ,OAAO,MAAM,EAAE;IACf,IAAI,GAAG,YAAY,MAAM;KACxB,UAAU,sBAAsB;KAChC,KAAK,OAAO,kBACX,YAAY,QAAQ,SAAS,OAAO,UACjC,KAAK,EACL,0JACA,UAAU,QAAQ,aACnB,IACC,KAAK,EAAE,2DAA2D,SAAS,IAAI,CACnF;IACD;IACA;GACD,KAAK;IACJ,OAAO,MAAM,EAAE;IAOf;GACD,SACC,IAAI,GAAG,UAAU,OAAO,GAAG,SAAS,KAAK,MAAM,IAAI,mBAAmB,EAAE;EAE1E;EAEA,OAAO,MAAM,EAAE;EACf,IAAIA,QAAO,aACV,KAAK,OAAO,UACX,+BAAgC,GAAG,UAAkB,SAAS,EAAE,EAAE,WAAW,GAAG,SACjF;CAEF;AACD;AA7pCE,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,YAAY;CAChD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACE;AACT,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA0DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA6DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,eAAe,QAAQ;CACrD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACQ;CACX;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,kBAAA,IAAA;AAuCA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,QAAQ;CAC5C,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACF;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AA8GA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,SAAS,QAAQ;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;CACL;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,YAAA,IAAA;AAqDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,uBAAA,IAAA;AA+DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,aAAa;CACpC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,0BAAA,IAAA;AAyBA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,aAAa;CACpC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,0BAAA,IAAA;AAqHA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AAoDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,oBAAA,IAAA;AA6DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,gBAAgB;CACvC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACrB;AACb,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,uBAAA,IAAA;AAsIA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,gBAAgB;CACvC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACrB;AACb,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,kBAAA,IAAA;;AAoUF,SAAgB,qBAAqB,KAAgD;CACpF,OAAO,IAAI,eAAe,sBAAsB,GAAG,CAAC;AACrD"}
+{"version":3,"file":"azure.js","names":["Logger"],"sources":["../../../../../../plus/integrations/src/providers/azure/azure.ts"],"sourcesContent":["import * as l10n from '@vscode/l10n';\nimport type { UnidentifiedAuthor } from '@gitlens/git/models/author.js';\nimport type { DefaultBranch } from '@gitlens/git/models/defaultBranch.js';\nimport type { Issue, IssueSearchCriteria } from '@gitlens/git/models/issue.js';\nimport type { IssueOrPullRequest, IssueOrPullRequestType } from '@gitlens/git/models/issueOrPullRequest.js';\nimport type { PullRequest } from '@gitlens/git/models/pullRequest.js';\nimport type { Provider } from '@gitlens/git/models/remoteProvider.js';\nimport type { RepositoryMetadata } from '@gitlens/git/models/repositoryMetadata.js';\nimport { effectiveIssueSort } from '@gitlens/git/utils/issue.utils.js';\nimport { base64 } from '@gitlens/utils/base64.js';\nimport { CancellationError, isCancellationError } from '@gitlens/utils/cancellation.js';\nimport { sha256, uuid } from '@gitlens/utils/crypto.js';\nimport { trace } from '@gitlens/utils/decorators/log.js';\nimport type { Disposable } from '@gitlens/utils/disposable.js';\nimport { Logger } from '@gitlens/utils/logger.js';\nimport type { ScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport { getScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport type { CacheController } from '@gitlens/utils/promiseCache.js';\nimport { PromiseCache } from '@gitlens/utils/promiseCache.js';\nimport { maybeStopWatch } from '@gitlens/utils/stopwatch.js';\nimport type { TokenWithInfo } from '../../authentication/models.js';\nimport type { IntegrationServiceContext } from '../../context.js';\nimport {\n\tAuthenticationError,\n\tAuthenticationErrorReason,\n\tisRateLimitResponse,\n\tProviderFetchError,\n\tRequestClientError,\n\tRequestNotFoundError,\n\ttoRateLimitError,\n} from '../../errors.js';\nimport type { ProviderIssueSearchPage } from '../../models/issueReads.js';\nimport { decodePathSegment } from '../../utils/domain.utils.js';\nimport type { ProviderApiConfig } from '../apiConfig.js';\nimport { baseProviderApiConfig } from '../apiConfig.js';\nimport type {\n\tAzureForkRepositoryUrls,\n\tAzureGitCommit,\n\tAzureProjectDescriptor,\n\tAzurePullRequest,\n\tAzurePullRequestWithLinks,\n\tAzureRepositoryReference,\n\tAzureRepositoryUrls,\n\tAzureRepositoryWithMetadata,\n\tAzureWorkItemState,\n\tAzureWorkItemStateCategory,\n\tWorkItem,\n} from './models.js';\nimport {\n\tazurePullRequestStatusToState,\n\tazureWorkItemsStateCategoryToState,\n\tencodeAzurePathSegment,\n\tfromAzurePullRequest,\n\tfromAzureWorkItem,\n\tgetAzurePullRequestWebUrl,\n\tisClosedAzurePullRequestStatus,\n\tisClosedAzureWorkItemStateCategory,\n\tnormalizeAzureBranchName,\n\tsanitizeAzureRepositoryUrl,\n} from './models.js';\nimport type { AzureWorkItemSearchCursor } from './search.js';\nimport {\n\tazureWorkItemBatchLimit,\n\tazureWorkItemSearchResultLimit,\n\tparseAzureWorkItemSearchCursor,\n\ttoAzureSearchPageSize,\n\ttoAzureWorkItemSearchCursorKey,\n\ttoAzureWorkItemSearchWiql,\n} from './search.js';\n\nconst forkRepositoryUrlCacheTtl = 5 * 60 * 1000;\n/** How long a work-item search's id snapshot outlives the last page read from it, and the most it lives at all. */\nconst workItemSearchSnapshotTtl = 5 * 60 * 1000;\nconst workItemSearchSnapshotMaxTtl = 30 * 60 * 1000;\n\n/** Whether Azure refused a WIQL query for matching more work items than it will return (`VS402337`). */\nfunction isWorkItemLimitRefusal(ex: unknown): boolean {\n\treturn ex instanceof RequestClientError && ex.message.includes('VS402337');\n}\n\nfunction parseAzureRepositoryDescriptor(repo: string): { projectName: string; repoName: string } {\n\tconst parts = repo.split('/');\n\tconst [projectName, segment, repoName] = parts;\n\tif (parts.length !== 3 || segment !== '_git' || !projectName || !repoName) {\n\t\tthrow new Error(`Invalid Azure repository descriptor '${repo}'; expected '{project}/_git/{repoName}'.`);\n\t}\n\n\treturn { projectName: projectName, repoName: repoName };\n}\n\nclass WorkItemStates {\n\tprivate readonly _categories = new Map<string, AzureWorkItemStateCategory>();\n\tprivate readonly _types = new Map<string, AzureWorkItemState[]>();\n\n\t// TODO@sergeibbb: we might need some logic for invalidating\n\tpublic getStateCategory(\n\t\tproject: string,\n\t\tworkItemType: string,\n\t\tstateName: string,\n\t): AzureWorkItemStateCategory | undefined {\n\t\treturn this._categories.get(this.getStateKey(project, workItemType, stateName));\n\t}\n\n\tpublic clear(): void {\n\t\tthis._categories.clear();\n\t\tthis._types.clear();\n\t}\n\n\tpublic saveTypeStates(project: string, workItemType: string, states: AzureWorkItemState[]): void {\n\t\tthis.clearTypeStates(project, workItemType);\n\t\tthis._types.set(this.getTypeKey(project, workItemType), states);\n\t\tfor (const state of states) {\n\t\t\tthis._categories.set(this.getStateKey(project, workItemType, state.name), state.category);\n\t\t}\n\t}\n\n\tpublic hasTypeStates(project: string, workItemType: string): boolean {\n\t\treturn this._types.has(this.getTypeKey(project, workItemType));\n\t}\n\n\tprivate clearTypeStates(project: string, workItemType: string): void {\n\t\tconst states = this._types.get(this.getTypeKey(project, workItemType));\n\t\tif (states == null) return;\n\n\t\tfor (const state of states) {\n\t\t\tthis._categories.delete(this.getStateKey(project, workItemType, state.name));\n\t\t}\n\t}\n\n\tprivate getStateKey(project: string, workItemType: string, stateName: string): string {\n\t\t// By stringifying the pair as JSON we make sure that all possible special characters are escaped\n\t\treturn JSON.stringify([project, workItemType, stateName]);\n\t}\n\n\tprivate getTypeKey(project: string, workItemType: string): string {\n\t\treturn JSON.stringify([project, workItemType]);\n\t}\n}\n\nexport class AzureDevOpsApi implements Disposable {\n\tprivate readonly _disposable: Disposable | undefined;\n\tprivate _workItemStates: WorkItemStates = new WorkItemStates();\n\tprivate readonly _forkRepositoryUrls = new PromiseCache<string, AzureForkRepositoryUrls | undefined>({\n\t\tcapacity: 100,\n\t\tcreateTTL: forkRepositoryUrlCacheTtl,\n\t});\n\t/**\n\t * The ordered ids each filtered work-item search's first page queried, paged through by its continuations. Kept\n\t * alive while a pagination keeps reading them (see `workItemSearchSnapshotTtl`). Every first page adds one, so\n\t * the capacity leaves room for repeated first pages before an idle pagination's snapshot is the one evicted.\n\t */\n\tprivate readonly _workItemSearches = new PromiseCache<string, number[]>({\n\t\tcapacity: 50,\n\t\taccessTTL: workItemSearchSnapshotTtl,\n\t\tcreateTTL: workItemSearchSnapshotMaxTtl,\n\t});\n\n\tconstructor(private readonly config: ProviderApiConfig) {\n\t\tthis._disposable = config.onConfigChanged?.