@gitkraken/core-gitlens 0.3.1 → 0.4.0

package/dist/plus/integrations/authentication/integrationAuthenticationProvider.js

@@ -0,0 +1,185 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { trace } from '../../../utils/decorators/log.js';
+import { Emitter } from '../../../utils/event.js';
+import { GitCloudHostIntegrationId } from '../constants.js';
+import { isCloudGitSelfManagedHostIntegrationId, isGitSelfManagedHostIntegrationId, } from '../utils/integration.utils.js';
+import { isSupportedCloudIntegrationId } from './models.js';
+const maxSmallIntegerV8 = 2 ** 30 - 1; // Max number that can be stored in V8's smis (small integers)
+class IntegrationAuthenticationProviderBase {
+    authenticationService;
+    configuredIntegrationService;
+    disposables = [];
+    constructor(authenticationService, configuredIntegrationService) {
+        this.authenticationService = authenticationService;
+        this.configuredIntegrationService = configuredIntegrationService;
+    }
+    dispose() {
+        this.disposables.forEach(d => d.dispose());
+    }
+    _onDidChange = new Emitter();
+    get onDidChange() {
+        return this._onDidChange.event;
+    }
+    async deleteSession(descriptor) {
+        const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {
+            cloud: true,
+            domain: isGitSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined,
+        });
+        await this.configuredIntegrationService.deleteStoredSessions(this.authProviderId, descriptor, undefined);
+        if (configured?.length) {
+            this.fireChange();
+        }
+    }
+    async deleteAllSessions() {
+        const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {
+            cloud: true,
+        });
+        await this.configuredIntegrationService.deleteAllStoredSessions(this.authProviderId, undefined);
+        if (configured?.length) {
+            this.fireChange();
+        }
+    }
+    async getSession(descriptor, options) {
+        let session;
+        let previousToken;
+        if (options?.forceNewSession) {
+            await this.configuredIntegrationService.deleteStoredSessions(this.authProviderId, descriptor, undefined);
+        }
+        else {
+            session = await this.configuredIntegrationService.getStoredSession(this.authProviderId, descriptor);
+            previousToken = session?.accessToken;
+        }
+        const isExpiredSession = session?.expiresAt != null && new Date(session.expiresAt).getTime() < Date.now();
+        if (session == null || isExpiredSession) {
+            session = await this.getNewSession(descriptor, {
+                ...options,
+                refreshIfExpired: isExpiredSession,
+            });
+            if (session != null) {
+                await this.configuredIntegrationService.storeSession(this.authProviderId, session);
+            }
+        }
+        if (previousToken !== session?.accessToken) {
+            this.fireChange();
+        }
+        return session;
+    }
+    fireChange() {
+        queueMicrotask(() => this._onDidChange.fire());
+    }
+}
+__decorate([
+    trace()
+], IntegrationAuthenticationProviderBase.prototype, "deleteSession", null);
+__decorate([
+    trace()
+], IntegrationAuthenticationProviderBase.prototype, "deleteAllSessions", null);
+__decorate([
+    trace()
+], IntegrationAuthenticationProviderBase.prototype, "getSession", null);
+export class CloudIntegrationAuthenticationProvider extends IntegrationAuthenticationProviderBase {
+    _authProviderId;
+    constructor(authenticationService, configuredIntegrationService, _authProviderId) {
+        super(authenticationService, configuredIntegrationService);
+        this._authProviderId = _authProviderId;
+    }
+    get authProviderId() {
+        return this._authProviderId;
+    }
+    async getNewSession(descriptor, options) {
+        if (options?.forceNewSession) {
+            if ((await this.disconnectCloudSession()) === 'failure') {
+                return undefined;
+            }
+            void this.connectCloudSession(false, options?.source);
+            return undefined;
+        }
+        // TODO: This is a stopgap to make sure we're not hammering the api on automatic calls to get the session.
+        // Ultimately we want to timestamp calls to syncCloudIntegrations and use that to determine whether we should
+        // make the call or not.
+        let session = options?.refreshIfExpired || options?.createIfNeeded || options?.forceNewSession || options?.sync
+            ? await this.getCloudSession(descriptor)
+            : undefined;
+        const shouldCreateSession = options?.createIfNeeded && session == null;
+        if (shouldCreateSession) {
+            const connected = await this.connectCloudSession(true, options?.source);
+            if (!connected)
+                return undefined;
+            // This should get us the session we just created with connectCloudSession, because a syncCloudIntegrations run from
+            // integration service should have resulted in it being created and stored by this provider
+            session = await this.getSession(descriptor, { source: options?.source });
+        }
+        return session;
+    }
+    connectCloudSession(skipIfConnected, source) {
+        // Capture in a const so the type guard narrows it to `SupportedCloudIntegrationIds` (a getter
+        // access wouldn't narrow), letting us call the service directly without a cast.
+        const id = this.authProviderId;
+        if (isSupportedCloudIntegrationId(id)) {
+            return this.authenticationService.connectCloudIntegrations({ integrationIds: [id], skipIfConnected: skipIfConnected, skipPreSync: true }, {
+                source: source ?? 'integrations',
+                detail: {
+                    action: 'connect',
+                    integration: id,
+                },
+            });
+        }
+        return Promise.resolve(false);
+    }
+    async getCloudSession(descriptor) {
+        const loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;
+        if (!loggedIn)
+            return undefined;
+        const cloudIntegrations = this.authenticationService.cloudIntegrations;
+        let session = await cloudIntegrations.getConnectionSession(this.authProviderId);
+        // Make an exception for GitHub and Cloud Self-Hosted integrations because they always return 0
+        if (session?.expiresIn === 0 &&
+            (this.authProviderId === GitCloudHostIntegrationId.GitHub ||
+                isCloudGitSelfManagedHostIntegrationId(this.authProviderId))) {
+            // It never expires so don't refresh it frequently:
+            session.expiresIn = maxSmallIntegerV8; // maximum expiration length
+        }
+        if (session != null && session.expiresIn < 60) {
+            session = await cloudIntegrations.getConnectionSession(this.authProviderId, session.accessToken);
+        }
+        if (!session)
+            return undefined;
+        let sessionProtocol;
+        try {
+            sessionProtocol = new URL(session.domain).protocol;
+        }
+        catch {
+            // If the domain is invalid, we can't use it to create a session
+            sessionProtocol = undefined;
+        }
+        // TODO: Once we care about domains, we should try to match the domain here against ours, and if it fails, return undefined
+        return {
+            id: this.configuredIntegrationService.getSessionId(descriptor),
+            accessToken: session.accessToken,
+            scopes: descriptor.scopes,
+            account: {
+                id: '',
+                label: '',
+            },
+            cloud: true,
+            type: session.type,
+            expiresAt: new Date(session.expiresIn * 1000 + Date.now()),
+            // Note: do not use the session's domain, because the format is different than in our model
+            domain: descriptor.domain,
+            protocol: sessionProtocol ?? undefined,
+        };
+    }
+    async disconnectCloudSession() {
+        const loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;
+        if (!loggedIn)
+            return 'skip';
+        const cloudIntegrations = this.authenticationService.cloudIntegrations;
+        return (await cloudIntegrations.disconnect(this.authProviderId)) ? 'success' : 'failure';
+    }
+}
+//# sourceMappingURL=integrationAuthenticationProvider.js.map

