@gitkraken/core-gitlens 0.10.4 → 0.10.6

package/dist/plus/integrations/authentication/models.js.map

@@ -1 +1 @@
-{"version":3,"file":"models.js","names":[],"sources":["../../../../../plus/integrations/src/authentication/models.ts"],"sourcesContent":["import { microhash } from '@gitlens/utils/hash.js';\nimport type { IntegrationIds, SupportedCloudIntegrationIds } from '../constants.js';\nimport {\n\tGitCloudHostIntegrationId,\n\tGitSelfManagedHostIntegrationId,\n\tIssuesCloudHostIntegrationId,\n\tIssuesSelfManagedHostIntegrationId,\n\tsupportedOrderedCloudIntegrationIds,\n} from '../constants.js';\n\n/**\n * Mirrors the shape of `vscode.AuthenticationSession` so the integrations\n * package can stay vscode-free. Host adapters bridge VS Code sessions to\n * this shape via {@link AuthenticationProvider}.\n */\nexport interface AuthenticationSessionLike {\n\treadonly id: string;\n\treadonly accessToken: string;\n\treadonly account: { readonly id: string; readonly label: string };\n\treadonly scopes: readonly string[];\n}\n\nexport interface ProviderAuthenticationSession extends AuthenticationSessionLike {\n\treadonly cloud: boolean;\n\treadonly type: CloudIntegrationAuthType | undefined;\n\treadonly expiresAt?: Date;\n\treadonly domain: string;\n\t/**\n\t * The connection's address exactly as it was configured, path and all, when that differs from\n\t * {@link domain}.\n\t *\n\t * `domain` is the IDENTITY a self-managed connection is keyed by, so it is normalized to a bare host\n\t * (`hostFromDomain`) and one host cannot key two connections. An instance mounted below a context path —\n\t * Jira Data Center's `/jira`, a reverse-proxied GitLab or Bitbucket — still has to be ADDRESSED at that\n\t * path, and normalizing it away is what made every request go to the root. Absent when the backend\n\t * reported nothing beyond the host, which is the common case.\n\t */\n\treadonly baseUrl?: string;\n\treadonly protocol?: string;\n\t/** The provider app key paired with the token for providers whose client needs one (e.g. Trello). */\n\treadonly appKey?: string;\n}\n\nexport interface TokenInfo<T extends IntegrationIds | 'gitkraken' = IntegrationIds | 'gitkraken'> {\n\treadonly providerId: T;\n\t/**\n\t * The first 3 characters of the md5 hash of the token.\n\t * It's a very obfuscated representation of the token that we can use in logs\n\t * to see whether the token survives refreshing or gets updated.\n\t */\n\treadonly microHash: string | undefined;\n\treadonly cloud: boolean;\n\treadonly type: CloudIntegrationAuthType | undefined;\n\treadonly scopes: readonly string[] | undefined;\n\treadonly expiresAt?: Date;\n}\n\nexport interface TokenWithInfo<T extends IntegrationIds = IntegrationIds> extends TokenInfo<T> {\n\treadonly accessToken: string;\n}\n\nexport function toTokenInfo<T extends IntegrationIds | 'gitkraken'>(\n\tproviderId: T,\n\taccessToken: string | undefined,\n\tinfo: { cloud: boolean; type: CloudIntegrationAuthType | undefined; scopes?: readonly string[]; expiresAt?: Date },\n): TokenInfo<T> {\n\treturn {\n\t\tproviderId: providerId,\n\t\tmicroHash: microhash(accessToken, 3),\n\t\tcloud: info.cloud,\n\t\ttype: info.type,\n\t\tscopes: info.scopes,\n\t\texpiresAt: info.expiresAt,\n\t};\n}\n\nexport function toTokenWithInfo<T extends IntegrationIds>(\n\tproviderId: T,\n\tsession: ProviderAuthenticationSession,\n\taltToken?: string,\n): TokenWithInfo<T> {\n\tconst { accessToken: sessionToken, ...sessionInfo } = session;\n\tconst accessToken = altToken ?? session.accessToken;\n\treturn {\n\t\t// pass original token info to form the correlated microhash\n\t\t...toTokenInfo(providerId, sessionToken, sessionInfo),\n\t\t// use the actual token used for the request\n\t\taccessToken: accessToken,\n\t};\n}\n\nexport type TokenOptInfo<T extends IntegrationIds = IntegrationIds> =\n\t| TokenWithInfo<T>\n\t// `connectionId` targets a specific connection (multi-account) when the token still has to be resolved.\n\t// Omitted resolves the provider's primary connection, preserving the pre-multi-account behavior.\n\t| { providerId: T; accessToken?: undefined; connectionId?: string };\n\nexport interface ConfiguredIntegrationDescriptor {\n\t/**\n\t * Stable per-connection identifier, distinct from the domain, so multiple accounts can be\n\t * connected to the same provider+domain simultaneously. For legacy/migrated single connections\n\t * this is the domain (self-managed) or the provider's canonical domain (cloud), which keeps the\n\t * existing secret key (`integration.auth[.cloud]:{id}|{domain}`) valid with zero migration.\n\t */\n\treadonly id: string;\n\t/**\n\t * Whether this is the connection used by default for the provider. Optional: when no descriptor\n\t * for a provider+domain carries an explicit flag, the first one is treated as primary. Only\n\t * {@link ConfiguredIntegrationService.setPrimaryConnection} sets the flag (and clears it on siblings).\n\t */\n\treadonly primary?: boolean;\n\t/** The connection's auth type (`oauth`/`pat`), when known. */\n\treadonly type?: CloudIntegrationAuthType;\n\t/**\n\t * Human-readable account handle for this connection (e.g. the GitHub login). Resolved from the\n\t * provider API (the token backend doesn't expose it); absent until resolved or if the lookup fails.\n\t */\n\treadonly accountName?: string;\n\treadonly cloud: boolean;\n\treadonly integrationId: IntegrationIds;\n\treadonly scopes: string;\n\treadonly domain?: string;\n\t/**\n\t * The address this connection was configured with, path included — see\n\t * {@link ProviderAuthenticationSession.baseUrl}.\n\t *\n\t * Mirrored onto the descriptor so reconciliation can tell a re-pointed connection from an unchanged one\n\t * without reading its secret: {@link domain} is normalized to a bare host, so a backend connection moved\n\t * from one context path to another on the SAME host looks identical by domain alone.