(() => this.resetCaches());\n\t}\n\n\tdispose(): void {\n\t\tthis._disposable?.dispose();\n\t}\n\n\tprivate resetCaches(): void {\n\t\tthis._workItemStates.clear();\n\t\tthis._forkRepositoryUrls.clear();\n\t\tthis._workItemSearches.clear();\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, branch) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tbranch: branch,\n\t\t}),\n\t})\n\tpublic async getPullRequestForBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbranch: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ value: AzurePullRequest[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullRequests?searchCriteria.status=all&searchCriteria.sourceRefName=${encodeURIComponent(`refs/heads/${branch}`)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\t// Sort PRs: open PRs first, then by most recent activity (creation or closure date)\n\t\t\tconst sortedPRs = prResult?.value.sort((a, b) => {\n\t\t\t\t// First, prioritize open PRs (active/notSet) over closed ones (abandoned/completed)\n\t\t\t\tconst aIsOpen = a.status === 'active' || a.status === 'notSet';\n\t\t\t\tconst bIsOpen = b.status === 'active' || b.status === 'notSet';\n\n\t\t\t\tif (aIsOpen !== bIsOpen) {\n\t\t\t\t\treturn aIsOpen ? -1 : 1; // Open PRs come first\n\t\t\t\t}\n\n\t\t\t\t// Among PRs with the same status, sort by most recent activity\n\t\t\t\t// Use closedDate if available, otherwise use creationDate\n\t\t\t\tconst aDate = new Date(a.closedDate || a.creationDate);\n\t\t\t\tconst bDate = new Date(b.closedDate || b.creationDate);\n\n\t\t\t\treturn bDate.getTime() - aDate.getTime(); // Most recent first\n\t\t\t});\n\n\t\t\tconst pr = sortedPRs?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getPullRequestForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ results: Record<string, AzurePullRequest[]>[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullrequestquery?api-version=4.1`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\tqueries: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\titems: [rev],\n\t\t\t\t\t\t\t\ttype: 'commit',\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\n\t\t\tconst pr = prResult?.results[0]?.[rev]?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\tconst pullRequest = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(pr.repository.project.id)}/_apis/git/repositories/${encodeAzurePathSegment(pr.repository.id)}/pullRequests/${encodeAzurePathSegment(pr.pullRequestId.toString())}`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (pullRequest == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pullRequest, provider, token, owner, baseUrl, scope, cancellation);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, projectOrName, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\tprojectOrName: projectOrName,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getPullRequest(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectOrName: string,\n\t\tid: string,\n\t\toptions: { baseUrl: string },\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\t// A pull request id is unique within the organization, so no repository is required here — only the\n\t\t// project. `projectOrName` is either a bare project name or a `{project}/_git/{repo}` descriptor; either\n\t\t// way the project is its first segment.\n\t\tconst projectName = projectOrName.split('/')[0];\n\n\t\ttry {\n\t\t\tconst pr = await this.request<AzurePullRequest>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/pullrequests/${encodeAzurePathSegment(id)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\treturn pr != null\n\t\t\t\t? await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope)\n\t\t\t\t: undefined;\n\t\t} catch (ex) {\n\t\t\t// Only a 404 is a proven absence; `Integration.getPullRequest` handles every other failure, so it is not\n\t\t\t// cached as a miss\n\t\t\tif (ex.original?.status === 404) return undefined;\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssueOrPullRequest(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t\ttype?: IssueOrPullRequestType;\n\t\t},\n\t): Promise<IssueOrPullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\tif (options?.type === undefined || options?.type === 'issue') {\n\t\t\ttry {\n\t\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/wit/workItems/${encodeAzurePathSegment(id)}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (issueResult != null) {\n\t\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\t\tissueType,\n\t\t\t\t\t\tstate,\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken,\n\t\t\t\t\t\towner,\n\t\t\t\t\t\tprojectName,\n\t\t\t\t\t\toptions,\n\t\t\t\t\t);\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: issueResult.id.toString(),\n\t\t\t\t\t\ttype: 'issue',\n\t\t\t\t\t\tnodeId: issueResult.id.toString(),\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(issueResult.fields['System.CreatedDate']),\n\t\t\t\t\t\tupdatedDate: new Date(issueResult.fields['System.ChangedDate']),\n\t\t\t\t\t\tstate: azureWorkItemsStateCategoryToState(stateCategory),\n\t\t\t\t\t\tclosed: isClosedAzureWorkItemStateCategory(stateCategory),\n\t\t\t\t\t\ttitle: issueResult.fields['System.Title'],\n\t\t\t\t\t\turl: issueResult._links.html.href,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (options?.type === undefined || options?.type === 'pullrequest') {\n\t\t\ttry {\n\t\t\t\tconst prResult = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullRequests/${encodeAzurePathSegment(id)}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (prResult != null) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: prResult.pullRequestId.toString(),\n\t\t\t\t\t\ttype: 'pullrequest',\n\t\t\t\t\t\tnodeId: prResult.pullRequestId.toString(), // prResult.artifactId maybe?\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tupdatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tstate: azurePullRequestStatusToState(prResult.status),\n\t\t\t\t\t\tclosed: isClosedAzurePullRequestStatus(prResult.status),\n\t\t\t\t\t\ttitle: prResult.title,\n\t\t\t\t\t\turl: getAzurePullRequestWebUrl(prResult, options.baseUrl, owner),\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\treturn undefined;\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, project, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tproject: project,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssue(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tproject: AzureProjectDescriptor,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<Issue | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(project.resourceName)}/${encodeAzurePathSegment(project.name)}/_apis/wit/workItems/${encodeAzurePathSegment(id)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tif (issueResult != null) {\n\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\tissueType,\n\t\t\t\t\tstate,\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\tproject.resourceName,\n\t\t\t\t\tproject.name,\n\t\t\t\t\toptions,\n\t\t\t\t);\n\t\t\t\treturn fromAzureWorkItem(issueResult, provider, project, stateCategory, 'point');\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getAccountForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t): Promise<UnidentifiedAuthor | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst commit = await this.request<AzureGitCommit>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/commits/${encodeAzurePathSegment(rev)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\t\t\tconst author = commit?.author;\n\t\t\tif (!author) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\t// Azure API never gives us an id/username we can use, therefore we always return UnidentifiedAuthor\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tid: undefined,\n\t\t\t\tusername: undefined,\n\t\t\t\tname: author?.name,\n\t\t\t\temail: author?.email,\n\t\t\t\tavatarUrl: undefined,\n\t\t\t} satisfies UnidentifiedAuthor;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t/**\n\t * The collection an Azure DevOps Server address names, or `undefined` when it names the installation.\n\t *\n\t * Below a collection, `connectionData` describes that collection: its `instanceId` is the collection's id, and its\n\t * `webApplicationRelativeDirectory` ends in the collection's path segment (`DefaultCollection/`); it is empty or\n\t * absent at the server level. As measured against Azure DevOps Server 2020. The directory may also carry the\n\t * installation's own virtual directory before the collection (`tfs/DefaultCollection/`), so only its LAST segment\n\t * names the collection, and only when it is the last segment of the address asked about.\n\t */\n\t@trace({\n\t\targs: (provider, token, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getAddressedCollection(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string,\n\t): Promise<{ id: string; name: string } | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst connectionData = await this.request<{ instanceId?: string; webApplicationRelativeDirectory?: string }>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t'_apis/connectionData',\n\t\t\t{ method: 'GET' },\n\t\t\tscope,\n\t\t);\n\t\tconst segment = connectionData?.webApplicationRelativeDirectory?.split('/').findLast(Boolean);\n\t\tconst addressed = new URL(baseUrl).pathname.split('/').findLast(Boolean);\n\t\tif (segment == null || addressed == null || connectionData?.instanceId == null) return undefined;\n\n\t\tconst name = decodePathSegment(segment);\n\t\tif (name.toLowerCase() !