@gitkraken/core-gitlens 0.9.4 → 0.9.5

package/dist/plus/integrations/models/issuesIntegration.d.ts

@@ -3,14 +3,20 @@ import { Issue, IssueShape } from "../../../git/models/issue.js";
 import { Account } from "../../../git/models/author.js";
 import { ProviderAuthenticationSession } from "../authentication/models.js";
 import { IntegrationIds } from "../constants.js";
-import { IssuesForProjectOptions, ProjectIssuesDrain } from "./issueReads.js";
-import { BatchSlot, Integration, IntegrationBase, IntegrationResult, IntegrationType } from "./integration.js";
 import { ProviderApiCollectionResult } from "../providers/models.js";
+import { IssuesForProjectOptions, ProjectIssuesDrain } from "./issueReads.js";
+import { BatchSlot, Integration, IntegrationBase, IntegrationResult, IntegrationType, IssueEtagFields, IssueEtagInclude } from "./integration.js";
 //#region ../plus/integrations/src/models/issuesIntegration.d.ts
 export declare function isIssuesIntegration(integration: Integration): integration is IssuesIntegration;
 export declare abstract class IssuesIntegration<ID extends IntegrationIds = IntegrationIds, T extends ResourceDescriptor = ResourceDescriptor> extends IntegrationBase<ID> {
   readonly type: IntegrationType;
   get supportsIssueLookupByResourceId(): boolean;
+  /**
+   * Whether this tracker has the cheap check behind the batch issue read's etags
+   * ({@link getProviderIssuesEtagFieldsByResourceId}). The read decides before calling anything, so a tracker without
+   * one makes one call.
+   */
+  get supportsIssueEtagsByResourceId(): boolean;
   /**
    * Result-returning wrapper for the BATCH tracker issue read: resolves several `(resourceId, identifier)` targets
    * with one {@link getProviderIssueByResourceId} request each, run with bounded concurrency. One settled slot per
@@ -20,7 +26,10 @@ export declare abstract class IssuesIntegration<ID extends IntegrationIds = Inte
    * Failure isolation happens PER TARGET, mirroring `GitHostIntegration.getPullRequestsBatchResult`: the whole
    * call counts as a failure against the integration's request-exception budget only when EVERY slot rejected,
    * and not even then when a credential that checks out was refused by each target's own resource
-   * (`settleBatchRefusals`), so a batch of mostly-good targets never spends more than one strike.
+   * (`settleBatchRefusals`), so a batch of mostly-good targets never spends more than one strike. A batch read with
+   * etags makes up to two such calls (a full read of the targets without an etag, and a full read of the ones that
+   * changed), so it can spend two; its cheap check ({@link getIssuesEtagFieldsByResourceIdBatchResult}) spends
+   * nothing unless the credential is refused.
    *
    * Uncached on purpose: the caller owns caching, as with the git hosts' batch reads.
    */
@@ -30,6 +39,38 @@ export declare abstract class IssuesIntegration<ID extends IntegrationIds = Inte
     resourceUrl?: string;
   }[], connectionId?: string): Promise<IntegrationResult<BatchSlot<IssueShape | undefined>[] | undefined>>;
   protected getProviderIssueByResourceId?(_session: ProviderAuthenticationSession, _resourceId: string, _id: string, _resourceUrl: string | undefined): Promise<Issue | undefined>;
+  /**
+   * Result-returning wrapper for the cheap check behind the batch tracker issue read's etags: each target's change
+   * state ({@link IssueEtagFields}), in ONE call to {@link getProviderIssuesEtagFieldsByResourceId}, which is handed
+   * `options.etagIncludes` as the git hosts' check is. The slots mean
+   * what {@link getIssuesByResourceIdBatchResult}'s do — `fulfilled` with `undefined` is a PROVEN ABSENCE, `rejected`
+   * means that target could not be checked. Failures are judged and budgeted as in
+   * `GitHostIntegration.getIssuesEtagFieldsResult`: every slot comes back as it settled, even when none answered, and
+   * only a refused credential fails the call or spends a strike.
+   */
+  getIssuesEtagFieldsByResourceIdBatchResult(targets: readonly {
+    resourceId: string;
+    identifier: string;
+    resourceUrl?: string;
+  }[], options: {
+    etagIncludes?: readonly IssueEtagInclude[];
+  }, connectionId?: string): Promise<IntegrationResult<BatchSlot<IssueEtagFields | undefined>[] | undefined>>;
+  /**
+   * OPTIONAL: the cheap check behind the batch tracker issue read's etags — one settled slot per input target, in
+   * order, holding the issue's change state in the vocabulary {@link getProviderIssueByResourceId}'s issues end in,
+   * so both reads compute the same etag. `fulfilled` with `undefined` is a PROVEN ABSENCE, as there; a tracker whose
+   * cheap read can't prove one rejects the slot instead, so the full read decides. `undefined` declines the whole
+   * check, sending every target to the full read without counting as a failure. A tracker implements this only
+   * where it is cheaper than the full read. No tracker's row carries a real reaction count, so `'reactions'` in
+   * `options.etagIncludes` reads nothing here.
+   */
+  protected getProviderIssuesEtagFieldsByResourceId?(session: ProviderAuthenticationSession, targets: readonly {
+    resourceId: string;
+    identifier: string;
+    resourceUrl?: string;
+  }[], options: {
+    etagIncludes?: readonly IssueEtagInclude[];
+  }): Promise<PromiseSettledResult<IssueEtagFields | undefined>[] | undefined>;
   getAccountForResource(resource: T, connectionId?: string): Promise<Account | undefined>;
   /**
    * Result-returning core of {@link getAccountForResource}. Recovers a thrown error into `{ error }` so

package/dist/plus/integrations/models/issuesIntegration.js

@@ -16,6 +16,14 @@ var IssuesIntegration = class extends IntegrationBase {
 		return this.getProviderIssueByResourceId != null;
 	}
 	/**
+	* Whether this tracker has the cheap check behind the batch issue read's etags
+	* ({@link getProviderIssuesEtagFieldsByResourceId}). The read decides before calling anything, so a tracker without
+	* one makes one call.
+	*/
+	get supportsIssueEtagsByResourceId() {
+		return this.getProviderIssuesEtagFieldsByResourceId != null;
+	}
+	/**
 	* Result-returning wrapper for the BATCH tracker issue read: resolves several `(resourceId, identifier)` targets
 	* with one {@link getProviderIssueByResourceId} request each, run with bounded concurrency. One settled slot per
 	* input target: `fulfilled` with `undefined` means the issue does not exist or is not visible to this token;
@@ -24,7 +32,10 @@ var IssuesIntegration = class extends IntegrationBase {
 	* Failure isolation happens PER TARGET, mirroring `GitHostIntegration.getPullRequestsBatchResult`: the whole
 	* call counts as a failure against the integration's request-exception budget only when EVERY slot rejected,
 	* and not even then when a credential that checks out was refused by each target's own resource
-	* (`settleBatchRefusals`), so a batch of mostly-good targets never spends more than one strike.
+	* (`settleBatchRefusals`), so a batch of mostly-good targets never spends more than one strike. A batch read with
+	* etags makes up to two such calls (a full read of the targets without an etag, and a full read of the ones that
+	* changed), so it can spend two; its cheap check ({@link getIssuesEtagFieldsByResourceIdBatchResult}) spends
+	* nothing unless the credential is refused.
 	*
 	* Uncached on purpose: the caller owns caching, as with the git hosts' batch reads.
 	*/
@@ -54,6 +65,45 @@ var IssuesIntegration = class extends IntegrationBase {
 			};
 		}
 	}
+	/**
+	* Result-returning wrapper for the cheap check behind the batch tracker issue read's etags: each target's change
+	* state ({@link IssueEtagFields}), in ONE call to {@link getProviderIssuesEtagFieldsByResourceId}, which is handed
+	* `options.etagIncludes` as the git hosts' check is. The slots mean
+	* what {@link getIssuesByResourceIdBatchResult}'s do — `fulfilled` with `undefined` is a PROVEN ABSENCE, `rejected`
+	* means that target could not be checked. Failures are judged and budgeted as in
+	* `GitHostIntegration.getIssuesEtagFieldsResult`: every slot comes back as it settled, even when none answered, and
+	* only a refused credential fails the call or spends a strike.
+	*/
+	async getIssuesEtagFieldsByResourceIdBatchResult(targets, options, connectionId) {
+		const scope = getScopedLogger();
+		const session = await this.resolveReadSession(connectionId, scope);
+		if (session == null) return void 0;
+		const getProviderEtagFields = this.getProviderIssuesEtagFieldsByResourceId;
+		if (getProviderEtagFields == null) return { value: void 0 };
+		const start = performance.now();
+		try {
+			const slots = await getProviderEtagFields.call(this, session, targets, options);
+			if (slots == null) return {
+				value: void 0,
+				duration: performance.now() - start
+			};
+			const settled = await this.settleBatchRefusals(session, targets, slots, { keepOtherFailures: true });
+			if (slots.some((slot) => slot.status === "fulfilled")) this.resetRequestExceptionCount("getIssuesEtagFields");
+			return {
+				value: settled,
+				duration: performance.now() - start
+			};
+		} catch (ex) {
+			this.handleEtagCheckException("getIssuesEtagFields", ex, {
+				scope,
+				connectionId
+			});
+			return {
+				error: toError(ex),
+				duration: performance.now() - start
+			};
+		}
+	}
 	async getAccountForResource(resource, connectionId) {
 		return (await this.getAccountForResourceResult(resource, connectionId))?.value;
 	}

package/dist/plus/integrations/models/issuesIntegration.js.map

@@ -1 +1 @@
-{"version":3,"file":"issuesIntegration.js","names":[],"sources":["../../../../../plus/integrations/src/models/issuesIntegration.ts"],"sourcesContent":["import type { Account } from '@gitlens/git/models/author.js';\nimport type { Issue, IssueShape } from '@gitlens/git/models/issue.js';\nimport type { ResourceDescriptor } from '@gitlens/git/models/resourceDescriptor.js';\nimport { gate } from '@gitlens/utils/decorators/gate.js';\nimport { trace } from '@gitlens/utils/decorators/log.js';\nimport { getScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport { mapSettledBounded } from '@gitlens/utils/promise.js';\nimport type { ProviderAuthenticationSession } from '../authentication/models.js';\nimport type { IntegrationIds } from '../constants.js';\nimport { providerFanOutConcurrency } from '../constants.js';\nimport { toError } from '../errors.js';\nimport type { ProviderApiCollectionResult } from '../providers/models.js';\nimport type { BatchSlot, Integration, IntegrationResult, IntegrationType } from './integration.js';\nimport { IntegrationBase } from './integration.js';\nimport type { IssuesForProjectOptions, ProjectIssuesDrain } from './issueReads.js';\n\nexport function isIssuesIntegration(integration: Integration): integration is IssuesIntegration {\n\treturn integration.type === 'issues';\n}\n\nexport abstract class IssuesIntegration<\n\tID extends IntegrationIds = IntegrationIds,\n\tT extends ResourceDescriptor = ResourceDescriptor,\n> extends IntegrationBase<ID> {\n\treadonly type: IntegrationType = 'issues';\n\n\tget supportsIssueLookupByResourceId(): boolean {\n\t\treturn this.getProviderIssueByResourceId != null;\n\t}\n\n\t/**\n\t * Result-returning wrapper for the BATCH tracker issue read: resolves several `(resourceId, identifier)` targets\n\t * with one {@link getProviderIssueByResourceId} request each, run with bounded concurrency. One settled slot per\n\t * input target: `fulfilled` with `undefined` means the issue does not exist or is not visible to this token;\n\t * `rejected` means that target could not be checked, never that it is absent.\n\t *\n\t * Failure isolation happens PER TARGET, mirroring `GitHostIntegration.getPullRequestsBatchResult`: the whole\n\t * call counts as a failure against the integration's request-exception budget only when EVERY slot rejected,\n\t * and not even then when a credential that checks out was refused by each target's own resource\n\t * (`settleBatchRefusals`), so a batch of mostly-good targets never spends more than one strike.\n\t *\n\t * Uncached on purpose: the caller owns caching, as with the git hosts' batch reads.\n\t */\n\tasync getIssuesByResourceIdBatchResult(\n\t\ttargets: readonly { resourceId: string; identifier: string; resourceUrl?: string }[],\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<BatchSlot<IssueShape | undefined>[] | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\tconst getProviderIssue = this.getProviderIssueByResourceId;\n\t\tif (getProviderIssue == null) return { value: undefined };\n\n\t\tconst start = performance.now();\n\t\ttry {\n\t\t\tconst slots = await mapSettledBounded(targets, providerFanOutConcurrency, t =>\n\t\t\t\tgetProviderIssue.call(this, session, t.resourceId, t.identifier, t.resourceUrl),\n\t\t\t);\n\n\t\t\tconst settled = await this.settleBatchRefusals(session, targets, slots);\n\n\t\t\tthis.resetRequestExceptionCount('getIssue');\n\t\t\treturn { value: settled, duration: performance.now() - start };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getIssue', ex, { scope: scope, connectionId: connectionId });\n\t\t\treturn { error: toError(ex), duration: performance.now() - start };\n\t\t}\n\t}\n\n\tprotected getProviderIssueByResourceId?(\n\t\t_session: ProviderAuthenticationSession,\n\t\t_resourceId: string,\n\t\t_id: string,\n\t\t_resourceUrl: string | undefined,\n\t): Promise<Issue | undefined>;\n\n\t@trace()\n\tasync getAccountForResource(resource: T, connectionId?: string): Promise<Account | undefined> {\n\t\treturn (await this.getAccountForResourceResult(resource, connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getAccountForResource}. Recovers a thrown error into `{ error }` so\n\t * callers can preserve its classification (e.g. a 401/403 → an `auth` warning that drives re-auth)\n\t * instead of collapsing every failure into an untyped `undefined`. Gated here (not on the wrapper) so\n\t * direct callers such as the ProviderBackend facade share the same dedup as `getAccountForResource`.\n\t */\n\t@gate()\n\tasync getAccountForResourceResult(\n\t\tresource: T,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<Account | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst account = await this.getProviderAccountForResource(session, resource);\n\t\t\tthis.resetRequestExceptionCount('getAccountForResource');\n\t\t\treturn { value: account };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getAccountForResource', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderAccountForResource(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresource: T,\n\t): Promise<Account | undefined>;\n\n\t@trace()\n\tasync getResourcesForUser(connectionId?: string): Promise<T[] | undefined> {\n\t\treturn (await this.getResourcesForUserResult(connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getResourcesForUser}. Recovers thrown errors into `{ error }` so callers\n\t * can surface them as warnings rather than silently swallowing them to `undefined`. Gated here (not on the\n\t * wrapper) so direct callers such as the ProviderBackend facade share the same dedup as `getResourcesForUser`.\n\t */\n\t@gate()\n\tasync getResourcesForUserResult(connectionId?: string): Promise<IntegrationResult<T[] | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst resources = await this.getProviderResourcesForUser(session);\n\t\t\tthis.resetRequestExceptionCount('getResourcesForUser');\n\t\t\treturn { value: resources };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getResourcesForUser', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderResourcesForUser(session: ProviderAuthenticationSession): Promise<T[] | undefined>;\n\n\t/**\n\t * Project discovery for a set of resources, returning the SDK collection `{ values, metadata }` (completeness\n\t * + per-resource failures) so callers can warn on failed resources and set `fetchFailed` without discarding\n\t * the resources that succeeded. Thrown errors are recovered into `{ error }` for the same reason: a caller\n\t * surfaces them as a warning rather than swallowing them to `undefined`.\n\t */\n\t@trace()\n\tasync getProjectsForResourcesWithMetadataResult(\n\t\tresources: T[],\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<ProviderApiCollectionResult<T> | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst projects = await this.getProviderProjectsForResourcesWithMetadata(session, resources);\n\t\t\tawait this.confirmScopedAuthFailures(session, projects.metadata);\n\t\t\tthis.resetRequestExceptionCount('getProjectsForResources');\n\t\t\treturn { value: projects };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getProjectsForResources', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\t/**\n\t * Metadata-aware provider project discovery. The default wraps the array-returning\n\t * {@link getProviderProjectsForResources} in `{ values }` with no metadata, so providers without a\n\t * fan-out completeness signal (Linear, Trello) need no change; Jira overrides it to preserve the SDK's\n\t * per-resource completeness/failures.\n\t */\n\tprotected async getProviderProjectsForResourcesWithMetadata(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresources: T[],\n\t): Promise<ProviderApiCollectionResult<T>> {\n\t\tconst projects = await this.getProviderProjectsForResources(session, resources);\n\t\treturn { values: projects ?? [] };\n\t}\n\n\tprotected abstract getProviderProjectsForResources(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresources: T[],\n\t): Promise<T[] | undefined>;\n\n\t@trace()\n\tasync getIssuesForProject(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IssueShape[] | undefined> {\n\t\treturn (await this.getIssuesForProjectResult(project, options, connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getIssuesForProject}. Recovers thrown errors into `{ error }` so callers\n\t * (e.g. the ProviderBackend facade) can surface a per-provider warning instead of a silent empty read —\n\t * important for providers that throw on unsupported operations (e.g. Linear's not-implemented issue read).\n\t */\n\tasync getIssuesForProjectResult(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<IssueShape[] | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst issues = await this.getProviderIssuesForProject(session, project, options);\n\t\t\tthis.resetRequestExceptionCount('getIssuesForProject');\n\t\t\treturn { value: issues };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\t/**\n\t * Truncation-aware variant of {@link getIssuesForProjectResult}. A provider that drains a project's issues\n\t * with an internal page backstop (Jira/Linear) overrides {@link getProviderIssuesForProjectWithTruncation}\n\t * to report when that backstop was hit, so the facade can surface an incomplete project read instead of\n\t * publishing it as complete. The default reports `truncated: false`.\n\t */\n\tasync getIssuesForProjectWithTruncationResult(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<ProjectIssuesDrain | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst result = await this.getProviderIssuesForProjectWithTruncation(session, project, options);\n\t\t\tawait this.confirmScopedAuthFailures(session, result?.metadata);\n\t\t\tthis.resetRequestExceptionCount('getIssuesForProject');\n\t\t\treturn { value: result };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderIssuesForProject(\n\t\tsession: ProviderAuthenticationSession,\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t): Promise<IssueShape[] | undefined>;\n\n\t/**\n\t * Truncation-aware core of {@link getProviderIssuesForProject}. The default wraps the plain read and\n\t * reports `truncated: false`; a provider whose per-project drain is capped by a page backstop overrides\n\t * this to report incompleteness. Optional metadata lets providers surface structured per-project failures\n\t * (e.g. a page-level auth rejection) without discarding the already-fetched prefix.