package/dist/plus/integrations/authentication/integrationAuthenticationProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrationAuthenticationProvider.js","sourceRoot":"","sources":["../../src/authentication/integrationAuthenticationProvider.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAGzD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,OAAO,EACN,sCAAsC,EACtC,iCAAiC,GACjC,MAAM,+BAA+B,CAAC;AAIvC,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,8DAA8D;AAyBrG,MAAe,qCAAqC;IAM/B;IACA;IAJD,WAAW,GAAiB,EAAE,CAAC;IAElD,YACoB,qBAAuD,EACvD,4BAA0D;QAD1D,0BAAqB,GAArB,qBAAqB,CAAkC;QACvD,iCAA4B,GAA5B,4BAA4B,CAA8B;IAC3E,CAAC;IAEJ,OAAO;QACN,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEgB,YAAY,GAAG,IAAI,OAAO,EAAQ,CAAC;IACpD,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;IAChC,CAAC;IAKK,AAAN,KAAK,CAAC,aAAa,CAAC,UAAsD;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,4BAA4B,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE;YACvF,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;SAC/F,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,4BAA4B,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAEzG,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;IACF,CAAC;IAGK,AAAN,KAAK,CAAC,iBAAiB;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,4BAA4B,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE;YACvF,KAAK,EAAE,IAAI;SACX,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,4BAA4B,CAAC,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAEhG,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;IACF,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CACf,UAAsD,EACtD,OAEuF;QAEvF,IAAI,OAAO,CAAC;QACZ,IAAI,aAAa,CAAC;QAClB,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,4BAA4B,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC1G,CAAC;aAAM,CAAC;YACP,OAAO,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;YACpG,aAAa,GAAG,OAAO,EAAE,WAAW,CAAC;QACtC,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1G,IAAI,OAAO,IAAI,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACzC,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE;gBAC9C,GAAG,OAAO;gBACV,gBAAgB,EAAE,gBAAgB;aAClC,CAAC,CAAC;YAEH,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,4BAA4B,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACpF,CAAC;QACF,CAAC;QAED,IAAI,aAAa,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAqBS,UAAU;QACnB,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;CACD;AAnFM;IADL,KAAK,EAAE;0EAYP;AAGK;IADL,KAAK,EAAE;8EAWP;AAGK;IADL,KAAK,EAAE;uEAiCP;AA0BF,MAAM,OAAO,sCAEX,SAAQ,qCAAyC;IAIhC;IAHlB,YACC,qBAAuD,EACvD,4BAA0D,EACzC,eAAmB;QAEpC,KAAK,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAC;QAF1C,oBAAe,GAAf,eAAe,CAAI;IAGrC,CAAC;IAED,IAAc,cAAc;QAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;IAC7B,CAAC;IAEkB,KAAK,CAAC,aAAa,CACrC,UAAsD,EACtD,OAcI;QAEJ,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;gBACzD,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,KAAK,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACtD,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,0GAA0G;QAC1G,6GAA6G;QAC7G,wBAAwB;QACxB,IAAI,OAAO,GACV,OAAO,EAAE,gBAAgB,IAAI,OAAO,EAAE,cAAc,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,EAAE,IAAI;YAChG,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,mBAAmB,GAAG,OAAO,EAAE,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC;QACvE,IAAI,mBAAmB,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YAEjC,oHAAoH;YACpH,2FAA2F;YAC3F,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,mBAAmB,CAAC,eAAwB,EAAE,MAA2B;QAChF,8FAA8F;QAC9F,gFAAgF;QAChF,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAC/B,IAAI,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,qBAAqB,CAAC,wBAAwB,CACzD,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,EAC7E;gBACC,MAAM,EAAE,MAAM,IAAI,cAAc;gBAChC,MAAM,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,EAAE;iBACf;aACD,CACD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,eAAe,CAC5B,UAAsD;QAEtD,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC;QACrF,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAEhC,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;QACvE,IAAI,OAAO,GAAG,MAAM,iBAAiB,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAEhF,+FAA+F;QAC/F,IACC,OAAO,EAAE,SAAS,KAAK,CAAC;YACxB,CAAC,IAAI,CAAC,cAAc,KAAK,yBAAyB,CAAC,MAAM;gBACxD,sCAAsC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAC5D,CAAC;YACF,mDAAmD;YACnD,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAAC,4BAA4B;QACpE,CAAC;QAED,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC;YAC/C,OAAO,GAAG,MAAM,iBAAiB,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAE/B,IAAI,eAAe,CAAC;QACpB,IAAI,CAAC;YACJ,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACR,gEAAgE;YAChE,eAAe,GAAG,SAAS,CAAC;QAC7B,CAAC;QAED,2HAA2H;QAC3H,OAAO;YACN,EAAE,EAAE,IAAI,CAAC,4BAA4B,CAAC,YAAY,CAAC,UAAU,CAAC;YAC9D,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACR,EAAE,EAAE,EAAE;gBACN,KAAK,EAAE,EAAE;aACT;YACD,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1D,2FAA2F;YAC3F,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,eAAe,IAAI,SAAS;SACtC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB;QACnC,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC;QACrF,IAAI,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC;QAE7B,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;QACvE,OAAO,CAAC,MAAM,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;CACD"}