\n\t */\n\treadonly baseUrl?: string;\n\treadonly expiresAt?: string | Date;\n}\n\nexport interface CloudIntegrationAuthenticationSession {\n\ttype: CloudIntegrationAuthType;\n\taccessToken: string;\n\tdomain: string;\n\texpiresIn: number;\n\tscopes: string;\n\t/** Backend per-connection token identifier, when the provider-tokens backend supports multi-account. */\n\tid?: string;\n\t/** Provider app key paired with the token (e.g. Trello app key), when the backend supplies one. */\n\tappKey?: string;\n}\n\nexport interface CloudIntegrationAuthorization {\n\turl: string;\n}\n\nexport interface CloudIntegrationConnection {\n\ttype: CloudIntegrationAuthType;\n\tprovider: CloudIntegrationType;\n\tdomain: string;\n\t/** Backend per-connection token identifier, when the provider-tokens backend supports multi-account. */\n\tid?: string;\n\t/** Whether the backend marks this connection as the primary/default for the provider. */\n\tprimary?: boolean;\n\t/** Human-readable account handle, when the backend provides it on the connection (may be absent). */\n\taccountName?: string;\n}\n\nexport type CloudIntegrationType =\n\t| 'jira'\n\t| 'jiraServer'\n\t| 'linear'\n\t| 'trello'\n\t| 'gitlab'\n\t| 'github'\n\t| 'bitbucket'\n\t| 'bitbucketServer'\n\t| 'azure'\n\t| 'azureDevopsServer'\n\t| 'githubEnterprise'\n\t| 'gitlabSelfHosted';\n\nexport type CloudIntegrationAuthType = 'oauth' | 'pat';\n\nexport const CloudIntegrationAuthenticationUriPathPrefix = 'did-authenticate-cloud-integration';\n\n/** Returns all supported cloud integration ids. */\nexport function getSupportedCloudIntegrationIds(): readonly SupportedCloudIntegrationIds[] {\n\t// Return the shared const directly (readonly so callers can't mutate it) — this runs on hot,\n\t// per-integration membership paths, so avoid allocating a fresh array per call.\n\treturn supportedOrderedCloudIntegrationIds;\n}\n\n/** Whether `id` is a supported cloud integration id. */\nexport function isSupportedCloudIntegrationId(id: string): id is SupportedCloudIntegrationIds {\n\treturn getSupportedCloudIntegrationIds().includes(id as SupportedCloudIntegrationIds);\n}\n\nexport function isIssueCloudIntegrationId(id: string): id is IssuesCloudHostIntegrationId {\n\tconst issueIds: string[] = Object.values(IssuesCloudHostIntegrationId);\n\treturn issueIds.includes(id);\n}\n\nexport const toIntegrationId: { [key in CloudIntegrationType]: IntegrationIds } = {\n\tjira: IssuesCloudHostIntegrationId.Jira,\n\tjiraServer: IssuesSelfManagedHostIntegrationId.JiraServer,\n\tlinear: IssuesCloudHostIntegrationId.Linear,\n\ttrello: IssuesCloudHostIntegrationId.Trello,\n\tgitlab: GitCloudHostIntegrationId.GitLab,\n\tgithub: GitCloudHostIntegrationId.GitHub,\n\tgithubEnterprise: GitSelfManagedHostIntegrationId.CloudGitHubEnterprise,\n\tgitlabSelfHosted: GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted,\n\tbitbucket: GitCloudHostIntegrationId.Bitbucket,\n\tbitbucketServer: GitSelfManagedHostIntegrationId.BitbucketServer,\n\tazure: GitCloudHostIntegrationId.AzureDevOps,\n\tazureDevopsServer: GitSelfManagedHostIntegrationId.AzureDevOpsServer,\n};\n\nexport const toCloudIntegrationType: { [key in IntegrationIds]: CloudIntegrationType | undefined } = {\n\t[IssuesCloudHostIntegrationId.Jira]: 'jira',\n\t[IssuesSelfManagedHostIntegrationId.JiraServer]: 'jiraServer',\n\t[IssuesCloudHostIntegrationId.Linear]: 'linear',\n\t[IssuesCloudHostIntegrationId.Trello]: 'trello',\n\t[GitCloudHostIntegrationId.GitLab]: 'gitlab',\n\t[GitCloudHostIntegrationId.GitHub]: 'github',\n\t[GitCloudHostIntegrationId.Bitbucket]: 'bitbucket',\n\t[GitCloudHostIntegrationId.AzureDevOps]: 'azure',\n\t[GitSelfManagedHostIntegrationId.AzureDevOpsServer]: 'azureDevopsServer',\n\t[GitSelfManagedHostIntegrationId.CloudGitHubEnterprise]: 'githubEnterprise',\n\t[GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted]: 'gitlabSelfHosted',\n\t[GitSelfManagedHostIntegrationId.BitbucketServer]: 'bitbucketServer',\n};\n"],"mappings":";;;AA6DA,SAAgB,YACf,YACA,aACA,MACe;CACf,OAAO;EACM;EACZ,WAAW,UAAU,aAAa,CAAC;EACnC,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,QAAQ,KAAK;EACb,WAAW,KAAK;CACjB;AACD;AAEA,SAAgB,gBACf,YACA,SACA,UACmB;CACnB,MAAM,EAAE,aAAa,cAAc,GAAG,gBAAgB;CACtD,MAAM,cAAc,YAAY,QAAQ;CACxC,OAAO;EAEN,GAAG,YAAY,YAAY,cAAc,WAAW;EAEvC;CACd;AACD;AAyFA,MAAa,8CAA8C;;AAG3D,SAAgB,kCAA2E;CAG1F,OAAO;AACR;;AAGA,SAAgB,8BAA8B,IAAgD;CAC7F,OAAO,gCAAgC,CAAC,CAAC,SAAS,EAAkC;AACrF;AAEA,SAAgB,0BAA0B,IAAgD;CAEzF,OAD2B,OAAO,OAAO,4BAC3B,CAAC,CAAC,SAAS,EAAE;AAC5B;AAEA,MAAa,kBAAqE;CACjF,MAAA;CACA,YAAA;CACA,QAAA;CACA,QAAA;CACA,QAAA;CACA,QAAA;CACA,kBAAA;CACA,kBAAA;CACA,WAAA;CACA,iBAAA;CACA,OAAA;CACA,mBAAA;AACD;AAEA,MAAa,yBAAwF;EAC/D,SAAA;EACY,gBAAA;EACV,WAAA;EACA,WAAA;EACH,WAAA;EACA,WAAA;EACG,cAAA;EACE,gBAAA;EACY,wBAAA;EACI,4BAAA;EACA,6BAAA;EACN,qBAAA;AACpD"}
+{"version":3,"file":"models.js","names":[],"sources":["../../../../../plus/integrations/src/authentication/models.ts"],"sourcesContent":["import { microhash } from '@gitlens/utils/hash.js';\nimport type { IntegrationIds, SupportedCloudIntegrationIds } from '../constants.js';\nimport {\n\tGitCloudHostIntegrationId,\n\tGitSelfManagedHostIntegrationId,\n\tIssuesCloudHostIntegrationId,\n\tIssuesSelfManagedHostIntegrationId,\n\tsupportedOrderedCloudIntegrationIds,\n} from '../constants.js';\n\n/**\n * Mirrors the shape of `vscode.AuthenticationSession` so the integrations\n * package can stay vscode-free. Host adapters bridge VS Code sessions to\n * this shape via {@link AuthenticationProvider}.\n */\nexport interface AuthenticationSessionLike {\n\treadonly id: string;\n\treadonly accessToken: string;\n\treadonly account: { readonly id: string; readonly label: string };\n\treadonly scopes: readonly string[];\n}\n\nexport interface ProviderAuthenticationSession extends AuthenticationSessionLike {\n\treadonly cloud: boolean;\n\treadonly type: CloudIntegrationAuthType | undefined;\n\treadonly expiresAt?: Date;\n\treadonly domain: string;\n\t/**\n\t * The connection's address exactly as it was configured, path and all, when that differs from\n\t * {@link domain}.