\n\t */\n\tprotected async getProviderIssuesForProjectWithTruncation(\n\t\tsession: ProviderAuthenticationSession,\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t): Promise<ProjectIssuesDrain | undefined> {\n\t\tconst values = await this.getProviderIssuesForProject(session, project, options);\n\t\tif (values == null) return undefined;\n\t\treturn { values: values, truncated: false };\n\t}\n}\n"],"mappings":";;;;;;;;;AAgBA,SAAgB,oBAAoB,aAA4D;CAC/F,OAAO,YAAY,SAAS;AAC7B;AAEA,IAAsB,oBAAtB,cAGU,gBAAoB;CAC7B,OAAiC;CAEjC,IAAI,kCAA2C;EAC9C,OAAO,KAAK,gCAAgC;CAC7C;;;;;;;;;;;;;;CAeA,MAAM,iCACL,SACA,cAC8E;EAC9E,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,MAAM,mBAAmB,KAAK;EAC9B,IAAI,oBAAoB,MAAM,OAAO,EAAE,OAAO,KAAA,EAAU;EAExD,MAAM,QAAQ,YAAY,IAAI;EAC9B,IAAI;GACH,MAAM,QAAQ,MAAM,kBAAkB,SAAA,IAAoC,MACzE,iBAAiB,KAAK,MAAM,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAC/E;GAEA,MAAM,UAAU,MAAM,KAAK,oBAAoB,SAAS,SAAS,KAAK;GAEtE,KAAK,2BAA2B,UAAU;GAC1C,OAAO;IAAE,OAAO;IAAS,UAAU,YAAY,IAAI,IAAI;GAAM;EAC9D,SAAS,IAAI;GACZ,KAAK,wBAAwB,YAAY,IAAI;IAAS;IAAqB;GAAa,CAAC;GACzF,OAAO;IAAE,OAAO,QAAQ,EAAE;IAAG,UAAU,YAAY,IAAI,IAAI;GAAM;EAClE;CACD;CASA,MACM,sBAAsB,UAAa,cAAqD;EAC7F,QAAQ,MAAM,KAAK,4BAA4B,UAAU,YAAY,EAAA,EAAI;CAC1E;;;;;;;CAQA,MACM,4BACL,UACA,cACkD;EAClD,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,UAAU,MAAM,KAAK,8BAA8B,SAAS,QAAQ;GAC1E,KAAK,2BAA2B,uBAAuB;GACvD,OAAO,EAAE,OAAO,QAAQ;EACzB,SAAS,IAAI;GACZ,KAAK,wBAAwB,yBAAyB,IAAI,EAAgB,aAAa,CAAC;GACxF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;CAOA,MACM,oBAAoB,cAAiD;EAC1E,QAAQ,MAAM,KAAK,0BAA0B,YAAY,EAAA,EAAI;CAC9D;;;;;;CAOA,MACM,0BAA0B,cAAoE;EACnG,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,YAAY,MAAM,KAAK,4BAA4B,OAAO;GAChE,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,UAAU;EAC3B,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAUA,MACM,0CACL,WACA,cACyE;EACzE,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,4CAA4C,SAAS,SAAS;GAC1F,MAAM,KAAK,0BAA0B,SAAS,SAAS,QAAQ;GAC/D,KAAK,2BAA2B,yBAAyB;GACzD,OAAO,EAAE,OAAO,SAAS;EAC1B,SAAS,IAAI;GACZ,KAAK,wBAAwB,2BAA2B,IAAI,EAAgB,aAAa,CAAC;GAC1F,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAQA,MAAgB,4CACf,SACA,WAC0C;EAE1C,OAAO,EAAE,QAAQ,MADM,KAAK,gCAAgC,SAAS,SAAS,KACjD,CAAC,EAAE;CACjC;CAOA,MACM,oBACL,SACA,SACA,cACoC;EACpC,QAAQ,MAAM,KAAK,0BAA0B,SAAS,SAAS,YAAY,EAAA,EAAI;CAChF;;;;;;CAOA,MAAM,0BACL,SACA,SACA,cACuD;EACvD,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,SAAS,MAAM,KAAK,4BAA4B,SAAS,SAAS,OAAO;GAC/E,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,OAAO;EACxB,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAQA,MAAM,wCACL,SACA,SACA,cAC6D;EAC7D,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,SAAS,MAAM,KAAK,0CAA0C,SAAS,SAAS,OAAO;GAC7F,MAAM,KAAK,0BAA0B,SAAS,QAAQ,QAAQ;GAC9D,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,OAAO;EACxB,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAcA,MAAgB,0CACf,SACA,SACA,SAC0C;EAC1C,MAAM,SAAS,MAAM,KAAK,4BAA4B,SAAS,SAAS,OAAO;EAC/E,IAAI,UAAU,MAAM,OAAO,KAAA;EAC3B,OAAO;GAAU;GAAQ,WAAW;EAAM;CAC3C;AACD;AAhME,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,yBAAA,IAAA;AAWN,WAAA,CAAA,KAAK,CAAA,GAAA,kBAAA,WAAA,+BAAA,IAAA;AAyBL,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,uBAAA,IAAA;AAUN,WAAA,CAAA,KAAK,CAAA,GAAA,kBAAA,WAAA,6BAAA,IAAA;AAyBL,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,6CAAA,IAAA;AAwCN,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,uBAAA,IAAA"}
+{"version":3,"file":"issuesIntegration.js","names":[],"sources":["../../../../../plus/integrations/src/models/issuesIntegration.ts"],"sourcesContent":["import type { Account } from '@gitlens/git/models/author.js';\nimport type { Issue, IssueShape } from '@gitlens/git/models/issue.js';\nimport type { ResourceDescriptor } from '@gitlens/git/models/resourceDescriptor.js';\nimport { gate } from '@gitlens/utils/decorators/gate.js';\nimport { trace } from '@gitlens/utils/decorators/log.js';\nimport { getScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport { mapSettledBounded } from '@gitlens/utils/promise.js';\nimport type { ProviderAuthenticationSession } from '../authentication/models.js';\nimport type { IntegrationIds } from '../constants.js';\nimport { providerFanOutConcurrency } from '../constants.js';\nimport { toError } from '../errors.js';\nimport type { ProviderApiCollectionResult } from '../providers/models.js';\nimport type {\n\tBatchSlot,\n\tIntegration,\n\tIntegrationResult,\n\tIntegrationType,\n\tIssueEtagFields,\n\tIssueEtagInclude,\n} from './integration.js';\nimport { IntegrationBase } from './integration.js';\nimport type { IssuesForProjectOptions, ProjectIssuesDrain } from './issueReads.js';\n\nexport function isIssuesIntegration(integration: Integration): integration is IssuesIntegration {\n\treturn integration.type === 'issues';\n}\n\nexport abstract class IssuesIntegration<\n\tID extends IntegrationIds = IntegrationIds,\n\tT extends ResourceDescriptor = ResourceDescriptor,\n> extends IntegrationBase<ID> {\n\treadonly type: IntegrationType = 'issues';\n\n\tget supportsIssueLookupByResourceId(): boolean {\n\t\treturn this.getProviderIssueByResourceId != null;\n\t}\n\n\t/**\n\t * Whether this tracker has the cheap check behind the batch issue read's etags\n\t * ({@link getProviderIssuesEtagFieldsByResourceId}). The read decides before calling anything, so a tracker without\n\t * one makes one call.\n\t */\n\tget supportsIssueEtagsByResourceId(): boolean {\n\t\treturn this.getProviderIssuesEtagFieldsByResourceId != null;\n\t}\n\n\t/**\n\t * Result-returning wrapper for the BATCH tracker issue read: resolves several `(resourceId, identifier)` targets\n\t * with one {@link getProviderIssueByResourceId} request each, run with bounded concurrency. One settled slot per\n\t * input target: `fulfilled` with `undefined` means the issue does not exist or is not visible to this token;\n\t * `rejected` means that target could not be checked, never that it is absent.\n\t *\n\t * Failure isolation happens PER TARGET, mirroring `GitHostIntegration.getPullRequestsBatchResult`: the whole\n\t * call counts as a failure against the integration's request-exception budget only when EVERY slot rejected,\n\t * and not even then when a credential that checks out was refused by each target's own resource\n\t * (`settleBatchRefusals`), so a batch of mostly-good targets never spends more than one strike. A batch read with\n\t * etags makes up to two such calls (a full read of the targets without an etag, and a full read of the ones that\n\t * changed), so it can spend two; its cheap check ({@link getIssuesEtagFieldsByResourceIdBatchResult}) spends\n\t * nothing unless the credential is refused.\n\t *\n\t * Uncached on purpose: the caller owns caching, as with the git hosts' batch reads.\n\t */\n\tasync getIssuesByResourceIdBatchResult(\n\t\ttargets: readonly { resourceId: string; identifier: string; resourceUrl?: string }[],\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<BatchSlot<IssueShape | undefined>[] | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\tconst getProviderIssue = this.getProviderIssueByResourceId;\n\t\tif (getProviderIssue == null) return { value: undefined };\n\n\t\tconst start = performance.now();\n\t\ttry {\n\t\t\tconst slots = await mapSettledBounded(targets, providerFanOutConcurrency, t =>\n\t\t\t\tgetProviderIssue.call(this, session, t.resourceId, t.identifier, t.resourceUrl),\n\t\t\t);\n\n\t\t\tconst settled = await this.settleBatchRefusals(session, targets, slots);\n\n\t\t\tthis.resetRequestExceptionCount('getIssue');\n\t\t\treturn { value: settled, duration: performance.now() - start };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getIssue', ex, { scope: scope, connectionId: connectionId });\n\t\t\treturn { error: toError(ex), duration: performance.now() - start };\n\t\t}\n\t}\n\n\tprotected getProviderIssueByResourceId?(\n\t\t_session: ProviderAuthenticationSession,\n\t\t_resourceId: string,\n\t\t_id: string,\n\t\t_resourceUrl: string | undefined,\n\t): Promise<Issue | undefined>;\n\n\t/**\n\t * Result-returning wrapper for the cheap check behind the batch tracker issue read's etags: each target's change\n\t * state ({@link IssueEtagFields}), in ONE call to {@link getProviderIssuesEtagFieldsByResourceId}, which is handed\n\t * `options.etagIncludes` as the git hosts' check is. The slots mean\n\t * what {@link getIssuesByResourceIdBatchResult}'s do — `fulfilled` with `undefined` is a PROVEN ABSENCE, `rejected`\n\t * means that target could not be checked. Failures are judged and budgeted as in\n\t * `GitHostIntegration.getIssuesEtagFieldsResult`: every slot comes back as it settled, even when none answered, and\n\t * only a refused credential fails the call or spends a strike.\n\t */\n\tasync getIssuesEtagFieldsByResourceIdBatchResult(\n\t\ttargets: readonly { resourceId: string; identifier: string; resourceUrl?: string }[],\n\t\toptions: { etagIncludes?: readonly IssueEtagInclude[] },\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<BatchSlot<IssueEtagFields | undefined>[] | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\tconst getProviderEtagFields = this.getProviderIssuesEtagFieldsByResourceId;\n\t\tif (getProviderEtagFields == null) return { value: undefined };\n\n\t\tconst start = performance.now();\n\t\ttry {\n\t\t\tconst slots = await getProviderEtagFields.call(this, session, targets, options);\n\t\t\tif (slots == null) return { value: undefined, duration: performance.now() - start };\n\n\t\t\tconst settled = await this.settleBatchRefusals(session, targets, slots, { keepOtherFailures: true });\n\n\t\t\tif (slots.some(slot => slot.status === 'fulfilled')) {\n\t\t\t\tthis.resetRequestExceptionCount('getIssuesEtagFields');\n\t\t\t}\n\t\t\treturn { value: settled, duration: performance.now() - start };\n\t\t} catch (ex) {\n\t\t\tthis.handleEtagCheckException('getIssuesEtagFields', ex, { scope: scope, connectionId: connectionId });\n\t\t\treturn { error: toError(ex), duration: performance.now() - start };\n\t\t}\n\t}\n\n\t/**\n\t * OPTIONAL: the cheap check behind the batch tracker issue read's etags — one settled slot per input target, in\n\t * order, holding the issue's change state in the vocabulary {@link getProviderIssueByResourceId}'s issues end in,\n\t * so both reads compute the same etag. `fulfilled` with `undefined` is a PROVEN ABSENCE, as there; a tracker whose\n\t * cheap read can't prove one rejects the slot instead, so the full read decides. `undefined` declines the whole\n\t * check, sending every target to the full read without counting as a failure. A tracker implements this only\n\t * where it is cheaper than the full read. No tracker's row carries a real reaction count, so `'reactions'` in\n\t * `options.etagIncludes` reads nothing here.\n\t */\n\tprotected getProviderIssuesEtagFieldsByResourceId?(\n\t\tsession: ProviderAuthenticationSession,\n\t\ttargets: readonly { resourceId: string; identifier: string; resourceUrl?: string }[],\n\t\toptions: { etagIncludes?: readonly IssueEtagInclude[] },\n\t): Promise<PromiseSettledResult<IssueEtagFields | undefined>[] | undefined>;\n\n\t@trace()\n\tasync getAccountForResource(resource: T, connectionId?: string): Promise<Account | undefined> {\n\t\treturn (await this.getAccountForResourceResult(resource, connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getAccountForResource}. Recovers a thrown error into `{ error }` so\n\t * callers can preserve its classification (e.g. a 401/403 → an `auth` warning that drives re-auth)\n\t * instead of collapsing every failure into an untyped `undefined`. Gated here (not on the wrapper) so\n\t * direct callers such as the ProviderBackend facade share the same dedup as `getAccountForResource`.\n\t */\n\t@gate()\n\tasync getAccountForResourceResult(\n\t\tresource: T,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<Account | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst account = await this.getProviderAccountForResource(session, resource);\n\t\t\tthis.resetRequestExceptionCount('getAccountForResource');\n\t\t\treturn { value: account };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getAccountForResource', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderAccountForResource(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresource: T,\n\t): Promise<Account | undefined>;\n\n\t@trace()\n\tasync getResourcesForUser(connectionId?: string): Promise<T[] | undefined> {\n\t\treturn (await this.getResourcesForUserResult(connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getResourcesForUser}. Recovers thrown errors into `{ error }` so callers\n\t * can surface them as warnings rather than silently swallowing them to `undefined`. Gated here (not on the\n\t * wrapper) so direct callers such as the ProviderBackend facade share the same dedup as `getResourcesForUser`.\n\t */\n\t@gate()\n\tasync getResourcesForUserResult(connectionId?: string): Promise<IntegrationResult<T[] | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst resources = await this.getProviderResourcesForUser(session);\n\t\t\tthis.resetRequestExceptionCount('getResourcesForUser');\n\t\t\treturn { value: resources };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getResourcesForUser', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderResourcesForUser(session: ProviderAuthenticationSession): Promise<T[] | undefined>;\n\n\t/**\n\t * Project discovery for a set of resources, returning the SDK collection `{ values, metadata }` (completeness\n\t * + per-resource failures) so callers can warn on failed resources and set `fetchFailed` without discarding\n\t * the resources that succeeded. Thrown errors are recovered into `{ error }` for the same reason: a caller\n\t * surfaces them as a warning rather than swallowing them to `undefined`.\n\t */\n\t@trace()\n\tasync getProjectsForResourcesWithMetadataResult(\n\t\tresources: T[],\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<ProviderApiCollectionResult<T> | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst projects = await this.getProviderProjectsForResourcesWithMetadata(session, resources);\n\t\t\tawait this.confirmScopedAuthFailures(session, projects.metadata);\n\t\t\tthis.resetRequestExceptionCount('getProjectsForResources');\n\t\t\treturn { value: projects };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getProjectsForResources', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\t/**\n\t * Metadata-aware provider project discovery. The default wraps the array-returning\n\t * {@link getProviderProjectsForResources} in `{ values }` with no metadata, so providers without a\n\t * fan-out completeness signal (Linear, Trello) need no change; Jira overrides it to preserve the SDK's\n\t * per-resource completeness/failures.\n\t */\n\tprotected async getProviderProjectsForResourcesWithMetadata(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresources: T[],\n\t): Promise<ProviderApiCollectionResult<T>> {\n\t\tconst projects = await this.getProviderProjectsForResources(session, resources);\n\t\treturn { values: projects ?? [] };\n\t}\n\n\tprotected abstract getProviderProjectsForResources(\n\t\tsession: ProviderAuthenticationSession,\n\t\tresources: T[],\n\t): Promise<T[] | undefined>;\n\n\t@trace()\n\tasync getIssuesForProject(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IssueShape[] | undefined> {\n\t\treturn (await this.getIssuesForProjectResult(project, options, connectionId))?.value;\n\t}\n\n\t/**\n\t * Result-returning core of {@link getIssuesForProject}. Recovers thrown errors into `{ error }` so callers\n\t * (e.g. the ProviderBackend facade) can surface a per-provider warning instead of a silent empty read —\n\t * important for providers that throw on unsupported operations (e.g. Linear's not-implemented issue read).\n\t */\n\tasync getIssuesForProjectResult(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<IssueShape[] | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\t// `connectionId` targets a specific account (multi-account); omitted reads the primary.\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst issues = await this.getProviderIssuesForProject(session, project, options);\n\t\t\tthis.resetRequestExceptionCount('getIssuesForProject');\n\t\t\treturn { value: issues };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\t/**\n\t * Truncation-aware variant of {@link getIssuesForProjectResult}. A provider that drains a project's issues\n\t * with an internal page backstop (Jira/Linear) overrides {@link getProviderIssuesForProjectWithTruncation}\n\t * to report when that backstop was hit, so the facade can surface an incomplete project read instead of\n\t * publishing it as complete. The default reports `truncated: false`.\n\t */\n\tasync getIssuesForProjectWithTruncationResult(\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t\tconnectionId?: string,\n\t): Promise<IntegrationResult<ProjectIssuesDrain | undefined>> {\n\t\tconst scope = getScopedLogger();\n\t\tconst session = await this.resolveReadSession(connectionId, scope);\n\t\tif (session == null) return undefined;\n\n\t\ttry {\n\t\t\tconst result = await this.getProviderIssuesForProjectWithTruncation(session, project, options);\n\t\t\tawait this.confirmScopedAuthFailures(session, result?.metadata);\n\t\t\tthis.resetRequestExceptionCount('getIssuesForProject');\n\t\t\treturn { value: result };\n\t\t} catch (ex) {\n\t\t\tthis.handleProviderException('getIssuesForProject', ex, { connectionId: connectionId });\n\t\t\treturn { error: toError(ex) };\n\t\t}\n\t}\n\n\tprotected abstract getProviderIssuesForProject(\n\t\tsession: ProviderAuthenticationSession,\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t): Promise<IssueShape[] | undefined>;\n\n\t/**\n\t * Truncation-aware core of {@link getProviderIssuesForProject}. The default wraps the plain read and\n\t * reports `truncated: false`; a provider whose per-project drain is capped by a page backstop overrides\n\t * this to report incompleteness. Optional metadata lets providers surface structured per-project failures\n\t * (e.g. a page-level auth rejection) without discarding the already-fetched prefix.\n\t */\n\tprotected async getProviderIssuesForProjectWithTruncation(\n\t\tsession: ProviderAuthenticationSession,\n\t\tproject: T,\n\t\toptions?: IssuesForProjectOptions,\n\t): Promise<ProjectIssuesDrain | undefined> {\n\t\tconst values = await this.getProviderIssuesForProject(session, project, options);\n\t\tif (values == null) return undefined;\n\t\treturn { values: values, truncated: false };\n\t}\n}\n"],"mappings":";;;;;;;;;AAuBA,SAAgB,oBAAoB,aAA4D;CAC/F,OAAO,YAAY,SAAS;AAC7B;AAEA,IAAsB,oBAAtB,cAGU,gBAAoB;CAC7B,OAAiC;CAEjC,IAAI,kCAA2C;EAC9C,OAAO,KAAK,gCAAgC;CAC7C;;;;;;CAOA,IAAI,iCAA0C;EAC7C,OAAO,KAAK,2CAA2C;CACxD;;;;;;;;;;;;;;;;;CAkBA,MAAM,iCACL,SACA,cAC8E;EAC9E,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,MAAM,mBAAmB,KAAK;EAC9B,IAAI,oBAAoB,MAAM,OAAO,EAAE,OAAO,KAAA,EAAU;EAExD,MAAM,QAAQ,YAAY,IAAI;EAC9B,IAAI;GACH,MAAM,QAAQ,MAAM,kBAAkB,SAAA,IAAoC,MACzE,iBAAiB,KAAK,MAAM,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAC/E;GAEA,MAAM,UAAU,MAAM,KAAK,oBAAoB,SAAS,SAAS,KAAK;GAEtE,KAAK,2BAA2B,UAAU;GAC1C,OAAO;IAAE,OAAO;IAAS,UAAU,YAAY,IAAI,IAAI;GAAM;EAC9D,SAAS,IAAI;GACZ,KAAK,wBAAwB,YAAY,IAAI;IAAS;IAAqB;GAAa,CAAC;GACzF,OAAO;IAAE,OAAO,QAAQ,EAAE;IAAG,UAAU,YAAY,IAAI,IAAI;GAAM;EAClE;CACD;;;;;;;;;;CAkBA,MAAM,2CACL,SACA,SACA,cACmF;EACnF,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,MAAM,wBAAwB,KAAK;EACnC,IAAI,yBAAyB,MAAM,OAAO,EAAE,OAAO,KAAA,EAAU;EAE7D,MAAM,QAAQ,YAAY,IAAI;EAC9B,IAAI;GACH,MAAM,QAAQ,MAAM,sBAAsB,KAAK,MAAM,SAAS,SAAS,OAAO;GAC9E,IAAI,SAAS,MAAM,OAAO;IAAE,OAAO,KAAA;IAAW,UAAU,YAAY,IAAI,IAAI;GAAM;GAElF,MAAM,UAAU,MAAM,KAAK,oBAAoB,SAAS,SAAS,OAAO,EAAE,mBAAmB,KAAK,CAAC;GAEnG,IAAI,MAAM,MAAK,SAAQ,KAAK,WAAW,WAAW,GACjD,KAAK,2BAA2B,qBAAqB;GAEtD,OAAO;IAAE,OAAO;IAAS,UAAU,YAAY,IAAI,IAAI;GAAM;EAC9D,SAAS,IAAI;GACZ,KAAK,yBAAyB,uBAAuB,IAAI;IAAS;IAAqB;GAAa,CAAC;GACrG,OAAO;IAAE,OAAO,QAAQ,EAAE;IAAG,UAAU,YAAY,IAAI,IAAI;GAAM;EAClE;CACD;CAiBA,MACM,sBAAsB,UAAa,cAAqD;EAC7F,QAAQ,MAAM,KAAK,4BAA4B,UAAU,YAAY,EAAA,EAAI;CAC1E;;;;;;;CAQA,MACM,4BACL,UACA,cACkD;EAClD,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,UAAU,MAAM,KAAK,8BAA8B,SAAS,QAAQ;GAC1E,KAAK,2BAA2B,uBAAuB;GACvD,OAAO,EAAE,OAAO,QAAQ;EACzB,SAAS,IAAI;GACZ,KAAK,wBAAwB,yBAAyB,IAAI,EAAgB,aAAa,CAAC;GACxF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;CAOA,MACM,oBAAoB,cAAiD;EAC1E,QAAQ,MAAM,KAAK,0BAA0B,YAAY,EAAA,EAAI;CAC9D;;;;;;CAOA,MACM,0BAA0B,cAAoE;EACnG,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,YAAY,MAAM,KAAK,4BAA4B,OAAO;GAChE,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,UAAU;EAC3B,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAUA,MACM,0CACL,WACA,cACyE;EACzE,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,4CAA4C,SAAS,SAAS;GAC1F,MAAM,KAAK,0BAA0B,SAAS,SAAS,QAAQ;GAC/D,KAAK,2BAA2B,yBAAyB;GACzD,OAAO,EAAE,OAAO,SAAS;EAC1B,SAAS,IAAI;GACZ,KAAK,wBAAwB,2BAA2B,IAAI,EAAgB,aAAa,CAAC;GAC1F,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAQA,MAAgB,4CACf,SACA,WAC0C;EAE1C,OAAO,EAAE,QAAQ,MADM,KAAK,gCAAgC,SAAS,SAAS,KACjD,CAAC,EAAE;CACjC;CAOA,MACM,oBACL,SACA,SACA,cACoC;EACpC,QAAQ,MAAM,KAAK,0BAA0B,SAAS,SAAS,YAAY,EAAA,EAAI;CAChF;;;;;;CAOA,MAAM,0BACL,SACA,SACA,cACuD;EACvD,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,SAAS,MAAM,KAAK,4BAA4B,SAAS,SAAS,OAAO;GAC/E,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,OAAO;EACxB,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAQA,MAAM,wCACL,SACA,SACA,cAC6D;EAC7D,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,UAAU,MAAM,KAAK,mBAAmB,cAAc,KAAK;EACjE,IAAI,WAAW,MAAM,OAAO,KAAA;EAE5B,IAAI;GACH,MAAM,SAAS,MAAM,KAAK,0CAA0C,SAAS,SAAS,OAAO;GAC7F,MAAM,KAAK,0BAA0B,SAAS,QAAQ,QAAQ;GAC9D,KAAK,2BAA2B,qBAAqB;GACrD,OAAO,EAAE,OAAO,OAAO;EACxB,SAAS,IAAI;GACZ,KAAK,wBAAwB,uBAAuB,IAAI,EAAgB,aAAa,CAAC;GACtF,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;EAC7B;CACD;;;;;;;CAcA,MAAgB,0CACf,SACA,SACA,SAC0C;EAC1C,MAAM,SAAS,MAAM,KAAK,4BAA4B,SAAS,SAAS,OAAO;EAC/E,IAAI,UAAU,MAAM,OAAO,KAAA;EAC3B,OAAO;GAAU;GAAQ,WAAW;EAAM;CAC3C;AACD;AAhME,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,yBAAA,IAAA;AAWN,WAAA,CAAA,KAAK,CAAA,GAAA,kBAAA,WAAA,+BAAA,IAAA;AAyBL,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,uBAAA,IAAA;AAUN,WAAA,CAAA,KAAK,CAAA,GAAA,kBAAA,WAAA,6BAAA,IAAA;AAyBL,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,6CAAA,IAAA;AAwCN,WAAA,CAAA,MAAM,CAAA,GAAA,kBAAA,WAAA,uBAAA,IAAA"}