package/dist/plus/integrations/authentication/integrationAuthenticationService.d.ts

@@ -0,0 +1,62 @@
+import type { GitRemote } from '../../../git/models/remote.js';
+import type { Disposable } from '../../../utils/disposable.js';
+import type { IntegrationIds, SupportedCloudIntegrationIds } from '../constants.js';
+import type { IntegrationServiceContext } from '../context.js';
+import type { IntegrationService } from '../integrationService.js';
+import type { GitHostIntegration } from '../models/gitHostIntegration.js';
+import type { ApiClients } from '../providers/apiClients.js';
+import type { Source } from '../telemetry.js';
+import type { CloudIntegrationService } from './cloudIntegrationService.js';
+import type { ConfiguredIntegrationService } from './configuredIntegrationService.js';
+import type { IntegrationAuthenticationProvider } from './integrationAuthenticationProvider.js';
+export declare class IntegrationAuthenticationService implements Disposable {
+    private readonly configuredIntegrationService;
+    readonly ctx: IntegrationServiceContext;
+    /**
+     * Lazy accessor for the owning {@link IntegrationService}. Injected by the composition root
+     * ({@link createIntegrationManager}) to break the auth↔service construction cycle without a
+     * mutable setter or a host round-trip; only resolved at runtime (long after construction).
+     */
+    private readonly getIntegrationService;
+    /** The package's cloud token-exchange client, constructed by the composition root. */
+    readonly cloudIntegrations: CloudIntegrationService;
+    private readonly providers;
+    constructor(configuredIntegrationService: ConfiguredIntegrationService, ctx: IntegrationServiceContext, 
+    /**
+     * Lazy accessor for the owning {@link IntegrationService}. Injected by the composition root
+     * ({@link createIntegrationManager}) to break the auth↔service construction cycle without a
+     * mutable setter or a host round-trip; only resolved at runtime (long after construction).
+     */
+    getIntegrationService: () => IntegrationService, 
+    /** The package's cloud token-exchange client, constructed by the composition root. */
+    cloudIntegrations: CloudIntegrationService);
+    dispose(): void;
+    /**
+     * Initiates the cloud-integration connect flow on the owning service. Cloud auth providers call
+     * this when they need a session that doesn't exist yet (see
+     * {@link CloudIntegrationAuthenticationProvider}).
+     */
+    connectCloudIntegrations(connect: {
+        integrationIds: SupportedCloudIntegrationIds[];
+        skipIfConnected?: boolean;
+        skipPreSync?: boolean;
+    }, source?: Source): Promise<boolean>;
+    /**
+     * Resolves the connected git-host integration for a `GitRemote`, via the owning service. Lets
+     * package-internal callers (e.g. the Bitbucket provider) resolve a remote's integration without a
+     * host round-trip.
+     */
+    getByRemote(remote: GitRemote): Promise<GitHostIntegration | undefined>;
+    /** Resolves the per-integration `ignoreSSLErrors` flag via the owning service (host-config-backed). */
+    ignoreSSLErrors(integration: GitHostIntegration | {
+        id: IntegrationIds;
+        domain?: string;
+    }): boolean | 'force';
+    /** The package-built per-provider API clients, via the owning service (built once + memoized there). */
+    get apis(): ApiClients;
+    get(providerId: IntegrationIds): Promise<IntegrationAuthenticationProvider>;
+    reset(): Promise<void>;
+    supports(providerId: string): boolean;
+    private ensureProvider;
+}
+//# sourceMappingURL=integrationAuthenticationService.d.ts.map

package/dist/plus/integrations/authentication/integrationAuthenticationService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrationAuthenticationService.d.ts","sourceRoot":"","sources":["../../src/authentication/integrationAuthenticationService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAG/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAMpF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACtF,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAGhG,qBAAa,gCAAiC,YAAW,UAAU;IAIjE,OAAO,CAAC,QAAQ,CAAC,4BAA4B;IAC7C,QAAQ,CAAC,GAAG,EAAE,yBAAyB;IACvC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,sFAAsF;IACtF,QAAQ,CAAC,iBAAiB,EAAE,uBAAuB;IAZpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgE;gBAGxE,4BAA4B,EAAE,4BAA4B,EAClE,GAAG,EAAE,yBAAyB;IACvC;;;;OAIG;IACc,qBAAqB,EAAE,MAAM,kBAAkB;IAChE,sFAAsF;IAC7E,iBAAiB,EAAE,uBAAuB;IAGpD,OAAO,IAAI,IAAI;IAKf;;;;OAIG;IACH,wBAAwB,CACvB,OAAO,EAAE;QAAE,cAAc,EAAE,4BAA4B,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,EAC7G,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC;IAInB;;;;OAIG;IACH,WAAW,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC;IAIvE,uGAAuG;IACvG,eAAe,CAAC,WAAW,EAAE,kBAAkB,GAAG;QAAE,EAAE,EAAE,cAAc,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,GAAG,OAAO;IAI7G,wGAAwG;IACxG,IAAI,IAAI,IAAI,UAAU,CAErB;IAEK,GAAG,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,iCAAiC,CAAC;IAK3E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;YAevB,cAAc;CAyC5B"}

package/dist/plus/integrations/authentication/integrationAuthenticationService.js