== decodePathSegment(addressed).toLowerCase()) return undefined;\n\n\t\treturn { id: connectionData.instanceId, name: name };\n\t}\n\n\t@trace({\n\t\targs: (provider, token, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getCurrentUserOnServer(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string,\n\t): Promise<{ id: string; name?: string; email?: string; username?: string; avatarUrl?: string } | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst connectionData = await this.request<{\n\t\t\t\tauthenticatedUser?: {\n\t\t\t\t\tid: string;\n\t\t\t\t\tdescriptor: string;\n\t\t\t\t\tisActive: boolean;\n\t\t\t\t\tmetTypeId: number;\n\t\t\t\t\tproviderDisplayName?: string;\n\t\t\t\t\temailAddress?: string;\n\t\t\t\t\tresourceVersion: 2;\n\t\t\t\t\tsubjectDescriptor: string;\n\t\t\t\t\tproperties?: {\n\t\t\t\t\t\tAccount?: {\n\t\t\t\t\t\t\t$type: string;\n\t\t\t\t\t\t\t$value: string;\n\t\t\t\t\t\t};\n\t\t\t\t\t};\n\t\t\t\t};\n\t\t\t}>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t'_apis/connectionData',\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tconst user = connectionData?.authenticatedUser;\n\t\t\tconst username = user?.properties?.Account?.$value;\n\t\t\tif (!username) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\tid: user.id,\n\t\t\t\tname: user.providerDisplayName,\n\t\t\t\temail: user.emailAddress,\n\t\t\t\tusername: username,\n\t\t\t};\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is the whole point of this read failing; reporting \"no user\" instead hides it.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex, `Failed to get current user from ${baseUrl}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tasync getWorkItemStateCategory(\n\t\tissueType: string,\n\t\tstate: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemStateCategory | undefined> {\n\t\t// By installation too: this API is shared by every connection, and two installations can each have a\n\t\t// collection and project of the same name whose process maps a state to a different category.\n\t\tconst project = JSON.stringify([options.baseUrl, owner, projectName]);\n\t\tconst category = this._workItemStates.getStateCategory(project, issueType, state);\n\t\tif (category != null) return category;\n\n\t\tconst states = await this.retrieveWorkItemTypeStates(issueType, provider, token, owner, projectName, options);\n\t\tthis._workItemStates.saveTypeStates(project, issueType, states);\n\n\t\treturn this._workItemStates.getStateCategory(project, issueType, state);\n\t}\n\n\tprivate async retrieveWorkItemTypeStates(\n\t\tworkItemType: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemState[]> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst issueResult = await this.request<{ value: AzureWorkItemState[]; count: number }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/wit/workItemTypes/${encodeAzurePathSegment(workItemType)}/states`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\treturn issueResult?.value ?? [];\n\t\t} catch (ex) {\n\t\t\t// A rejected credential must not be degraded to an empty state list: the caller caches whatever this\n\t\t\t// returns, so an empty list would pin every work item of this type to an unknown state until the\n\t\t\t// cache is dropped — long after the session recovery this error is supposed to trigger.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn [];\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getRepositoryMetadata(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<RepositoryMetadata | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response == null) return undefined;\n\n\t\t\t// Azure's `parentRepository` only reliably carries the repo name and its project; a fork's parent\n\t\t\t// lives in the same organization, so the org (`owner`) is the parent owner. Only report `parent`\n\t\t\t// when the parent's name is actually present — never fall back to the fork's own name.\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\towner: owner,\n\t\t\t\t// Prefer the API's canonical name over parsing the composite `repo` descriptor string.\n\t\t\t\tname: response.name,\n\t\t\t\tisFork: response.isFork ?? false,\n\t\t\t\tparent:\n\t\t\t\t\tresponse.isFork && response.parentRepository?.name != null\n\t\t\t\t\t\t? { owner: owner, name: response.parentRepository.name }\n\t\t\t\t\t\t: undefined,\n\t\t\t} satisfies RepositoryMetadata;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getDefaultBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<DefaultBranch | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response?.defaultBranch == null) return undefined;\n\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tname: normalizeAzureBranchName(response.defaultBranch),\n\t\t\t} satisfies DefaultBranch;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t/**\n\t * One page of a filtered work-item search over a collection: a WIQL query for the ordered ids, then one detail\n\t * read for the page's slice of them.\n\t *\n\t * The ids a first page queried are kept as the snapshot its continuations page through, for as long as the\n\t * pagination keeps reading it, so it reads a consistent set rather than re-running a query whose rows move under\n\t * an `updated` order. Each first page queries its own snapshot, so paginations of one query never share one, and\n\t * a continuation whose snapshot is gone is refused (see {@link AzureWorkItemSearchCursor}).\n\t *\n\t * The query asks for one id more than {@link azureWorkItemSearchResultLimit}, bounded by `$top`: the extra id is\n\t * what tells \"exactly the limit\" from \"past it\". Past it, the page is `truncated` with `limitReached` and no total,\n\t * since the true count is unknowable here. A server that refuses the match set even so fails the page with a\n\t * \"narrow the search\" error: no bounded query could serve that order's first window.\n\t *\n\t * `resolveProject` maps each result's project name to its descriptor. A work item in a project it doesn't know\n\t * fails the page rather than being dropped or mis-attributed, since either would leave the page disagreeing with\n\t * the count of the same query; the caller refreshes its project discovery before a search so that means a\n\t * project created during the pagination.\n\t */\n\t@trace({\n\t\targs: (provider, token, collection) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tcollection: collection,\n\t\t}),\n\t})\n\tasync searchWorkItemsPage(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t\tcriteria?: IssueSearchCriteria;\n\t\t\tprojectNames?: readonly string[];\n\t\t\tresolveProject: (name: string) => AzureProjectDescriptor | undefined;\n\t\t\tcursor?: string;\n\t\t\tpageSize?: number;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<ProviderIssueSearchPage> {\n\t\tconst scope = getScopedLogger();\n\t\tconst wiql = toAzureWorkItemSearchWiql(\n\t\t\toptions.criteria,\n\t\t\teffectiveIssueSort(options.criteria?.sort),\n\t\t\toptions.projectNames,\n\t\t);\n\t\tconst key = toAzureWorkItemSearchCursorKey(collection, wiql);\n\t\tconst pageSize = toAzureSearchPageSize(options.pageSize, 100, azureWorkItemBatchLimit);\n\t\tconst cursor = parseAzureWorkItemSearchCursor(options.cursor, key, pageSize);\n\t\tconst page = cursor?.page ?? 1;\n\n\t\t// Keyed by credential and address, and by the query itself rather than its fingerprint: two accounts on one\n\t\t// installation must never page through each other's matches, and two queries whose fingerprints collide must\n\t\t// never share a snapshot. The full credential digest, since the token's `microHash` is truncated for logs.\n\t\t// And by the snapshot's own id: a first page queries a new snapshot rather than replacing the query's, so a\n\t\t// pagination still reading an earlier one keeps it (see `AzureWorkItemSearchCursor`).\n\t\tconst snapshot = cursor?.snapshot ?? uuid();\n\t\tconst snapshotKey = JSON.stringify([\n\t\t\tawait sha256(token.accessToken),\n\t\t\toptions.baseUrl,\n\t\t\tcollection,\n\t\t\twiql,\n\t\t\tsnapshot,\n\t\t]);\n\t\t// A continuation only ever READS its snapshot: resuming against a fresh query could skip a work item silently.\n\t\tconst snapshotFound = cursor?.snapshot != null ? this._workItemSearches.get(snapshotKey) : undefined;\n\t\tif (cursor?.snapshot != null && snapshotFound == null) {\n\t\t\tthrow new Error('Work item search results expired; restart the read without a cursor');\n\t\t}\n\n\t\tconst result = await (snapshotFound ??