package/dist/plus/integrations/providers/azure/azure.js

@@ -207,7 +207,7 @@ var AzureDevOpsApi = class {
 				const issueType = issueResult.fields["System.WorkItemType"];
 				const state = issueResult.fields["System.State"];
 				const stateCategory = await this.getWorkItemStateCategory(issueType, state, provider, token, project.resourceName, project.name, options);
-				return fromAzureWorkItem(issueResult, provider, project, stateCategory);
+				return fromAzureWorkItem(issueResult, provider, project, stateCategory, "point");
 			}
 		} catch (ex) {
 			if (ex instanceof AuthenticationError) throw ex;
@@ -399,7 +399,7 @@ var AzureDevOpsApi = class {
 				const project = options.resolveProject(projectName);
 				if (project == null) throw new Error(`Azure DevOps work item ${id} is in project '${projectName}', which isn't visible`);
 				const stateCategory = await this.getWorkItemStateCategory(workItem.fields["System.WorkItemType"], workItem.fields["System.State"], provider, token, collection, project.name, options);
-				values.push(fromAzureWorkItem(workItem, provider, project, stateCategory));
+				values.push(fromAzureWorkItem(workItem, provider, project, stateCategory, "search"));
 			}
 		}
 		const nextOffset = offset + slice.length;
@@ -457,7 +457,7 @@ var AzureDevOpsApi = class {
 	}
 	async toPullRequest(pr, provider, token, owner, baseUrl, scope, cancellation) {
 		const forkRepositoryUrls = await this.getForkRepositoryUrls(provider, token, owner, baseUrl, pr.forkSource?.repository, scope, cancellation);
-		return fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls);
+		return fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls, "point");
 	}
 	/**
 	* Resolves the web and HTTPS clone URLs of the fork a cross-repository pull request comes from. Every other

package/dist/plus/integrations/providers/azure/azure.js.map

@@ -1 +1 @@
-{"version":3,"file":"azure.js","names":["Logger"],"sources":["../../../../../../plus/integrations/src/providers/azure/azure.ts"],"sourcesContent":["import * as l10n from '@vscode/l10n';\nimport type { UnidentifiedAuthor } from '@gitlens/git/models/author.js';\nimport type { DefaultBranch } from '@gitlens/git/models/defaultBranch.js';\nimport type { Issue, IssueSearchCriteria } from '@gitlens/git/models/issue.js';\nimport type { IssueOrPullRequest, IssueOrPullRequestType } from '@gitlens/git/models/issueOrPullRequest.js';\nimport type { PullRequest } from '@gitlens/git/models/pullRequest.js';\nimport type { Provider } from '@gitlens/git/models/remoteProvider.js';\nimport type { RepositoryMetadata } from '@gitlens/git/models/repositoryMetadata.js';\nimport { effectiveIssueSort } from '@gitlens/git/utils/issue.utils.js';\nimport { base64 } from '@gitlens/utils/base64.js';\nimport { CancellationError, isCancellationError } from '@gitlens/utils/cancellation.js';\nimport { sha256, uuid } from '@gitlens/utils/crypto.js';\nimport { trace } from '@gitlens/utils/decorators/log.js';\nimport type { Disposable } from '@gitlens/utils/disposable.js';\nimport { Logger } from '@gitlens/utils/logger.js';\nimport type { ScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport { getScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport type { CacheController } from '@gitlens/utils/promiseCache.js';\nimport { PromiseCache } from '@gitlens/utils/promiseCache.js';\nimport { maybeStopWatch } from '@gitlens/utils/stopwatch.js';\nimport type { TokenWithInfo } from '../../authentication/models.js';\nimport type { IntegrationServiceContext } from '../../context.js';\nimport {\n\tAuthenticationError,\n\tAuthenticationErrorReason,\n\tisRateLimitResponse,\n\tProviderFetchError,\n\tRequestClientError,\n\tRequestNotFoundError,\n\ttoRateLimitError,\n} from '../../errors.js';\nimport type { ProviderIssueSearchPage } from '../../models/issueReads.js';\nimport { decodePathSegment } from '../../utils/domain.utils.js';\nimport type { ProviderApiConfig } from '../apiConfig.js';\nimport { baseProviderApiConfig } from '../apiConfig.js';\nimport type {\n\tAzureForkRepositoryUrls,\n\tAzureGitCommit,\n\tAzureProjectDescriptor,\n\tAzurePullRequest,\n\tAzurePullRequestWithLinks,\n\tAzureRepositoryReference,\n\tAzureRepositoryUrls,\n\tAzureRepositoryWithMetadata,\n\tAzureWorkItemState,\n\tAzureWorkItemStateCategory,\n\tWorkItem,\n} from './models.js';\nimport {\n\tazurePullRequestStatusToState,\n\tazureWorkItemsStateCategoryToState,\n\tencodeAzurePathSegment,\n\tfromAzurePullRequest,\n\tfromAzureWorkItem,\n\tgetAzurePullRequestWebUrl,\n\tisClosedAzurePullRequestStatus,\n\tisClosedAzureWorkItemStateCategory,\n\tnormalizeAzureBranchName,\n\tsanitizeAzureRepositoryUrl,\n} from './models.js';\nimport type { AzureWorkItemSearchCursor } from './search.js';\nimport {\n\tazureWorkItemBatchLimit,\n\tazureWorkItemSearchResultLimit,\n\tparseAzureWorkItemSearchCursor,\n\ttoAzureSearchPageSize,\n\ttoAzureWorkItemSearchCursorKey,\n\ttoAzureWorkItemSearchWiql,\n} from './search.js';\n\nconst forkRepositoryUrlCacheTtl = 5 * 60 * 1000;\n/** How long a work-item search's id snapshot outlives the last page read from it, and the most it lives at all. */\nconst workItemSearchSnapshotTtl = 5 * 60 * 1000;\nconst workItemSearchSnapshotMaxTtl = 30 * 60 * 1000;\n\n/** Whether Azure refused a WIQL query for matching more work items than it will return (`VS402337`). */\nfunction isWorkItemLimitRefusal(ex: unknown): boolean {\n\treturn ex instanceof RequestClientError && ex.message.includes('VS402337');\n}\n\nfunction parseAzureRepositoryDescriptor(repo: string): { projectName: string; repoName: string } {\n\tconst parts = repo.split('/');\n\tconst [projectName, segment, repoName] = parts;\n\tif (parts.length !== 3 || segment !== '_git' || !projectName || !repoName) {\n\t\tthrow new Error(`Invalid Azure repository descriptor '${repo}'; expected '{project}/_git/{repoName}'.`);\n\t}\n\n\treturn { projectName: projectName, repoName: repoName };\n}\n\nclass WorkItemStates {\n\tprivate readonly _categories = new Map<string, AzureWorkItemStateCategory>();\n\tprivate readonly _types = new Map<string, AzureWorkItemState[]>();\n\n\t// TODO@sergeibbb: we might need some logic for invalidating\n\tpublic getStateCategory(\n\t\tproject: string,\n\t\tworkItemType: string,\n\t\tstateName: string,\n\t): AzureWorkItemStateCategory | undefined {\n\t\treturn this._categories.get(this.getStateKey(project, workItemType, stateName));\n\t}\n\n\tpublic clear(): void {\n\t\tthis._categories.clear();\n\t\tthis._types.clear();\n\t}\n\n\tpublic saveTypeStates(project: string, workItemType: string, states: AzureWorkItemState[]): void {\n\t\tthis.clearTypeStates(project, workItemType);\n\t\tthis._types.set(this.getTypeKey(project, workItemType), states);\n\t\tfor (const state of states) {\n\t\t\tthis._categories.set(this.getStateKey(project, workItemType, state.name), state.category);\n\t\t}\n\t}\n\n\tpublic hasTypeStates(project: string, workItemType: string): boolean {\n\t\treturn this._types.has(this.getTypeKey(project, workItemType));\n\t}\n\n\tprivate clearTypeStates(project: string, workItemType: string): void {\n\t\tconst states = this._types.get(this.getTypeKey(project, workItemType));\n\t\tif (states == null) return;\n\n\t\tfor (const state of states) {\n\t\t\tthis._categories.delete(this.getStateKey(project, workItemType, state.name));\n\t\t}\n\t}\n\n\tprivate getStateKey(project: string, workItemType: string, stateName: string): string {\n\t\t// By stringifying the pair as JSON we make sure that all possible special characters are escaped\n\t\treturn JSON.stringify([project, workItemType, stateName]);\n\t}\n\n\tprivate getTypeKey(project: string, workItemType: string): string {\n\t\treturn JSON.stringify([project, workItemType]);\n\t}\n}\n\nexport class AzureDevOpsApi implements Disposable {\n\tprivate readonly _disposable: Disposable | undefined;\n\tprivate _workItemStates: WorkItemStates = new WorkItemStates();\n\tprivate readonly _forkRepositoryUrls = new PromiseCache<string, AzureForkRepositoryUrls | undefined>({\n\t\tcapacity: 100,\n\t\tcreateTTL: forkRepositoryUrlCacheTtl,\n\t});\n\t/**\n\t * The ordered ids each filtered work-item search's first page queried, paged through by its continuations. Kept\n\t * alive while a pagination keeps reading them (see `workItemSearchSnapshotTtl`). Every first page adds one, so\n\t * the capacity leaves room for repeated first pages before an idle pagination's snapshot is the one evicted.\n\t */\n\tprivate readonly _workItemSearches = new PromiseCache<string, number[]>({\n\t\tcapacity: 50,\n\t\taccessTTL: workItemSearchSnapshotTtl,\n\t\tcreateTTL: workItemSearchSnapshotMaxTtl,\n\t});\n\n\tconstructor(private readonly config: ProviderApiConfig) {\n\t\tthis._disposable = config.onConfigChanged?.(() => this.resetCaches());\n\t}\n\n\tdispose(): void {\n\t\tthis._disposable?.dispose();\n\t}\n\n\tprivate resetCaches(): void {\n\t\tthis._workItemStates.clear();\n\t\tthis._forkRepositoryUrls.clear();\n\t\tthis._workItemSearches.clear();\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, branch) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tbranch: branch,\n\t\t}),\n\t})\n\tpublic async getPullRequestForBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbranch: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ value: AzurePullRequest[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullRequests?searchCriteria.status=all&searchCriteria.sourceRefName=${encodeURIComponent(`refs/heads/${branch}`)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\t// Sort PRs: open PRs first, then by most recent activity (creation or closure date)\n\t\t\tconst sortedPRs = prResult?.value.sort((a, b) => {\n\t\t\t\t// First, prioritize open PRs (active/notSet) over closed ones (abandoned/completed)\n\t\t\t\tconst aIsOpen = a.status === 'active' || a.status === 'notSet';\n\t\t\t\tconst bIsOpen = b.status === 'active' || b.status === 'notSet';\n\n\t\t\t\tif (aIsOpen !== bIsOpen) {\n\t\t\t\t\treturn aIsOpen ? -1 : 1; // Open PRs come first\n\t\t\t\t}\n\n\t\t\t\t// Among PRs with the same status, sort by most recent activity\n\t\t\t\t// Use closedDate if available, otherwise use creationDate\n\t\t\t\tconst aDate = new Date(a.closedDate || a.creationDate);\n\t\t\t\tconst bDate = new Date(b.closedDate || b.creationDate);\n\n\t\t\t\treturn bDate.getTime() - aDate.getTime(); // Most recent first\n\t\t\t});\n\n\t\t\tconst pr = sortedPRs?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getPullRequestForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ results: Record<string, AzurePullRequest[]>[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullrequestquery?api-version=4.1`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\tqueries: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\titems: [rev],\n\t\t\t\t\t\t\t\ttype: 'commit',\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\n\t\t\tconst pr = prResult?.results[0]?.[rev]?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\tconst pullRequest = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(pr.repository.project.id)}/_apis/git/repositories/${encodeAzurePathSegment(pr.repository.id)}/pullRequests/${encodeAzurePathSegment(pr.pullRequestId.toString())}`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (pullRequest == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pullRequest, provider, token, owner, baseUrl, scope, cancellation);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, projectOrName, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\tprojectOrName: projectOrName,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getPullRequest(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectOrName: string,\n\t\tid: string,\n\t\toptions: { baseUrl: string },\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\t// A pull request id is unique within the organization, so no repository is required here — only the\n\t\t// project. `projectOrName` is either a bare project name or a `{project}/_git/{repo}` descriptor; either\n\t\t// way the project is its first segment.\n\t\tconst projectName = projectOrName.split('/')[0];\n\n\t\ttry {\n\t\t\tconst pr = await this.request<AzurePullRequest>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/pullrequests/${encodeAzurePathSegment(id)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\treturn pr != null\n\t\t\t\t? await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope)\n\t\t\t\t: undefined;\n\t\t} catch (ex) {\n\t\t\t// Only a 404 is a proven absence; `Integration.getPullRequest` handles every other failure, so it is not\n\t\t\t// cached as a miss\n\t\t\tif (ex.original?.status === 404) return undefined;\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssueOrPullRequest(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t\ttype?: IssueOrPullRequestType;\n\t\t},\n\t): Promise<IssueOrPullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\tif (options?.type === undefined || options?.type === 'issue') {\n\t\t\ttry {\n\t\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/wit/workItems/${encodeAzurePathSegment(id)}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (issueResult != null) {\n\t\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\t\tissueType,\n\t\t\t\t\t\tstate,\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken,\n\t\t\t\t\t\towner,\n\t\t\t\t\t\tprojectName,\n\t\t\t\t\t\toptions,\n\t\t\t\t\t);\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: issueResult.id.toString(),\n\t\t\t\t\t\ttype: 'issue',\n\t\t\t\t\t\tnodeId: issueResult.id.toString(),\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(issueResult.fields['System.CreatedDate']),\n\t\t\t\t\t\tupdatedDate: new Date(issueResult.fields['System.ChangedDate']),\n\t\t\t\t\t\tstate: azureWorkItemsStateCategoryToState(stateCategory),\n\t\t\t\t\t\tclosed: isClosedAzureWorkItemStateCategory(stateCategory),\n\t\t\t\t\t\ttitle: issueResult.fields['System.Title'],\n\t\t\t\t\t\turl: issueResult._links.html.href,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (options?.type === undefined || options?.type === 'pullrequest') {\n\t\t\ttry {\n\t\t\t\tconst prResult = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullRequests/${encodeAzurePathSegment(id)}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (prResult != null) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: prResult.pullRequestId.toString(),\n\t\t\t\t\t\ttype: 'pullrequest',\n\t\t\t\t\t\tnodeId: prResult.pullRequestId.toString(), // prResult.artifactId maybe?\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tupdatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tstate: azurePullRequestStatusToState(prResult.status),\n\t\t\t\t\t\tclosed: isClosedAzurePullRequestStatus(prResult.status),\n\t\t\t\t\t\ttitle: prResult.title,\n\t\t\t\t\t\turl: getAzurePullRequestWebUrl(prResult, options.baseUrl, owner),\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\treturn undefined;\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, project, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tproject: project,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssue(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tproject: AzureProjectDescriptor,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<Issue | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(project.resourceName)}/${encodeAzurePathSegment(project.name)}/_apis/wit/workItems/${encodeAzurePathSegment(id)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tif (issueResult != null) {\n\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\tissueType,\n\t\t\t\t\tstate,\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\tproject.resourceName,\n\t\t\t\t\tproject.name,\n\t\t\t\t\toptions,\n\t\t\t\t);\n\t\t\t\treturn fromAzureWorkItem(issueResult, provider, project, stateCategory);\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getAccountForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t): Promise<UnidentifiedAuthor | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst commit = await this.request<AzureGitCommit>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/commits/${encodeAzurePathSegment(rev)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\t\t\tconst author = commit?.author;\n\t\t\tif (!author) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\t// Azure API never gives us an id/username we can use, therefore we always return UnidentifiedAuthor\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tid: undefined,\n\t\t\t\tusername: undefined,\n\t\t\t\tname: author?.name,\n\t\t\t\temail: author?.email,\n\t\t\t\tavatarUrl: undefined,\n\t\t\t} satisfies UnidentifiedAuthor;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t/**\n\t * The collection an Azure DevOps Server address names, or `undefined` when it names the installation.