@@ -0,0 +1,122 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { gate } from '../../../utils/decorators/gate.js';
+import { debug } from '../../../utils/decorators/log.js';
+import { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId, IssuesCloudHostIntegrationId, } from '../constants.js';
+import { supportedIntegrationIds } from '../utils/integration.utils.js';
+import { CloudIntegrationAuthenticationProvider } from './integrationAuthenticationProvider.js';
+export class IntegrationAuthenticationService {
+    configuredIntegrationService;
+    ctx;
+    getIntegrationService;
+    cloudIntegrations;
+    providers = new Map();
+    constructor(configuredIntegrationService, ctx, 
+    /**
+     * Lazy accessor for the owning {@link IntegrationService}. Injected by the composition root
+     * ({@link createIntegrationManager}) to break the auth↔service construction cycle without a
+     * mutable setter or a host round-trip; only resolved at runtime (long after construction).
+     */
+    getIntegrationService, 
+    /** The package's cloud token-exchange client, constructed by the composition root. */
+    cloudIntegrations) {
+        this.configuredIntegrationService = configuredIntegrationService;
+        this.ctx = ctx;
+        this.getIntegrationService = getIntegrationService;
+        this.cloudIntegrations = cloudIntegrations;
+    }
+    dispose() {
+        this.providers.forEach(p => p.dispose());
+        this.providers.clear();
+    }
+    /**
+     * Initiates the cloud-integration connect flow on the owning service. Cloud auth providers call
+     * this when they need a session that doesn't exist yet (see
+     * {@link CloudIntegrationAuthenticationProvider}).
+     */
+    connectCloudIntegrations(connect, source) {
+        return this.getIntegrationService().connectCloudIntegrations(connect, source);
+    }
+    /**
+     * Resolves the connected git-host integration for a `GitRemote`, via the owning service. Lets
+     * package-internal callers (e.g. the Bitbucket provider) resolve a remote's integration without a
+     * host round-trip.
+     */
+    getByRemote(remote) {
+        return this.getIntegrationService().getByRemote(remote);
+    }
+    /** Resolves the per-integration `ignoreSSLErrors` flag via the owning service (host-config-backed). */
+    ignoreSSLErrors(integration) {
+        return this.getIntegrationService().ignoreSSLErrors(integration);
+    }
+    /** The package-built per-provider API clients, via the owning service (built once + memoized there). */
+    get apis() {
+        return this.getIntegrationService().apis;
+    }
+    async get(providerId) {
+        return this.ensureProvider(providerId);
+    }
+    async reset() {
+        // TODO: This really isn't ideal, since it will only work for "cloud" providers as we won't have any more specific descriptors
+        await Promise.allSettled(supportedIntegrationIds.map(async (providerId) => (await this.ensureProvider(providerId)).deleteAllSessions()));
+    }
+    supports(providerId) {
+        switch (providerId) {
+            case GitCloudHostIntegrationId.AzureDevOps:
+            case GitSelfManagedHostIntegrationId.AzureDevOpsServer:
+            case GitCloudHostIntegrationId.Bitbucket:
+            case GitCloudHostIntegrationId.GitLab:
+            case IssuesCloudHostIntegrationId.Jira:
+            case GitCloudHostIntegrationId.GitHub:
+                return true;
+            default:
+                return false;
+        }
+    }
+    async ensureProvider(providerId) {
+        let provider = this.providers.get(providerId);
+        if (provider != null)
+            return provider;
+        // Optional consumer override for custom auth (e.g. a manual-token provider). GitLens omits it —
+        // the package constructs its own cloud providers below (so GitLens's cloud auth needs no host hook).
+        const hostProvider = await this.ctx.hooks?.createAuthenticationProvider?.({
+            id: providerId,
+            auth: this,
+            configured: this.configuredIntegrationService,
+        });
+        if (hostProvider != null) {
+            this.providers.set(providerId, hostProvider);
+            return hostProvider;
+        }
+        // Every cloud integration shares one provider, parameterized by id (cloud-only).
+        switch (providerId) {
+            case GitCloudHostIntegrationId.GitHub:
+            case GitSelfManagedHostIntegrationId.CloudGitHubEnterprise:
+            case GitCloudHostIntegrationId.GitLab:
+            case GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted:
+            case GitCloudHostIntegrationId.AzureDevOps:
+            case GitSelfManagedHostIntegrationId.AzureDevOpsServer:
+            case GitCloudHostIntegrationId.Bitbucket:
+            case GitSelfManagedHostIntegrationId.BitbucketServer:
+            case IssuesCloudHostIntegrationId.Jira:
+            case IssuesCloudHostIntegrationId.Linear:
+                provider = new CloudIntegrationAuthenticationProvider(this, this.configuredIntegrationService, providerId);
+                break;
+            default:
+                throw new Error(`No authentication provider registered for integration '${providerId}'`);
+        }
+        this.providers.set(providerId, provider);
+        return provider;
+    }
+}
+__decorate([
+    debug()
+], IntegrationAuthenticationService.prototype, "reset", null);
+__decorate([
+    gate()
+], IntegrationAuthenticationService.prototype, "ensureProvider", null);
+//# sourceMappingURL=integrationAuthenticationService.js.map