\n\t *\n\t * `domain` is the IDENTITY a self-managed connection is keyed by, so it is normalized to a bare host\n\t * (`hostFromDomain`) and one host cannot key two connections. An instance mounted below a context path —\n\t * Jira Data Center's `/jira`, a reverse-proxied GitLab or Bitbucket — still has to be ADDRESSED at that\n\t * path, and normalizing it away is what made every request go to the root. Absent when the backend\n\t * reported nothing beyond the host, which is the common case.\n\t */\n\treadonly baseUrl?: string;\n\treadonly protocol?: string;\n\t/** The provider app key paired with the token for providers whose client needs one (e.g. Trello). */\n\treadonly appKey?: string;\n}\n\nexport interface TokenInfo<T extends IntegrationIds | 'gitkraken' = IntegrationIds | 'gitkraken'> {\n\treadonly providerId: T;\n\t/**\n\t * The first 3 characters of the md5 hash of the token.\n\t * It's a very obfuscated representation of the token that we can use in logs\n\t * to see whether the token survives refreshing or gets updated.\n\t */\n\treadonly microHash: string | undefined;\n\treadonly cloud: boolean;\n\treadonly type: CloudIntegrationAuthType | undefined;\n\treadonly scopes: readonly string[] | undefined;\n\treadonly expiresAt?: Date;\n}\n\nexport interface TokenWithInfo<T extends IntegrationIds = IntegrationIds> extends TokenInfo<T> {\n\treadonly accessToken: string;\n}\n\nexport function toTokenInfo<T extends IntegrationIds | 'gitkraken'>(\n\tproviderId: T,\n\taccessToken: string | undefined,\n\tinfo: { cloud: boolean; type: CloudIntegrationAuthType | undefined; scopes?: readonly string[]; expiresAt?: Date },\n): TokenInfo<T> {\n\treturn {\n\t\tproviderId: providerId,\n\t\tmicroHash: microhash(accessToken, 3),\n\t\tcloud: info.cloud,\n\t\ttype: info.type,\n\t\tscopes: info.scopes,\n\t\texpiresAt: info.expiresAt,\n\t};\n}\n\nexport function toTokenWithInfo<T extends IntegrationIds>(\n\tproviderId: T,\n\tsession: ProviderAuthenticationSession,\n\taltToken?: string,\n): TokenWithInfo<T> {\n\tconst { accessToken: sessionToken, ...sessionInfo } = session;\n\tconst accessToken = altToken ?? session.accessToken;\n\treturn {\n\t\t// pass original token info to form the correlated microhash\n\t\t...toTokenInfo(providerId, sessionToken, sessionInfo),\n\t\t// use the actual token used for the request\n\t\taccessToken: accessToken,\n\t};\n}\n\nexport type TokenOptInfo<T extends IntegrationIds = IntegrationIds> =\n\t| TokenWithInfo<T>\n\t// `connectionId` targets a specific connection (multi-account) when the token still has to be resolved.\n\t// Omitted resolves the provider's primary connection, preserving the pre-multi-account behavior.\n\t| { providerId: T; accessToken?: undefined; connectionId?: string };\n\nexport interface ConfiguredIntegrationDescriptor {\n\t/**\n\t * Stable per-connection identifier, distinct from the domain, so multiple accounts can be\n\t * connected to the same provider+domain simultaneously. For legacy/migrated single connections\n\t * this is the domain (self-managed) or the provider's canonical domain (cloud), which keeps the\n\t * existing secret key (`integration.auth[.cloud]:{id}|{domain}`) valid with zero migration.\n\t */\n\treadonly id: string;\n\t/**\n\t * Whether this is the connection used by default for the provider. Optional: when no descriptor\n\t * for a provider+domain carries an explicit flag, the first one is treated as primary. Only\n\t * {@link ConfiguredIntegrationService.setPrimaryConnection} sets the flag (and clears it on siblings).\n\t */\n\treadonly primary?: boolean;\n\t/** The connection's auth type (`oauth`/`pat`), when known. */\n\treadonly type?: CloudIntegrationAuthType;\n\t/**\n\t * Human-readable account handle for this connection (e.g. the GitHub login). Resolved from the\n\t * provider API (the token backend doesn't expose it); absent until resolved or if the lookup fails.\n\t */\n\treadonly accountName?: string;\n\t/**\n\t * Workspace the connection's token was granted for (Linear), separate from the person. Resolved with the\n\t * connection's own token and kept by connection id; both are set together, or neither is.\n\t */\n\treadonly resourceName?: string;\n\treadonly resourceId?: string;\n\treadonly cloud: boolean;\n\treadonly integrationId: IntegrationIds;\n\treadonly scopes: string;\n\treadonly domain?: string;\n\t/**\n\t * The address this connection was configured with, path included — see\n\t * {@link ProviderAuthenticationSession.baseUrl}.\n\t *\n\t * Mirrored onto the descriptor so reconciliation can tell a re-pointed connection from an unchanged one\n\t * without reading its secret: {@link domain} is normalized to a bare host, so a backend connection moved\n\t * from one context path to another on the SAME host looks identical by domain alone.\n\t */\n\treadonly baseUrl?: string;\n\treadonly expiresAt?: string | Date;\n}\n\nexport interface CloudIntegrationAuthenticationSession {\n\ttype: CloudIntegrationAuthType;\n\taccessToken: string;\n\tdomain: string;\n\texpiresIn: number;\n\tscopes: string;\n\t/** Backend per-connection token identifier, when the provider-tokens backend supports multi-account. */\n\tid?: string;\n\t/** Provider app key paired with the token (e.g. Trello app key), when the backend supplies one. */\n\tappKey?: string;\n}\n\nexport interface CloudIntegrationAuthorization {\n\turl: string;\n}\n\n/** Workspace a connection's token was granted for; only ever a complete pair. */\nexport interface ConnectionResource {\n\treadonly id: string;\n\treadonly name: string;\n}\n\nexport interface CloudIntegrationConnection {\n\ttype: CloudIntegrationAuthType;\n\tprovider: CloudIntegrationType;\n\tdomain: string;\n\t/** Backend per-connection token identifier, when the provider-tokens backend supports multi-account. */\n\tid?: string;\n\t/** Whether the backend marks this connection as the primary/default for the provider. */\n\tprimary?: boolean;\n\t/** Human-readable account handle, when the backend provides it on the connection (may be absent). */\n\taccountName?: string;\n}\n\nexport type CloudIntegrationType =\n\t| 'jira'\n\t| 'jiraServer'\n\t| 'linear'\n\t| 'trello'\n\t| 'gitlab'\n\t| 'github'\n\t| 'bitbucket'\n\t| 'bitbucketServer'\n\t| 'azure'\n\t| 'azureDevopsServer'\n\t| 'githubEnterprise'\n\t| 'gitlabSelfHosted';\n\nexport type CloudIntegrationAuthType = 'oauth' | 'pat';\n\nexport const CloudIntegrationAuthenticationUriPathPrefix = 'did-authenticate-cloud-integration';\n\n/** Returns all supported cloud integration ids. */\nexport function getSupportedCloudIntegrationIds(): readonly SupportedCloudIntegrationIds[] {\n\t// Return the shared const directly (readonly so callers can't mutate it) — this runs on hot,\n\t// per-integration membership paths, so avoid allocating a fresh array per call.