\n\t *\n\t * Below a collection, `connectionData` describes that collection: its `instanceId` is the collection's id, and its\n\t * `webApplicationRelativeDirectory` ends in the collection's path segment (`DefaultCollection/`); it is empty or\n\t * absent at the server level. As measured against Azure DevOps Server 2020. The directory may also carry the\n\t * installation's own virtual directory before the collection (`tfs/DefaultCollection/`), so only its LAST segment\n\t * names the collection, and only when it is the last segment of the address asked about.\n\t */\n\t@trace({\n\t\targs: (provider, token, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getAddressedCollection(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string,\n\t): Promise<{ id: string; name: string } | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst connectionData = await this.request<{ instanceId?: string; webApplicationRelativeDirectory?: string }>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t'_apis/connectionData',\n\t\t\t{ method: 'GET' },\n\t\t\tscope,\n\t\t);\n\t\tconst segment = connectionData?.webApplicationRelativeDirectory?.split('/').findLast(Boolean);\n\t\tconst addressed = new URL(baseUrl).pathname.split('/').findLast(Boolean);\n\t\tif (segment == null || addressed == null || connectionData?.instanceId == null) return undefined;\n\n\t\tconst name = decodePathSegment(segment);\n\t\tif (name.toLowerCase() !== decodePathSegment(addressed).toLowerCase()) return undefined;\n\n\t\treturn { id: connectionData.instanceId, name: name };\n\t}\n\n\t@trace({\n\t\targs: (provider, token, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getCurrentUserOnServer(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string,\n\t): Promise<{ id: string; name?: string; email?: string; username?: string; avatarUrl?: string } | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst connectionData = await this.request<{\n\t\t\t\tauthenticatedUser?: {\n\t\t\t\t\tid: string;\n\t\t\t\t\tdescriptor: string;\n\t\t\t\t\tisActive: boolean;\n\t\t\t\t\tmetTypeId: number;\n\t\t\t\t\tproviderDisplayName?: string;\n\t\t\t\t\temailAddress?: string;\n\t\t\t\t\tresourceVersion: 2;\n\t\t\t\t\tsubjectDescriptor: string;\n\t\t\t\t\tproperties?: {\n\t\t\t\t\t\tAccount?: {\n\t\t\t\t\t\t\t$type: string;\n\t\t\t\t\t\t\t$value: string;\n\t\t\t\t\t\t};\n\t\t\t\t\t};\n\t\t\t\t};\n\t\t\t}>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t'_apis/connectionData',\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tconst user = connectionData?.authenticatedUser;\n\t\t\tconst username = user?.properties?.Account?.$value;\n\t\t\tif (!username) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\tid: user.id,\n\t\t\t\tname: user.providerDisplayName,\n\t\t\t\temail: user.emailAddress,\n\t\t\t\tusername: username,\n\t\t\t};\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is the whole point of this read failing; reporting \"no user\" instead hides it.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex, `Failed to get current user from ${baseUrl}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tasync getWorkItemStateCategory(\n\t\tissueType: string,\n\t\tstate: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemStateCategory | undefined> {\n\t\t// By installation too: this API is shared by every connection, and two installations can each have a\n\t\t// collection and project of the same name whose process maps a state to a different category.\n\t\tconst project = JSON.stringify([options.baseUrl, owner, projectName]);\n\t\tconst category = this._workItemStates.getStateCategory(project, issueType, state);\n\t\tif (category != null) return category;\n\n\t\tconst states = await this.retrieveWorkItemTypeStates(issueType, provider, token, owner, projectName, options);\n\t\tthis._workItemStates.saveTypeStates(project, issueType, states);\n\n\t\treturn this._workItemStates.getStateCategory(project, issueType, state);\n\t}\n\n\tprivate async retrieveWorkItemTypeStates(\n\t\tworkItemType: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemState[]> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst issueResult = await this.request<{ value: AzureWorkItemState[]; count: number }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/wit/workItemTypes/${encodeAzurePathSegment(workItemType)}/states`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\treturn issueResult?.value ?? [];\n\t\t} catch (ex) {\n\t\t\t// A rejected credential must not be degraded to an empty state list: the caller caches whatever this\n\t\t\t// returns, so an empty list would pin every work item of this type to an unknown state until the\n\t\t\t// cache is dropped — long after the session recovery this error is supposed to trigger.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn [];\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getRepositoryMetadata(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<RepositoryMetadata | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response == null) return undefined;\n\n\t\t\t// Azure's `parentRepository` only reliably carries the repo name and its project; a fork's parent\n\t\t\t// lives in the same organization, so the org (`owner`) is the parent owner. Only report `parent`\n\t\t\t// when the parent's name is actually present — never fall back to the fork's own name.\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\towner: owner,\n\t\t\t\t// Prefer the API's canonical name over parsing the composite `repo` descriptor string.\n\t\t\t\tname: response.name,\n\t\t\t\tisFork: response.isFork ?? false,\n\t\t\t\tparent:\n\t\t\t\t\tresponse.isFork && response.parentRepository?.name != null\n\t\t\t\t\t\t? { owner: owner, name: response.parentRepository.name }\n\t\t\t\t\t\t: undefined,\n\t\t\t} satisfies RepositoryMetadata;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getDefaultBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<DefaultBranch | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response?.defaultBranch == null) return undefined;\n\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tname: normalizeAzureBranchName(response.defaultBranch),\n\t\t\t} satisfies DefaultBranch;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t/**\n\t * One page of a filtered work-item search over a collection: a WIQL query for the ordered ids, then one detail\n\t * read for the page's slice of them.\n\t *\n\t * The ids a first page queried are kept as the snapshot its continuations page through, for as long as the\n\t * pagination keeps reading it, so it reads a consistent set rather than re-running a query whose rows move under\n\t * an `updated` order. Each first page queries its own snapshot, so paginations of one query never share one, and\n\t * a continuation whose snapshot is gone is refused (see {@link AzureWorkItemSearchCursor}).\n\t *\n\t * The query asks for one id more than {@link azureWorkItemSearchResultLimit}, bounded by `$top`: the extra id is\n\t * what tells \"exactly the limit\" from \"past it\". Past it, the page is `truncated` with `limitReached` and no total,\n\t * since the true count is unknowable here. A server that refuses the match set even so fails the page with a\n\t * \"narrow the search\" error: no bounded query could serve that order's first window.\n\t *\n\t * `resolveProject` maps each result's project name to its descriptor. A work item in a project it doesn't know\n\t * fails the page rather than being dropped or mis-attributed, since either would leave the page disagreeing with\n\t * the count of the same query; the caller refreshes its project discovery before a search so that means a\n\t * project created during the pagination.\n\t */\n\t@trace({\n\t\targs: (provider, token, collection) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tcollection: collection,\n\t\t}),\n\t})\n\tasync searchWorkItemsPage(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t\tcriteria?: IssueSearchCriteria;\n\t\t\tprojectNames?: readonly string[];\n\t\t\tresolveProject: (name: string) => AzureProjectDescriptor | undefined;\n\t\t\tcursor?: string;\n\t\t\tpageSize?: number;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<ProviderIssueSearchPage> {\n\t\tconst scope = getScopedLogger();\n\t\tconst wiql = toAzureWorkItemSearchWiql(\n\t\t\toptions.criteria,\n\t\t\teffectiveIssueSort(options.criteria?.sort),\n\t\t\toptions.projectNames,\n\t\t);\n\t\tconst key = toAzureWorkItemSearchCursorKey(collection, wiql);\n\t\tconst pageSize = toAzureSearchPageSize(options.pageSize, 100, azureWorkItemBatchLimit);\n\t\tconst cursor = parseAzureWorkItemSearchCursor(options.cursor, key, pageSize);\n\t\tconst page = cursor?.page ?? 1;\n\n\t\t// Keyed by credential and address, and by the query itself rather than its fingerprint: two accounts on one\n\t\t// installation must never page through each other's matches, and two queries whose fingerprints collide must\n\t\t// never share a snapshot. The full credential digest, since the token's `microHash` is truncated for logs.\n\t\t// And by the snapshot's own id: a first page queries a new snapshot rather than replacing the query's, so a\n\t\t// pagination still reading an earlier one keeps it (see `AzureWorkItemSearchCursor`).\n\t\tconst snapshot = cursor?.snapshot ?? uuid();\n\t\tconst snapshotKey = JSON.stringify([\n\t\t\tawait sha256(token.accessToken),\n\t\t\toptions.baseUrl,\n\t\t\tcollection,\n\t\t\twiql,\n\t\t\tsnapshot,\n\t\t]);\n\t\t// A continuation only ever READS its snapshot: resuming against a fresh query could skip a work item silently.\n\t\tconst snapshotFound = cursor?.snapshot != null ? this._workItemSearches.get(snapshotKey) : undefined;\n\t\tif (cursor?.snapshot != null && snapshotFound == null) {\n\t\t\tthrow new Error('Work item search results expired; restart the read without a cursor');\n\t\t}\n\n\t\tconst result = await (snapshotFound ??\n\t\t\tthis._workItemSearches.getOrCreate(\n\t\t\t\tsnapshotKey,\n\t\t\t\t(_cacheable, signal) =>\n\t\t\t\t\tthis.queryWorkItemIds(\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken,\n\t\t\t\t\t\tcollection,\n\t\t\t\t\t\toptions.baseUrl,\n\t\t\t\t\t\twiql,\n\t\t\t\t\t\tazureWorkItemSearchResultLimit + 1,\n\t\t\t\t\t\tscope,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t).catch((ex: unknown) => {\n\t\t\t\t\t\t// `$top` is expected to bound the answer; should a server refuse the match set regardless, say\n\t\t\t\t\t\t// what happened rather than surfacing a bare client error.\n\t\t\t\t\t\tif (isWorkItemLimitRefusal(ex)) {\n\t\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t\t`${provider.name} refused a work item search matching more than ${azureWorkItemSearchResultLimit} results; narrow the search`,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tthrow ex;\n\t\t\t\t\t}),\n\t\t\t\t{ cancellation: cancellation },\n\t\t\t));\n\t\tconst limitReached = result.length > azureWorkItemSearchResultLimit;\n\t\tconst ids = limitReached ? result.slice(0, azureWorkItemSearchResultLimit) : result;\n\n\t\tconst offset = cursor?.offset ?? 0;\n\n\t\tconst slice = ids.slice(offset, offset + pageSize);\n\t\tconst values: Issue[] = [];\n\t\tif (slice.length > 0) {\n\t\t\tconst workItems = await this.request<{ value: (WorkItem | null)[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(collection)}/_apis/wit/workitemsbatch?api-version=5.0`,\n\t\t\t\t{ method: 'POST', body: JSON.stringify({ ids: slice, $expand: 'Links', errorPolicy: 'Omit' }) },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tconst byId = new Map((workItems?.value ?? []).filter(w => w != null).map(w => [w.id, w]));\n\t\t\tfor (const id of slice) {\n\t\t\t\t// A work item deleted since the ids were queried is gone, not a failure: skipping it keeps the page\n\t\t\t\t// honest, since it no longer matches anything.\n\t\t\t\tconst workItem = byId.get(id);\n\t\t\t\tif (workItem == null) continue;\n\n\t\t\t\tconst projectName = workItem.fields['System.TeamProject'];\n\t\t\t\tconst project = options.resolveProject(projectName);\n\t\t\t\tif (project == null) {\n\t\t\t\t\tthrow new Error(`Azure DevOps work item ${id} is in project '${projectName}', which isn't visible`);\n\t\t\t\t}\n\n\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\tworkItem.fields['System.WorkItemType'],\n\t\t\t\t\tworkItem.fields['System.State'],\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\tcollection,\n\t\t\t\t\tproject.name,\n\t\t\t\t\toptions,\n\t\t\t\t);\n\t\t\t\tvalues.push(fromAzureWorkItem(workItem, provider, project, stateCategory));\n\t\t\t}\n\t\t}\n\n\t\tconst nextOffset = offset + slice.length;\n\t\tconst hasMore = nextOffset < ids.length;\n\t\tconst next: AzureWorkItemSearchCursor = { key: key, snapshot: snapshot, offset: nextOffset, page: page + 1 };\n\t\treturn {\n\t\t\tvalues: values,\n\t\t\tcursor: hasMore ? JSON.stringify(next) : undefined,\n\t\t\thasMore: hasMore,\n\t\t\tpage: page,\n\t\t\ttruncated: limitReached,\n\t\t\ttotalCount: limitReached ? undefined : ids.length,\n\t\t\tlimitReached: limitReached || undefined,\n\t\t};\n\t}\n\n\t/**\n\t * How many work items the same WIQL {@link searchWorkItemsPage} would page through match, reading no details.\n\t *\n\t * Asks for one id more than the result ceiling, so the count is exact up to it and `'exceeds-limit'` past it —\n\t * never the ceiling itself, which would understate the match set.\n\t */\n\t@trace({\n\t\targs: (provider, token, collection) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tcollection: collection,\n\t\t}),\n\t})\n\tasync countWorkItems(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\toptions: { baseUrl: string; criteria?: IssueSearchCriteria; projectNames?: readonly string[] },\n\t\tcancellation?: AbortSignal,\n\t): Promise<number | 'exceeds-limit'> {\n\t\tconst scope = getScopedLogger();\n\t\tconst wiql = toAzureWorkItemSearchWiql(\n\t\t\toptions.criteria,\n\t\t\teffectiveIssueSort(options.criteria?.sort),\n\t\t\toptions.projectNames,\n\t\t);\n\t\ttry {\n\t\t\tconst ids = await this.queryWorkItemIds(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tcollection,\n\t\t\t\toptions.baseUrl,\n\t\t\t\twiql,\n\t\t\t\tazureWorkItemSearchResultLimit + 1,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\treturn ids.length > azureWorkItemSearchResultLimit ? 'exceeds-limit' : ids.length;\n\t\t} catch (ex) {\n\t\t\tif (isWorkItemLimitRefusal(ex)) return 'exceeds-limit';\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\t/**\n\t * The ids a collection-level WIQL query matches, in its order.\n\t *\n\t * `api-version=5.0` is the oldest version every Azure DevOps Server release this search supports (2019 and later)\n\t * answers; `timePrecision=true` is what lets the criteria's dates compare as instants — see `toWiqlDate`.\n\t */\n\tprivate async queryWorkItemIds(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\tbaseUrl: string,\n\t\twiql: string,\n\t\ttop: number,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<number[]> {\n\t\tconst result = await this.request<{ workItems?: { id: number }[] }>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t`${encodeAzurePathSegment(collection)}/_apis/wit/wiql?$top=${top}&timePrecision=true&api-version=5.0`,\n\t\t\t{ method: 'POST', body: JSON.stringify({ query: wiql }) },\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t\tif (result?.workItems == null) throw new Error('Azure DevOps returned no work item query result');\n\n\t\treturn result.workItems.map(w => w.id);\n\t}\n\n\tprivate getRepository(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureRepositoryWithMetadata | undefined> {\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\treturn this.request<AzureRepositoryWithMetadata>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}?api-version=7.1`,\n\t\t\t{ method: 'GET' },\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t}\n\n\tprivate async toPullRequest(\n\t\tpr: AzurePullRequest,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest> {\n\t\tconst forkRepositoryUrls = await this.getForkRepositoryUrls(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\towner,\n\t\t\tbaseUrl,\n\t\t\tpr.forkSource?.repository,\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t\treturn fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls);\n\t}\n\n\t/**\n\t * Resolves the web and HTTPS clone URLs of the fork a cross-repository pull request comes from. Every other\n\t * repository URL the model reports is rebuilt from the pull request payload; only a fork reference lacks the\n\t * project to do that, so only a fork costs a request.\n\t *\n\t * Best-effort by contract: a fork in a project the token cannot read, a deleted fork, or a throttled request\n\t * leaves the head ref without a URL. It must never cost the pull request itself, which is what makes swallowing\n\t * the failure here the right call rather than a shortcut.\n\t */\n\tprivate async getForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepository: AzureRepositoryReference | undefined,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls | undefined> {\n\t\tif (repository == null) return undefined;\n\n\t\tlet tokenHash: string;\n\t\ttry {\n\t\t\ttokenHash = await sha256(token.accessToken);\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst cacheKey = JSON.stringify([tokenHash, baseUrl, owner, repository.id]);\n\t\t// The request is shared, so the factory is handed the cache's aggregate signal rather than this caller's: it\n\t\t// aborts only once every caller waiting on the entry has cancelled.\n\t\treturn this._forkRepositoryUrls.getOrCreate(\n\t\t\tcacheKey,\n\t\t\t(cacheable, aggregate) =>\n\t\t\t\tthis.fetchForkRepositoryUrls(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\towner,\n\t\t\t\t\tbaseUrl,\n\t\t\t\t\trepository.id,\n\t\t\t\t\tcacheable,\n\t\t\t\t\tscope,\n\t\t\t\t\taggregate,\n\t\t\t\t),\n\t\t\t{ cancellation: cancellation },\n\t\t);\n\t}\n\n\tprivate async fetchForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepositoryId: string,\n\t\tcacheable: CacheController,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls | undefined> {\n\t\ttry {\n\t\t\tconst response = await this.request<AzureRepositoryUrls>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/_apis/git/repositories/${encodeAzurePathSegment(repositoryId)}?api-version=4.1`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tconst webUrl = sanitizeAzureRepositoryUrl(response?.webUrl, baseUrl, owner);\n\t\t\tconst cloneHttps = sanitizeAzureRepositoryUrl(response?.remoteUrl, baseUrl, owner);\n\n\t\t\t// The clone URL stands in for the web URL when the response omits it — an older `api-version` promises\n\t\t\t// neither field, and naming the fork by the URL git would use beats naming it not at all.\n\t\t\tconst url = webUrl ?? cloneHttps;\n\t\t\tif (url == null) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn { url: url, cloneHttps: cloneHttps };\n\t\t} catch (ex) {\n\t\t\t// Missing or inaccessible forks are cached briefly; transient failures retry on the next read.\n\t\t\tif (!(ex instanceof RequestNotFoundError) && !(ex instanceof AuthenticationError)) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t}\n\n\t\t\tconst status = ex instanceof ProviderFetchError ? ` (${ex.status})` : '';\n\t\t\tscope?.warn(`Unable to resolve the fork repository URLs${status}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tprivate async request<T>(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string | undefined,\n\t\troute: string,\n\t\toptions: { method: RequestInit['method'] } & Record<string, unknown>,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal | undefined,\n\t): Promise<T | undefined> {\n\t\tconst { accessToken } = token;\n\t\tconst url = baseUrl ? `${baseUrl}/${route}` : route;\n\n\t\tlet rsp: Response;\n\t\ttry {\n\t\t\tconst sw = maybeStopWatch(`[AZURE] ${options?.method ?? 