package/dist/plus/integrations/authentication/integrationAuthenticationService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrationAuthenticationService.js","sourceRoot":"","sources":["../../src/authentication/integrationAuthenticationService.ts"],"names":[],"mappings":";;;;;;AACA,OAAO,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAGzD,OAAO,EACN,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,GAC5B,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAIxE,OAAO,EAAE,sCAAsC,EAAE,MAAM,wCAAwC,CAAC;AAEhG,MAAM,OAAO,gCAAgC;IAI1B;IACR;IAMQ;IAER;IAZO,SAAS,GAAG,IAAI,GAAG,EAAqD,CAAC;IAE1F,YACkB,4BAA0D,EAClE,GAA8B;IACvC;;;;OAIG;IACc,qBAA+C;IAChE,sFAAsF;IAC7E,iBAA0C;QATlC,iCAA4B,GAA5B,4BAA4B,CAA8B;QAClE,QAAG,GAAH,GAAG,CAA2B;QAMtB,0BAAqB,GAArB,qBAAqB,CAA0B;QAEvD,sBAAiB,GAAjB,iBAAiB,CAAyB;IACjD,CAAC;IAEJ,OAAO;QACN,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,wBAAwB,CACvB,OAA6G,EAC7G,MAAe;QAEf,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,MAAiB;QAC5B,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,uGAAuG;IACvG,eAAe,CAAC,WAAyE;QACxF,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC;IAED,wGAAwG;IACxG,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAA0B;QACnC,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK;QACV,8HAA8H;QAC9H,MAAM,OAAO,CAAC,UAAU,CACvB,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE,CAC9C,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAC3D,CACD,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,UAAkB;QAC1B,QAAQ,UAAU,EAAE,CAAC;YACpB,KAAK,yBAAyB,CAAC,WAAW,CAAC;YAC3C,KAAK,+BAA+B,CAAC,iBAAiB,CAAC;YACvD,KAAK,yBAAyB,CAAC,SAAS,CAAC;YACzC,KAAK,yBAAyB,CAAC,MAAM,CAAC;YACtC,KAAK,4BAA4B,CAAC,IAAI,CAAC;YACvC,KAAK,yBAAyB,CAAC,MAAM;gBACpC,OAAO,IAAI,CAAC;YACb;gBACC,OAAO,KAAK,CAAC;QACf,CAAC;IACF,CAAC;IAGa,AAAN,KAAK,CAAC,cAAc,CAAC,UAA0B;QACtD,IAAI,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,QAAQ,IAAI,IAAI;YAAE,OAAO,QAAQ,CAAC;QAEtC,gGAAgG;QAChG,qGAAqG;QACrG,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACzE,EAAE,EAAE,UAAU;YACd,IAAI,EAAE,IAAI;YACV,UAAU,EAAE,IAAI,CAAC,4BAA4B;SAC7C,CAAC,CAAC;QACH,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAC7C,OAAO,YAAY,CAAC;QACrB,CAAC;QAED,iFAAiF;QACjF,QAAQ,UAAU,EAAE,CAAC;YACpB,KAAK,yBAAyB,CAAC,MAAM,CAAC;YACtC,KAAK,+BAA+B,CAAC,qBAAqB,CAAC;YAC3D,KAAK,yBAAyB,CAAC,MAAM,CAAC;YACtC,KAAK,+BAA+B,CAAC,qBAAqB,CAAC;YAC3D,KAAK,yBAAyB,CAAC,WAAW,CAAC;YAC3C,KAAK,+BAA+B,CAAC,iBAAiB,CAAC;YACvD,KAAK,yBAAyB,CAAC,SAAS,CAAC;YACzC,KAAK,+BAA+B,CAAC,eAAe,CAAC;YACrD,KAAK,4BAA4B,CAAC,IAAI,CAAC;YACvC,KAAK,4BAA4B,CAAC,MAAM;gBACvC,QAAQ,GAAG,IAAI,sCAAsC,CACpD,IAAI,EACJ,IAAI,CAAC,4BAA4B,EACjC,UAAU,CACV,CAAC;gBACF,MAAM;YACP;gBACC,MAAM,IAAI,KAAK,CAAC,0DAA0D,UAAU,GAAG,CAAC,CAAC;QAC3F,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC;IACjB,CAAC;CACD;AAjEM;IADL,KAAK,EAAE;6DAQP;AAiBa;IADb,IAAI,EAAE;sEAyCN"}

package/dist/plus/integrations/authentication/manualTokenProvider.d.ts

@@ -0,0 +1,15 @@
+import type { IntegrationIds } from '../constants.js';
+import type { IntegrationAuthenticationProvider } from './integrationAuthenticationProvider.js';
+export interface ManualTokenAuthProviderOptions {
+    readonly id: IntegrationIds;
+    readonly token: string;
+    readonly account: {
+        readonly id: string;
+        readonly label: string;
+    };
+    readonly scopes?: readonly string[];
+    readonly domain?: string;
+    readonly cloud?: boolean;
+}
+export declare function createManualTokenAuthProvider(options: ManualTokenAuthProviderOptions): IntegrationAuthenticationProvider;
+//# sourceMappingURL=manualTokenProvider.d.ts.map

package/dist/plus/integrations/authentication/manualTokenProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manualTokenProvider.d.ts","sourceRoot":"","sources":["../../src/authentication/manualTokenProvider.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EACX,iCAAiC,EAEjC,MAAM,wCAAwC,CAAC;AAGhD,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,8BAA8B,GACrC,iCAAiC,CA4BnC"}