\n\treturn supportedOrderedCloudIntegrationIds;\n}\n\n/** Whether `id` is a supported cloud integration id. */\nexport function isSupportedCloudIntegrationId(id: string): id is SupportedCloudIntegrationIds {\n\treturn getSupportedCloudIntegrationIds().includes(id as SupportedCloudIntegrationIds);\n}\n\nexport function isIssueCloudIntegrationId(id: string): id is IssuesCloudHostIntegrationId {\n\tconst issueIds: string[] = Object.values(IssuesCloudHostIntegrationId);\n\treturn issueIds.includes(id);\n}\n\nexport const toIntegrationId: { [key in CloudIntegrationType]: IntegrationIds } = {\n\tjira: IssuesCloudHostIntegrationId.Jira,\n\tjiraServer: IssuesSelfManagedHostIntegrationId.JiraServer,\n\tlinear: IssuesCloudHostIntegrationId.Linear,\n\ttrello: IssuesCloudHostIntegrationId.Trello,\n\tgitlab: GitCloudHostIntegrationId.GitLab,\n\tgithub: GitCloudHostIntegrationId.GitHub,\n\tgithubEnterprise: GitSelfManagedHostIntegrationId.CloudGitHubEnterprise,\n\tgitlabSelfHosted: GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted,\n\tbitbucket: GitCloudHostIntegrationId.Bitbucket,\n\tbitbucketServer: GitSelfManagedHostIntegrationId.BitbucketServer,\n\tazure: GitCloudHostIntegrationId.AzureDevOps,\n\tazureDevopsServer: GitSelfManagedHostIntegrationId.AzureDevOpsServer,\n};\n\nexport const toCloudIntegrationType: { [key in IntegrationIds]: CloudIntegrationType | undefined } = {\n\t[IssuesCloudHostIntegrationId.Jira]: 'jira',\n\t[IssuesSelfManagedHostIntegrationId.JiraServer]: 'jiraServer',\n\t[IssuesCloudHostIntegrationId.Linear]: 'linear',\n\t[IssuesCloudHostIntegrationId.Trello]: 'trello',\n\t[GitCloudHostIntegrationId.GitLab]: 'gitlab',\n\t[GitCloudHostIntegrationId.GitHub]: 'github',\n\t[GitCloudHostIntegrationId.Bitbucket]: 'bitbucket',\n\t[GitCloudHostIntegrationId.AzureDevOps]: 'azure',\n\t[GitSelfManagedHostIntegrationId.AzureDevOpsServer]: 'azureDevopsServer',\n\t[GitSelfManagedHostIntegrationId.CloudGitHubEnterprise]: 'githubEnterprise',\n\t[GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted]: 'gitlabSelfHosted',\n\t[GitSelfManagedHostIntegrationId.BitbucketServer]: 'bitbucketServer',\n};\n"],"mappings":";;;AA6DA,SAAgB,YACf,YACA,aACA,MACe;CACf,OAAO;EACM;EACZ,WAAW,UAAU,aAAa,CAAC;EACnC,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,QAAQ,KAAK;EACb,WAAW,KAAK;CACjB;AACD;AAEA,SAAgB,gBACf,YACA,SACA,UACmB;CACnB,MAAM,EAAE,aAAa,cAAc,GAAG,gBAAgB;CACtD,MAAM,cAAc,YAAY,QAAQ;CACxC,OAAO;EAEN,GAAG,YAAY,YAAY,cAAc,WAAW;EAEvC;CACd;AACD;AAqGA,MAAa,8CAA8C;;AAG3D,SAAgB,kCAA2E;CAG1F,OAAO;AACR;;AAGA,SAAgB,8BAA8B,IAAgD;CAC7F,OAAO,gCAAgC,CAAC,CAAC,SAAS,EAAkC;AACrF;AAEA,SAAgB,0BAA0B,IAAgD;CAEzF,OAD2B,OAAO,OAAO,4BAC3B,CAAC,CAAC,SAAS,EAAE;AAC5B;AAEA,MAAa,kBAAqE;CACjF,MAAA;CACA,YAAA;CACA,QAAA;CACA,QAAA;CACA,QAAA;CACA,QAAA;CACA,kBAAA;CACA,kBAAA;CACA,WAAA;CACA,iBAAA;CACA,OAAA;CACA,mBAAA;AACD;AAEA,MAAa,yBAAwF;EAC/D,SAAA;EACY,gBAAA;EACV,WAAA;EACA,WAAA;EACH,WAAA;EACA,WAAA;EACG,cAAA;EACE,gBAAA;EACY,wBAAA;EACI,4BAAA;EACA,6BAAA;EACN,qBAAA;AACpD"}

package/dist/plus/integrations/constants.d.ts

@@ -65,6 +65,10 @@ export interface StoredConfiguredIntegrationDescriptor {
   type?: CloudIntegrationAuthType;
   /** Human-readable account handle for this connection (e.g. the GitHub login), when resolved. */
   accountName?: string;
+  /** Workspace the token was granted for (Linear), separate from the person; set with {@link resourceId}. */
+  resourceName?: string;
+  /** Id of that workspace; set with {@link resourceName}, or neither is. */
+  resourceId?: string;
   cloud: boolean;
   integrationId: IntegrationIds;
   domain?: string;

package/dist/plus/integrations/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","names":[],"sources":["../../../../plus/integrations/src/constants.ts"],"sourcesContent":["import type { CloudIntegrationAuthType } from './authentication/models.js';\n\nexport const providerFanOutConcurrency = 6;\n\nexport enum GitCloudHostIntegrationId {\n\tGitHub = 'github',\n\tGitLab = 'gitlab',\n\tBitbucket = 'bitbucket',\n\tAzureDevOps = 'azureDevOps',\n}\n\nexport enum GitSelfManagedHostIntegrationId {\n\tBitbucketServer = 'bitbucket-server',\n\tCloudGitHubEnterprise = 'cloud-github-enterprise',\n\tCloudGitLabSelfHosted = 'cloud-gitlab-self-hosted',\n\tAzureDevOpsServer = 'azure-devops-server',\n}\n\nexport enum IssuesCloudHostIntegrationId {\n\tJira = 'jira',\n\tLinear = 'linear',\n\tTrello = 'trello',\n}\n\n/**\n * Issue trackers that live on a customer-run host rather than a single cloud endpoint, so every read must be\n * routed by the connection's own domain. Separate from {@link GitSelfManagedHostIntegrationId} because a\n * tracker has no repositories or pull requests: the two enums differ in what the id can be ASKED for, while\n * what they share — being keyed by host — is expressed by {@link SelfManagedHostIntegrationIds} and the\n * `isSelfManagedHostIntegrationId` predicate.