'GET'} request`, { log: { onlyExit: true } });\n\n\t\t\ttry {\n\t\t\t\tif (cancellation?.aborted) throw new CancellationError();\n\n\t\t\t\trsp = await this.config.wrapForForcedInsecureSSL(provider.getIgnoreSSLErrors(), () =>\n\t\t\t\t\tthis.config.fetch(url, {\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\tAuthorization: `Basic ${base64(`PAT:${accessToken}`)}`,\n\t\t\t\t\t\t\t'Content-Type': 'application/json',\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsignal: cancellation,\n\t\t\t\t\t\t...options,\n\t\t\t\t\t}),\n\t\t\t\t);\n\n\t\t\t\tif (rsp.ok) {\n\t\t\t\t\t// Azure answers a rejected credential by redirecting to its sign-in page, which returns `203\n\t\t\t\t\t// text/html` rather than `401`. `rsp.ok` spans 200-299, so that page used to reach `json()` and\n\t\t\t\t\t// die as a bare `SyntaxError` — which `getIssue` and friends catch and report as \"not found\",\n\t\t\t\t\t// making an invalid credential indistinguishable from a missing work item (GKDEV-3617).\n\t\t\t\t\tconst contentType = rsp.headers.get('content-type')?.toLowerCase() ?? '';\n\t\t\t\t\tif (contentType.startsWith('text/html')) {\n\t\t\t\t\t\tconst { accessToken: _accessToken, ...tokenInfo } = token;\n\t\t\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t\t\ttokenInfo,\n\t\t\t\t\t\t\tAuthenticationErrorReason.Unauthorized,\n\t\t\t\t\t\t\tnew Error(`(${rsp.status}) Azure DevOps returned a sign-in page instead of data`),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\treturn (await rsp.json()) as T;\n\t\t\t\t}\n\n\t\t\t\t// Reads the body so the 403 branch below can tell a throttled request from a permission failure.\n\t\t\t\tthrow await ProviderFetchError.fromResponse('AzureDevOps', rsp);\n\t\t\t} finally {\n\t\t\t\tsw?.stop();\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\tif (ex instanceof ProviderFetchError || ex.name === 'AbortError') {\n\t\t\t\tthis.handleRequestError(provider, token, ex, scope);\n\t\t\t} else if (Logger.isDebugging) {\n\t\t\t\tthis.config.onError?.(`AzureDevOps request failed: ${ex.message}`);\n\t\t\t}\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\tprivate handleRequestError(\n\t\tprovider: Provider | undefined,\n\t\ttoken: TokenWithInfo,\n\t\tex: ProviderFetchError | (Error & { name: 'AbortError' }),\n\t\tscope: ScopedLogger | undefined,\n\t): void {\n\t\tif (ex.name === 'AbortError' || !(ex instanceof ProviderFetchError)) throw new CancellationError(ex);\n\n\t\tconst { accessToken, ...tokenInfo } = token;\n\t\tswitch (ex.status) {\n\t\t\tcase 404: // Not found\n\t\t\tcase 410: // Gone\n\t\t\tcase 422: // Unprocessable Entity\n\t\t\t\tthrow new RequestNotFoundError(ex);\n\t\t\tcase 401: // Unauthorized\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Unauthorized, ex);\n\t\t\tcase 429: // Too Many Requests\n\t\t\t\tthrow toRateLimitError(ex, accessToken);\n\t\t\tcase 403: // Forbidden\n\t\t\t\t// Azure returns 403 for both a permission failure and a throttled request (\"Request was blocked\n\t\t\t\t// due to exceeding usage of resource 'RateLimit'\"), so the message is the discriminant. Reporting\n\t\t\t\t// a throttle as `auth` would prompt the user to re-authenticate a healthy connection instead of\n\t\t\t\t// retrying (see `isRateLimitResponse`).\n\t\t\t\tif (isRateLimitResponse(ex)) throw toRateLimitError(ex, accessToken);\n\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Forbidden, ex);\n\t\t\tcase 500: // Internal Server Error\n\t\t\t\tscope?.error(ex);\n\t\t\t\tif (ex.response != null) {\n\t\t\t\t\tprovider?.trackRequestException();\n\t\t\t\t\tthis.config.onRequestFailed?.(\n\t\t\t\t\t\tprovider == null || provider.id === 'azure'\n\t\t\t\t\t\t\t? l10n.t(\n\t\t\t\t\t\t\t\t\t'{0} failed to respond and might be experiencing issues. Please visit the [AzureDevOps status page](https://status.dev.azure.com) for more information.',\n\t\t\t\t\t\t\t\t\tprovider?.name ?? 'AzureDevOps',\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: l10n.t('{0} failed to respond and might be experiencing issues.', provider.name),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\tcase 502: // Bad Gateway\n\t\t\t\tscope?.error(ex);\n\t\t\t\t// TODO: Learn the Azure API docs and put it in order:\n\t\t\t\t// if (ex.message.includes('timeout')) {\n\t\t\t\t// \tprovider?.trackRequestException();\n\t\t\t\t// \tvoid showIntegrationRequestTimedOutWarningMessage(provider?.name ?? 'Azure');\n\t\t\t\t// \treturn;\n\t\t\t\t// }\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tif (ex.status >= 400 && ex.status < 500) throw new RequestClientError(ex);\n\t\t\t\tbreak;\n\t\t}\n\n\t\tscope?.error(ex);\n\t\tif (Logger.isDebugging) {\n\t\t\tthis.config.onError?.(\n\t\t\t\t`AzureDevOps request failed: ${(ex.response as any)?.errors?.[0]?.message ?? ex.message}`,\n\t\t\t);\n\t\t}\n\t}\n}\n\n/** Wires an {@link AzureDevOpsApi} from the full runtime context, mapping `ctx` down to the narrow config. */\nexport function createAzureDevOpsApi(ctx: IntegrationServiceContext): AzureDevOpsApi {\n\treturn new AzureDevOpsApi(baseProviderApiConfig(ctx));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsEA,MAAM,4BAA4B;;AAElC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;;AAGrC,SAAS,uBAAuB,IAAsB;CACrD,OAAO,cAAc,sBAAsB,GAAG,QAAQ,SAAS,UAAU;AAC1E;AAEA,SAAS,+BAA+B,MAAyD;CAChG,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,MAAM,CAAC,aAAa,SAAS,YAAY;CACzC,IAAI,MAAM,WAAW,KAAK,YAAY,UAAU,CAAC,eAAe,CAAC,UAChE,MAAM,IAAI,MAAM,wCAAwC,KAAK,yCAAyC;CAGvG,OAAO;EAAe;EAAuB;CAAS;AACvD;AAEA,IAAM,iBAAN,MAAqB;CACpB,8BAA+B,IAAI,IAAwC;CAC3E,yBAA0B,IAAI,IAAkC;CAGhE,iBACC,SACA,cACA,WACyC;EACzC,OAAO,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,SAAS,CAAC;CAC/E;CAEA,QAAqB;EACpB,KAAK,YAAY,MAAM;EACvB,KAAK,OAAO,MAAM;CACnB;CAEA,eAAsB,SAAiB,cAAsB,QAAoC;EAChG,KAAK,gBAAgB,SAAS,YAAY;EAC1C,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,GAAG,MAAM;EAC9D,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,GAAG,MAAM,QAAQ;CAE1F;CAEA,cAAqB,SAAiB,cAA+B;EACpE,OAAO,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;CAC9D;CAEA,gBAAwB,SAAiB,cAA4B;EACpE,MAAM,SAAS,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;EACrE,IAAI,UAAU,MAAM;EAEpB,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,OAAO,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,CAAC;CAE7E;CAEA,YAAoB,SAAiB,cAAsB,WAA2B;EAErF,OAAO,KAAK,UAAU;GAAC;GAAS;GAAc;EAAS,CAAC;CACzD;CAEA,WAAmB,SAAiB,cAA8B;EACjE,OAAO,KAAK,UAAU,CAAC,SAAS,YAAY,CAAC;CAC9C;AACD;AAEA,IAAa,iBAAb,MAAkD;CAkBpB;CAjB7B;CACA,kBAA0C,IAAI,eAAe;CAC7D,sBAAuC,IAAI,aAA0D;EACpG,UAAU;EACV,WAAW;CACZ,CAAC;;;;;;CAMD,oBAAqC,IAAI,aAA+B;EACvE,UAAU;EACV,WAAW;EACX,WAAW;CACZ,CAAC;CAED,YAAY,QAA4C;EAA3B,KAAA,SAAA;EAC5B,KAAK,cAAc,OAAO,wBAAwB,KAAK,YAAY,CAAC;CACrE;CAEA,UAAgB;EACf,KAAK,aAAa,QAAQ;CAC3B;CAEA,cAA4B;EAC3B,KAAK,gBAAgB,MAAM;EAC3B,KAAK,oBAAoB,MAAM;EAC/B,KAAK,kBAAkB,MAAM;CAC9B;CAEA,MASa,wBACZ,UACA,OACA,OACA,MACA,QACA,SAGmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GA8BH,MAAM,OAjBY,MAZK,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,uEAAuE,mBAAmB,cAAc,QAAQ,KACnP,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAG4B,MAAM,MAAM,GAAG,MAAM;IAEhD,MAAM,UAAU,EAAE,WAAW,YAAY,EAAE,WAAW;IAGtD,IAAI,aAFY,EAAE,WAAW,YAAY,EAAE,WAAW,WAGrD,OAAO,UAAU,KAAK;IAKvB,MAAM,QAAQ,IAAI,KAAK,EAAE,cAAc,EAAE,YAAY;IAGrD,OAAO,IAFW,KAAK,EAAE,cAAc,EAAE,YAE9B,CAAC,CAAC,QAAQ,IAAI,MAAM,QAAQ;GACxC,CAAC,EAAA,GAEsB;GACvB,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,OAAO,MAAM,KAAK,cAAc,IAAI,UAAU,OAAO,OAAO,QAAQ,SAAS,KAAK;EACnF,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MAUM,wBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAGA,cACmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,IAAI;GAqBH,MAAM,MAAK,MApBY,KAAK,QAC3B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,oCACnI;IACC,QAAQ;IACR,MAAM,KAAK,UAAU,EACpB,SAAS,CACR;KACC,OAAO,CAAC,GAAG;KACX,MAAM;IACP,CACD,EACD,CAAC;GACF,GACA,OACA,YACD,EAAA,EAEqB,QAAQ,EAAE,GAAG,IAAI,GAAG;GACzC,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,GAAG,WAAW,QAAQ,EAAE,EAAE,0BAA0B,uBAAuB,GAAG,WAAW,EAAE,EAAE,gBAAgB,uBAAuB,GAAG,cAAc,SAAS,CAAC,KAC1N,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,IAAI,eAAe,MAAM,OAAO,KAAA;GAEhC,OAAO,MAAM,KAAK,cAAc,aAAa,UAAU,OAAO,OAAO,SAAS,OAAO,YAAY;EAClG,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MASa,eACZ,UACA,OACA,OACA,eACA,IACA,SACmC;EACnC,MAAM,QAAQ,gBAAgB;EAI9B,MAAM,cAAc,cAAc,MAAM,GAAG,CAAC,CAAC;EAE7C,IAAI;GACH,MAAM,KAAK,MAAM,KAAK,QACrB,UACA,OACA,QAAQ,SACR,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,EAAE,KAC3H,EACC,QAAQ,MACT,GACA,KACD;GAEA,OAAO,MAAM,OACV,MAAM,KAAK,cAAc,IAAI,UAAU,OAAO,OAAO,QAAQ,SAAS,KAAK,IAC3E,KAAA;EACJ,SAAS,IAAI;GAGZ,IAAI,GAAG,UAAU,WAAW,KAAK,OAAO,KAAA;GAExC,MAAM;EACP;CACD;CAEA,MASa,sBACZ,UACA,OACA,OACA,MACA,IACA,SAI0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,SACpD,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,uBAAuB,uBAAuB,EAAE,KACxH,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,OACA,aACA,OACD;IAEA,OAAO;KACN,IAAI,YAAY,GAAG,SAAS;KAC5B,MAAM;KACN,QAAQ,YAAY,GAAG,SAAS;KACtB;KACV,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,OAAO,mCAAmC,aAAa;KACvD,QAAQ,mCAAmC,aAAa;KACxD,OAAO,YAAY,OAAO;KAC1B,KAAK,YAAY,OAAO,KAAK;IAC9B;GACD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;EAGD,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,eACpD,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,gBAAgB,uBAAuB,EAAE,KAC5K,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,YAAY,MACf,OAAO;IACN,IAAI,SAAS,cAAc,SAAS;IACpC,MAAM;IACN,QAAQ,SAAS,cAAc,SAAS;IAC9B;IACV,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,OAAO,8BAA8B,SAAS,MAAM;IACpD,QAAQ,+BAA+B,SAAS,MAAM;IACtD,OAAO,SAAS;IAChB,KAAK,0BAA0B,UAAU,QAAQ,SAAS,KAAK;GAChE;GAGD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGF;CAEA,MAQa,SACZ,UACA,OACA,SACA,IACA,SAG6B;EAC7B,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,QAAQ,YAAY,EAAE,GAAG,uBAAuB,QAAQ,IAAI,EAAE,uBAAuB,uBAAuB,EAAE,KACxI,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,QAAQ,cACR,QAAQ,MACR,OACD;IACA,OAAO,kBAAkB,aAAa,UAAU,SAAS,aAAa;GACvE;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;CAEA,MAUM,oBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAG0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GAYH,MAAM,UAAS,MAVM,KAAK,QACzB,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,WAAW,uBAAuB,GAAG,KACxK,EACC,QAAQ,MACT,GACA,KACD,EAAA,EACuB;GACvB,IAAI,CAAC,QACJ;GAGD,OAAO;IACI;IACV,IAAI,KAAA;IACJ,UAAU,KAAA;IACV,MAAM,QAAQ;IACd,OAAO,QAAQ;IACf,WAAW,KAAA;GACZ;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;;;;;;;;;;CAWA,MAOM,uBACL,UACA,OACA,SACoD;EACpD,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,iBAAiB,MAAM,KAAK,QACjC,UACA,OACA,SACA,wBACA,EAAE,QAAQ,MAAM,GAChB,KACD;EACA,MAAM,UAAU,gBAAgB,iCAAiC,MAAM,GAAG,CAAC,CAAC,SAAS,OAAO;EAC5F,MAAM,YAAY,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,CAAC,CAAC,SAAS,OAAO;EACvE,IAAI,WAAW,QAAQ,aAAa,QAAQ,gBAAgB,cAAc,MAAM,OAAO,KAAA;EAEvF,MAAM,OAAO,kBAAkB,OAAO;EACtC,IAAI,KAAK,YAAY,MAAM,kBAAkB,SAAS,CAAC,CAAC,YAAY,GAAG,OAAO,KAAA;EAE9E,OAAO;GAAE,IAAI,eAAe;GAAkB;EAAK;CACpD;CAEA,MAOM,uBACL,UACA,OACA,SAC4G;EAC5G,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GA6BH,MAAM,QAAO,MA5BgB,KAAK,QAkBjC,UACA,OACA,SACA,wBACA,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAE6B;GAC7B,MAAM,WAAW,MAAM,YAAY,SAAS;GAC5C,IAAI,CAAC,UACJ;GAGD,OAAO;IACN,IAAI,KAAK;IACT,MAAM,KAAK;IACX,OAAO,KAAK;IACF;GACX;EACD,SAAS,IAAI;GAEZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,IAAI,mCAAmC,SAAS;GAC7D;EACD;CACD;CAEA,MAAM,yBACL,WACA,OACA,UACA,OACA,OACA,aACA,SAGkD;EAGlD,MAAM,UAAU,KAAK,UAAU;GAAC,QAAQ;GAAS;GAAO;EAAW,CAAC;EACpE,MAAM,WAAW,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;EAChF,IAAI,YAAY,MAAM,OAAO;EAE7B,MAAM,SAAS,MAAM,KAAK,2BAA2B,WAAW,UAAU,OAAO,OAAO,aAAa,OAAO;EAC5G,KAAK,gBAAgB,eAAe,SAAS,WAAW,MAAM;EAE9D,OAAO,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;CACvE;CAEA,MAAc,2BACb,cACA,UACA,OACA,OACA,aACA,SAGgC;EAChC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAYH,QAAO,MAXmB,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,2BAA2B,uBAAuB,YAAY,EAAE,UACxI,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAEoB,SAAS,CAAC;EAC/B,SAAS,IAAI;GAIZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf,OAAO,CAAC;EACT;CACD;CAEA,MAQM,sBACL,UACA,OACA,OACA,MACA,SAGA,cAC0C;EAC1C,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,YAAY,MAAM,OAAO,KAAA;GAK7B,OAAO;IACI;IACH;IAEP,MAAM,SAAS;IACf,QAAQ,SAAS,UAAU;IAC3B,QACC,SAAS,UAAU,SAAS,kBAAkB,QAAQ,OACnD;KAAS;KAAO,MAAM,SAAS,iBAAiB;IAAK,IACrD,KAAA;GACL;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;CAEA,MAQM,iBACL,UACA,OACA,OACA,MACA,SAGA,cACqC;EACrC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,UAAU,iBAAiB,MAAM,OAAO,KAAA;GAE5C,OAAO;IACI;IACV,MAAM,yBAAyB,SAAS,aAAa;GACtD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;;;;;;;;;;;;;;;;;;;;CAqBA,MAOM,oBACL,UACA,OACA,YACA,SAQA,cACmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,OAAO,0BACZ,QAAQ,UACR,mBAAmB,QAAQ,UAAU,IAAI,GACzC,QAAQ,YACT;EACA,MAAM,MAAM,+BAA+B,YAAY,IAAI;EAC3D,MAAM,WAAW,sBAAsB,QAAQ,UAAU,KAAA,GAA4B;EACrF,MAAM,SAAS,+BAA+B,QAAQ,QAAQ,KAAK,QAAQ;EAC3E,MAAM,OAAO,QAAQ,QAAQ;EAO7B,MAAM,WAAW,QAAQ,YAAY,KAAK;EAC1C,MAAM,cAAc,KAAK,UAAU;GAClC,MAAM,OAAO,MAAM,WAAW;GAC9B,QAAQ;GACR;GACA;GACA;EACD,CAAC;EAED,MAAM,gBAAgB,QAAQ,YAAY,OAAO,KAAK,kBAAkB,IAAI,WAAW,IAAI,KAAA;EAC3F,IAAI,QAAQ,YAAY,QAAQ,iBAAiB,MAChD,MAAM,IAAI,MAAM,qEAAqE;EAGtF,MAAM,SAAS,OAAO,iBACrB,KAAK,kBAAkB,YACtB,cACC,YAAY,WACZ,KAAK,iBACJ,UACA,OACA,YACA,QAAQ,SACR,MAAA,OAEA,OACA,MACD,CAAC,CAAC,OAAO,OAAgB;GAGxB,IAAI,uBAAuB,EAAE,GAC5B,MAAM,IAAI,MACT,GAAG,SAAS,KAAK,gFAClB;GAGD,MAAM;EACP,CAAC,GACF,EAAgB,aAAa,CAC9B;EACD,MAAM,eAAe,OAAO,SAAS;EACrC,MAAM,MAAM,eAAe,OAAO,MAAM,GAAG,8BAA8B,IAAI;EAE7E,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,QAAQ,IAAI,MAAM,QAAQ,SAAS,QAAQ;EACjD,MAAM,SAAkB,CAAC;EACzB,IAAI,MAAM,SAAS,GAAG;GACrB,MAAM,YAAY,MAAM,KAAK,QAC5B,UACA,OACA,QAAQ,SACR,GAAG,uBAAuB,UAAU,EAAE,4CACtC;IAAE,QAAQ;IAAQ,MAAM,KAAK,UAAU;KAAE,KAAK;KAAO,SAAS;KAAS,aAAa;IAAO,CAAC;GAAE,GAC9F,OACA,YACD;GACA,MAAM,OAAO,IAAI,KAAK,WAAW,SAAS,CAAC,EAAA,CAAG,QAAO,MAAK,KAAK,IAAI,CAAC,CAAC,KAAI,MAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;GACxF,KAAK,MAAM,MAAM,OAAO;IAGvB,MAAM,WAAW,KAAK,IAAI,EAAE;IAC5B,IAAI,YAAY,MAAM;IAEtB,MAAM,cAAc,SAAS,OAAO;IACpC,MAAM,UAAU,QAAQ,eAAe,WAAW;IAClD,IAAI,WAAW,MACd,MAAM,IAAI,MAAM,0BAA0B,GAAG,kBAAkB,YAAY,uBAAuB;IAGnG,MAAM,gBAAgB,MAAM,KAAK,yBAChC,SAAS,OAAO,wBAChB,SAAS,OAAO,iBAChB,UACA,OACA,YACA,QAAQ,MACR,OACD;IACA,OAAO,KAAK,kBAAkB,UAAU,UAAU,SAAS,aAAa,CAAC;GAC1E;EACD;EAEA,MAAM,aAAa,SAAS,MAAM;EAClC,MAAM,UAAU,aAAa,IAAI;EACjC,MAAM,OAAkC;GAAO;GAAe;GAAU,QAAQ;GAAY,MAAM,OAAO;EAAE;EAC3G,OAAO;GACE;GACR,QAAQ,UAAU,KAAK,UAAU,IAAI,IAAI,KAAA;GAChC;GACH;GACN,WAAW;GACX,YAAY,eAAe,KAAA,IAAY,IAAI;GAC3C,cAAc,gBAAgB,KAAA;EAC/B;CACD;;;;;;;CAQA,MAOM,eACL,UACA,OACA,YACA,SACA,cACoC;EACpC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,OAAO,0BACZ,QAAQ,UACR,mBAAmB,QAAQ,UAAU,IAAI,GACzC,QAAQ,YACT;EACA,IAAI;GACH,MAAM,MAAM,MAAM,KAAK,iBACtB,UACA,OACA,YACA,QAAQ,SACR,MACA,iCAAiC,GACjC,OACA,YACD;GACA,OAAO,IAAI,SAAA,MAA0C,kBAAkB,IAAI;EAC5E,SAAS,IAAI;GACZ,IAAI,uBAAuB,EAAE,GAAG,OAAO;GAEvC,MAAM;EACP;CACD;;;;;;;CAQA,MAAc,iBACb,UACA,OACA,YACA,SACA,MACA,KACA,OACA,cACoB;EACpB,MAAM,SAAS,MAAM,KAAK,QACzB,UACA,OACA,SACA,GAAG,uBAAuB,UAAU,EAAE,uBAAuB,IAAI,sCACjE;GAAE,QAAQ;GAAQ,MAAM,KAAK,UAAU,EAAE,OAAO,KAAK,CAAC;EAAE,GACxD,OACA,YACD;EACA,IAAI,QAAQ,aAAa,MAAM,MAAM,IAAI,MAAM,iDAAiD;EAEhG,OAAO,OAAO,UAAU,KAAI,MAAK,EAAE,EAAE;CACtC;CAEA,cACC,UACA,OACA,OACA,MACA,SACA,OACA,cACmD;EACnD,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,OAAO,KAAK,QACX,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,mBACnI,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;CACD;CAEA,MAAc,cACb,IACA,UACA,OACA,OACA,SACA,OACA,cACuB;EACvB,MAAM,qBAAqB,MAAM,KAAK,sBACrC,UACA,OACA,OACA,SACA,GAAG,YAAY,YACf,OACA,YACD;EACA,OAAO,qBAAqB,IAAI,UAAU,OAAO,SAAS,kBAAkB;CAC7E;;;;;;;;;;CAWA,MAAc,sBACb,UACA,OACA,OACA,SACA,YACA,OACA,cAC+C;EAC/C,IAAI,cAAc,MAAM,OAAO,KAAA;EAE/B,IAAI;EACJ,IAAI;GACH,YAAY,MAAM,OAAO,MAAM,WAAW;EAC3C,QAAQ;GACP;EACD;EAEA,MAAM,WAAW,KAAK,UAAU;GAAC;GAAW;GAAS;GAAO,WAAW;EAAE,CAAC;EAG1E,OAAO,KAAK,oBAAoB,YAC/B,WACC,WAAW,cACX,KAAK,wBACJ,UACA,OACA,OACA,SACA,WAAW,IACX,WACA,OACA,SACD,GACD,EAAgB,aAAa,CAC9B;CACD;CAEA,MAAc,wBACb,UACA,OACA,OACA,SACA,cACA,WACA,OACA,cAC+C;EAC/C,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,0BAA0B,uBAAuB,YAAY,EAAE,mBAChG,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,MAAM,SAAS,2BAA2B,UAAU,QAAQ,SAAS,KAAK;GAC1E,MAAM,aAAa,2BAA2B,UAAU,WAAW,SAAS,KAAK;GAIjF,MAAM,MAAM,UAAU;GACtB,IAAI,OAAO,MAAM;IAChB,UAAU,WAAW;IACrB;GACD;GAEA,OAAO;IAAO;IAAiB;GAAW;EAC3C,SAAS,IAAI;GAEZ,IAAI,EAAE,cAAc,yBAAyB,EAAE,cAAc,sBAC5D,UAAU,WAAW;GAGtB,MAAM,SAAS,cAAc,qBAAqB,KAAK,GAAG,OAAO,KAAK;GACtE,OAAO,KAAK,6CAA6C,QAAQ;GACjE;EACD;CACD;CAEA,MAAc,QACb,UACA,OACA,SACA,OACA,SACA,OACA,cACyB;EACzB,MAAM,EAAE,gBAAgB;EACxB,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,UAAU;EAE9C,IAAI;EACJ,IAAI;GACH,MAAM,KAAK,eAAe,WAAW,SAAS,UAAU,MAAM,WAAW,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,CAAC;GAEpG,IAAI;IACH,IAAI,cAAc,SAAS,MAAM,IAAI,kBAAkB;IAEvD,MAAM,MAAM,KAAK,OAAO,yBAAyB,SAAS,mBAAmB,SAC5E,KAAK,OAAO,MAAM,KAAK;KACtB,SAAS;MACR,eAAe,SAAS,OAAO,OAAO,aAAa;MACnD,gBAAgB;KACjB;KACA,QAAQ;KACR,GAAG;IACJ,CAAC,CACF;IAEA,IAAI,IAAI,IAAI;KAMX,KADoB,IAAI,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY,KAAK,GAAA,CACtD,WAAW,WAAW,GAAG;MACxC,MAAM,EAAE,aAAa,cAAc,GAAG,cAAc;MACpD,MAAM,IAAI,oBACT,WAAA,mBAEA,IAAI,MAAM,IAAI,IAAI,OAAO,uDAAuD,CACjF;KACD;KAEA,OAAQ,MAAM,IAAI,KAAK;IACxB;IAGA,MAAM,MAAM,mBAAmB,aAAa,eAAe,GAAG;GAC/D,UAAU;IACT,IAAI,KAAK;GACV;EACD,SAAS,IAAI;GACZ,IAAI,cAAc,sBAAsB,GAAG,SAAS,cACnD,KAAK,mBAAmB,UAAU,OAAO,IAAI,KAAK;QAC5C,IAAIA,QAAO,aACjB,KAAK,OAAO,UAAU,+BAA+B,GAAG,SAAS;GAGlE,MAAM;EACP;CACD;CAEA,mBACC,UACA,OACA,IACA,OACO;EACP,IAAI,GAAG,SAAS,gBAAgB,EAAE,cAAc,qBAAqB,MAAM,IAAI,kBAAkB,EAAE;EAEnG,MAAM,EAAE,aAAa,GAAG,cAAc;EACtC,QAAQ,GAAG,QAAX;GACC,KAAK;GACL,KAAK;GACL,KAAK,KACJ,MAAM,IAAI,qBAAqB,EAAE;GAClC,KAAK,KACJ,MAAM,IAAI,oBAAoB,WAAA,GAAmD,EAAE;GACpF,KAAK,KACJ,MAAM,iBAAiB,IAAI,WAAW;GACvC,KAAK;IAKJ,IAAI,oBAAoB,EAAE,GAAG,MAAM,iBAAiB,IAAI,WAAW;IAEnE,MAAM,IAAI,oBAAoB,WAAA,GAAgD,EAAE;GACjF,KAAK;IACJ,OAAO,MAAM,EAAE;IACf,IAAI,GAAG,YAAY,MAAM;KACxB,UAAU,sBAAsB;KAChC,KAAK,OAAO,kBACX,YAAY,QAAQ,SAAS,OAAO,UACjC,KAAK,EACL,0JACA,UAAU,QAAQ,aACnB,IACC,KAAK,EAAE,2DAA2D,SAAS,IAAI,CACnF;IACD;IACA;GACD,KAAK;IACJ,OAAO,MAAM,EAAE;IAOf;GACD,SACC,IAAI,GAAG,UAAU,OAAO,GAAG,SAAS,KAAK,MAAM,IAAI,mBAAmB,EAAE;EAE1E;EAEA,OAAO,MAAM,EAAE;EACf,IAAIA,QAAO,aACV,KAAK,OAAO,UACX,+BAAgC,GAAG,UAAkB,SAAS,EAAE,EAAE,WAAW,GAAG,SACjF;CAEF;AACD;AA7pCE,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,YAAY;CAChD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACE;AACT,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA0DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA6DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,eAAe,QAAQ;CACrD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACQ;CACX;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,kBAAA,IAAA;AAuCA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,QAAQ;CAC5C,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACF;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AA8GA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,SAAS,QAAQ;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;CACL;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,YAAA,IAAA;AAqDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,uBAAA,IAAA;AA+DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,aAAa;CACpC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,0BAAA,IAAA;AAyBA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,aAAa;CACpC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,0BAAA,IAAA;AAqHA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AAoDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,oBAAA,IAAA;AA6DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,gBAAgB;CACvC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACrB;AACb,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,uBAAA,IAAA;AAsIA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,gBAAgB;CACvC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACrB;AACb,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,kBAAA,IAAA;;AAoUF,SAAgB,qBAAqB,KAAgD;CACpF,OAAO,IAAI,eAAe,sBAAsB,GAAG,CAAC;AACrD"}