package/dist/plus/integrations/authentication/manualTokenProvider.js

@@ -0,0 +1,49 @@
+// Convenience for "manual token" auth — when a consumer already has an access
+// token (CLI flag, env var, secret manager) and just wants the package to use
+// it without an OAuth dance. Wire it into the manager via the
+// `createAuthenticationProvider` hook:
+//
+//   const manager = createIntegrationManager({
+//       ...runtime,
+//       hooks: {
+//           createAuthenticationProvider: async ({ id }) =>
+//               id === GitCloudHostIntegrationId.GitHub
+//                   ? createManualTokenAuthProvider({
+//                         id: id,
+//                         token: process.env.GITHUB_TOKEN!,
+//                         account: { id: 'me', label: 'CLI Token' },
+//                     })
+//                   : undefined,
+//       },
+//   });
+//
+// The provider is intentionally minimal — sessions are non-cancellable, never
+// expire, and persist for the lifetime of the manager. For OAuth flows or
+// refreshable tokens, implement `IntegrationAuthenticationProvider` yourself.
+import { Emitter } from '../../../utils/event.js';
+export function createManualTokenAuthProvider(options) {
+    const onDidChange = new Emitter();
+    const session = {
+        id: `manual:${options.id}`,
+        accessToken: options.token,
+        account: options.account,
+        scopes: options.scopes ?? [],
+        cloud: options.cloud ?? true,
+        type: undefined,
+        domain: options.domain ?? '',
+    };
+    return {
+        get onDidChange() {
+            return onDidChange.event;
+        },
+        getSession: (_descriptor, options) => 
+        // A manual token can't be refreshed; on a forced new session, fail safe by returning undefined
+        // rather than handing back the same (likely-rejected) token, which would loop a caller's
+        // reauthenticate-on-failure flow.
+        Promise.resolve(options?.forceNewSession ? undefined : session),
+        deleteSession: () => Promise.resolve(),
+        deleteAllSessions: () => Promise.resolve(),
+        dispose: () => onDidChange.dispose(),
+    };
+}
+//# sourceMappingURL=manualTokenProvider.js.map

package/dist/plus/integrations/authentication/manualTokenProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manualTokenProvider.js","sourceRoot":"","sources":["../../src/authentication/manualTokenProvider.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,8DAA8D;AAC9D,uCAAuC;AACvC,EAAE;AACF,+CAA+C;AAC/C,oBAAoB;AACpB,iBAAiB;AACjB,4DAA4D;AAC5D,wDAAwD;AACxD,sDAAsD;AACtD,kCAAkC;AAClC,4DAA4D;AAC5D,qEAAqE;AACrE,yBAAyB;AACzB,iCAAiC;AACjC,WAAW;AACX,QAAQ;AACR,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAG9E,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAiBlD,MAAM,UAAU,6BAA6B,CAC5C,OAAuC;IAEvC,MAAM,WAAW,GAAG,IAAI,OAAO,EAAQ,CAAC;IACxC,MAAM,OAAO,GAAkC;QAC9C,EAAE,EAAE,UAAU,OAAO,CAAC,EAAE,EAAE;QAC1B,WAAW,EAAE,OAAO,CAAC,KAAK;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC5B,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;KAC5B,CAAC;IAEF,OAAO;QACN,IAAI,WAAW;YACd,OAAO,WAAW,CAAC,KAAK,CAAC;QAC1B,CAAC;QACD,UAAU,EAAE,CACX,WAAuD,EACvD,OAAwE,EACvE,EAAE;QACH,+FAA+F;QAC/F,yFAAyF;QACzF,kCAAkC;QAClC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;QAChE,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;QACtC,iBAAiB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;QAC1C,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE;KACpC,CAAC;AACH,CAAC"}