\n */\nexport enum IssuesSelfManagedHostIntegrationId {\n\tJiraServer = 'jira-server',\n}\n\nexport type CloudGitSelfManagedHostIntegrationIds =\n\t| GitSelfManagedHostIntegrationId.CloudGitHubEnterprise\n\t| GitSelfManagedHostIntegrationId.BitbucketServer\n\t| GitSelfManagedHostIntegrationId.AzureDevOpsServer\n\t| GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted;\n\n/** The self-managed ids whose tokens are issued by the GK cloud backend, whatever they host. */\nexport type CloudSelfManagedHostIntegrationIds =\n\t| CloudGitSelfManagedHostIntegrationIds\n\t| IssuesSelfManagedHostIntegrationId.JiraServer;\n\nexport type GitHostIntegrationIds = GitCloudHostIntegrationId | GitSelfManagedHostIntegrationId;\nexport type IssuesHostIntegrationIds = IssuesCloudHostIntegrationId | IssuesSelfManagedHostIntegrationId;\n\n/** Every id addressed by host, across both families — what the domain-keyed machinery keys off. */\nexport type SelfManagedHostIntegrationIds = GitSelfManagedHostIntegrationId | IssuesSelfManagedHostIntegrationId;\n\nexport type IntegrationIds = GitHostIntegrationIds | IssuesHostIntegrationIds;\n\nexport const supportedOrderedCloudIntegrationIds = [\n\tGitCloudHostIntegrationId.GitHub,\n\tGitSelfManagedHostIntegrationId.CloudGitHubEnterprise,\n\tGitCloudHostIntegrationId.GitLab,\n\tGitSelfManagedHostIntegrationId.CloudGitLabSelfHosted,\n\tGitCloudHostIntegrationId.AzureDevOps,\n\tGitSelfManagedHostIntegrationId.AzureDevOpsServer,\n\tGitCloudHostIntegrationId.Bitbucket,\n\tGitSelfManagedHostIntegrationId.BitbucketServer,\n\tIssuesCloudHostIntegrationId.Jira,\n\tIssuesSelfManagedHostIntegrationId.JiraServer,\n\tIssuesCloudHostIntegrationId.Linear,\n\tIssuesCloudHostIntegrationId.Trello,\n];\n\n/**\n * The issue trackers of {@link supportedOrderedCloudIntegrationIds}, in the same order. Derived rather than\n * listed again: the two were parallel literals, and an id added to one and forgotten in the other drops that\n * tracker out of default project discovery and the Graph's issue-integration check with no other symptom.\n */\nexport const supportedOrderedCloudIssuesIntegrationIds = supportedOrderedCloudIntegrationIds.filter(\n\t(id): id is IssuesHostIntegrationIds =>\n\t\t// `Object.values`, not `in`: these are string enums, so the object is keyed by member name and `in`\n\t\t// would test the id against `Jira`/`Linear` rather than against `jira`/`linear`.\n\t\t(Object.values(IssuesCloudHostIntegrationId) as IntegrationIds[]).includes(id) ||\n\t\t(Object.values(IssuesSelfManagedHostIntegrationId) as IntegrationIds[]).includes(id),\n);\n\nexport const integrationIds = [\n\tGitCloudHostIntegrationId.GitHub,\n\tGitCloudHostIntegrationId.GitLab,\n\tGitCloudHostIntegrationId.Bitbucket,\n\tGitCloudHostIntegrationId.AzureDevOps,\n\tGitSelfManagedHostIntegrationId.AzureDevOpsServer,\n\tGitSelfManagedHostIntegrationId.BitbucketServer,\n\tGitSelfManagedHostIntegrationId.CloudGitHubEnterprise,\n\tGitSelfManagedHostIntegrationId.CloudGitLabSelfHosted,\n\tIssuesCloudHostIntegrationId.Jira,\n\tIssuesSelfManagedHostIntegrationId.JiraServer,\n\tIssuesCloudHostIntegrationId.Linear,\n\tIssuesCloudHostIntegrationId.Trello,\n];\n\nexport type SupportedCloudIntegrationIds = (typeof supportedOrderedCloudIntegrationIds)[number];\n\nexport function isSupportedCloudIntegrationId(id: IntegrationIds): id is SupportedCloudIntegrationIds {\n\treturn supportedOrderedCloudIntegrationIds.includes(id);\n}\n\nexport function isIntegrationId(id: string): id is IntegrationIds {\n\treturn integrationIds.includes(id as IntegrationIds);\n}\n\nexport type IntegrationFeatures = 'prs' | 'issues';\n\nexport interface IntegrationDescriptor {\n\tid: SupportedCloudIntegrationIds;\n\tname: string;\n\ticon: string;\n\tsupports: IntegrationFeatures[];\n\trequiresPro: boolean;\n}\n\n/** Stored shape of a configured-integration descriptor in workspace state. */\nexport interface StoredConfiguredIntegrationDescriptor {\n\t/** Stable per-connection identifier. Backfilled from the domain for pre-multi-account stored data. */\n\tid?: string;\n\t/** Whether this is the primary/default connection for the provider. */\n\tprimary?: boolean;\n\t/** The connection's auth type (`oauth`/`pat`), when known. */\n\ttype?: CloudIntegrationAuthType;\n\t/** Human-readable account handle for this connection (e.g. the GitHub login), when resolved. */\n\taccountName?: string;\n\tcloud: boolean;\n\tintegrationId: IntegrationIds;\n\tdomain?: string;\n\t/**\n\t * The address a self-managed connection was configured with, path included, when it differs from the\n\t * host-normalized {@link domain} — see `ProviderAuthenticationSession.baseUrl`.\n\t */\n\tbaseUrl?: string;\n\texpiresAt?: string;\n\tscopes: string;\n}\n\n/** Stored shape of the `integrations:configured` storage key. */\nexport type StoredIntegrationConfigurations = Record<\n\tIntegrationIds,\n\tStoredConfiguredIntegrationDescriptor[] | undefined\n>;\n\nexport const supportedCloudIntegrationDescriptors: IntegrationDescriptor[] = [\n\t{\n\t\tid: GitCloudHostIntegrationId.GitHub,\n\t\tname: 'GitHub',\n\t\ticon: 'gl-provider-github',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: false,\n\t},\n\t{\n\t\tid: GitSelfManagedHostIntegrationId.CloudGitHubEnterprise,\n\t\tname: 'GitHub Enterprise',\n\t\ticon: 'gl-provider-github',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: GitCloudHostIntegrationId.GitLab,\n\t\tname: 'GitLab',\n\t\ticon: 'gl-provider-gitlab',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: false,\n\t},\n\t{\n\t\tid: GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted,\n\t\tname: 'GitLab Self-Hosted',\n\t\ticon: 'gl-provider-gitlab',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: GitCloudHostIntegrationId.AzureDevOps,\n\t\tname: 'Azure DevOps',\n\t\ticon: 'gl-provider-azdo',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: GitSelfManagedHostIntegrationId.AzureDevOpsServer,\n\t\tname: 'Azure DevOps Server',\n\t\ticon: 'gl-provider-azdo',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: GitCloudHostIntegrationId.Bitbucket,\n\t\tname: 'Bitbucket',\n\t\ticon: 'gl-provider-bitbucket',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: false,\n\t},\n\t{\n\t\tid: GitSelfManagedHostIntegrationId.BitbucketServer,\n\t\tname: 'Bitbucket Data Center',\n\t\ticon: 'gl-provider-bitbucket',\n\t\tsupports: ['prs'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: IssuesCloudHostIntegrationId.Jira,\n\t\tname: 'Jira',\n\t\ticon: 'gl-provider-jira',\n\t\tsupports: ['issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: IssuesSelfManagedHostIntegrationId.JiraServer,\n\t\tname: 'Jira Data Center',\n\t\ticon: 'gl-provider-jira',\n\t\tsupports: ['issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: IssuesCloudHostIntegrationId.Linear,\n\t\tname: 'Linear',\n\t\ticon: 'gl-provider-linear',\n\t\tsupports: ['issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: IssuesCloudHostIntegrationId.Trello,\n\t\tname: 'Trello',\n\t\ticon: 'gl-provider-trello',\n\t\tsupports: ['issues'],\n\t\trequiresPro: true,\n\t},\n];\n"],"mappings":";AAEA,MAAa,4BAA4B;AAEzC,IAAY,4BAAL,yBAAA,2BAAA;CACN,0BAAA,YAAA;CACA,0BAAA,YAAA;CACA,0BAAA,eAAA;CACA,0BAAA,iBAAA;;AACD,EAAA,CAAA,CAAA;AAEA,IAAY,kCAAL,yBAAA,iCAAA;CACN,gCAAA,qBAAA;CACA,gCAAA,2BAAA;CACA,gCAAA,2BAAA;CACA,gCAAA,uBAAA;;AACD,EAAA,CAAA,CAAA;AAEA,IAAY,+BAAL,yBAAA,8BAAA;CACN,6BAAA,UAAA;CACA,6BAAA,YAAA;CACA,6BAAA,YAAA;;AACD,EAAA,CAAA,CAAA;;;;;;;;AASA,IAAY,qCAAL,yBAAA,oCAAA;CACN,mCAAA,gBAAA;;AACD,EAAA,CAAA,CAAA;AAqBA,MAAa,sCAAsC;;;;;;;;;;;;;AAanD;;;;;;AAOA,MAAa,4CAA4C,oCAAoC,QAC3F,OAGC,OAAO,OAAO,4BAA4B,CAAC,CAAsB,SAAS,EAAE,KAC5E,OAAO,OAAO,kCAAkC,CAAC,CAAsB,SAAS,EAAE,CACrF;AAEA,MAAa,iBAAiB;;;;;;;;;;;;;AAa9B;AAIA,SAAgB,8BAA8B,IAAwD;CACrG,OAAO,oCAAoC,SAAS,EAAE;AACvD;AAEA,SAAgB,gBAAgB,IAAkC;CACjE,OAAO,eAAe,SAAS,EAAoB;AACpD;AAwCA,MAAa,uCAAgE;CAC5E;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,KAAK;EAChB,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,QAAQ;EACnB,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,QAAQ;EACnB,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,QAAQ;EACnB,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,QAAQ;EACnB,aAAa;CACd;AACD"}
+{"version":3,"file":"constants.js","names":[],"sources":["../../../../plus/integrations/src/constants.ts"],"sourcesContent":["import type { CloudIntegrationAuthType } from './authentication/models.js';\n\nexport const providerFanOutConcurrency = 6;\n\nexport enum GitCloudHostIntegrationId {\n\tGitHub = 'github',\n\tGitLab = 'gitlab',\n\tBitbucket = 'bitbucket',\n\tAzureDevOps = 'azureDevOps',\n}\n\nexport enum GitSelfManagedHostIntegrationId {\n\tBitbucketServer = 'bitbucket-server',\n\tCloudGitHubEnterprise = 'cloud-github-enterprise',\n\tCloudGitLabSelfHosted = 'cloud-gitlab-self-hosted',\n\tAzureDevOpsServer = 'azure-devops-server',\n}\n\nexport enum IssuesCloudHostIntegrationId {\n\tJira = 'jira',\n\tLinear = 'linear',\n\tTrello = 'trello',\n}\n\n/**\n * Issue trackers that live on a customer-run host rather than a single cloud endpoint, so every read must be\n * routed by the connection's own domain. Separate from {@link GitSelfManagedHostIntegrationId} because a\n * tracker has no repositories or pull requests: the two enums differ in what the id can be ASKED for, while\n * what they share — being keyed by host — is expressed by {@link SelfManagedHostIntegrationIds} and the\n * `isSelfManagedHostIntegrationId` predicate.\n */\nexport enum IssuesSelfManagedHostIntegrationId {\n\tJiraServer = 'jira-server',\n}\n\nexport type CloudGitSelfManagedHostIntegrationIds =\n\t| GitSelfManagedHostIntegrationId.CloudGitHubEnterprise\n\t| GitSelfManagedHostIntegrationId.BitbucketServer\n\t| GitSelfManagedHostIntegrationId.AzureDevOpsServer\n\t| GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted;\n\n/** The self-managed ids whose tokens are issued by the GK cloud backend, whatever they host. */\nexport type CloudSelfManagedHostIntegrationIds =\n\t| CloudGitSelfManagedHostIntegrationIds\n\t| IssuesSelfManagedHostIntegrationId.JiraServer;\n\nexport type GitHostIntegrationIds = GitCloudHostIntegrationId | GitSelfManagedHostIntegrationId;\nexport type IssuesHostIntegrationIds = IssuesCloudHostIntegrationId | IssuesSelfManagedHostIntegrationId;\n\n/** Every id addressed by host, across both families — what the domain-keyed machinery keys off. */\nexport type SelfManagedHostIntegrationIds = GitSelfManagedHostIntegrationId | IssuesSelfManagedHostIntegrationId;\n\nexport type IntegrationIds = GitHostIntegrationIds | IssuesHostIntegrationIds;\n\nexport const supportedOrderedCloudIntegrationIds = [\n\tGitCloudHostIntegrationId.GitHub,\n\tGitSelfManagedHostIntegrationId.CloudGitHubEnterprise,\n\tGitCloudHostIntegrationId.GitLab,\n\tGitSelfManagedHostIntegrationId.CloudGitLabSelfHosted,\n\tGitCloudHostIntegrationId.AzureDevOps,\n\tGitSelfManagedHostIntegrationId.AzureDevOpsServer,\n\tGitCloudHostIntegrationId.Bitbucket,\n\tGitSelfManagedHostIntegrationId.BitbucketServer,\n\tIssuesCloudHostIntegrationId.Jira,\n\tIssuesSelfManagedHostIntegrationId.JiraServer,\n\tIssuesCloudHostIntegrationId.Linear,\n\tIssuesCloudHostIntegrationId.Trello,\n];\n\n/**\n * The issue trackers of {@link supportedOrderedCloudIntegrationIds}, in the same order. Derived rather than\n * listed again: the two were parallel literals, and an id added to one and forgotten in the other drops that\n * tracker out of default project discovery and the Graph's issue-integration check with no other symptom.\n */\nexport const supportedOrderedCloudIssuesIntegrationIds = supportedOrderedCloudIntegrationIds.filter(\n\t(id): id is IssuesHostIntegrationIds =>\n\t\t// `Object.values`, not `in`: these are string enums, so the object is keyed by member name and `in`\n\t\t// would test the id against `Jira`/`Linear` rather than against `jira`/`linear`.