\n\t\t\tthis._workItemSearches.getOrCreate(\n\t\t\t\tsnapshotKey,\n\t\t\t\t(_cacheable, signal) =>\n\t\t\t\t\tthis.queryWorkItemIds(\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken,\n\t\t\t\t\t\tcollection,\n\t\t\t\t\t\toptions.baseUrl,\n\t\t\t\t\t\twiql,\n\t\t\t\t\t\tazureWorkItemSearchResultLimit + 1,\n\t\t\t\t\t\tscope,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t).catch((ex: unknown) => {\n\t\t\t\t\t\t// `$top` is expected to bound the answer; should a server refuse the match set regardless, say\n\t\t\t\t\t\t// what happened rather than surfacing a bare client error.\n\t\t\t\t\t\tif (isWorkItemLimitRefusal(ex)) {\n\t\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t\t`${provider.name} refused a work item search matching more than ${azureWorkItemSearchResultLimit} results; narrow the search`,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tthrow ex;\n\t\t\t\t\t}),\n\t\t\t\t{ cancellation: cancellation },\n\t\t\t));\n\t\tconst limitReached = result.length > azureWorkItemSearchResultLimit;\n\t\tconst ids = limitReached ? result.slice(0, azureWorkItemSearchResultLimit) : result;\n\n\t\tconst offset = cursor?.offset ?? 0;\n\n\t\tconst slice = ids.slice(offset, offset + pageSize);\n\t\tconst values: Issue[] = [];\n\t\tif (slice.length > 0) {\n\t\t\tconst workItems = await this.request<{ value: (WorkItem | null)[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(collection)}/_apis/wit/workitemsbatch?api-version=5.0`,\n\t\t\t\t{ method: 'POST', body: JSON.stringify({ ids: slice, $expand: 'Links', errorPolicy: 'Omit' }) },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tconst byId = new Map((workItems?.value ?? []).filter(w => w != null).map(w => [w.id, w]));\n\t\t\tfor (const id of slice) {\n\t\t\t\t// A work item deleted since the ids were queried is gone, not a failure: skipping it keeps the page\n\t\t\t\t// honest, since it no longer matches anything.\n\t\t\t\tconst workItem = byId.get(id);\n\t\t\t\tif (workItem == null) continue;\n\n\t\t\t\tconst projectName = workItem.fields['System.TeamProject'];\n\t\t\t\tconst project = options.resolveProject(projectName);\n\t\t\t\tif (project == null) {\n\t\t\t\t\tthrow new Error(`Azure DevOps work item ${id} is in project '${projectName}', which isn't visible`);\n\t\t\t\t}\n\n\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\tworkItem.fields['System.WorkItemType'],\n\t\t\t\t\tworkItem.fields['System.State'],\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\tcollection,\n\t\t\t\t\tproject.name,\n\t\t\t\t\toptions,\n\t\t\t\t);\n\t\t\t\tvalues.push(fromAzureWorkItem(workItem, provider, project, stateCategory, 'search'));\n\t\t\t}\n\t\t}\n\n\t\tconst nextOffset = offset + slice.length;\n\t\tconst hasMore = nextOffset < ids.length;\n\t\tconst next: AzureWorkItemSearchCursor = { key: key, snapshot: snapshot, offset: nextOffset, page: page + 1 };\n\t\treturn {\n\t\t\tvalues: values,\n\t\t\tcursor: hasMore ? JSON.stringify(next) : undefined,\n\t\t\thasMore: hasMore,\n\t\t\tpage: page,\n\t\t\ttruncated: limitReached,\n\t\t\ttotalCount: limitReached ? undefined : ids.length,\n\t\t\tlimitReached: limitReached || undefined,\n\t\t};\n\t}\n\n\t/**\n\t * How many work items the same WIQL {@link searchWorkItemsPage} would page through match, reading no details.\n\t *\n\t * Asks for one id more than the result ceiling, so the count is exact up to it and `'exceeds-limit'` past it —\n\t * never the ceiling itself, which would understate the match set.\n\t */\n\t@trace({\n\t\targs: (provider, token, collection) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tcollection: collection,\n\t\t}),\n\t})\n\tasync countWorkItems(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\toptions: { baseUrl: string; criteria?: IssueSearchCriteria; projectNames?: readonly string[] },\n\t\tcancellation?: AbortSignal,\n\t): Promise<number | 'exceeds-limit'> {\n\t\tconst scope = getScopedLogger();\n\t\tconst wiql = toAzureWorkItemSearchWiql(\n\t\t\toptions.criteria,\n\t\t\teffectiveIssueSort(options.criteria?.sort),\n\t\t\toptions.projectNames,\n\t\t);\n\t\ttry {\n\t\t\tconst ids = await this.queryWorkItemIds(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tcollection,\n\t\t\t\toptions.baseUrl,\n\t\t\t\twiql,\n\t\t\t\tazureWorkItemSearchResultLimit + 1,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\treturn ids.length > azureWorkItemSearchResultLimit ? 'exceeds-limit' : ids.length;\n\t\t} catch (ex) {\n\t\t\tif (isWorkItemLimitRefusal(ex)) return 'exceeds-limit';\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\t/**\n\t * The ids a collection-level WIQL query matches, in its order.\n\t *\n\t * `api-version=5.0` is the oldest version every Azure DevOps Server release this search supports (2019 and later)\n\t * answers; `timePrecision=true` is what lets the criteria's dates compare as instants — see `toWiqlDate`.\n\t */\n\tprivate async queryWorkItemIds(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\tbaseUrl: string,\n\t\twiql: string,\n\t\ttop: number,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<number[]> {\n\t\tconst result = await this.request<{ workItems?: { id: number }[] }>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t`${encodeAzurePathSegment(collection)}/_apis/wit/wiql?$top=${top}&timePrecision=true&api-version=5.0`,\n\t\t\t{ method: 'POST', body: JSON.stringify({ query: wiql }) },\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t\tif (result?.workItems == null) throw new Error('Azure DevOps returned no work item query result');\n\n\t\treturn result.workItems.map(w => w.id);\n\t}\n\n\tprivate getRepository(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureRepositoryWithMetadata | undefined> {\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\treturn this.request<AzureRepositoryWithMetadata>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}?api-version=7.1`,\n\t\t\t{ method: 'GET' },\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t}\n\n\tprivate async toPullRequest(\n\t\tpr: AzurePullRequest,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest> {\n\t\tconst forkRepositoryUrls = await this.getForkRepositoryUrls(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\towner,\n\t\t\tbaseUrl,\n\t\t\tpr.forkSource?.repository,\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t\t// Only the point reads convert through here.\n\t\treturn fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls, 'point');\n\t}\n\n\t/**\n\t * Resolves the web and HTTPS clone URLs of the fork a cross-repository pull request comes from. Every other\n\t * repository URL the model reports is rebuilt from the pull request payload; only a fork reference lacks the\n\t * project to do that, so only a fork costs a request.\n\t *\n\t * Best-effort by contract: a fork in a project the token cannot read, a deleted fork, or a throttled request\n\t * leaves the head ref without a URL. It must never cost the pull request itself, which is what makes swallowing\n\t * the failure here the right call rather than a shortcut.\n\t */\n\tprivate async getForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepository: AzureRepositoryReference | undefined,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls | undefined> {\n\t\tif (repository == null) return undefined;\n\n\t\tlet tokenHash: string;\n\t\ttry {\n\t\t\ttokenHash = await sha256(token.accessToken);\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst cacheKey = JSON.stringify([tokenHash, baseUrl, owner, repository.id]);\n\t\t// The request is shared, so the factory is handed the cache's aggregate signal rather than this caller's: it\n\t\t// aborts only once every caller waiting on the entry has cancelled.\n\t\treturn this._forkRepositoryUrls.getOrCreate(\n\t\t\tcacheKey,\n\t\t\t(cacheable, aggregate) =>\n\t\t\t\tthis.fetchForkRepositoryUrls(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\towner,\n\t\t\t\t\tbaseUrl,\n\t\t\t\t\trepository.id,\n\t\t\t\t\tcacheable,\n\t\t\t\t\tscope,\n\t\t\t\t\taggregate,\n\t\t\t\t),\n\t\t\t{ cancellation: cancellation },\n\t\t);\n\t}\n\n\tprivate async fetchForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepositoryId: string,\n\t\tcacheable: CacheController,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls | undefined> {\n\t\ttry {\n\t\t\tconst response = await this.request<AzureRepositoryUrls>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/_apis/git/repositories/${encodeAzurePathSegment(repositoryId)}?api-version=4.1`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tconst webUrl = sanitizeAzureRepositoryUrl(response?.webUrl, baseUrl, owner);\n\t\t\tconst cloneHttps = sanitizeAzureRepositoryUrl(response?.remoteUrl, baseUrl, owner);\n\n\t\t\t// The clone URL stands in for the web URL when the response omits it — an older `api-version` promises\n\t\t\t// neither field, and naming the fork by the URL git would use beats naming it not at all.\n\t\t\tconst url = webUrl ?? cloneHttps;\n\t\t\tif (url == null) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn { url: url, cloneHttps: cloneHttps };\n\t\t} catch (ex) {\n\t\t\t// Missing or inaccessible forks are cached briefly; transient failures retry on the next read.\n\t\t\tif (!(ex instanceof RequestNotFoundError) && !