package/dist/plus/integrations/authentication/models.d.ts

@@ -0,0 +1,87 @@
+import type { IntegrationIds, SupportedCloudIntegrationIds } from '../constants.js';
+import { IssuesCloudHostIntegrationId } from '../constants.js';
+/**
+ * Mirrors the shape of `vscode.AuthenticationSession` so the integrations
+ * package can stay vscode-free. Host adapters bridge VS Code sessions to
+ * this shape via {@link AuthenticationProvider}.
+ */
+export interface AuthenticationSessionLike {
+    readonly id: string;
+    readonly accessToken: string;
+    readonly account: {
+        readonly id: string;
+        readonly label: string;
+    };
+    readonly scopes: readonly string[];
+}
+export interface ProviderAuthenticationSession extends AuthenticationSessionLike {
+    readonly cloud: boolean;
+    readonly type: CloudIntegrationAuthType | undefined;
+    readonly expiresAt?: Date;
+    readonly domain: string;
+    readonly protocol?: string;
+}
+export interface TokenInfo<T extends IntegrationIds | 'gitkraken' = IntegrationIds | 'gitkraken'> {
+    readonly providerId: T;
+    /**
+     * The first 3 characters of the md5 hash of the token.
+     * It's a very obfuscated representation of the token that we can use in logs
+     * to see whether the token survives refreshing or gets updated.
+     */
+    readonly microHash: string | undefined;
+    readonly cloud: boolean;
+    readonly type: CloudIntegrationAuthType | undefined;
+    readonly scopes: readonly string[] | undefined;
+    readonly expiresAt?: Date;
+}
+export interface TokenWithInfo<T extends IntegrationIds = IntegrationIds> extends TokenInfo<T> {
+    readonly accessToken: string;
+}
+export declare function toTokenInfo<T extends IntegrationIds | 'gitkraken'>(providerId: T, accessToken: string | undefined, info: {
+    cloud: boolean;
+    type: CloudIntegrationAuthType | undefined;
+    scopes?: readonly string[];
+    expiresAt?: Date;
+}): TokenInfo<T>;
+export declare function toTokenWithInfo<T extends IntegrationIds>(providerId: T, session: ProviderAuthenticationSession, altToken?: string): TokenWithInfo<T>;
+export type TokenOptInfo<T extends IntegrationIds = IntegrationIds> = TokenWithInfo<T> | {
+    providerId: T;
+    accessToken?: undefined;
+};
+export interface ConfiguredIntegrationDescriptor {
+    readonly cloud: boolean;
+    readonly integrationId: IntegrationIds;
+    readonly scopes: string;
+    readonly domain?: string;
+    readonly expiresAt?: string | Date;
+}
+export interface CloudIntegrationAuthenticationSession {
+    type: CloudIntegrationAuthType;
+    accessToken: string;
+    domain: string;
+    expiresIn: number;
+    scopes: string;
+}
+export interface CloudIntegrationAuthorization {
+    url: string;
+}
+export interface CloudIntegrationConnection {
+    type: CloudIntegrationAuthType;
+    provider: CloudIntegrationType;
+    domain: string;
+}
+export type CloudIntegrationType = 'jira' | 'linear' | 'trello' | 'gitlab' | 'github' | 'bitbucket' | 'bitbucketServer' | 'azure' | 'azureDevopsServer' | 'githubEnterprise' | 'gitlabSelfHosted';
+export type CloudIntegrationAuthType = 'oauth' | 'pat';
+export declare const CloudIntegrationAuthenticationUriPathPrefix = "did-authenticate-cloud-integration";
+/** Returns all supported cloud integration ids. */
+export declare function getSupportedCloudIntegrationIds(): readonly SupportedCloudIntegrationIds[];
+/** Whether `id` is a supported cloud integration id. */
+export declare function isSupportedCloudIntegrationId(id: string): id is SupportedCloudIntegrationIds;
+export declare function isIssueCloudIntegrationId(id: string): id is IssuesCloudHostIntegrationId;
+export declare const toIntegrationId: {
+    [key in CloudIntegrationType]: IntegrationIds;
+};
+export declare const toCloudIntegrationType: {
+    [key in IntegrationIds]: CloudIntegrationType | undefined;
+};
+//# sourceMappingURL=models.d.ts.map

package/dist/plus/integrations/authentication/models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/authentication/models.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACpF,OAAO,EAGN,4BAA4B,EAE5B,MAAM,iBAAiB,CAAC;AAEzB;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,6BAA8B,SAAQ,yBAAyB;IAC/E,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS,CAAC,CAAC,SAAS,cAAc,GAAG,WAAW,GAAG,cAAc,GAAG,WAAW;IAC/F,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACpD,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,CAAE,SAAQ,SAAS,CAAC,CAAC,CAAC;IAC7F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,WAAW,CAAC,CAAC,SAAS,cAAc,GAAG,WAAW,EACjE,UAAU,EAAE,CAAC,EACb,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,IAAI,EAAE;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,SAAS,CAAC,EAAE,IAAI,CAAA;CAAE,GAChH,SAAS,CAAC,CAAC,CAAC,CASd;AAED,wBAAgB,eAAe,CAAC,CAAC,SAAS,cAAc,EACvD,UAAU,EAAE,CAAC,EACb,OAAO,EAAE,6BAA6B,EACtC,QAAQ,CAAC,EAAE,MAAM,GACf,aAAa,CAAC,CAAC,CAAC,CASlB;AAED,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,cAAc,GAAG,cAAc,IAC/D,aAAa,CAAC,CAAC,CAAC,GAChB;IAAE,UAAU,EAAE,CAAC,CAAC;IAAC,WAAW,CAAC,EAAE,SAAS,CAAA;CAAE,CAAC;AAE9C,MAAM,WAAW,+BAA+B;IAC/C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,aAAa,EAAE,cAAc,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,qCAAqC;IACrD,IAAI,EAAE,wBAAwB,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,6BAA6B;IAC7C,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,wBAAwB,CAAC;IAC/B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,oBAAoB,GAC7B,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,iBAAiB,GACjB,OAAO,GACP,mBAAmB,GACnB,kBAAkB,GAClB,kBAAkB,CAAC;AAEtB,MAAM,MAAM,wBAAwB,GAAG,OAAO,GAAG,KAAK,CAAC;AAEvD,eAAO,MAAM,2CAA2C,uCAAuC,CAAC;AAEhG,mDAAmD;AACnD,wBAAgB,+BAA+B,IAAI,SAAS,4BAA4B,EAAE,CAIzF;AAED,wDAAwD;AACxD,wBAAgB,6BAA6B,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,4BAA4B,CAE5F;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,4BAA4B,CAGxF;AAED,eAAO,MAAM,eAAe,EAAE;KAAG,GAAG,IAAI,oBAAoB,GAAG,cAAc;CAY5E,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE;KAAG,GAAG,IAAI,cAAc,GAAG,oBAAoB,GAAG,SAAS;CAY/F,CAAC"}