\n\t\t(Object.values(IssuesCloudHostIntegrationId) as IntegrationIds[]).includes(id) ||\n\t\t(Object.values(IssuesSelfManagedHostIntegrationId) as IntegrationIds[]).includes(id),\n);\n\nexport const integrationIds = [\n\tGitCloudHostIntegrationId.GitHub,\n\tGitCloudHostIntegrationId.GitLab,\n\tGitCloudHostIntegrationId.Bitbucket,\n\tGitCloudHostIntegrationId.AzureDevOps,\n\tGitSelfManagedHostIntegrationId.AzureDevOpsServer,\n\tGitSelfManagedHostIntegrationId.BitbucketServer,\n\tGitSelfManagedHostIntegrationId.CloudGitHubEnterprise,\n\tGitSelfManagedHostIntegrationId.CloudGitLabSelfHosted,\n\tIssuesCloudHostIntegrationId.Jira,\n\tIssuesSelfManagedHostIntegrationId.JiraServer,\n\tIssuesCloudHostIntegrationId.Linear,\n\tIssuesCloudHostIntegrationId.Trello,\n];\n\nexport type SupportedCloudIntegrationIds = (typeof supportedOrderedCloudIntegrationIds)[number];\n\nexport function isSupportedCloudIntegrationId(id: IntegrationIds): id is SupportedCloudIntegrationIds {\n\treturn supportedOrderedCloudIntegrationIds.includes(id);\n}\n\nexport function isIntegrationId(id: string): id is IntegrationIds {\n\treturn integrationIds.includes(id as IntegrationIds);\n}\n\nexport type IntegrationFeatures = 'prs' | 'issues';\n\nexport interface IntegrationDescriptor {\n\tid: SupportedCloudIntegrationIds;\n\tname: string;\n\ticon: string;\n\tsupports: IntegrationFeatures[];\n\trequiresPro: boolean;\n}\n\n/** Stored shape of a configured-integration descriptor in workspace state. */\nexport interface StoredConfiguredIntegrationDescriptor {\n\t/** Stable per-connection identifier. Backfilled from the domain for pre-multi-account stored data. */\n\tid?: string;\n\t/** Whether this is the primary/default connection for the provider. */\n\tprimary?: boolean;\n\t/** The connection's auth type (`oauth`/`pat`), when known. */\n\ttype?: CloudIntegrationAuthType;\n\t/** Human-readable account handle for this connection (e.g. the GitHub login), when resolved. */\n\taccountName?: string;\n\t/** Workspace the token was granted for (Linear), separate from the person; set with {@link resourceId}. */\n\tresourceName?: string;\n\t/** Id of that workspace; set with {@link resourceName}, or neither is. */\n\tresourceId?: string;\n\tcloud: boolean;\n\tintegrationId: IntegrationIds;\n\tdomain?: string;\n\t/**\n\t * The address a self-managed connection was configured with, path included, when it differs from the\n\t * host-normalized {@link domain} — see `ProviderAuthenticationSession.baseUrl`.\n\t */\n\tbaseUrl?: string;\n\texpiresAt?: string;\n\tscopes: string;\n}\n\n/** Stored shape of the `integrations:configured` storage key. */\nexport type StoredIntegrationConfigurations = Record<\n\tIntegrationIds,\n\tStoredConfiguredIntegrationDescriptor[] | undefined\n>;\n\nexport const supportedCloudIntegrationDescriptors: IntegrationDescriptor[] = [\n\t{\n\t\tid: GitCloudHostIntegrationId.GitHub,\n\t\tname: 'GitHub',\n\t\ticon: 'gl-provider-github',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: false,\n\t},\n\t{\n\t\tid: GitSelfManagedHostIntegrationId.CloudGitHubEnterprise,\n\t\tname: 'GitHub Enterprise',\n\t\ticon: 'gl-provider-github',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: GitCloudHostIntegrationId.GitLab,\n\t\tname: 'GitLab',\n\t\ticon: 'gl-provider-gitlab',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: false,\n\t},\n\t{\n\t\tid: GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted,\n\t\tname: 'GitLab Self-Hosted',\n\t\ticon: 'gl-provider-gitlab',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: GitCloudHostIntegrationId.AzureDevOps,\n\t\tname: 'Azure DevOps',\n\t\ticon: 'gl-provider-azdo',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: GitSelfManagedHostIntegrationId.AzureDevOpsServer,\n\t\tname: 'Azure DevOps Server',\n\t\ticon: 'gl-provider-azdo',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: GitCloudHostIntegrationId.Bitbucket,\n\t\tname: 'Bitbucket',\n\t\ticon: 'gl-provider-bitbucket',\n\t\tsupports: ['prs', 'issues'],\n\t\trequiresPro: false,\n\t},\n\t{\n\t\tid: GitSelfManagedHostIntegrationId.BitbucketServer,\n\t\tname: 'Bitbucket Data Center',\n\t\ticon: 'gl-provider-bitbucket',\n\t\tsupports: ['prs'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: IssuesCloudHostIntegrationId.Jira,\n\t\tname: 'Jira',\n\t\ticon: 'gl-provider-jira',\n\t\tsupports: ['issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: IssuesSelfManagedHostIntegrationId.JiraServer,\n\t\tname: 'Jira Data Center',\n\t\ticon: 'gl-provider-jira',\n\t\tsupports: ['issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: IssuesCloudHostIntegrationId.Linear,\n\t\tname: 'Linear',\n\t\ticon: 'gl-provider-linear',\n\t\tsupports: ['issues'],\n\t\trequiresPro: true,\n\t},\n\t{\n\t\tid: IssuesCloudHostIntegrationId.Trello,\n\t\tname: 'Trello',\n\t\ticon: 'gl-provider-trello',\n\t\tsupports: ['issues'],\n\t\trequiresPro: true,\n\t},\n];\n"],"mappings":";AAEA,MAAa,4BAA4B;AAEzC,IAAY,4BAAL,yBAAA,2BAAA;CACN,0BAAA,YAAA;CACA,0BAAA,YAAA;CACA,0BAAA,eAAA;CACA,0BAAA,iBAAA;;AACD,EAAA,CAAA,CAAA;AAEA,IAAY,kCAAL,yBAAA,iCAAA;CACN,gCAAA,qBAAA;CACA,gCAAA,2BAAA;CACA,gCAAA,2BAAA;CACA,gCAAA,uBAAA;;AACD,EAAA,CAAA,CAAA;AAEA,IAAY,+BAAL,yBAAA,8BAAA;CACN,6BAAA,UAAA;CACA,6BAAA,YAAA;CACA,6BAAA,YAAA;;AACD,EAAA,CAAA,CAAA;;;;;;;;AASA,IAAY,qCAAL,yBAAA,oCAAA;CACN,mCAAA,gBAAA;;AACD,EAAA,CAAA,CAAA;AAqBA,MAAa,sCAAsC;;;;;;;;;;;;;AAanD;;;;;;AAOA,MAAa,4CAA4C,oCAAoC,QAC3F,OAGC,OAAO,OAAO,4BAA4B,CAAC,CAAsB,SAAS,EAAE,KAC5E,OAAO,OAAO,kCAAkC,CAAC,CAAsB,SAAS,EAAE,CACrF;AAEA,MAAa,iBAAiB;;;;;;;;;;;;;AAa9B;AAIA,SAAgB,8BAA8B,IAAwD;CACrG,OAAO,oCAAoC,SAAS,EAAE;AACvD;AAEA,SAAgB,gBAAgB,IAAkC;CACjE,OAAO,eAAe,SAAS,EAAoB;AACpD;AA4CA,MAAa,uCAAgE;CAC5E;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,OAAO,QAAQ;EAC1B,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,KAAK;EAChB,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,QAAQ;EACnB,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,QAAQ;EACnB,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,QAAQ;EACnB,aAAa;CACd;CACA;EACC,IAAA;EACA,MAAM;EACN,MAAM;EACN,UAAU,CAAC,QAAQ;EACnB,aAAa;CACd;AACD"}

package/dist/plus/integrations/integrationService.d.ts

@@ -530,6 +530,12 @@ export declare class IntegrationService implements Disposable, RepositoryResolut
    * Throws if the backend delete fails so the caller can surface it (local state stays untouched).