+{"version":3,"file":"azure.js","names":["Logger"],"sources":["../../../../../../plus/integrations/src/providers/azure/azure.ts"],"sourcesContent":["import * as l10n from '@vscode/l10n';\nimport type { UnidentifiedAuthor } from '@gitlens/git/models/author.js';\nimport type { DefaultBranch } from '@gitlens/git/models/defaultBranch.js';\nimport type { Issue, IssueSearchCriteria } from '@gitlens/git/models/issue.js';\nimport type { IssueOrPullRequest, IssueOrPullRequestType } from '@gitlens/git/models/issueOrPullRequest.js';\nimport type { PullRequest } from '@gitlens/git/models/pullRequest.js';\nimport type { Provider } from '@gitlens/git/models/remoteProvider.js';\nimport type { RepositoryMetadata } from '@gitlens/git/models/repositoryMetadata.js';\nimport { effectiveIssueSort } from '@gitlens/git/utils/issue.utils.js';\nimport { base64 } from '@gitlens/utils/base64.js';\nimport { CancellationError, isCancellationError } from '@gitlens/utils/cancellation.js';\nimport { sha256, uuid } from '@gitlens/utils/crypto.js';\nimport { trace } from '@gitlens/utils/decorators/log.js';\nimport type { Disposable } from '@gitlens/utils/disposable.js';\nimport { Logger } from '@gitlens/utils/logger.js';\nimport type { ScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport { getScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport type { CacheController } from '@gitlens/utils/promiseCache.js';\nimport { PromiseCache } from '@gitlens/utils/promiseCache.js';\nimport { maybeStopWatch } from '@gitlens/utils/stopwatch.js';\nimport type { TokenWithInfo } from '../../authentication/models.js';\nimport type { IntegrationServiceContext } from '../../context.js';\nimport {\n\tAuthenticationError,\n\tAuthenticationErrorReason,\n\tisRateLimitResponse,\n\tProviderFetchError,\n\tRequestClientError,\n\tRequestNotFoundError,\n\ttoRateLimitError,\n} from '../../errors.js';\nimport type { ProviderIssueSearchPage } from '../../models/issueReads.js';\nimport { decodePathSegment } from '../../utils/domain.utils.js';\nimport type { ProviderApiConfig } from '../apiConfig.js';\nimport { baseProviderApiConfig } from '../apiConfig.js';\nimport type {\n\tAzureForkRepositoryUrls,\n\tAzureGitCommit,\n\tAzureProjectDescriptor,\n\tAzurePullRequest,\n\tAzurePullRequestWithLinks,\n\tAzureRepositoryReference,\n\tAzureRepositoryUrls,\n\tAzureRepositoryWithMetadata,\n\tAzureWorkItemState,\n\tAzureWorkItemStateCategory,\n\tWorkItem,\n} from './models.js';\nimport {\n\tazurePullRequestStatusToState,\n\tazureWorkItemsStateCategoryToState,\n\tencodeAzurePathSegment,\n\tfromAzurePullRequest,\n\tfromAzureWorkItem,\n\tgetAzurePullRequestWebUrl,\n\tisClosedAzurePullRequestStatus,\n\tisClosedAzureWorkItemStateCategory,\n\tnormalizeAzureBranchName,\n\tsanitizeAzureRepositoryUrl,\n} from './models.js';\nimport type { AzureWorkItemSearchCursor } from './search.js';\nimport {\n\tazureWorkItemBatchLimit,\n\tazureWorkItemSearchResultLimit,\n\tparseAzureWorkItemSearchCursor,\n\ttoAzureSearchPageSize,\n\ttoAzureWorkItemSearchCursorKey,\n\ttoAzureWorkItemSearchWiql,\n} from './search.js';\n\nconst forkRepositoryUrlCacheTtl = 5 * 60 * 1000;\n/** How long a work-item search's id snapshot outlives the last page read from it, and the most it lives at all. */\nconst workItemSearchSnapshotTtl = 5 * 60 * 1000;\nconst workItemSearchSnapshotMaxTtl = 30 * 60 * 1000;\n\n/** Whether Azure refused a WIQL query for matching more work items than it will return (`VS402337`). */\nfunction isWorkItemLimitRefusal(ex: unknown): boolean {\n\treturn ex instanceof RequestClientError && ex.message.includes('VS402337');\n}\n\nfunction parseAzureRepositoryDescriptor(repo: string): { projectName: string; repoName: string } {\n\tconst parts = repo.split('/');\n\tconst [projectName, segment, repoName] = parts;\n\tif (parts.length !== 3 || segment !== '_git' || !projectName || !repoName) {\n\t\tthrow new Error(`Invalid Azure repository descriptor '${repo}'; expected '{project}/_git/{repoName}'.`);\n\t}\n\n\treturn { projectName: projectName, repoName: repoName };\n}\n\nclass WorkItemStates {\n\tprivate readonly _categories = new Map<string, AzureWorkItemStateCategory>();\n\tprivate readonly _types = new Map<string, AzureWorkItemState[]>();\n\n\t// TODO@sergeibbb: we might need some logic for invalidating\n\tpublic getStateCategory(\n\t\tproject: string,\n\t\tworkItemType: string,\n\t\tstateName: string,\n\t): AzureWorkItemStateCategory | undefined {\n\t\treturn this._categories.get(this.getStateKey(project, workItemType, stateName));\n\t}\n\n\tpublic clear(): void {\n\t\tthis._categories.clear();\n\t\tthis._types.clear();\n\t}\n\n\tpublic saveTypeStates(project: string, workItemType: string, states: AzureWorkItemState[]): void {\n\t\tthis.clearTypeStates(project, workItemType);\n\t\tthis._types.set(this.getTypeKey(project, workItemType), states);\n\t\tfor (const state of states) {\n\t\t\tthis._categories.set(this.getStateKey(project, workItemType, state.name), state.category);\n\t\t}\n\t}\n\n\tpublic hasTypeStates(project: string, workItemType: string): boolean {\n\t\treturn this._types.has(this.getTypeKey(project, workItemType));\n\t}\n\n\tprivate clearTypeStates(project: string, workItemType: string): void {\n\t\tconst states = this._types.get(this.getTypeKey(project, workItemType));\n\t\tif (states == null) return;\n\n\t\tfor (const state of states) {\n\t\t\tthis._categories.delete(this.getStateKey(project, workItemType, state.name));\n\t\t}\n\t}\n\n\tprivate getStateKey(project: string, workItemType: string, stateName: string): string {\n\t\t// By stringifying the pair as JSON we make sure that all possible special characters are escaped\n\t\treturn JSON.stringify([project, workItemType, stateName]);\n\t}\n\n\tprivate getTypeKey(project: string, workItemType: string): string {\n\t\treturn JSON.stringify([project, workItemType]);\n\t}\n}\n\nexport class AzureDevOpsApi implements Disposable {\n\tprivate readonly _disposable: Disposable | undefined;\n\tprivate _workItemStates: WorkItemStates = new WorkItemStates();\n\tprivate readonly _forkRepositoryUrls = new PromiseCache<string, AzureForkRepositoryUrls | undefined>({\n\t\tcapacity: 100,\n\t\tcreateTTL: forkRepositoryUrlCacheTtl,\n\t});\n\t/**\n\t * The ordered ids each filtered work-item search's first page queried, paged through by its continuations. Kept\n\t * alive while a pagination keeps reading them (see `workItemSearchSnapshotTtl`). Every first page adds one, so\n\t * the capacity leaves room for repeated first pages before an idle pagination's snapshot is the one evicted.\n\t */\n\tprivate readonly _workItemSearches = new PromiseCache<string, number[]>({\n\t\tcapacity: 50,\n\t\taccessTTL: workItemSearchSnapshotTtl,\n\t\tcreateTTL: workItemSearchSnapshotMaxTtl,\n\t});\n\n\tconstructor(private readonly config: ProviderApiConfig) {\n\t\tthis._disposable = config.onConfigChanged?.(() => this.resetCaches());\n\t}\n\n\tdispose(): void {\n\t\tthis._disposable?.dispose();\n\t}\n\n\tprivate resetCaches(): void {\n\t\tthis._workItemStates.clear();\n\t\tthis._forkRepositoryUrls.clear();\n\t\tthis._workItemSearches.clear();\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, branch) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tbranch: branch,\n\t\t}),\n\t})\n\tpublic async getPullRequestForBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbranch: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ value: AzurePullRequest[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullRequests?searchCriteria.status=all&searchCriteria.sourceRefName=${encodeURIComponent(`refs/heads/${branch}`)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\t// Sort PRs: open PRs first, then by most recent activity (creation or closure date)\n\t\t\tconst sortedPRs = prResult?.value.sort((a, b) => {\n\t\t\t\t// First, prioritize open PRs (active/notSet) over closed ones (abandoned/completed)\n\t\t\t\tconst aIsOpen = a.status === 'active' || a.status === 'notSet';\n\t\t\t\tconst bIsOpen = b.status === 'active' || b.status === 'notSet';\n\n\t\t\t\tif (aIsOpen !== bIsOpen) {\n\t\t\t\t\treturn aIsOpen ? -1 : 1; // Open PRs come first\n\t\t\t\t}\n\n\t\t\t\t// Among PRs with the same status, sort by most recent activity\n\t\t\t\t// Use closedDate if available, otherwise use creationDate\n\t\t\t\tconst aDate = new Date(a.closedDate || a.creationDate);\n\t\t\t\tconst bDate = new Date(b.closedDate || b.creationDate);\n\n\t\t\t\treturn bDate.getTime() - aDate.getTime(); // Most recent first\n\t\t\t});\n\n\t\t\tconst pr = sortedPRs?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getPullRequestForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\ttry {\n\t\t\tconst prResult = await this.request<{ results: Record<string, AzurePullRequest[]>[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullrequestquery?api-version=4.1`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\tqueries: [\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\titems: [rev],\n\t\t\t\t\t\t\t\ttype: 'commit',\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t],\n\t\t\t\t\t}),\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\n\t\t\tconst pr = prResult?.results[0]?.[rev]?.[0];\n\t\t\tif (pr == null) return undefined;\n\n\t\t\tconst pullRequest = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(pr.repository.project.id)}/_apis/git/repositories/${encodeAzurePathSegment(pr.repository.id)}/pullRequests/${encodeAzurePathSegment(pr.pullRequestId.toString())}`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (pullRequest == null) return undefined;\n\n\t\t\treturn await this.toPullRequest(pullRequest, provider, token, owner, baseUrl, scope, cancellation);\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent result; every other\n\t\t\t// failure keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, projectOrName, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\tprojectOrName: projectOrName,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getPullRequest(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectOrName: string,\n\t\tid: string,\n\t\toptions: { baseUrl: string },\n\t): Promise<PullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\t// A pull request id is unique within the organization, so no repository is required here — only the\n\t\t// project. `projectOrName` is either a bare project name or a `{project}/_git/{repo}` descriptor; either\n\t\t// way the project is its first segment.\n\t\tconst projectName = projectOrName.split('/')[0];\n\n\t\ttry {\n\t\t\tconst pr = await this.request<AzurePullRequest>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/pullrequests/${encodeAzurePathSegment(id)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\treturn pr != null\n\t\t\t\t? await this.toPullRequest(pr, provider, token, owner, options.baseUrl, scope)\n\t\t\t\t: undefined;\n\t\t} catch (ex) {\n\t\t\t// Only a 404 is a proven absence; `Integration.getPullRequest` handles every other failure, so it is not\n\t\t\t// cached as a miss\n\t\t\tif (ex.original?.status === 404) return undefined;\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssueOrPullRequest(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t\ttype?: IssueOrPullRequestType;\n\t\t},\n\t): Promise<IssueOrPullRequest | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\tif (options?.type === undefined || options?.type === 'issue') {\n\t\t\ttry {\n\t\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/wit/workItems/${encodeAzurePathSegment(id)}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (issueResult != null) {\n\t\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\t\tissueType,\n\t\t\t\t\t\tstate,\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken,\n\t\t\t\t\t\towner,\n\t\t\t\t\t\tprojectName,\n\t\t\t\t\t\toptions,\n\t\t\t\t\t);\n\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: issueResult.id.toString(),\n\t\t\t\t\t\ttype: 'issue',\n\t\t\t\t\t\tnodeId: issueResult.id.toString(),\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(issueResult.fields['System.CreatedDate']),\n\t\t\t\t\t\tupdatedDate: new Date(issueResult.fields['System.ChangedDate']),\n\t\t\t\t\t\tstate: azureWorkItemsStateCategoryToState(stateCategory),\n\t\t\t\t\t\tclosed: isClosedAzureWorkItemStateCategory(stateCategory),\n\t\t\t\t\t\ttitle: issueResult.fields['System.Title'],\n\t\t\t\t\t\turl: issueResult._links.html.href,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tif (options?.type === undefined || options?.type === 'pullrequest') {\n\t\t\ttry {\n\t\t\t\tconst prResult = await this.request<AzurePullRequestWithLinks>(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\toptions?.baseUrl,\n\t\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/pullRequests/${encodeAzurePathSegment(id)}`,\n\t\t\t\t\t{\n\t\t\t\t\t\tmethod: 'GET',\n\t\t\t\t\t},\n\t\t\t\t\tscope,\n\t\t\t\t);\n\n\t\t\t\tif (prResult != null) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tid: prResult.pullRequestId.toString(),\n\t\t\t\t\t\ttype: 'pullrequest',\n\t\t\t\t\t\tnodeId: prResult.pullRequestId.toString(), // prResult.artifactId maybe?\n\t\t\t\t\t\tprovider: provider,\n\t\t\t\t\t\tcreatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tupdatedDate: new Date(prResult.creationDate),\n\t\t\t\t\t\tstate: azurePullRequestStatusToState(prResult.status),\n\t\t\t\t\t\tclosed: isClosedAzurePullRequestStatus(prResult.status),\n\t\t\t\t\t\ttitle: prResult.title,\n\t\t\t\t\t\turl: getAzurePullRequestWebUrl(prResult, options.baseUrl, owner),\n\t\t\t\t\t};\n\t\t\t\t}\n\n\t\t\t\treturn undefined;\n\t\t\t} catch (ex) {\n\t\t\t\t// A rejected credential is actionable and must not be reported as an absent issue; every other\n\t\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\t\tscope?.error(ex);\n\t\t\t\t\treturn undefined;\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, project, id) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tproject: project,\n\t\t\tid: id,\n\t\t}),\n\t})\n\tpublic async getIssue(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tproject: AzureProjectDescriptor,\n\t\tid: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<Issue | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst issueResult = await this.request<WorkItem>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(project.resourceName)}/${encodeAzurePathSegment(project.name)}/_apis/wit/workItems/${encodeAzurePathSegment(id)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tif (issueResult != null) {\n\t\t\t\tconst issueType = issueResult.fields['System.WorkItemType'];\n\t\t\t\tconst state = issueResult.fields['System.State'];\n\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\tissueType,\n\t\t\t\t\tstate,\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\tproject.resourceName,\n\t\t\t\t\tproject.name,\n\t\t\t\t\toptions,\n\t\t\t\t);\n\t\t\t\treturn fromAzureWorkItem(issueResult, provider, project, stateCategory, 'point');\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo, rev, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t\trev: rev,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getAccountForCommit(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\trev: string,\n\t\tbaseUrl: string,\n\t\t_options?: {\n\t\t\tavatarSize?: number;\n\t\t},\n\t): Promise<UnidentifiedAuthor | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\n\t\ttry {\n\t\t\t// Try to get the Work item (wit) first with specific fields\n\t\t\tconst commit = await this.request<AzureGitCommit>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}/commits/${encodeAzurePathSegment(rev)}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\t\t\tconst author = commit?.author;\n\t\t\tif (!author) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\t// Azure API never gives us an id/username we can use, therefore we always return UnidentifiedAuthor\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tid: undefined,\n\t\t\t\tusername: undefined,\n\t\t\t\tname: author?.name,\n\t\t\t\temail: author?.email,\n\t\t\t\tavatarUrl: undefined,\n\t\t\t} satisfies UnidentifiedAuthor;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is actionable and must not be reported as an absent work item; every other\n\t\t\t// non-404 keeps the existing degrade-to-undefined behavior.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tif (ex.original?.status !== 404) {\n\t\t\t\tscope?.error(ex);\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\treturn undefined;\n\t}\n\n\t/**\n\t * The collection an Azure DevOps Server address names, or `undefined` when it names the installation.\n\t *\n\t * Below a collection, `connectionData` describes that collection: its `instanceId` is the collection's id, and its\n\t * `webApplicationRelativeDirectory` ends in the collection's path segment (`DefaultCollection/`); it is empty or\n\t * absent at the server level. As measured against Azure DevOps Server 2020. The directory may also carry the\n\t * installation's own virtual directory before the collection (`tfs/DefaultCollection/`), so only its LAST segment\n\t * names the collection, and only when it is the last segment of the address asked about.\n\t */\n\t@trace({\n\t\targs: (provider, token, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getAddressedCollection(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string,\n\t): Promise<{ id: string; name: string } | undefined> {\n\t\tconst scope = getScopedLogger();\n\t\tconst connectionData = await this.request<{ instanceId?: string; webApplicationRelativeDirectory?: string }>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t'_apis/connectionData',\n\t\t\t{ method: 'GET' },\n\t\t\tscope,\n\t\t);\n\t\tconst segment = connectionData?.webApplicationRelativeDirectory?.split('/').findLast(Boolean);\n\t\tconst addressed = new URL(baseUrl).pathname.split('/').findLast(Boolean);\n\t\tif (segment == null || addressed == null || connectionData?.instanceId == null) return undefined;\n\n\t\tconst name = decodePathSegment(segment);\n\t\tif (name.toLowerCase() !== decodePathSegment(addressed).toLowerCase()) return undefined;\n\n\t\treturn { id: connectionData.instanceId, name: name };\n\t}\n\n\t@trace({\n\t\targs: (provider, token, baseUrl) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tbaseUrl: baseUrl,\n\t\t}),\n\t})\n\tasync getCurrentUserOnServer(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string,\n\t): Promise<{ id: string; name?: string; email?: string; username?: string; avatarUrl?: string } | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst connectionData = await this.request<{\n\t\t\t\tauthenticatedUser?: {\n\t\t\t\t\tid: string;\n\t\t\t\t\tdescriptor: string;\n\t\t\t\t\tisActive: boolean;\n\t\t\t\t\tmetTypeId: number;\n\t\t\t\t\tproviderDisplayName?: string;\n\t\t\t\t\temailAddress?: string;\n\t\t\t\t\tresourceVersion: 2;\n\t\t\t\t\tsubjectDescriptor: string;\n\t\t\t\t\tproperties?: {\n\t\t\t\t\t\tAccount?: {\n\t\t\t\t\t\t\t$type: string;\n\t\t\t\t\t\t\t$value: string;\n\t\t\t\t\t\t};\n\t\t\t\t\t};\n\t\t\t\t};\n\t\t\t}>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t'_apis/connectionData',\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\tconst user = connectionData?.authenticatedUser;\n\t\t\tconst username = user?.properties?.Account?.$value;\n\t\t\tif (!username) {\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn {\n\t\t\t\tid: user.id,\n\t\t\t\tname: user.providerDisplayName,\n\t\t\t\temail: user.emailAddress,\n\t\t\t\tusername: username,\n\t\t\t};\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is the whole point of this read failing; reporting \"no user\" instead hides it.