package/dist/plus/integrations/authentication/models.js

@@ -0,0 +1,64 @@
+import { microhash } from '../../../utils/hash.js';
+import { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId, IssuesCloudHostIntegrationId, supportedOrderedCloudIntegrationIds, } from '../constants.js';
+export function toTokenInfo(providerId, accessToken, info) {
+    return {
+        providerId: providerId,
+        microHash: microhash(accessToken, 3),
+        cloud: info.cloud,
+        type: info.type,
+        scopes: info.scopes,
+        expiresAt: info.expiresAt,
+    };
+}
+export function toTokenWithInfo(providerId, session, altToken) {
+    const { accessToken: sessionToken, ...sessionInfo } = session;
+    const accessToken = altToken ?? session.accessToken;
+    return {
+        // pass original token info to form the correlated microhash
+        ...toTokenInfo(providerId, sessionToken, sessionInfo),
+        // use the actual token used for the request
+        accessToken: accessToken,
+    };
+}
+export const CloudIntegrationAuthenticationUriPathPrefix = 'did-authenticate-cloud-integration';
+/** Returns all supported cloud integration ids. */
+export function getSupportedCloudIntegrationIds() {
+    // Return the shared const directly (readonly so callers can't mutate it) — this runs on hot,
+    // per-integration membership paths, so avoid allocating a fresh array per call.
+    return supportedOrderedCloudIntegrationIds;
+}
+/** Whether `id` is a supported cloud integration id. */
+export function isSupportedCloudIntegrationId(id) {
+    return getSupportedCloudIntegrationIds().includes(id);
+}
+export function isIssueCloudIntegrationId(id) {
+    const issueIds = Object.values(IssuesCloudHostIntegrationId);
+    return issueIds.includes(id);
+}
+export const toIntegrationId = {
+    jira: IssuesCloudHostIntegrationId.Jira,
+    linear: IssuesCloudHostIntegrationId.Linear,
+    trello: IssuesCloudHostIntegrationId.Trello,
+    gitlab: GitCloudHostIntegrationId.GitLab,
+    github: GitCloudHostIntegrationId.GitHub,
+    githubEnterprise: GitSelfManagedHostIntegrationId.CloudGitHubEnterprise,
+    gitlabSelfHosted: GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted,
+    bitbucket: GitCloudHostIntegrationId.Bitbucket,
+    bitbucketServer: GitSelfManagedHostIntegrationId.BitbucketServer,
+    azure: GitCloudHostIntegrationId.AzureDevOps,
+    azureDevopsServer: GitSelfManagedHostIntegrationId.AzureDevOpsServer,
+};
+export const toCloudIntegrationType = {
+    [IssuesCloudHostIntegrationId.Jira]: 'jira',
+    [IssuesCloudHostIntegrationId.Linear]: 'linear',
+    [IssuesCloudHostIntegrationId.Trello]: 'trello',
+    [GitCloudHostIntegrationId.GitLab]: 'gitlab',
+    [GitCloudHostIntegrationId.GitHub]: 'github',
+    [GitCloudHostIntegrationId.Bitbucket]: 'bitbucket',
+    [GitCloudHostIntegrationId.AzureDevOps]: 'azure',
+    [GitSelfManagedHostIntegrationId.AzureDevOpsServer]: 'azureDevopsServer',
+    [GitSelfManagedHostIntegrationId.CloudGitHubEnterprise]: 'githubEnterprise',
+    [GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted]: 'gitlabSelfHosted',
+    [GitSelfManagedHostIntegrationId.BitbucketServer]: 'bitbucketServer',
+};
+//# sourceMappingURL=models.js.map

package/dist/plus/integrations/authentication/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../src/authentication/models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EACN,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,EAC5B,mCAAmC,GACnC,MAAM,iBAAiB,CAAC;AAwCzB,MAAM,UAAU,WAAW,CAC1B,UAAa,EACb,WAA+B,EAC/B,IAAkH;IAElH,OAAO;QACN,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;KACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,UAAa,EACb,OAAsC,EACtC,QAAiB;IAEjB,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;IAC9D,MAAM,WAAW,GAAG,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC;IACpD,OAAO;QACN,4DAA4D;QAC5D,GAAG,WAAW,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;QACrD,4CAA4C;QAC5C,WAAW,EAAE,WAAW;KACxB,CAAC;AACH,CAAC;AA+CD,MAAM,CAAC,MAAM,2CAA2C,GAAG,oCAAoC,CAAC;AAEhG,mDAAmD;AACnD,MAAM,UAAU,+BAA+B;IAC9C,6FAA6F;IAC7F,gFAAgF;IAChF,OAAO,mCAAmC,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,6BAA6B,CAAC,EAAU;IACvD,OAAO,+BAA+B,EAAE,CAAC,QAAQ,CAAC,EAAkC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,EAAU;IACnD,MAAM,QAAQ,GAAa,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAsD;IACjF,IAAI,EAAE,4BAA4B,CAAC,IAAI;IACvC,MAAM,EAAE,4BAA4B,CAAC,MAAM;IAC3C,MAAM,EAAE,4BAA4B,CAAC,MAAM;IAC3C,MAAM,EAAE,yBAAyB,CAAC,MAAM;IACxC,MAAM,EAAE,yBAAyB,CAAC,MAAM;IACxC,gBAAgB,EAAE,+BAA+B,CAAC,qBAAqB;IACvE,gBAAgB,EAAE,+BAA+B,CAAC,qBAAqB;IACvE,SAAS,EAAE,yBAAyB,CAAC,SAAS;IAC9C,eAAe,EAAE,+BAA+B,CAAC,eAAe;IAChE,KAAK,EAAE,yBAAyB,CAAC,WAAW;IAC5C,iBAAiB,EAAE,+BAA+B,CAAC,iBAAiB;CACpE,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAkE;IACpG,CAAC,4BAA4B,CAAC,IAAI,CAAC,EAAE,MAAM;IAC3C,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,QAAQ;IAC/C,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,QAAQ;IAC/C,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,QAAQ;IAC5C,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,QAAQ;IAC5C,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,WAAW;IAClD,CAAC,yBAAyB,CAAC,WAAW,CAAC,EAAE,OAAO;IAChD,CAAC,+BAA+B,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IACxE,CAAC,+BAA+B,CAAC,qBAAqB,CAAC,EAAE,kBAAkB;IAC3E,CAAC,+BAA+B,CAAC,qBAAqB,CAAC,EAAE,kBAAkB;IAC3E,CAAC,+BAA+B,CAAC,eAAe,CAAC,EAAE,iBAAiB;CACpE,CAAC"}