(ex instanceof AuthenticationError)) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t}\n\n\t\t\tconst status = ex instanceof ProviderFetchError ? ` (${ex.status})` : '';\n\t\t\tscope?.warn(`Unable to resolve the fork repository URLs${status}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tprivate async request<T>(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string | undefined,\n\t\troute: string,\n\t\toptions: { method: RequestInit['method'] } & Record<string, unknown>,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal | undefined,\n\t): Promise<T | undefined> {\n\t\tconst { accessToken } = token;\n\t\tconst url = baseUrl ? `${baseUrl}/${route}` : route;\n\n\t\tlet rsp: Response;\n\t\ttry {\n\t\t\tconst sw = maybeStopWatch(`[AZURE] ${options?.method ?? 'GET'} request`, { log: { onlyExit: true } });\n\n\t\t\ttry {\n\t\t\t\tif (cancellation?.aborted) throw new CancellationError();\n\n\t\t\t\trsp = await this.config.wrapForForcedInsecureSSL(provider.getIgnoreSSLErrors(), () =>\n\t\t\t\t\tthis.config.fetch(url, {\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\tAuthorization: `Basic ${base64(`PAT:${accessToken}`)}`,\n\t\t\t\t\t\t\t'Content-Type': 'application/json',\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsignal: cancellation,\n\t\t\t\t\t\t...options,\n\t\t\t\t\t}),\n\t\t\t\t);\n\n\t\t\t\tif (rsp.ok) {\n\t\t\t\t\t// Azure answers a rejected credential by redirecting to its sign-in page, which returns `203\n\t\t\t\t\t// text/html` rather than `401`. `rsp.ok` spans 200-299, so that page used to reach `json()` and\n\t\t\t\t\t// die as a bare `SyntaxError` — which `getIssue` and friends catch and report as \"not found\",\n\t\t\t\t\t// making an invalid credential indistinguishable from a missing work item (GKDEV-3617).\n\t\t\t\t\tconst contentType = rsp.headers.get('content-type')?.toLowerCase() ?? '';\n\t\t\t\t\tif (contentType.startsWith('text/html')) {\n\t\t\t\t\t\tconst { accessToken: _accessToken, ...tokenInfo } = token;\n\t\t\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t\t\ttokenInfo,\n\t\t\t\t\t\t\tAuthenticationErrorReason.Unauthorized,\n\t\t\t\t\t\t\tnew Error(`(${rsp.status}) Azure DevOps returned a sign-in page instead of data`),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\treturn (await rsp.json()) as T;\n\t\t\t\t}\n\n\t\t\t\t// Reads the body so the 403 branch below can tell a throttled request from a permission failure.\n\t\t\t\tthrow await ProviderFetchError.fromResponse('AzureDevOps', rsp);\n\t\t\t} finally {\n\t\t\t\tsw?.stop();\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\tif (ex instanceof ProviderFetchError || ex.name === 'AbortError') {\n\t\t\t\tthis.handleRequestError(provider, token, ex, scope);\n\t\t\t} else if (Logger.isDebugging) {\n\t\t\t\tthis.config.onError?.(`AzureDevOps request failed: ${ex.message}`);\n\t\t\t}\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\tprivate handleRequestError(\n\t\tprovider: Provider | undefined,\n\t\ttoken: TokenWithInfo,\n\t\tex: ProviderFetchError | (Error & { name: 'AbortError' }),\n\t\tscope: ScopedLogger | undefined,\n\t): void {\n\t\tif (ex.name === 'AbortError' || !(ex instanceof ProviderFetchError)) throw new CancellationError(ex);\n\n\t\tconst { accessToken, ...tokenInfo } = token;\n\t\tswitch (ex.status) {\n\t\t\tcase 404: // Not found\n\t\t\tcase 410: // Gone\n\t\t\tcase 422: // Unprocessable Entity\n\t\t\t\tthrow new RequestNotFoundError(ex);\n\t\t\tcase 401: // Unauthorized\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Unauthorized, ex);\n\t\t\tcase 429: // Too Many Requests\n\t\t\t\tthrow toRateLimitError(ex, accessToken);\n\t\t\tcase 403: // Forbidden\n\t\t\t\t// Azure returns 403 for both a permission failure and a throttled request (\"Request was blocked\n\t\t\t\t// due to exceeding usage of resource 'RateLimit'\"), so the message is the discriminant. Reporting\n\t\t\t\t// a throttle as `auth` would prompt the user to re-authenticate a healthy connection instead of\n\t\t\t\t// retrying (see `isRateLimitResponse`).\n\t\t\t\tif (isRateLimitResponse(ex)) throw toRateLimitError(ex, accessToken);\n\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Forbidden, ex);\n\t\t\tcase 500: // Internal Server Error\n\t\t\t\tscope?.error(ex);\n\t\t\t\tif (ex.response != null) {\n\t\t\t\t\tprovider?.trackRequestException();\n\t\t\t\t\tthis.config.onRequestFailed?.(\n\t\t\t\t\t\tprovider == null || provider.id === 'azure'\n\t\t\t\t\t\t\t? l10n.t(\n\t\t\t\t\t\t\t\t\t'{0} failed to respond and might be experiencing issues. Please visit the [AzureDevOps status page](https://status.dev.azure.com) for more information.',\n\t\t\t\t\t\t\t\t\tprovider?.name ?? 'AzureDevOps',\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: l10n.t('{0} failed to respond and might be experiencing issues.', provider.name),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\tcase 502: // Bad Gateway\n\t\t\t\tscope?.error(ex);\n\t\t\t\t// TODO: Learn the Azure API docs and put it in order:\n\t\t\t\t// if (ex.message.includes('timeout')) {\n\t\t\t\t// \tprovider?.trackRequestException();\n\t\t\t\t// \tvoid showIntegrationRequestTimedOutWarningMessage(provider?.name ?? 'Azure');\n\t\t\t\t// \treturn;\n\t\t\t\t// }\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tif (ex.status >= 400 && ex.status < 500) throw new RequestClientError(ex);\n\t\t\t\tbreak;\n\t\t}\n\n\t\tscope?.error(ex);\n\t\tif (Logger.isDebugging) {\n\t\t\tthis.config.onError?.(\n\t\t\t\t`AzureDevOps request failed: ${(ex.response as any)?.errors?.[0]?.message ?? ex.message}`,\n\t\t\t);\n\t\t}\n\t}\n}\n\n/** Wires an {@link AzureDevOpsApi} from the full runtime context, mapping `ctx` down to the narrow config. */\nexport function createAzureDevOpsApi(ctx: IntegrationServiceContext): AzureDevOpsApi {\n\treturn new AzureDevOpsApi(baseProviderApiConfig(ctx));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsEA,MAAM,4BAA4B;;AAElC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;;AAGrC,SAAS,uBAAuB,IAAsB;CACrD,OAAO,cAAc,sBAAsB,GAAG,QAAQ,SAAS,UAAU;AAC1E;AAEA,SAAS,+BAA+B,MAAyD;CAChG,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,MAAM,CAAC,aAAa,SAAS,YAAY;CACzC,IAAI,MAAM,WAAW,KAAK,YAAY,UAAU,CAAC,eAAe,CAAC,UAChE,MAAM,IAAI,MAAM,wCAAwC,KAAK,yCAAyC;CAGvG,OAAO;EAAe;EAAuB;CAAS;AACvD;AAEA,IAAM,iBAAN,MAAqB;CACpB,8BAA+B,IAAI,IAAwC;CAC3E,yBAA0B,IAAI,IAAkC;CAGhE,iBACC,SACA,cACA,WACyC;EACzC,OAAO,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,SAAS,CAAC;CAC/E;CAEA,QAAqB;EACpB,KAAK,YAAY,MAAM;EACvB,KAAK,OAAO,MAAM;CACnB;CAEA,eAAsB,SAAiB,cAAsB,QAAoC;EAChG,KAAK,gBAAgB,SAAS,YAAY;EAC1C,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,GAAG,MAAM;EAC9D,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,GAAG,MAAM,QAAQ;CAE1F;CAEA,cAAqB,SAAiB,cAA+B;EACpE,OAAO,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;CAC9D;CAEA,gBAAwB,SAAiB,cAA4B;EACpE,MAAM,SAAS,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;EACrE,IAAI,UAAU,MAAM;EAEpB,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,OAAO,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,CAAC;CAE7E;CAEA,YAAoB,SAAiB,cAAsB,WAA2B;EAErF,OAAO,KAAK,UAAU;GAAC;GAAS;GAAc;EAAS,CAAC;CACzD;CAEA,WAAmB,SAAiB,cAA8B;EACjE,OAAO,KAAK,UAAU,CAAC,SAAS,YAAY,CAAC;CAC9C;AACD;AAEA,IAAa,iBAAb,MAAkD;CAkBpB;CAjB7B;CACA,kBAA0C,IAAI,eAAe;CAC7D,sBAAuC,IAAI,aAA0D;EACpG,UAAU;EACV,WAAW;CACZ,CAAC;;;;;;CAMD,oBAAqC,IAAI,aAA+B;EACvE,UAAU;EACV,WAAW;EACX,WAAW;CACZ,CAAC;CAED,YAAY,QAA4C;EAA3B,KAAA,SAAA;EAC5B,KAAK,cAAc,OAAO,wBAAwB,KAAK,YAAY,CAAC;CACrE;CAEA,UAAgB;EACf,KAAK,aAAa,QAAQ;CAC3B;CAEA,cAA4B;EAC3B,KAAK,gBAAgB,MAAM;EAC3B,KAAK,oBAAoB,MAAM;EAC/B,KAAK,kBAAkB,MAAM;CAC9B;CAEA,MASa,wBACZ,UACA,OACA,OACA,MACA,QACA,SAGmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GA8BH,MAAM,OAjBY,MAZK,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,uEAAuE,mBAAmB,cAAc,QAAQ,KACnP,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAG4B,MAAM,MAAM,GAAG,MAAM;IAEhD,MAAM,UAAU,EAAE,WAAW,YAAY,EAAE,WAAW;IAGtD,IAAI,aAFY,EAAE,WAAW,YAAY,EAAE,WAAW,WAGrD,OAAO,UAAU,KAAK;IAKvB,MAAM,QAAQ,IAAI,KAAK,EAAE,cAAc,EAAE,YAAY;IAGrD,OAAO,IAFW,KAAK,EAAE,cAAc,EAAE,YAE9B,CAAC,CAAC,QAAQ,IAAI,MAAM,QAAQ;GACxC,CAAC,EAAA,GAEsB;GACvB,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,OAAO,MAAM,KAAK,cAAc,IAAI,UAAU,OAAO,OAAO,QAAQ,SAAS,KAAK;EACnF,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MAUM,wBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAGA,cACmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,IAAI;GAqBH,MAAM,MAAK,MApBY,KAAK,QAC3B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,oCACnI;IACC,QAAQ;IACR,MAAM,KAAK,UAAU,EACpB,SAAS,CACR;KACC,OAAO,CAAC,GAAG;KACX,MAAM;IACP,CACD,EACD,CAAC;GACF,GACA,OACA,YACD,EAAA,EAEqB,QAAQ,EAAE,GAAG,IAAI,GAAG;GACzC,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,GAAG,WAAW,QAAQ,EAAE,EAAE,0BAA0B,uBAAuB,GAAG,WAAW,EAAE,EAAE,gBAAgB,uBAAuB,GAAG,cAAc,SAAS,CAAC,KAC1N,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,IAAI,eAAe,MAAM,OAAO,KAAA;GAEhC,OAAO,MAAM,KAAK,cAAc,aAAa,UAAU,OAAO,OAAO,SAAS,OAAO,YAAY;EAClG,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MASa,eACZ,UACA,OACA,OACA,eACA,IACA,SACmC;EACnC,MAAM,QAAQ,gBAAgB;EAI9B,MAAM,cAAc,cAAc,MAAM,GAAG,CAAC,CAAC;EAE7C,IAAI;GACH,MAAM,KAAK,MAAM,KAAK,QACrB,UACA,OACA,QAAQ,SACR,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,EAAE,KAC3H,EACC,QAAQ,MACT,GACA,KACD;GAEA,OAAO,MAAM,OACV,MAAM,KAAK,cAAc,IAAI,UAAU,OAAO,OAAO,QAAQ,SAAS,KAAK,IAC3E,KAAA;EACJ,SAAS,IAAI;GAGZ,IAAI,GAAG,UAAU,WAAW,KAAK,OAAO,KAAA;GAExC,MAAM;EACP;CACD;CAEA,MASa,sBACZ,UACA,OACA,OACA,MACA,IACA,SAI0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,SACpD,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,uBAAuB,uBAAuB,EAAE,KACxH,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,OACA,aACA,OACD;IAEA,OAAO;KACN,IAAI,YAAY,GAAG,SAAS;KAC5B,MAAM;KACN,QAAQ,YAAY,GAAG,SAAS;KACtB;KACV,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,OAAO,mCAAmC,aAAa;KACvD,QAAQ,mCAAmC,aAAa;KACxD,OAAO,YAAY,OAAO;KAC1B,KAAK,YAAY,OAAO,KAAK;IAC9B;GACD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;EAGD,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,eACpD,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,gBAAgB,uBAAuB,EAAE,KAC5K,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,YAAY,MACf,OAAO;IACN,IAAI,SAAS,cAAc,SAAS;IACpC,MAAM;IACN,QAAQ,SAAS,cAAc,SAAS;IAC9B;IACV,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,OAAO,8BAA8B,SAAS,MAAM;IACpD,QAAQ,+BAA+B,SAAS,MAAM;IACtD,OAAO,SAAS;IAChB,KAAK,0BAA0B,UAAU,QAAQ,SAAS,KAAK;GAChE;GAGD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGF;CAEA,MAQa,SACZ,UACA,OACA,SACA,IACA,SAG6B;EAC7B,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,QAAQ,YAAY,EAAE,GAAG,uBAAuB,QAAQ,IAAI,EAAE,uBAAuB,uBAAuB,EAAE,KACxI,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,QAAQ,cACR,QAAQ,MACR,OACD;IACA,OAAO,kBAAkB,aAAa,UAAU,SAAS,eAAe,OAAO;GAChF;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;CAEA,MAUM,oBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAG0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GAYH,MAAM,UAAS,MAVM,KAAK,QACzB,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,WAAW,uBAAuB,GAAG,KACxK,EACC,QAAQ,MACT,GACA,KACD,EAAA,EACuB;GACvB,IAAI,CAAC,QACJ;GAGD,OAAO;IACI;IACV,IAAI,KAAA;IACJ,UAAU,KAAA;IACV,MAAM,QAAQ;IACd,OAAO,QAAQ;IACf,WAAW,KAAA;GACZ;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;;;;;;;;;;CAWA,MAOM,uBACL,UACA,OACA,SACoD;EACpD,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,iBAAiB,MAAM,KAAK,QACjC,UACA,OACA,SACA,wBACA,EAAE,QAAQ,MAAM,GAChB,KACD;EACA,MAAM,UAAU,gBAAgB,iCAAiC,MAAM,GAAG,CAAC,CAAC,SAAS,OAAO;EAC5F,MAAM,YAAY,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,CAAC,CAAC,SAAS,OAAO;EACvE,IAAI,WAAW,QAAQ,aAAa,QAAQ,gBAAgB,cAAc,MAAM,OAAO,KAAA;EAEvF,MAAM,OAAO,kBAAkB,OAAO;EACtC,IAAI,KAAK,YAAY,MAAM,kBAAkB,SAAS,CAAC,CAAC,YAAY,GAAG,OAAO,KAAA;EAE9E,OAAO;GAAE,IAAI,eAAe;GAAkB;EAAK;CACpD;CAEA,MAOM,uBACL,UACA,OACA,SAC4G;EAC5G,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GA6BH,MAAM,QAAO,MA5BgB,KAAK,QAkBjC,UACA,OACA,SACA,wBACA,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAE6B;GAC7B,MAAM,WAAW,MAAM,YAAY,SAAS;GAC5C,IAAI,CAAC,UACJ;GAGD,OAAO;IACN,IAAI,KAAK;IACT,MAAM,KAAK;IACX,OAAO,KAAK;IACF;GACX;EACD,SAAS,IAAI;GAEZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,IAAI,mCAAmC,SAAS;GAC7D;EACD;CACD;CAEA,MAAM,yBACL,WACA,OACA,UACA,OACA,OACA,aACA,SAGkD;EAGlD,MAAM,UAAU,KAAK,UAAU;GAAC,QAAQ;GAAS;GAAO;EAAW,CAAC;EACpE,MAAM,WAAW,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;EAChF,IAAI,YAAY,MAAM,OAAO;EAE7B,MAAM,SAAS,MAAM,KAAK,2BAA2B,WAAW,UAAU,OAAO,OAAO,aAAa,OAAO;EAC5G,KAAK,gBAAgB,eAAe,SAAS,WAAW,MAAM;EAE9D,OAAO,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;CACvE;CAEA,MAAc,2BACb,cACA,UACA,OACA,OACA,aACA,SAGgC;EAChC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAYH,QAAO,MAXmB,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,2BAA2B,uBAAuB,YAAY,EAAE,UACxI,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAEoB,SAAS,CAAC;EAC/B,SAAS,IAAI;GAIZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf,OAAO,CAAC;EACT;CACD;CAEA,MAQM,sBACL,UACA,OACA,OACA,MACA,SAGA,cAC0C;EAC1C,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,YAAY,MAAM,OAAO,KAAA;GAK7B,OAAO;IACI;IACH;IAEP,MAAM,SAAS;IACf,QAAQ,SAAS,UAAU;IAC3B,QACC,SAAS,UAAU,SAAS,kBAAkB,QAAQ,OACnD;KAAS;KAAO,MAAM,SAAS,iBAAiB;IAAK,IACrD,KAAA;GACL;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;CAEA,MAQM,iBACL,UACA,OACA,OACA,MACA,SAGA,cACqC;EACrC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,UAAU,iBAAiB,MAAM,OAAO,KAAA;GAE5C,OAAO;IACI;IACV,MAAM,yBAAyB,SAAS,aAAa;GACtD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;;;;;;;;;;;;;;;;;;;;CAqBA,MAOM,oBACL,UACA,OACA,YACA,SAQA,cACmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,OAAO,0BACZ,QAAQ,UACR,mBAAmB,QAAQ,UAAU,IAAI,GACzC,QAAQ,YACT;EACA,MAAM,MAAM,+BAA+B,YAAY,IAAI;EAC3D,MAAM,WAAW,sBAAsB,QAAQ,UAAU,KAAA,GAA4B;EACrF,MAAM,SAAS,+BAA+B,QAAQ,QAAQ,KAAK,QAAQ;EAC3E,MAAM,OAAO,QAAQ,QAAQ;EAO7B,MAAM,WAAW,QAAQ,YAAY,KAAK;EAC1C,MAAM,cAAc,KAAK,UAAU;GAClC,MAAM,OAAO,MAAM,WAAW;GAC9B,QAAQ;GACR;GACA;GACA;EACD,CAAC;EAED,MAAM,gBAAgB,QAAQ,YAAY,OAAO,KAAK,kBAAkB,IAAI,WAAW,IAAI,KAAA;EAC3F,IAAI,QAAQ,YAAY,QAAQ,iBAAiB,MAChD,MAAM,IAAI,MAAM,qEAAqE;EAGtF,MAAM,SAAS,OAAO,iBACrB,KAAK,kBAAkB,YACtB,cACC,YAAY,WACZ,KAAK,iBACJ,UACA,OACA,YACA,QAAQ,SACR,MAAA,OAEA,OACA,MACD,CAAC,CAAC,OAAO,OAAgB;GAGxB,IAAI,uBAAuB,EAAE,GAC5B,MAAM,IAAI,MACT,GAAG,SAAS,KAAK,gFAClB;GAGD,MAAM;EACP,CAAC,GACF,EAAgB,aAAa,CAC9B;EACD,MAAM,eAAe,OAAO,SAAS;EACrC,MAAM,MAAM,eAAe,OAAO,MAAM,GAAG,8BAA8B,IAAI;EAE7E,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,QAAQ,IAAI,MAAM,QAAQ,SAAS,QAAQ;EACjD,MAAM,SAAkB,CAAC;EACzB,IAAI,MAAM,SAAS,GAAG;GACrB,MAAM,YAAY,MAAM,KAAK,QAC5B,UACA,OACA,QAAQ,SACR,GAAG,uBAAuB,UAAU,EAAE,4CACtC;IAAE,QAAQ;IAAQ,MAAM,KAAK,UAAU;KAAE,KAAK;KAAO,SAAS;KAAS,aAAa;IAAO,CAAC;GAAE,GAC9F,OACA,YACD;GACA,MAAM,OAAO,IAAI,KAAK,WAAW,SAAS,CAAC,EAAA,CAAG,QAAO,MAAK,KAAK,IAAI,CAAC,CAAC,KAAI,MAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;GACxF,KAAK,MAAM,MAAM,OAAO;IAGvB,MAAM,WAAW,KAAK,IAAI,EAAE;IAC5B,IAAI,YAAY,MAAM;IAEtB,MAAM,cAAc,SAAS,OAAO;IACpC,MAAM,UAAU,QAAQ,eAAe,WAAW;IAClD,IAAI,WAAW,MACd,MAAM,IAAI,MAAM,0BAA0B,GAAG,kBAAkB,YAAY,uBAAuB;IAGnG,MAAM,gBAAgB,MAAM,KAAK,yBAChC,SAAS,OAAO,wBAChB,SAAS,OAAO,iBAChB,UACA,OACA,YACA,QAAQ,MACR,OACD;IACA,OAAO,KAAK,kBAAkB,UAAU,UAAU,SAAS,eAAe,QAAQ,CAAC;GACpF;EACD;EAEA,MAAM,aAAa,SAAS,MAAM;EAClC,MAAM,UAAU,aAAa,IAAI;EACjC,MAAM,OAAkC;GAAO;GAAe;GAAU,QAAQ;GAAY,MAAM,OAAO;EAAE;EAC3G,OAAO;GACE;GACR,QAAQ,UAAU,KAAK,UAAU,IAAI,IAAI,KAAA;GAChC;GACH;GACN,WAAW;GACX,YAAY,eAAe,KAAA,IAAY,IAAI;GAC3C,cAAc,gBAAgB,KAAA;EAC/B;CACD;;;;;;;CAQA,MAOM,eACL,UACA,OACA,YACA,SACA,cACoC;EACpC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,OAAO,0BACZ,QAAQ,UACR,mBAAmB,QAAQ,UAAU,IAAI,GACzC,QAAQ,YACT;EACA,IAAI;GACH,MAAM,MAAM,MAAM,KAAK,iBACtB,UACA,OACA,YACA,QAAQ,SACR,MACA,iCAAiC,GACjC,OACA,YACD;GACA,OAAO,IAAI,SAAA,MAA0C,kBAAkB,IAAI;EAC5E,SAAS,IAAI;GACZ,IAAI,uBAAuB,EAAE,GAAG,OAAO;GAEvC,MAAM;EACP;CACD;;;;;;;CAQA,MAAc,iBACb,UACA,OACA,YACA,SACA,MACA,KACA,OACA,cACoB;EACpB,MAAM,SAAS,MAAM,KAAK,QACzB,UACA,OACA,SACA,GAAG,uBAAuB,UAAU,EAAE,uBAAuB,IAAI,sCACjE;GAAE,QAAQ;GAAQ,MAAM,KAAK,UAAU,EAAE,OAAO,KAAK,CAAC;EAAE,GACxD,OACA,YACD;EACA,IAAI,QAAQ,aAAa,MAAM,MAAM,IAAI,MAAM,iDAAiD;EAEhG,OAAO,OAAO,UAAU,KAAI,MAAK,EAAE,EAAE;CACtC;CAEA,cACC,UACA,OACA,OACA,MACA,SACA,OACA,cACmD;EACnD,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,OAAO,KAAK,QACX,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,mBACnI,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;CACD;CAEA,MAAc,cACb,IACA,UACA,OACA,OACA,SACA,OACA,cACuB;EACvB,MAAM,qBAAqB,MAAM,KAAK,sBACrC,UACA,OACA,OACA,SACA,GAAG,YAAY,YACf,OACA,YACD;EAEA,OAAO,qBAAqB,IAAI,UAAU,OAAO,SAAS,oBAAoB,OAAO;CACtF;;;;;;;;;;CAWA,MAAc,sBACb,UACA,OACA,OACA,SACA,YACA,OACA,cAC+C;EAC/C,IAAI,cAAc,MAAM,OAAO,KAAA;EAE/B,IAAI;EACJ,IAAI;GACH,YAAY,MAAM,OAAO,MAAM,WAAW;EAC3C,QAAQ;GACP;EACD;EAEA,MAAM,WAAW,KAAK,UAAU;GAAC;GAAW;GAAS;GAAO,WAAW;EAAE,CAAC;EAG1E,OAAO,KAAK,oBAAoB,YAC/B,WACC,WAAW,cACX,KAAK,wBACJ,UACA,OACA,OACA,SACA,WAAW,IACX,WACA,OACA,SACD,GACD,EAAgB,aAAa,CAC9B;CACD;CAEA,MAAc,wBACb,UACA,OACA,OACA,SACA,cACA,WACA,OACA,cAC+C;EAC/C,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,0BAA0B,uBAAuB,YAAY,EAAE,mBAChG,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,MAAM,SAAS,2BAA2B,UAAU,QAAQ,SAAS,KAAK;GAC1E,MAAM,aAAa,2BAA2B,UAAU,WAAW,SAAS,KAAK;GAIjF,MAAM,MAAM,UAAU;GACtB,IAAI,OAAO,MAAM;IAChB,UAAU,WAAW;IACrB;GACD;GAEA,OAAO;IAAO;IAAiB;GAAW;EAC3C,SAAS,IAAI;GAEZ,IAAI,EAAE,cAAc,yBAAyB,EAAE,cAAc,sBAC5D,UAAU,WAAW;GAGtB,MAAM,SAAS,cAAc,qBAAqB,KAAK,GAAG,OAAO,KAAK;GACtE,OAAO,KAAK,6CAA6C,QAAQ;GACjE;EACD;CACD;CAEA,MAAc,QACb,UACA,OACA,SACA,OACA,SACA,OACA,cACyB;EACzB,MAAM,EAAE,gBAAgB;EACxB,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,UAAU;EAE9C,IAAI;EACJ,IAAI;GACH,MAAM,KAAK,eAAe,WAAW,SAAS,UAAU,MAAM,WAAW,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,CAAC;GAEpG,IAAI;IACH,IAAI,cAAc,SAAS,MAAM,IAAI,kBAAkB;IAEvD,MAAM,MAAM,KAAK,OAAO,yBAAyB,SAAS,mBAAmB,SAC5E,KAAK,OAAO,MAAM,KAAK;KACtB,SAAS;MACR,eAAe,SAAS,OAAO,OAAO,aAAa;MACnD,gBAAgB;KACjB;KACA,QAAQ;KACR,GAAG;IACJ,CAAC,CACF;IAEA,IAAI,IAAI,IAAI;KAMX,KADoB,IAAI,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY,KAAK,GAAA,CACtD,WAAW,WAAW,GAAG;MACxC,MAAM,EAAE,aAAa,cAAc,GAAG,cAAc;MACpD,MAAM,IAAI,oBACT,WAAA,mBAEA,IAAI,MAAM,IAAI,IAAI,OAAO,uDAAuD,CACjF;KACD;KAEA,OAAQ,MAAM,IAAI,KAAK;IACxB;IAGA,MAAM,MAAM,mBAAmB,aAAa,eAAe,GAAG;GAC/D,UAAU;IACT,IAAI,KAAK;GACV;EACD,SAAS,IAAI;GACZ,IAAI,cAAc,sBAAsB,GAAG,SAAS,cACnD,KAAK,mBAAmB,UAAU,OAAO,IAAI,KAAK;QAC5C,IAAIA,QAAO,aACjB,KAAK,OAAO,UAAU,+BAA+B,GAAG,SAAS;GAGlE,MAAM;EACP;CACD;CAEA,mBACC,UACA,OACA,IACA,OACO;EACP,IAAI,GAAG,SAAS,gBAAgB,EAAE,cAAc,qBAAqB,MAAM,IAAI,kBAAkB,EAAE;EAEnG,MAAM,EAAE,aAAa,GAAG,cAAc;EACtC,QAAQ,GAAG,QAAX;GACC,KAAK;GACL,KAAK;GACL,KAAK,KACJ,MAAM,IAAI,qBAAqB,EAAE;GAClC,KAAK,KACJ,MAAM,IAAI,oBAAoB,WAAA,GAAmD,EAAE;GACpF,KAAK,KACJ,MAAM,iBAAiB,IAAI,WAAW;GACvC,KAAK;IAKJ,IAAI,oBAAoB,EAAE,GAAG,MAAM,iBAAiB,IAAI,WAAW;IAEnE,MAAM,IAAI,oBAAoB,WAAA,GAAgD,EAAE;GACjF,KAAK;IACJ,OAAO,MAAM,EAAE;IACf,IAAI,GAAG,YAAY,MAAM;KACxB,UAAU,sBAAsB;KAChC,KAAK,OAAO,kBACX,YAAY,QAAQ,SAAS,OAAO,UACjC,KAAK,EACL,0JACA,UAAU,QAAQ,aACnB,IACC,KAAK,EAAE,2DAA2D,SAAS,IAAI,CACnF;IACD;IACA;GACD,KAAK;IACJ,OAAO,MAAM,EAAE;IAOf;GACD,SACC,IAAI,GAAG,UAAU,OAAO,GAAG,SAAS,KAAK,MAAM,IAAI,mBAAmB,EAAE;EAE1E;EAEA,OAAO,MAAM,EAAE;EACf,IAAIA,QAAO,aACV,KAAK,OAAO,UACX,+BAAgC,GAAG,UAAkB,SAAS,EAAE,EAAE,WAAW,GAAG,SACjF;CAEF;AACD;AA9pCE,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,YAAY;CAChD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACE;AACT,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA0DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA6DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,eAAe,QAAQ;CACrD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACQ;CACX;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,kBAAA,IAAA;AAuCA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,QAAQ;CAC5C,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACF;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AA8GA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,SAAS,QAAQ;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;CACL;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,YAAA,IAAA;AAqDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,uBAAA,IAAA;AA+DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,aAAa;CACpC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,0BAAA,IAAA;AAyBA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,aAAa;CACpC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,0BAAA,IAAA;AAqHA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AAoDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,oBAAA,IAAA;AA6DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,gBAAgB;CACvC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACrB;AACb,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,uBAAA,IAAA;AAsIA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,gBAAgB;CACvC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACrB;AACb,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,kBAAA,IAAA;;AAqUF,SAAgB,qBAAqB,KAAgD;CACpF,OAAO,IAAI,eAAe,sBAAsB,GAAG,CAAC;AACrD"}

package/dist/plus/integrations/providers/azure/models.d.ts

@@ -1,9 +1,10 @@
 import { ResourceDescriptor } from "../../../../git/models/resourceDescriptor.js";
 import { Provider } from "../../../../git/models/remoteProvider.js";
 import { IssueOrPullRequestState } from "../../../../git/models/issueOrPullRequest.js";
-import { Issue } from "../../../../git/models/issue.js";
-import { PullRequest, PullRequestMember, PullRequestMergeableState, PullRequestReviewDecision, PullRequestReviewState, PullRequestReviewer } from "../../../../git/models/pullRequest.js";
+import { Issue, IssueProjection } from "../../../../git/models/issue.js";
+import { PullRequest, PullRequestMember, PullRequestMergeableState, PullRequestProjection, PullRequestReviewDecision, PullRequestReviewState, PullRequestReviewer } from "../../../../git/models/pullRequest.js";
 import { ProviderIssue } from "../models.js";
+import { IssueEtagFields, PullRequestEtagFields, PullRequestEtagInclude } from "../../models/integration.js";
 //#region ../plus/integrations/src/providers/azure/models.d.ts
 export declare const vstsHostnameSuffix = ".visualstudio.com";
 export interface AzureRepositoryDescriptor extends ResourceDescriptor {
@@ -332,8 +333,8 @@ export interface AzureForkRepositoryUrls {
  * `baseUrl` and `owner` are the prefix the pull request was read through; every URL the model reports is built from
  * them. The required `forkRepositoryUrls` argument makes each call site resolve the best-effort fork URLs explicitly.
  */
-export declare function fromAzurePullRequest(pr: AzurePullRequest, provider: Provider, owner: string, baseUrl: string, forkRepositoryUrls: AzureForkRepositoryUrls | undefined): PullRequest;
-export declare function fromAzureWorkItem(workItem: WorkItem, provider: Provider, project: AzureProjectDescriptor, stateCategory?: AzureWorkItemStateCategory): Issue;
+export declare function fromAzurePullRequest(pr: AzurePullRequest, provider: Provider, owner: string, baseUrl: string, forkRepositoryUrls: AzureForkRepositoryUrls | undefined, projection?: PullRequestProjection): PullRequest;
+export declare function fromAzureWorkItem(workItem: WorkItem, provider: Provider, project: AzureProjectDescriptor, stateCategory?: AzureWorkItemStateCategory, projection?: IssueProjection): Issue;
 /**
  * A work item as `GET …/_apis/wit/workitems/{id}?$expand=Links` returns it. Loosely typed because
  * {@link fromAzureWorkItemToProviderIssue} checks every field it reads, as provider-apis does.
@@ -357,5 +358,36 @@ export interface AzureWorkItemResponse {
  * `state.name` is the raw `System.State`, as on every list read here, which passes the SDK no state-name map.
  */
 export declare function fromAzureWorkItemToProviderIssue(workItem: AzureWorkItemResponse, namespace: string, project: string): ProviderIssue | undefined;
+/**
+ * The most ids one cheap work item read asks for: the most Azure DevOps' work item list (`GET …/_apis/wit/workitems`)
+ * takes.
+ */
+export declare const azureWorkItemsEtagFieldsMaxIds = 200;
+/**
+ * The fields the cheap work item read selects: only the ones a full row's etag reads, and the project the full read
+ * checks the work item against. Not `System.State`: {@link fromAzureWorkItemToProviderIssue} gives the state no
+ * category, so `toIssueShape` closes a work item by its closed date alone.
+ */
+export declare const azureWorkItemEtagFieldNames: readonly string[];
+/**
+ * A cheap read's work item, as the fields its full batch row's etag reads: `toIssueShape` closes the row the full
+ * read builds (see {@link fromAzureWorkItemToProviderIssue}) exactly when it has a closed date, parsed by the same rule.
+ * Throws where the full read fails the work item: on one in another project than `project` (compared as Azure
+ * compares names), and on a missing or unparseable change date, so the target falls through to the full read.
+ */
+export declare function toAzureWorkItemEtagFields(workItem: AzureWorkItemResponse, project: string): IssueEtagFields;
+/**
+ * A cheap read's pull request (the same `GET …/pullrequests/{id}` provider-apis sends), as the fields its full batch
+ * row's etag reads: provider-apis' mapping (see the tables above), then `fromProviderPullRequest`'s. Azure DevOps
+ * reports no update time, so provider-apis' `updatedDate` is the close time, else the creation time, which is why
+ * the fields Azure changes without one are fingerprinted into the `revision`, from the values the full row ends up
+ * with: provider-apis' title, description (`?? null`, which the row reads `?? undefined`) and target branch, and its
+ * reviews, split into requests and completed reviews by `fromProviderPullRequest`'s own helpers.
+ *
+ * Throws where provider-apis' mapping throws, on a field it reads without a guard, so a pull request the full read
+ * fails on falls through to it rather than matching an etag. A full row never carries a check rollup (provider-apis
+ * maps none for Azure DevOps), so the `checks` include always reads `undefined`, as there.
+ */
+export declare function toAzurePullRequestEtagFields(pr: AzurePullRequest, etagIncludes: readonly PullRequestEtagInclude[]): PullRequestEtagFields;
 //#endregion
 //# sourceMappingURL=models.d.ts.map

package/dist/plus/integrations/providers/azure/models.js

@@ -1,5 +1,8 @@
 import { Issue } from "../../../../git/models/issue.js";
 import { PullRequest } from "../../../../git/models/pullRequest.js";
+import { decideProviderReviewDecision, fromPullRequestReviewDecision, toCompletedReviews, toReviewRequests } from "../pullRequestReviews.js";
+import { GitPullRequestMergeableState, GitPullRequestReviewState, GitPullRequestState, fromProviderPullRequestMergeableState, fromProviderPullRequestState } from "../models.js";
+import { pullRequestRevision } from "../../models/integration.js";
 //#region ../plus/integrations/src/providers/azure/models.ts
 const vstsHostnameSuffix = ".visualstudio.com";
 function isClosedAzureWorkItemStateCategory(category) {
@@ -186,7 +189,7 @@ function fromAzureUserToMember(user, _type) {
 * `baseUrl` and `owner` are the prefix the pull request was read through; every URL the model reports is built from
 * them. The required `forkRepositoryUrls` argument makes each call site resolve the best-effort fork URLs explicitly.