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex, `Failed to get current user from ${baseUrl}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tasync getWorkItemStateCategory(\n\t\tissueType: string,\n\t\tstate: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemStateCategory | undefined> {\n\t\t// By installation too: this API is shared by every connection, and two installations can each have a\n\t\t// collection and project of the same name whose process maps a state to a different category.\n\t\tconst project = JSON.stringify([options.baseUrl, owner, projectName]);\n\t\tconst category = this._workItemStates.getStateCategory(project, issueType, state);\n\t\tif (category != null) return category;\n\n\t\tconst states = await this.retrieveWorkItemTypeStates(issueType, provider, token, owner, projectName, options);\n\t\tthis._workItemStates.saveTypeStates(project, issueType, states);\n\n\t\treturn this._workItemStates.getStateCategory(project, issueType, state);\n\t}\n\n\tprivate async retrieveWorkItemTypeStates(\n\t\tworkItemType: string,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tprojectName: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t): Promise<AzureWorkItemState[]> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst issueResult = await this.request<{ value: AzureWorkItemState[]; count: number }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions?.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/wit/workItemTypes/${encodeAzurePathSegment(workItemType)}/states`,\n\t\t\t\t{\n\t\t\t\t\tmethod: 'GET',\n\t\t\t\t},\n\t\t\t\tscope,\n\t\t\t);\n\n\t\t\treturn issueResult?.value ?? [];\n\t\t} catch (ex) {\n\t\t\t// A rejected credential must not be degraded to an empty state list: the caller caches whatever this\n\t\t\t// returns, so an empty list would pin every work item of this type to an unknown state until the\n\t\t\t// cache is dropped — long after the session recovery this error is supposed to trigger.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\tscope?.error(ex);\n\t\t\treturn [];\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getRepositoryMetadata(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<RepositoryMetadata | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response == null) return undefined;\n\n\t\t\t// Azure's `parentRepository` only reliably carries the repo name and its project; a fork's parent\n\t\t\t// lives in the same organization, so the org (`owner`) is the parent owner. Only report `parent`\n\t\t\t// when the parent's name is actually present — never fall back to the fork's own name.\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\towner: owner,\n\t\t\t\t// Prefer the API's canonical name over parsing the composite `repo` descriptor string.\n\t\t\t\tname: response.name,\n\t\t\t\tisFork: response.isFork ?? false,\n\t\t\t\tparent:\n\t\t\t\t\tresponse.isFork && response.parentRepository?.name != null\n\t\t\t\t\t\t? { owner: owner, name: response.parentRepository.name }\n\t\t\t\t\t\t: undefined,\n\t\t\t} satisfies RepositoryMetadata;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t@trace({\n\t\targs: (provider, token, owner, repo) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\towner: owner,\n\t\t\trepo: repo,\n\t\t}),\n\t})\n\tasync getDefaultBranch(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<DefaultBranch | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\ttry {\n\t\t\tconst response = await this.getRepository(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\towner,\n\t\t\t\trepo,\n\t\t\t\toptions.baseUrl,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tif (response?.defaultBranch == null) return undefined;\n\n\t\t\treturn {\n\t\t\t\tprovider: provider,\n\t\t\t\tname: normalizeAzureBranchName(response.defaultBranch),\n\t\t\t} satisfies DefaultBranch;\n\t\t} catch (ex) {\n\t\t\t// A rejected credential is not a probe outcome: it is actionable, and the caller routes it into the\n\t\t\t// session recovery. A cancellation or a 404 still degrades quietly.\n\t\t\tif (ex instanceof AuthenticationError) throw ex;\n\n\t\t\t// Cancellations and 404s are expected outcomes for a probe; don't log them as errors.\n\t\t\tif (!isCancellationError(ex) && !(ex instanceof RequestNotFoundError)) {\n\t\t\t\tscope?.error(ex);\n\t\t\t}\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\t/**\n\t * One page of a filtered work-item search over a collection: a WIQL query for the ordered ids, then one detail\n\t * read for the page's slice of them.\n\t *\n\t * The ids a first page queried are kept as the snapshot its continuations page through, for as long as the\n\t * pagination keeps reading it, so it reads a consistent set rather than re-running a query whose rows move under\n\t * an `updated` order. Each first page queries its own snapshot, so paginations of one query never share one, and\n\t * a continuation whose snapshot is gone is refused (see {@link AzureWorkItemSearchCursor}).\n\t *\n\t * The query asks for one id more than {@link azureWorkItemSearchResultLimit}, bounded by `$top`: the extra id is\n\t * what tells \"exactly the limit\" from \"past it\". Past it, the page is `truncated` with `limitReached` and no total,\n\t * since the true count is unknowable here. A server that refuses the match set even so fails the page with a\n\t * \"narrow the search\" error: no bounded query could serve that order's first window.\n\t *\n\t * `resolveProject` maps each result's project name to its descriptor. A work item in a project it doesn't know\n\t * fails the page rather than being dropped or mis-attributed, since either would leave the page disagreeing with\n\t * the count of the same query; the caller refreshes its project discovery before a search so that means a\n\t * project created during the pagination.\n\t */\n\t@trace({\n\t\targs: (provider, token, collection) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tcollection: collection,\n\t\t}),\n\t})\n\tasync searchWorkItemsPage(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\toptions: {\n\t\t\tbaseUrl: string;\n\t\t\tcriteria?: IssueSearchCriteria;\n\t\t\tprojectNames?: readonly string[];\n\t\t\tresolveProject: (name: string) => AzureProjectDescriptor | undefined;\n\t\t\tcursor?: string;\n\t\t\tpageSize?: number;\n\t\t},\n\t\tcancellation?: AbortSignal,\n\t): Promise<ProviderIssueSearchPage> {\n\t\tconst scope = getScopedLogger();\n\t\tconst wiql = toAzureWorkItemSearchWiql(\n\t\t\toptions.criteria,\n\t\t\teffectiveIssueSort(options.criteria?.sort),\n\t\t\toptions.projectNames,\n\t\t);\n\t\tconst key = toAzureWorkItemSearchCursorKey(collection, wiql);\n\t\tconst pageSize = toAzureSearchPageSize(options.pageSize, 100, azureWorkItemBatchLimit);\n\t\tconst cursor = parseAzureWorkItemSearchCursor(options.cursor, key, pageSize);\n\t\tconst page = cursor?.page ?? 1;\n\n\t\t// Keyed by credential and address, and by the query itself rather than its fingerprint: two accounts on one\n\t\t// installation must never page through each other's matches, and two queries whose fingerprints collide must\n\t\t// never share a snapshot. The full credential digest, since the token's `microHash` is truncated for logs.\n\t\t// And by the snapshot's own id: a first page queries a new snapshot rather than replacing the query's, so a\n\t\t// pagination still reading an earlier one keeps it (see `AzureWorkItemSearchCursor`).\n\t\tconst snapshot = cursor?.snapshot ?? uuid();\n\t\tconst snapshotKey = JSON.stringify([\n\t\t\tawait sha256(token.accessToken),\n\t\t\toptions.baseUrl,\n\t\t\tcollection,\n\t\t\twiql,\n\t\t\tsnapshot,\n\t\t]);\n\t\t// A continuation only ever READS its snapshot: resuming against a fresh query could skip a work item silently.\n\t\tconst snapshotFound = cursor?.snapshot != null ? this._workItemSearches.get(snapshotKey) : undefined;\n\t\tif (cursor?.snapshot != null && snapshotFound == null) {\n\t\t\tthrow new Error('Work item search results expired; restart the read without a cursor');\n\t\t}\n\n\t\tconst result = await (snapshotFound ??\n\t\t\tthis._workItemSearches.getOrCreate(\n\t\t\t\tsnapshotKey,\n\t\t\t\t(_cacheable, signal) =>\n\t\t\t\t\tthis.queryWorkItemIds(\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken,\n\t\t\t\t\t\tcollection,\n\t\t\t\t\t\toptions.baseUrl,\n\t\t\t\t\t\twiql,\n\t\t\t\t\t\tazureWorkItemSearchResultLimit + 1,\n\t\t\t\t\t\tscope,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t).catch((ex: unknown) => {\n\t\t\t\t\t\t// `$top` is expected to bound the answer; should a server refuse the match set regardless, say\n\t\t\t\t\t\t// what happened rather than surfacing a bare client error.\n\t\t\t\t\t\tif (isWorkItemLimitRefusal(ex)) {\n\t\t\t\t\t\t\tthrow new Error(\n\t\t\t\t\t\t\t\t`${provider.name} refused a work item search matching more than ${azureWorkItemSearchResultLimit} results; narrow the search`,\n\t\t\t\t\t\t\t);\n\t\t\t\t\t\t}\n\n\t\t\t\t\t\tthrow ex;\n\t\t\t\t\t}),\n\t\t\t\t{ cancellation: cancellation },\n\t\t\t));\n\t\tconst limitReached = result.length > azureWorkItemSearchResultLimit;\n\t\tconst ids = limitReached ? result.slice(0, azureWorkItemSearchResultLimit) : result;\n\n\t\tconst offset = cursor?.offset ?? 0;\n\n\t\tconst slice = ids.slice(offset, offset + pageSize);\n\t\tconst values: Issue[] = [];\n\t\tif (slice.length > 0) {\n\t\t\tconst workItems = await this.request<{ value: (WorkItem | null)[] }>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\toptions.baseUrl,\n\t\t\t\t`${encodeAzurePathSegment(collection)}/_apis/wit/workitemsbatch?api-version=5.0`,\n\t\t\t\t{ method: 'POST', body: JSON.stringify({ ids: slice, $expand: 'Links', errorPolicy: 'Omit' }) },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tconst byId = new Map((workItems?.value ?? []).filter(w => w != null).map(w => [w.id, w]));\n\t\t\tfor (const id of slice) {\n\t\t\t\t// A work item deleted since the ids were queried is gone, not a failure: skipping it keeps the page\n\t\t\t\t// honest, since it no longer matches anything.\n\t\t\t\tconst workItem = byId.get(id);\n\t\t\t\tif (workItem == null) continue;\n\n\t\t\t\tconst projectName = workItem.fields['System.TeamProject'];\n\t\t\t\tconst project = options.resolveProject(projectName);\n\t\t\t\tif (project == null) {\n\t\t\t\t\tthrow new Error(`Azure DevOps work item ${id} is in project '${projectName}', which isn't visible`);\n\t\t\t\t}\n\n\t\t\t\tconst stateCategory = await this.getWorkItemStateCategory(\n\t\t\t\t\tworkItem.fields['System.WorkItemType'],\n\t\t\t\t\tworkItem.fields['System.State'],\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\tcollection,\n\t\t\t\t\tproject.name,\n\t\t\t\t\toptions,\n\t\t\t\t);\n\t\t\t\tvalues.push(fromAzureWorkItem(workItem, provider, project, stateCategory, 'search'));\n\t\t\t}\n\t\t}\n\n\t\tconst nextOffset = offset + slice.length;\n\t\tconst hasMore = nextOffset < ids.length;\n\t\tconst next: AzureWorkItemSearchCursor = { key: key, snapshot: snapshot, offset: nextOffset, page: page + 1 };\n\t\treturn {\n\t\t\tvalues: values,\n\t\t\tcursor: hasMore ? JSON.stringify(next) : undefined,\n\t\t\thasMore: hasMore,\n\t\t\tpage: page,\n\t\t\ttruncated: limitReached,\n\t\t\ttotalCount: limitReached ? undefined : ids.length,\n\t\t\tlimitReached: limitReached || undefined,\n\t\t};\n\t}\n\n\t/**\n\t * How many work items the same WIQL {@link searchWorkItemsPage} would page through match, reading no details.\n\t *\n\t * Asks for one id more than the result ceiling, so the count is exact up to it and `'exceeds-limit'` past it —\n\t * never the ceiling itself, which would understate the match set.\n\t */\n\t@trace({\n\t\targs: (provider, token, collection) => ({\n\t\t\tprovider: provider.name,\n\t\t\ttoken: `<token:${token.microHash}>`,\n\t\t\tcollection: collection,\n\t\t}),\n\t})\n\tasync countWorkItems(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\toptions: { baseUrl: string; criteria?: IssueSearchCriteria; projectNames?: readonly string[] },\n\t\tcancellation?: AbortSignal,\n\t): Promise<number | 'exceeds-limit'> {\n\t\tconst scope = getScopedLogger();\n\t\tconst wiql = toAzureWorkItemSearchWiql(\n\t\t\toptions.criteria,\n\t\t\teffectiveIssueSort(options.criteria?.sort),\n\t\t\toptions.projectNames,\n\t\t);\n\t\ttry {\n\t\t\tconst ids = await this.queryWorkItemIds(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tcollection,\n\t\t\t\toptions.baseUrl,\n\t\t\t\twiql,\n\t\t\t\tazureWorkItemSearchResultLimit + 1,\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\treturn ids.length > azureWorkItemSearchResultLimit ? 'exceeds-limit' : ids.length;\n\t\t} catch (ex) {\n\t\t\tif (isWorkItemLimitRefusal(ex)) return 'exceeds-limit';\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\t/**\n\t * The ids a collection-level WIQL query matches, in its order.\n\t *\n\t * `api-version=5.0` is the oldest version every Azure DevOps Server release this search supports (2019 and later)\n\t * answers; `timePrecision=true` is what lets the criteria's dates compare as instants — see `toWiqlDate`.\n\t */\n\tprivate async queryWorkItemIds(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tcollection: string,\n\t\tbaseUrl: string,\n\t\twiql: string,\n\t\ttop: number,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<number[]> {\n\t\tconst result = await this.request<{ workItems?: { id: number }[] }>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t`${encodeAzurePathSegment(collection)}/_apis/wit/wiql?$top=${top}&timePrecision=true&api-version=5.0`,\n\t\t\t{ method: 'POST', body: JSON.stringify({ query: wiql }) },\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t\tif (result?.workItems == null) throw new Error('Azure DevOps returned no work item query result');\n\n\t\treturn result.workItems.map(w => w.id);\n\t}\n\n\tprivate getRepository(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\trepo: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureRepositoryWithMetadata | undefined> {\n\t\tconst { projectName, repoName } = parseAzureRepositoryDescriptor(repo);\n\t\treturn this.request<AzureRepositoryWithMetadata>(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\tbaseUrl,\n\t\t\t`${encodeAzurePathSegment(owner)}/${encodeAzurePathSegment(projectName)}/_apis/git/repositories/${encodeAzurePathSegment(repoName)}?api-version=7.1`,\n\t\t\t{ method: 'GET' },\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t}\n\n\tprivate async toPullRequest(\n\t\tpr: AzurePullRequest,\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<PullRequest> {\n\t\tconst forkRepositoryUrls = await this.getForkRepositoryUrls(\n\t\t\tprovider,\n\t\t\ttoken,\n\t\t\towner,\n\t\t\tbaseUrl,\n\t\t\tpr.forkSource?.repository,\n\t\t\tscope,\n\t\t\tcancellation,\n\t\t);\n\t\t// Only the point reads convert through here.\n\t\treturn fromAzurePullRequest(pr, provider, owner, baseUrl, forkRepositoryUrls, 'point');\n\t}\n\n\t/**\n\t * Resolves the web and HTTPS clone URLs of the fork a cross-repository pull request comes from. Every other\n\t * repository URL the model reports is rebuilt from the pull request payload; only a fork reference lacks the\n\t * project to do that, so only a fork costs a request.\n\t *\n\t * Best-effort by contract: a fork in a project the token cannot read, a deleted fork, or a throttled request\n\t * leaves the head ref without a URL. It must never cost the pull request itself, which is what makes swallowing\n\t * the failure here the right call rather than a shortcut.\n\t */\n\tprivate async getForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepository: AzureRepositoryReference | undefined,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls | undefined> {\n\t\tif (repository == null) return undefined;\n\n\t\tlet tokenHash: string;\n\t\ttry {\n\t\t\ttokenHash = await sha256(token.accessToken);\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst cacheKey = JSON.stringify([tokenHash, baseUrl, owner, repository.id]);\n\t\t// The request is shared, so the factory is handed the cache's aggregate signal rather than this caller's: it\n\t\t// aborts only once every caller waiting on the entry has cancelled.\n\t\treturn this._forkRepositoryUrls.getOrCreate(\n\t\t\tcacheKey,\n\t\t\t(cacheable, aggregate) =>\n\t\t\t\tthis.fetchForkRepositoryUrls(\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken,\n\t\t\t\t\towner,\n\t\t\t\t\tbaseUrl,\n\t\t\t\t\trepository.id,\n\t\t\t\t\tcacheable,\n\t\t\t\t\tscope,\n\t\t\t\t\taggregate,\n\t\t\t\t),\n\t\t\t{ cancellation: cancellation },\n\t\t);\n\t}\n\n\tprivate async fetchForkRepositoryUrls(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\towner: string,\n\t\tbaseUrl: string,\n\t\trepositoryId: string,\n\t\tcacheable: CacheController,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal,\n\t): Promise<AzureForkRepositoryUrls | undefined> {\n\t\ttry {\n\t\t\tconst response = await this.request<AzureRepositoryUrls>(\n\t\t\t\tprovider,\n\t\t\t\ttoken,\n\t\t\t\tbaseUrl,\n\t\t\t\t`${encodeAzurePathSegment(owner)}/_apis/git/repositories/${encodeAzurePathSegment(repositoryId)}?api-version=4.1`,\n\t\t\t\t{ method: 'GET' },\n\t\t\t\tscope,\n\t\t\t\tcancellation,\n\t\t\t);\n\t\t\tconst webUrl = sanitizeAzureRepositoryUrl(response?.webUrl, baseUrl, owner);\n\t\t\tconst cloneHttps = sanitizeAzureRepositoryUrl(response?.remoteUrl, baseUrl, owner);\n\n\t\t\t// The clone URL stands in for the web URL when the response omits it — an older `api-version` promises\n\t\t\t// neither field, and naming the fork by the URL git would use beats naming it not at all.\n\t\t\tconst url = webUrl ?? cloneHttps;\n\t\t\tif (url == null) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t\treturn undefined;\n\t\t\t}\n\n\t\t\treturn { url: url, cloneHttps: cloneHttps };\n\t\t} catch (ex) {\n\t\t\t// Missing or inaccessible forks are cached briefly; transient failures retry on the next read.\n\t\t\tif (!(ex instanceof RequestNotFoundError) && !(ex instanceof AuthenticationError)) {\n\t\t\t\tcacheable.invalidate();\n\t\t\t}\n\n\t\t\tconst status = ex instanceof ProviderFetchError ? ` (${ex.status})` : '';\n\t\t\tscope?.warn(`Unable to resolve the fork repository URLs${status}`);\n\t\t\treturn undefined;\n\t\t}\n\t}\n\n\tprivate async request<T>(\n\t\tprovider: Provider,\n\t\ttoken: TokenWithInfo,\n\t\tbaseUrl: string | undefined,\n\t\troute: string,\n\t\toptions: { method: RequestInit['method'] } & Record<string, unknown>,\n\t\tscope: ScopedLogger | undefined,\n\t\tcancellation?: AbortSignal | undefined,\n\t): Promise<T | undefined> {\n\t\tconst { accessToken } = token;\n\t\tconst url = baseUrl ? `${baseUrl}/${route}` : route;\n\n\t\tlet rsp: Response;\n\t\ttry {\n\t\t\tconst sw = maybeStopWatch(`[AZURE] ${options?.method ?? 'GET'} request`, { log: { onlyExit: true } });\n\n\t\t\ttry {\n\t\t\t\tif (cancellation?.aborted) throw new CancellationError();\n\n\t\t\t\trsp = await this.config.wrapForForcedInsecureSSL(provider.getIgnoreSSLErrors(), () =>\n\t\t\t\t\tthis.config.fetch(url, {\n\t\t\t\t\t\theaders: {\n\t\t\t\t\t\t\tAuthorization: `Basic ${base64(`PAT:${accessToken}`)}`,\n\t\t\t\t\t\t\t'Content-Type': 'application/json',\n\t\t\t\t\t\t},\n\t\t\t\t\t\tsignal: cancellation,\n\t\t\t\t\t\t...options,\n\t\t\t\t\t}),\n\t\t\t\t);\n\n\t\t\t\tif (rsp.ok) {\n\t\t\t\t\t// Azure answers a rejected credential by redirecting to its sign-in page, which returns `203\n\t\t\t\t\t// text/html` rather than `401`. `rsp.ok` spans 200-299, so that page used to reach `json()` and\n\t\t\t\t\t// die as a bare `SyntaxError` — which `getIssue` and friends catch and report as \"not found\",\n\t\t\t\t\t// making an invalid credential indistinguishable from a missing work item (GKDEV-3617).