    */
   deleteConnection(id: IntegrationIds, connectionId: string): Promise<void>;
+  /**
+   * Resolves the workspace a connection's token was granted for, asking the provider with that token every time the
+   * reconcile fetches it, which includes every sync while the connection has no workspace stored. Best-effort:
+   * undefined on any failure, in which case the stored pair is kept and the next fetch looks it up again.
+   */
+  private resolveResource;
   /**
    * Resolves a human-readable account handle (e.g. the GitHub login) for a connection by asking the
    * provider API with that connection's token. The token backend doesn't expose it. Routes through the

package/dist/plus/integrations/integrationService.js

@@ -1,4 +1,5 @@
 import { filterMap, flatten } from "../../utils/iterable.js";
+import { raceWithTimeout } from "../../utils/cancellation.js";
 import { getScopedLogger } from "../../utils/logger.scoped.js";
 import { mapSettledBounded } from "../../utils/promise.js";
 import { debug, trace } from "../../utils/decorators/log.js";
@@ -34,6 +35,7 @@ import { searchPullRequestsPage } from "./reads/searchPullRequests.js";
 import { sweepClosedPullRequests, sweepPullRequests } from "./reads/sweeps.js";
 //#region ../plus/integrations/src/integrationService.ts
 const maxSmallIntegerV8 = 2 ** 30 - 1;
+const resourceLookupTimeoutMs = 1e4;
 var IntegrationService = class {
 	authenticationService;
 	configuredIntegrationService;
@@ -945,7 +947,8 @@ var IntegrationService = class {
 			syncEligibleIds.add(connection.id);
 			const cached = existingById.get(connection.id);
 			const baseUrlChanged = isSelfManagedHostIntegrationId(id) && Boolean(connection.domain?.trim()) && !sameConfiguredBaseUrl(cached?.baseUrl, connection.domain);
-			if (!forceConnect && cached != null && !isDescriptorExpired(cached) && !baseUrlChanged) return {
+			const resourceMissing = carriesConnectionResource(id) && cached?.resourceId == null;
+			if (!forceConnect && cached != null && !isDescriptorExpired(cached) && !baseUrlChanged && !resourceMissing) return {
 				kind: "cached",
 				connection,
 				host
@@ -964,11 +967,13 @@ var IntegrationService = class {
 						label: accountName
 					}
 				};
+				const resource = await this.resolveResource(id, host, providerSession);
 				return {
 					kind: "fetched",
 					connection,
 					host,
-					providerSession
+					providerSession,
+					resource
 				};
 			} catch (ex) {
 				scope?.warn(`Failed to sync connection '${connection.id}' for ${id}: ${ex instanceof Error ? ex.message : String(ex)}`);
@@ -977,7 +982,10 @@ var IntegrationService = class {
 		}));
 		for (const prepared of preparedConnections) {
 			if (prepared == null) continue;
-			if (prepared.kind === "fetched" && !await this.configuredIntegrationService.storeSession(id, prepared.providerSession, { signOutMark })) continue;
+			if (prepared.kind === "fetched" && !await this.configuredIntegrationService.storeSession(id, prepared.providerSession, {
+				signOutMark,
+				resource: prepared.resource
+			})) continue;
 			syncedIds.add(prepared.connection.id);
 			if (prepared.connection.primary) {
 				const domain = isSelfManagedHostIntegrationId(id) ? prepared.host : void 0;
@@ -1029,6 +1037,23 @@ var IntegrationService = class {
 		this.getCachedForDomain(id, connection.domain)?.switchConnection();
 	}
 	/**
+	* Resolves the workspace a connection's token was granted for, asking the provider with that token every time the
+	* reconcile fetches it, which includes every sync while the connection has no workspace stored. Best-effort:
+	* undefined on any failure, in which case the stored pair is kept and the next fetch looks it up again.
+	*/
+	async resolveResource(id, host, session) {
+		if (!carriesConnectionResource(id)) return void 0;
+		const scope = getScopedLogger();
+		try {
+			const integration = await this.get(id, host);
+			if (integration == null) return void 0;
+			return await raceWithTimeout(integration.getProviderResourceForSession(session), resourceLookupTimeoutMs);
+		} catch (ex) {
+			scope?.warn(`Failed to resolve workspace for '${id}': ${ex instanceof Error ? ex.message : String(ex)}`);
+			return;
+		}
+	}
+	/**
 	* Resolves a human-readable account handle (e.g. the GitHub login) for a connection by asking the
 	* provider API with that connection's token. The token backend doesn't expose it. Routes through the
 	* integration model so the correct provider API base URL (incl. self-managed domains) and auth type
@@ -1098,6 +1123,10 @@ function normalizeAccountName(accountName) {
 	const value = accountName?.trim();
 	return value ? value : void 0;
 }
+/** Whether the provider's connections carry a workspace (Linear only). */
+function carriesConnectionResource(id) {
+	return id === "linear";
+}
 /**
 * Whether a stored connection descriptor's token has expired. A missing `expiresAt` is treated as
 * not-expired (non-expiring/legacy tokens, e.g. GitHub and self-managed cloud, carry no meaningful