 */
-function fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls) {
+function fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls, projection) {
 	const baseRepositoryUrl = getAzureRepositoryWebUrl(baseUrl, owner, pr.repository.project.name, pr.repository.name);
 	const baseCloneHttps = getAzureRepositoryCloneUrl(pr.repository, baseUrl, owner);
 	const forkRepository = pr.forkSource?.repository;
@@ -195,8 +198,7 @@ function fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls)
 	return new PullRequest(provider, fromAzureUserToMember(pr.createdBy, "pullRequest"), pr.pullRequestId.toString(), pr.pullRequestId.toString(), pr.title, getAzurePullRequestWebUrl(pr, baseUrl, owner), {
 		owner,
 		repo: pr.repository.name,
-		id: pr.repository.id,
-		accessLevel: 30
+		id: pr.repository.id
 	}, azurePullRequestStatusToState(pr.status), new Date(pr.creationDate), new Date(pr.closedDate || pr.creationDate), pr.closedDate ? new Date(pr.closedDate) : void 0, pr.closedDate && pr.status === "completed" ? new Date(pr.closedDate) : void 0, fromAzurePullRequestMergeStatusToMergeableState(pr.mergeStatus ?? "notSet"), void 0, {
 		base: {
 			branch: pr.targetRefName ? normalizeAzureBranchName(pr.targetRefName) : "",
@@ -222,10 +224,10 @@ function fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls)
 		name: pr.repository.project.name,
 		resourceId: "",
 		resourceName: owner
-	});
+	}, void 0, void 0, void 0, void 0, void 0, void 0, void 0, projection);
 }
-function fromAzureWorkItem(workItem, provider, project, stateCategory) {
-	return new Issue(provider, workItem.id.toString(), workItem.id.toString(), workItem.fields["System.Title"], workItem._links.html.href, new Date(workItem.fields["System.CreatedDate"]), new Date(workItem.fields["System.ChangedDate"]), isClosedAzureWorkItemStateCategory(stateCategory), azureWorkItemsStateCategoryToState(stateCategory), fromAzureUserToMember(workItem.fields["System.CreatedBy"], "issue"), workItem.fields["System.AssignedTo"] != null ? [fromAzureUserToMember(workItem.fields["System.AssignedTo"], "issue")] : [], void 0, workItem.fields["Microsoft.VSTS.Common.ClosedDate"] ? new Date(workItem.fields["Microsoft.VSTS.Common.ClosedDate"]) : void 0, void 0, workItem.fields["System.CommentCount"], void 0, workItem.fields["System.Description"], project, void 0, void 0, void 0, void 0, toWorkItemIterations(workItem.fields["System.IterationPath"]));
+function fromAzureWorkItem(workItem, provider, project, stateCategory, projection) {
+	return new Issue(provider, workItem.id.toString(), workItem.id.toString(), workItem.fields["System.Title"], workItem._links.html.href, new Date(workItem.fields["System.CreatedDate"]), new Date(workItem.fields["System.ChangedDate"]), isClosedAzureWorkItemStateCategory(stateCategory), azureWorkItemsStateCategoryToState(stateCategory), fromAzureUserToMember(workItem.fields["System.CreatedBy"], "issue"), workItem.fields["System.AssignedTo"] != null ? [fromAzureUserToMember(workItem.fields["System.AssignedTo"], "issue")] : [], void 0, workItem.fields["Microsoft.VSTS.Common.ClosedDate"] ? new Date(workItem.fields["Microsoft.VSTS.Common.ClosedDate"]) : void 0, void 0, workItem.fields["System.CommentCount"], void 0, workItem.fields["System.Description"], project, void 0, void 0, void 0, void 0, toWorkItemIterations(workItem.fields["System.IterationPath"]), projection);
 }
 /**
 * Azure reports the iteration as a backslash-delimited path rooted at the project. The project root is its default
@@ -294,7 +296,7 @@ function fromAzureWorkItemToProviderIssue(workItem, namespace, project) {
 			key: null,
 			id: null
 		},
-		upvoteCount: 0,
+		upvoteCount: null,
 		labels: (typeof tags === "string" ? tags.split(";") : []).map((tag) => ({
 			color: null,
 			description: null,
@@ -349,7 +351,115 @@ function toAzureWorkItemIteration(path) {
 		name: iteration.name
 	} : void 0;
 }
+/**
+* The most ids one cheap work item read asks for: the most Azure DevOps' work item list (`GET …/_apis/wit/workitems`)
+* takes.
+*/
+const azureWorkItemsEtagFieldsMaxIds = 200;
+/**
+* The fields the cheap work item read selects: only the ones a full row's etag reads, and the project the full read
+* checks the work item against. Not `System.State`: {@link fromAzureWorkItemToProviderIssue} gives the state no
+* category, so `toIssueShape` closes a work item by its closed date alone.
+*/
+const azureWorkItemEtagFieldNames = [
+	"System.TeamProject",
+	"System.ChangedDate",
+	"Microsoft.VSTS.Common.ClosedDate"
+];
+/**
+* A cheap read's work item, as the fields its full batch row's etag reads: `toIssueShape` closes the row the full
+* read builds (see {@link fromAzureWorkItemToProviderIssue}) exactly when it has a closed date, parsed by the same rule.
+* Throws where the full read fails the work item: on one in another project than `project` (compared as Azure
+* compares names), and on a missing or unparseable change date, so the target falls through to the full read.
+*/
+function toAzureWorkItemEtagFields(workItem, project) {
+	const fields = workItem.fields;
+	const teamProject = fields?.["System.TeamProject"];
+	if (typeof teamProject === "string" && teamProject.toLowerCase() !== project.toLowerCase()) throw new Error(`Azure DevOps work item ${String(workItem.id)} is in project '${teamProject}', not '${project}'`);
+	const updatedDate = parseAzureWorkItemDate(fields?.["System.ChangedDate"]);
+	if (updatedDate == null) throw new Error(`Azure DevOps returned work item ${String(workItem.id)} without a change date`);
+	return {
+		state: parseAzureWorkItemDate(fields?.["Microsoft.VSTS.Common.ClosedDate"]) != null ? "closed" : "opened",
+		updatedDate
+	};
+}
+/** provider-apis' pull request `status` map (`bi`). It has no `notSet`, which therefore maps to `undefined`. */
+const azurePullRequestProviderStates = {
+	active: GitPullRequestState.Open,
+	completed: GitPullRequestState.Merged,
+	abandoned: GitPullRequestState.Closed
+};
+/** provider-apis' `mergeStatus` map (`Ti`); any other status, or none, is unknown. */
+const azureMergeStatusProviderStates = {
+	conflicts: GitPullRequestMergeableState.Conflicts,
+	failure: GitPullRequestMergeableState.FailingChecks,
+	rejectedByPolicy: GitPullRequestMergeableState.Blocked,
+	succeeded: GitPullRequestMergeableState.Mergeable
+};
+/** provider-apis' reviewer `vote` map (`Di`); any other vote reads as review requested. */
+const azureVoteProviderReviewStates = {
+	10: GitPullRequestReviewState.Approved,
+	5: GitPullRequestReviewState.Approved,
+	0: GitPullRequestReviewState.ReviewRequested,
+	[-5]: GitPullRequestReviewState.ChangesRequested,
+	[-10]: GitPullRequestReviewState.ChangesRequested
+};
+/** provider-apis' reviewer mapping (`ve`), with the state its vote maps to: every reviewer, required or optional. */
+function toAzureProviderReview(reviewer) {
+	return {
+		reviewer: {
+			id: reviewer.id,
+			name: reviewer.displayName ?? null,
+			username: (reviewer.uniqueName || reviewer.displayName) ?? null,
+			email: null,
+			avatarUrl: reviewer.imageUrl ?? null,
+			url: null
+		},
+		state: toAzureProviderReviewState(reviewer)
+	};
+}
+function toAzureProviderReviewState(reviewer) {
+	return azureVoteProviderReviewStates[reviewer.vote ?? 0] ?? GitPullRequestReviewState.ReviewRequested;
+}
+/**
+* A cheap read's pull request (the same `GET …/pullrequests/{id}` provider-apis sends), as the fields its full batch
+* row's etag reads: provider-apis' mapping (see the tables above), then `fromProviderPullRequest`'s. Azure DevOps
+* reports no update time, so provider-apis' `updatedDate` is the close time, else the creation time, which is why
+* the fields Azure changes without one are fingerprinted into the `revision`, from the values the full row ends up
+* with: provider-apis' title, description (`?? null`, which the row reads `?? undefined`) and target branch, and its
+* reviews, split into requests and completed reviews by `fromProviderPullRequest`'s own helpers.
+*
+* Throws where provider-apis' mapping throws, on a field it reads without a guard, so a pull request the full read
+* fails on falls through to it rather than matching an etag. A full row never carries a check rollup (provider-apis
+* maps none for Azure DevOps), so the `checks` include always reads `undefined`, as there.
+*/
+function toAzurePullRequestEtagFields(pr, etagIncludes) {
+	if (pr.pullRequestId == null || pr.createdBy == null || pr.repository?.project == null || pr.lastMergeSourceCommit == null || pr.lastMergeTargetCommit == null || !Array.isArray(pr.reviewers) || pr.reviewers.some((r) => r == null) || typeof pr.url !== "string" || typeof pr.sourceRefName !== "string" || typeof pr.targetRefName !== "string") throw new Error(`Azure DevOps returned pull request ${String(pr.pullRequestId)} without a field it maps`);
+	const reviews = pr.reviewers.map(toAzureProviderReview);
+	const fields = {
+		state: fromProviderPullRequestState(azurePullRequestProviderStates[pr.status]),
+		isDraft: pr.isDraft,
+		updatedDate: new Date(pr.closedDate || pr.creationDate),
+		headSha: pr.lastMergeSourceCommit.commitId ?? "",
+		revision: pullRequestRevision({
+			title: pr.title,
+			body: pr.description ?? void 0,
+			refs: { base: { branch: normalizeAzureBranchName(pr.targetRefName) } },
+			reviewRequests: toReviewRequests(reviews),
+			latestReviews: toCompletedReviews(reviews)
+		})
+	};
+	if (etagIncludes.includes("mergeable")) {
+		const mergeable = (pr.mergeStatus != null ? azureMergeStatusProviderStates[pr.mergeStatus] : void 0) ?? GitPullRequestMergeableState.Unknown;
+		fields.mergeableState = fromProviderPullRequestMergeableState[mergeable];
+	}
+	if (etagIncludes.includes("reviewDecision")) {
+		const decision = decideProviderReviewDecision(pr.reviewers.filter((r) => r.isRequired).map(toAzureProviderReviewState));
+		fields.reviewDecision = decision ? fromPullRequestReviewDecision[decision] : void 0;
+	}
+	return fields;
+}
 //#endregion
-export { azurePullRequestStatusToState, azureWorkItemsStateCategoryToState, encodeAzurePathSegment, fromAzurePullRequest, fromAzurePullRequestMergeStatusToMergeableState, fromAzurePullRequestVoteToReviewState, fromAzureReviewerToPullRequestMember, fromAzureUserWithVoteToReviewer, fromAzureWorkItem, fromAzureWorkItemToProviderIssue, getAzureDevOpsOwner, getAzurePullRequestReviewDecision, getAzurePullRequestWebUrl, isClosedAzurePullRequestStatus, isClosedAzureWorkItemStateCategory, isVsts, normalizeAzureBranchName, sanitizeAzureRepositoryUrl, vstsHostnameSuffix };
+export { azurePullRequestStatusToState, azureWorkItemEtagFieldNames, azureWorkItemsEtagFieldsMaxIds, azureWorkItemsStateCategoryToState, encodeAzurePathSegment, fromAzurePullRequest, fromAzurePullRequestMergeStatusToMergeableState, fromAzurePullRequestVoteToReviewState, fromAzureReviewerToPullRequestMember, fromAzureUserWithVoteToReviewer, fromAzureWorkItem, fromAzureWorkItemToProviderIssue, getAzureDevOpsOwner, getAzurePullRequestReviewDecision, getAzurePullRequestWebUrl, isClosedAzurePullRequestStatus, isClosedAzureWorkItemStateCategory, isVsts, normalizeAzureBranchName, sanitizeAzureRepositoryUrl, toAzurePullRequestEtagFields, toAzureWorkItemEtagFields, vstsHostnameSuffix };
 
 //# sourceMappingURL=models.js.map