\n\t\t\t\t\tconst contentType = rsp.headers.get('content-type')?.toLowerCase() ?? '';\n\t\t\t\t\tif (contentType.startsWith('text/html')) {\n\t\t\t\t\t\tconst { accessToken: _accessToken, ...tokenInfo } = token;\n\t\t\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t\t\ttokenInfo,\n\t\t\t\t\t\t\tAuthenticationErrorReason.Unauthorized,\n\t\t\t\t\t\t\tnew Error(`(${rsp.status}) Azure DevOps returned a sign-in page instead of data`),\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\treturn (await rsp.json()) as T;\n\t\t\t\t}\n\n\t\t\t\t// Reads the body so the 403 branch below can tell a throttled request from a permission failure.\n\t\t\t\tthrow await ProviderFetchError.fromResponse('AzureDevOps', rsp);\n\t\t\t} finally {\n\t\t\t\tsw?.stop();\n\t\t\t}\n\t\t} catch (ex) {\n\t\t\tif (ex instanceof ProviderFetchError || ex.name === 'AbortError') {\n\t\t\t\tthis.handleRequestError(provider, token, ex, scope);\n\t\t\t} else if (Logger.isDebugging) {\n\t\t\t\tthis.config.onError?.(`AzureDevOps request failed: ${ex.message}`);\n\t\t\t}\n\n\t\t\tthrow ex;\n\t\t}\n\t}\n\n\tprivate handleRequestError(\n\t\tprovider: Provider | undefined,\n\t\ttoken: TokenWithInfo,\n\t\tex: ProviderFetchError | (Error & { name: 'AbortError' }),\n\t\tscope: ScopedLogger | undefined,\n\t): void {\n\t\tif (ex.name === 'AbortError' || !(ex instanceof ProviderFetchError)) throw new CancellationError(ex);\n\n\t\tconst { accessToken, ...tokenInfo } = token;\n\t\tswitch (ex.status) {\n\t\t\tcase 404: // Not found\n\t\t\tcase 410: // Gone\n\t\t\tcase 422: // Unprocessable Entity\n\t\t\t\tthrow new RequestNotFoundError(ex);\n\t\t\tcase 401: // Unauthorized\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Unauthorized, ex);\n\t\t\tcase 429: // Too Many Requests\n\t\t\t\tthrow toRateLimitError(ex, accessToken);\n\t\t\tcase 403: // Forbidden\n\t\t\t\t// Azure returns 403 for both a permission failure and a throttled request (\"Request was blocked\n\t\t\t\t// due to exceeding usage of resource 'RateLimit'\"), so the message is the discriminant. Reporting\n\t\t\t\t// a throttle as `auth` would prompt the user to re-authenticate a healthy connection instead of\n\t\t\t\t// retrying (see `isRateLimitResponse`).\n\t\t\t\tif (isRateLimitResponse(ex)) throw toRateLimitError(ex, accessToken);\n\n\t\t\t\tthrow new AuthenticationError(tokenInfo, AuthenticationErrorReason.Forbidden, ex);\n\t\t\tcase 500: // Internal Server Error\n\t\t\t\tscope?.error(ex);\n\t\t\t\tif (ex.response != null) {\n\t\t\t\t\tprovider?.trackRequestException();\n\t\t\t\t\tthis.config.onRequestFailed?.(\n\t\t\t\t\t\tprovider == null || provider.id === 'azure'\n\t\t\t\t\t\t\t? l10n.t(\n\t\t\t\t\t\t\t\t\t'{0} failed to respond and might be experiencing issues. Please visit the [AzureDevOps status page](https://status.dev.azure.com) for more information.',\n\t\t\t\t\t\t\t\t\tprovider?.name ?? 'AzureDevOps',\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: l10n.t('{0} failed to respond and might be experiencing issues.', provider.name),\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\treturn;\n\t\t\tcase 502: // Bad Gateway\n\t\t\t\tscope?.error(ex);\n\t\t\t\t// TODO: Learn the Azure API docs and put it in order:\n\t\t\t\t// if (ex.message.includes('timeout')) {\n\t\t\t\t// \tprovider?.trackRequestException();\n\t\t\t\t// \tvoid showIntegrationRequestTimedOutWarningMessage(provider?.name ?? 'Azure');\n\t\t\t\t// \treturn;\n\t\t\t\t// }\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tif (ex.status >= 400 && ex.status < 500) throw new RequestClientError(ex);\n\t\t\t\tbreak;\n\t\t}\n\n\t\tscope?.error(ex);\n\t\tif (Logger.isDebugging) {\n\t\t\tthis.config.onError?.(\n\t\t\t\t`AzureDevOps request failed: ${(ex.response as any)?.errors?.[0]?.message ?? ex.message}`,\n\t\t\t);\n\t\t}\n\t}\n}\n\n/** Wires an {@link AzureDevOpsApi} from the full runtime context, mapping `ctx` down to the narrow config. */\nexport function createAzureDevOpsApi(ctx: IntegrationServiceContext): AzureDevOpsApi {\n\treturn new AzureDevOpsApi(baseProviderApiConfig(ctx));\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsEA,MAAM,4BAA4B;;AAElC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;;AAGrC,SAAS,uBAAuB,IAAsB;CACrD,OAAO,cAAc,sBAAsB,GAAG,QAAQ,SAAS,UAAU;AAC1E;AAEA,SAAS,+BAA+B,MAAyD;CAChG,MAAM,QAAQ,KAAK,MAAM,GAAG;CAC5B,MAAM,CAAC,aAAa,SAAS,YAAY;CACzC,IAAI,MAAM,WAAW,KAAK,YAAY,UAAU,CAAC,eAAe,CAAC,UAChE,MAAM,IAAI,MAAM,wCAAwC,KAAK,yCAAyC;CAGvG,OAAO;EAAe;EAAuB;CAAS;AACvD;AAEA,IAAM,iBAAN,MAAqB;CACpB,8BAA+B,IAAI,IAAwC;CAC3E,yBAA0B,IAAI,IAAkC;CAGhE,iBACC,SACA,cACA,WACyC;EACzC,OAAO,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,SAAS,CAAC;CAC/E;CAEA,QAAqB;EACpB,KAAK,YAAY,MAAM;EACvB,KAAK,OAAO,MAAM;CACnB;CAEA,eAAsB,SAAiB,cAAsB,QAAoC;EAChG,KAAK,gBAAgB,SAAS,YAAY;EAC1C,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,GAAG,MAAM;EAC9D,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,IAAI,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,GAAG,MAAM,QAAQ;CAE1F;CAEA,cAAqB,SAAiB,cAA+B;EACpE,OAAO,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;CAC9D;CAEA,gBAAwB,SAAiB,cAA4B;EACpE,MAAM,SAAS,KAAK,OAAO,IAAI,KAAK,WAAW,SAAS,YAAY,CAAC;EACrE,IAAI,UAAU,MAAM;EAEpB,KAAK,MAAM,SAAS,QACnB,KAAK,YAAY,OAAO,KAAK,YAAY,SAAS,cAAc,MAAM,IAAI,CAAC;CAE7E;CAEA,YAAoB,SAAiB,cAAsB,WAA2B;EAErF,OAAO,KAAK,UAAU;GAAC;GAAS;GAAc;EAAS,CAAC;CACzD;CAEA,WAAmB,SAAiB,cAA8B;EACjE,OAAO,KAAK,UAAU,CAAC,SAAS,YAAY,CAAC;CAC9C;AACD;AAEA,IAAa,iBAAb,MAAkD;CAkBpB;CAjB7B;CACA,kBAA0C,IAAI,eAAe;CAC7D,sBAAuC,IAAI,aAA0D;EACpG,UAAU;EACV,WAAW;CACZ,CAAC;;;;;;CAMD,oBAAqC,IAAI,aAA+B;EACvE,UAAU;EACV,WAAW;EACX,WAAW;CACZ,CAAC;CAED,YAAY,QAA4C;EAA3B,KAAA,SAAA;EAC5B,KAAK,cAAc,OAAO,wBAAwB,KAAK,YAAY,CAAC;CACrE;CAEA,UAAgB;EACf,KAAK,aAAa,QAAQ;CAC3B;CAEA,cAA4B;EAC3B,KAAK,gBAAgB,MAAM;EAC3B,KAAK,oBAAoB,MAAM;EAC/B,KAAK,kBAAkB,MAAM;CAC9B;CAEA,MASa,wBACZ,UACA,OACA,OACA,MACA,QACA,SAGmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GA8BH,MAAM,OAjBY,MAZK,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,uEAAuE,mBAAmB,cAAc,QAAQ,KACnP,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAG4B,MAAM,MAAM,GAAG,MAAM;IAEhD,MAAM,UAAU,EAAE,WAAW,YAAY,EAAE,WAAW;IAGtD,IAAI,aAFY,EAAE,WAAW,YAAY,EAAE,WAAW,WAGrD,OAAO,UAAU,KAAK;IAKvB,MAAM,QAAQ,IAAI,KAAK,EAAE,cAAc,EAAE,YAAY;IAGrD,OAAO,IAFW,KAAK,EAAE,cAAc,EAAE,YAE9B,CAAC,CAAC,QAAQ,IAAI,MAAM,QAAQ;GACxC,CAAC,EAAA,GAEsB;GACvB,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,OAAO,MAAM,KAAK,cAAc,IAAI,UAAU,OAAO,OAAO,QAAQ,SAAS,KAAK;EACnF,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MAUM,wBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAGA,cACmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,IAAI;GAqBH,MAAM,MAAK,MApBY,KAAK,QAC3B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,oCACnI;IACC,QAAQ;IACR,MAAM,KAAK,UAAU,EACpB,SAAS,CACR;KACC,OAAO,CAAC,GAAG;KACX,MAAM;IACP,CACD,EACD,CAAC;GACF,GACA,OACA,YACD,EAAA,EAEqB,QAAQ,EAAE,GAAG,IAAI,GAAG;GACzC,IAAI,MAAM,MAAM,OAAO,KAAA;GAEvB,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,GAAG,WAAW,QAAQ,EAAE,EAAE,0BAA0B,uBAAuB,GAAG,WAAW,EAAE,EAAE,gBAAgB,uBAAuB,GAAG,cAAc,SAAS,CAAC,KAC1N,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,IAAI,eAAe,MAAM,OAAO,KAAA;GAEhC,OAAO,MAAM,KAAK,cAAc,aAAa,UAAU,OAAO,OAAO,SAAS,OAAO,YAAY;EAClG,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf;EACD;CACD;CAEA,MASa,eACZ,UACA,OACA,OACA,eACA,IACA,SACmC;EACnC,MAAM,QAAQ,gBAAgB;EAI9B,MAAM,cAAc,cAAc,MAAM,GAAG,CAAC,CAAC;EAE7C,IAAI;GACH,MAAM,KAAK,MAAM,KAAK,QACrB,UACA,OACA,QAAQ,SACR,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,EAAE,KAC3H,EACC,QAAQ,MACT,GACA,KACD;GAEA,OAAO,MAAM,OACV,MAAM,KAAK,cAAc,IAAI,UAAU,OAAO,OAAO,QAAQ,SAAS,KAAK,IAC3E,KAAA;EACJ,SAAS,IAAI;GAGZ,IAAI,GAAG,UAAU,WAAW,KAAK,OAAO,KAAA;GAExC,MAAM;EACP;CACD;CAEA,MASa,sBACZ,UACA,OACA,OACA,MACA,IACA,SAI0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,SACpD,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,uBAAuB,uBAAuB,EAAE,KACxH,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,OACA,aACA,OACD;IAEA,OAAO;KACN,IAAI,YAAY,GAAG,SAAS;KAC5B,MAAM;KACN,QAAQ,YAAY,GAAG,SAAS;KACtB;KACV,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,aAAa,IAAI,KAAK,YAAY,OAAO,qBAAqB;KAC9D,OAAO,mCAAmC,aAAa;KACvD,QAAQ,mCAAmC,aAAa;KACxD,OAAO,YAAY,OAAO;KAC1B,KAAK,YAAY,OAAO,KAAK;IAC9B;GACD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;EAGD,IAAI,SAAS,SAAS,KAAA,KAAa,SAAS,SAAS,eACpD,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,gBAAgB,uBAAuB,EAAE,KAC5K,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,YAAY,MACf,OAAO;IACN,IAAI,SAAS,cAAc,SAAS;IACpC,MAAM;IACN,QAAQ,SAAS,cAAc,SAAS;IAC9B;IACV,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,aAAa,IAAI,KAAK,SAAS,YAAY;IAC3C,OAAO,8BAA8B,SAAS,MAAM;IACpD,QAAQ,+BAA+B,SAAS,MAAM;IACtD,OAAO,SAAS;IAChB,KAAK,0BAA0B,UAAU,QAAQ,SAAS,KAAK;GAChE;GAGD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGF;CAEA,MAQa,SACZ,UACA,OACA,SACA,IACA,SAG6B;EAC7B,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAEH,MAAM,cAAc,MAAM,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,QAAQ,YAAY,EAAE,GAAG,uBAAuB,QAAQ,IAAI,EAAE,uBAAuB,uBAAuB,EAAE,KACxI,EACC,QAAQ,MACT,GACA,KACD;GAEA,IAAI,eAAe,MAAM;IACxB,MAAM,YAAY,YAAY,OAAO;IACrC,MAAM,QAAQ,YAAY,OAAO;IACjC,MAAM,gBAAgB,MAAM,KAAK,yBAChC,WACA,OACA,UACA,OACA,QAAQ,cACR,QAAQ,MACR,OACD;IACA,OAAO,kBAAkB,aAAa,UAAU,SAAS,eAAe,OAAO;GAChF;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;CAEA,MAUM,oBACL,UACA,OACA,OACA,MACA,KACA,SACA,UAG0C;EAC1C,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EAErE,IAAI;GAYH,MAAM,UAAS,MAVM,KAAK,QACzB,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,WAAW,uBAAuB,GAAG,KACxK,EACC,QAAQ,MACT,GACA,KACD,EAAA,EACuB;GACvB,IAAI,CAAC,QACJ;GAGD,OAAO;IACI;IACV,IAAI,KAAA;IACJ,UAAU,KAAA;IACV,MAAM,QAAQ;IACd,OAAO,QAAQ;IACf,WAAW,KAAA;GACZ;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,IAAI,GAAG,UAAU,WAAW,KAAK;IAChC,OAAO,MAAM,EAAE;IACf;GACD;EACD;CAGD;;;;;;;;;;CAWA,MAOM,uBACL,UACA,OACA,SACoD;EACpD,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,iBAAiB,MAAM,KAAK,QACjC,UACA,OACA,SACA,wBACA,EAAE,QAAQ,MAAM,GAChB,KACD;EACA,MAAM,UAAU,gBAAgB,iCAAiC,MAAM,GAAG,CAAC,CAAC,SAAS,OAAO;EAC5F,MAAM,YAAY,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,CAAC,CAAC,SAAS,OAAO;EACvE,IAAI,WAAW,QAAQ,aAAa,QAAQ,gBAAgB,cAAc,MAAM,OAAO,KAAA;EAEvF,MAAM,OAAO,kBAAkB,OAAO;EACtC,IAAI,KAAK,YAAY,MAAM,kBAAkB,SAAS,CAAC,CAAC,YAAY,GAAG,OAAO,KAAA;EAE9E,OAAO;GAAE,IAAI,eAAe;GAAkB;EAAK;CACpD;CAEA,MAOM,uBACL,UACA,OACA,SAC4G;EAC5G,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GA6BH,MAAM,QAAO,MA5BgB,KAAK,QAkBjC,UACA,OACA,SACA,wBACA,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAE6B;GAC7B,MAAM,WAAW,MAAM,YAAY,SAAS;GAC5C,IAAI,CAAC,UACJ;GAGD,OAAO;IACN,IAAI,KAAK;IACT,MAAM,KAAK;IACX,OAAO,KAAK;IACF;GACX;EACD,SAAS,IAAI;GAEZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,IAAI,mCAAmC,SAAS;GAC7D;EACD;CACD;CAEA,MAAM,yBACL,WACA,OACA,UACA,OACA,OACA,aACA,SAGkD;EAGlD,MAAM,UAAU,KAAK,UAAU;GAAC,QAAQ;GAAS;GAAO;EAAW,CAAC;EACpE,MAAM,WAAW,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;EAChF,IAAI,YAAY,MAAM,OAAO;EAE7B,MAAM,SAAS,MAAM,KAAK,2BAA2B,WAAW,UAAU,OAAO,OAAO,aAAa,OAAO;EAC5G,KAAK,gBAAgB,eAAe,SAAS,WAAW,MAAM;EAE9D,OAAO,KAAK,gBAAgB,iBAAiB,SAAS,WAAW,KAAK;CACvE;CAEA,MAAc,2BACb,cACA,UACA,OACA,OACA,aACA,SAGgC;EAChC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GAYH,QAAO,MAXmB,KAAK,QAC9B,UACA,OACA,SAAS,SACT,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,2BAA2B,uBAAuB,YAAY,EAAE,UACxI,EACC,QAAQ,MACT,GACA,KACD,EAAA,EAEoB,SAAS,CAAC;EAC/B,SAAS,IAAI;GAIZ,IAAI,cAAc,qBAAqB,MAAM;GAE7C,OAAO,MAAM,EAAE;GACf,OAAO,CAAC;EACT;CACD;CAEA,MAQM,sBACL,UACA,OACA,OACA,MACA,SAGA,cAC0C;EAC1C,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,YAAY,MAAM,OAAO,KAAA;GAK7B,OAAO;IACI;IACH;IAEP,MAAM,SAAS;IACf,QAAQ,SAAS,UAAU;IAC3B,QACC,SAAS,UAAU,SAAS,kBAAkB,QAAQ,OACnD;KAAS;KAAO,MAAM,SAAS,iBAAiB;IAAK,IACrD,KAAA;GACL;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;CAEA,MAQM,iBACL,UACA,OACA,OACA,MACA,SAGA,cACqC;EACrC,MAAM,QAAQ,gBAAgB;EAE9B,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,cAC3B,UACA,OACA,OACA,MACA,QAAQ,SACR,OACA,YACD;GACA,IAAI,UAAU,iBAAiB,MAAM,OAAO,KAAA;GAE5C,OAAO;IACI;IACV,MAAM,yBAAyB,SAAS,aAAa;GACtD;EACD,SAAS,IAAI;GAGZ,IAAI,cAAc,qBAAqB,MAAM;GAG7C,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,cAAc,uBAC/C,OAAO,MAAM,EAAE;GAEhB;EACD;CACD;;;;;;;;;;;;;;;;;;;;CAqBA,MAOM,oBACL,UACA,OACA,YACA,SAQA,cACmC;EACnC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,OAAO,0BACZ,QAAQ,UACR,mBAAmB,QAAQ,UAAU,IAAI,GACzC,QAAQ,YACT;EACA,MAAM,MAAM,+BAA+B,YAAY,IAAI;EAC3D,MAAM,WAAW,sBAAsB,QAAQ,UAAU,KAAA,GAA4B;EACrF,MAAM,SAAS,+BAA+B,QAAQ,QAAQ,KAAK,QAAQ;EAC3E,MAAM,OAAO,QAAQ,QAAQ;EAO7B,MAAM,WAAW,QAAQ,YAAY,KAAK;EAC1C,MAAM,cAAc,KAAK,UAAU;GAClC,MAAM,OAAO,MAAM,WAAW;GAC9B,QAAQ;GACR;GACA;GACA;EACD,CAAC;EAED,MAAM,gBAAgB,QAAQ,YAAY,OAAO,KAAK,kBAAkB,IAAI,WAAW,IAAI,KAAA;EAC3F,IAAI,QAAQ,YAAY,QAAQ,iBAAiB,MAChD,MAAM,IAAI,MAAM,qEAAqE;EAGtF,MAAM,SAAS,OAAO,iBACrB,KAAK,kBAAkB,YACtB,cACC,YAAY,WACZ,KAAK,iBACJ,UACA,OACA,YACA,QAAQ,SACR,MAAA,OAEA,OACA,MACD,CAAC,CAAC,OAAO,OAAgB;GAGxB,IAAI,uBAAuB,EAAE,GAC5B,MAAM,IAAI,MACT,GAAG,SAAS,KAAK,gFAClB;GAGD,MAAM;EACP,CAAC,GACF,EAAgB,aAAa,CAC9B;EACD,MAAM,eAAe,OAAO,SAAS;EACrC,MAAM,MAAM,eAAe,OAAO,MAAM,GAAG,8BAA8B,IAAI;EAE7E,MAAM,SAAS,QAAQ,UAAU;EAEjC,MAAM,QAAQ,IAAI,MAAM,QAAQ,SAAS,QAAQ;EACjD,MAAM,SAAkB,CAAC;EACzB,IAAI,MAAM,SAAS,GAAG;GACrB,MAAM,YAAY,MAAM,KAAK,QAC5B,UACA,OACA,QAAQ,SACR,GAAG,uBAAuB,UAAU,EAAE,4CACtC;IAAE,QAAQ;IAAQ,MAAM,KAAK,UAAU;KAAE,KAAK;KAAO,SAAS;KAAS,aAAa;IAAO,CAAC;GAAE,GAC9F,OACA,YACD;GACA,MAAM,OAAO,IAAI,KAAK,WAAW,SAAS,CAAC,EAAA,CAAG,QAAO,MAAK,KAAK,IAAI,CAAC,CAAC,KAAI,MAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;GACxF,KAAK,MAAM,MAAM,OAAO;IAGvB,MAAM,WAAW,KAAK,IAAI,EAAE;IAC5B,IAAI,YAAY,MAAM;IAEtB,MAAM,cAAc,SAAS,OAAO;IACpC,MAAM,UAAU,QAAQ,eAAe,WAAW;IAClD,IAAI,WAAW,MACd,MAAM,IAAI,MAAM,0BAA0B,GAAG,kBAAkB,YAAY,uBAAuB;IAGnG,MAAM,gBAAgB,MAAM,KAAK,yBAChC,SAAS,OAAO,wBAChB,SAAS,OAAO,iBAChB,UACA,OACA,YACA,QAAQ,MACR,OACD;IACA,OAAO,KAAK,kBAAkB,UAAU,UAAU,SAAS,eAAe,QAAQ,CAAC;GACpF;EACD;EAEA,MAAM,aAAa,SAAS,MAAM;EAClC,MAAM,UAAU,aAAa,IAAI;EACjC,MAAM,OAAkC;GAAO;GAAe;GAAU,QAAQ;GAAY,MAAM,OAAO;EAAE;EAC3G,OAAO;GACE;GACR,QAAQ,UAAU,KAAK,UAAU,IAAI,IAAI,KAAA;GAChC;GACH;GACN,WAAW;GACX,YAAY,eAAe,KAAA,IAAY,IAAI;GAC3C,cAAc,gBAAgB,KAAA;EAC/B;CACD;;;;;;;CAQA,MAOM,eACL,UACA,OACA,YACA,SACA,cACoC;EACpC,MAAM,QAAQ,gBAAgB;EAC9B,MAAM,OAAO,0BACZ,QAAQ,UACR,mBAAmB,QAAQ,UAAU,IAAI,GACzC,QAAQ,YACT;EACA,IAAI;GACH,MAAM,MAAM,MAAM,KAAK,iBACtB,UACA,OACA,YACA,QAAQ,SACR,MACA,iCAAiC,GACjC,OACA,YACD;GACA,OAAO,IAAI,SAAA,MAA0C,kBAAkB,IAAI;EAC5E,SAAS,IAAI;GACZ,IAAI,uBAAuB,EAAE,GAAG,OAAO;GAEvC,MAAM;EACP;CACD;;;;;;;CAQA,MAAc,iBACb,UACA,OACA,YACA,SACA,MACA,KACA,OACA,cACoB;EACpB,MAAM,SAAS,MAAM,KAAK,QACzB,UACA,OACA,SACA,GAAG,uBAAuB,UAAU,EAAE,uBAAuB,IAAI,sCACjE;GAAE,QAAQ;GAAQ,MAAM,KAAK,UAAU,EAAE,OAAO,KAAK,CAAC;EAAE,GACxD,OACA,YACD;EACA,IAAI,QAAQ,aAAa,MAAM,MAAM,IAAI,MAAM,iDAAiD;EAEhG,OAAO,OAAO,UAAU,KAAI,MAAK,EAAE,EAAE;CACtC;CAEA,cACC,UACA,OACA,OACA,MACA,SACA,OACA,cACmD;EACnD,MAAM,EAAE,aAAa,aAAa,+BAA+B,IAAI;EACrE,OAAO,KAAK,QACX,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,GAAG,uBAAuB,WAAW,EAAE,0BAA0B,uBAAuB,QAAQ,EAAE,mBACnI,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;CACD;CAEA,MAAc,cACb,IACA,UACA,OACA,OACA,SACA,OACA,cACuB;EACvB,MAAM,qBAAqB,MAAM,KAAK,sBACrC,UACA,OACA,OACA,SACA,GAAG,YAAY,YACf,OACA,YACD;EAEA,OAAO,qBAAqB,IAAI,UAAU,OAAO,SAAS,oBAAoB,OAAO;CACtF;;;;;;;;;;CAWA,MAAc,sBACb,UACA,OACA,OACA,SACA,YACA,OACA,cAC+C;EAC/C,IAAI,cAAc,MAAM,OAAO,KAAA;EAE/B,IAAI;EACJ,IAAI;GACH,YAAY,MAAM,OAAO,MAAM,WAAW;EAC3C,QAAQ;GACP;EACD;EAEA,MAAM,WAAW,KAAK,UAAU;GAAC;GAAW;GAAS;GAAO,WAAW;EAAE,CAAC;EAG1E,OAAO,KAAK,oBAAoB,YAC/B,WACC,WAAW,cACX,KAAK,wBACJ,UACA,OACA,OACA,SACA,WAAW,IACX,WACA,OACA,SACD,GACD,EAAgB,aAAa,CAC9B;CACD;CAEA,MAAc,wBACb,UACA,OACA,OACA,SACA,cACA,WACA,OACA,cAC+C;EAC/C,IAAI;GACH,MAAM,WAAW,MAAM,KAAK,QAC3B,UACA,OACA,SACA,GAAG,uBAAuB,KAAK,EAAE,0BAA0B,uBAAuB,YAAY,EAAE,mBAChG,EAAE,QAAQ,MAAM,GAChB,OACA,YACD;GACA,MAAM,SAAS,2BAA2B,UAAU,QAAQ,SAAS,KAAK;GAC1E,MAAM,aAAa,2BAA2B,UAAU,WAAW,SAAS,KAAK;GAIjF,MAAM,MAAM,UAAU;GACtB,IAAI,OAAO,MAAM;IAChB,UAAU,WAAW;IACrB;GACD;GAEA,OAAO;IAAO;IAAiB;GAAW;EAC3C,SAAS,IAAI;GAEZ,IAAI,EAAE,cAAc,yBAAyB,EAAE,cAAc,sBAC5D,UAAU,WAAW;GAGtB,MAAM,SAAS,cAAc,qBAAqB,KAAK,GAAG,OAAO,KAAK;GACtE,OAAO,KAAK,6CAA6C,QAAQ;GACjE;EACD;CACD;CAEA,MAAc,QACb,UACA,OACA,SACA,OACA,SACA,OACA,cACyB;EACzB,MAAM,EAAE,gBAAgB;EACxB,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,UAAU;EAE9C,IAAI;EACJ,IAAI;GACH,MAAM,KAAK,eAAe,WAAW,SAAS,UAAU,MAAM,WAAW,EAAE,KAAK,EAAE,UAAU,KAAK,EAAE,CAAC;GAEpG,IAAI;IACH,IAAI,cAAc,SAAS,MAAM,IAAI,kBAAkB;IAEvD,MAAM,MAAM,KAAK,OAAO,yBAAyB,SAAS,mBAAmB,SAC5E,KAAK,OAAO,MAAM,KAAK;KACtB,SAAS;MACR,eAAe,SAAS,OAAO,OAAO,aAAa;MACnD,gBAAgB;KACjB;KACA,QAAQ;KACR,GAAG;IACJ,CAAC,CACF;IAEA,IAAI,IAAI,IAAI;KAMX,KADoB,IAAI,QAAQ,IAAI,cAAc,CAAC,EAAE,YAAY,KAAK,GAAA,CACtD,WAAW,WAAW,GAAG;MACxC,MAAM,EAAE,aAAa,cAAc,GAAG,cAAc;MACpD,MAAM,IAAI,oBACT,WAAA,mBAEA,IAAI,MAAM,IAAI,IAAI,OAAO,uDAAuD,CACjF;KACD;KAEA,OAAQ,MAAM,IAAI,KAAK;IACxB;IAGA,MAAM,MAAM,mBAAmB,aAAa,eAAe,GAAG;GAC/D,UAAU;IACT,IAAI,KAAK;GACV;EACD,SAAS,IAAI;GACZ,IAAI,cAAc,sBAAsB,GAAG,SAAS,cACnD,KAAK,mBAAmB,UAAU,OAAO,IAAI,KAAK;QAC5C,IAAIA,QAAO,aACjB,KAAK,OAAO,UAAU,+BAA+B,GAAG,SAAS;GAGlE,MAAM;EACP;CACD;CAEA,mBACC,UACA,OACA,IACA,OACO;EACP,IAAI,GAAG,SAAS,gBAAgB,EAAE,cAAc,qBAAqB,MAAM,IAAI,kBAAkB,EAAE;EAEnG,MAAM,EAAE,aAAa,GAAG,cAAc;EACtC,QAAQ,GAAG,QAAX;GACC,KAAK;GACL,KAAK;GACL,KAAK,KACJ,MAAM,IAAI,qBAAqB,EAAE;GAClC,KAAK,KACJ,MAAM,IAAI,oBAAoB,WAAA,GAAmD,EAAE;GACpF,KAAK,KACJ,MAAM,iBAAiB,IAAI,WAAW;GACvC,KAAK;IAKJ,IAAI,oBAAoB,EAAE,GAAG,MAAM,iBAAiB,IAAI,WAAW;IAEnE,MAAM,IAAI,oBAAoB,WAAA,GAAgD,EAAE;GACjF,KAAK;IACJ,OAAO,MAAM,EAAE;IACf,IAAI,GAAG,YAAY,MAAM;KACxB,UAAU,sBAAsB;KAChC,KAAK,OAAO,kBACX,YAAY,QAAQ,SAAS,OAAO,UACjC,KAAK,EACL,0JACA,UAAU,QAAQ,aACnB,IACC,KAAK,EAAE,2DAA2D,SAAS,IAAI,CACnF;IACD;IACA;GACD,KAAK;IACJ,OAAO,MAAM,EAAE;IAOf;GACD,SACC,IAAI,GAAG,UAAU,OAAO,GAAG,SAAS,KAAK,MAAM,IAAI,mBAAmB,EAAE;EAE1E;EAEA,OAAO,MAAM,EAAE;EACf,IAAIA,QAAO,aACV,KAAK,OAAO,UACX,+BAAgC,GAAG,UAAkB,SAAS,EAAE,EAAE,WAAW,GAAG,SACjF;CAEF;AACD;AA9pCE,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,YAAY;CAChD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACE;AACT,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA0DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,2BAAA,IAAA;AA6DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,eAAe,QAAQ;CACrD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACQ;CACX;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,kBAAA,IAAA;AAuCA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,QAAQ;CAC5C,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACF;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AA8GA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,SAAS,QAAQ;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;CACL;AACL,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,YAAA,IAAA;AAqDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,MAAM,KAAK,aAAa;CACtD,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;CACD;CACI;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,uBAAA,IAAA;AA+DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,aAAa;CACpC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,0BAAA,IAAA;AAyBA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,aAAa;CACpC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACxB;AACV,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,0BAAA,IAAA;AAqHA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,yBAAA,IAAA;AAoDA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,OAAO,UAAU;CACxC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CAC1B;CACD;AACP,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,oBAAA,IAAA;AA6DA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,gBAAgB;CACvC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACrB;AACb,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,uBAAA,IAAA;AAsIA,WAAA,CAAA,MAAM,EACN,OAAO,UAAU,OAAO,gBAAgB;CACvC,UAAU,SAAS;CACnB,OAAO,UAAU,MAAM,UAAU;CACrB;AACb,GACD,CAAC,CAAA,GAAA,eAAA,WAAA,kBAAA,IAAA;;AAqUF,SAAgB,qBAAqB,KAAgD;CACpF,OAAO,IAAI,eAAe,sBAAsB,GAAG,CAAC;AACrD"}