@gitkraken/core-gitlens 0.3.1 → 0.4.100

package/dist/plus/integrations/authentication/integrationAuthenticationProvider.d.ts

@@ -0,0 +1,112 @@
+import type { Disposable } from '../../../utils/disposable.js';
+import type { Event } from '../../../utils/event.js';
+import type { IntegrationIds } from '../constants.js';
+import type { Sources } from '../telemetry.js';
+import type { ConfiguredIntegrationService } from './configuredIntegrationService.js';
+import type { IntegrationAuthenticationService } from './integrationAuthenticationService.js';
+import type { ProviderAuthenticationSession } from './models.js';
+export interface IntegrationAuthenticationProviderDescriptor {
+    id: IntegrationIds;
+    scopes: string[];
+}
+export interface IntegrationAuthenticationSessionDescriptor {
+    domain: string;
+    scopes: string[];
+    /** When set, reads/deletes only the matching storage variant. */
+    cloud?: boolean;
+    /**
+     * Targets a specific connection when a provider has multiple accounts connected. When omitted,
+     * operations resolve to the provider's primary connection (see
+     * {@link ConfiguredIntegrationService.resolveConnectionId}).
+     */
+    connectionId?: string;
+    [key: string]: unknown;
+}
+export interface IntegrationAuthenticationProvider extends Disposable {
+    /**
+     * Clears the stored secret for one connection only (never the whole provider). Unlike
+     * {@link deleteAllSessions}, this by default leaves the descriptor in `integrations:configured` — its
+     * primary caller is a forced re-sync, which needs `getConfigured()` to keep reporting the connection
+     * while a fresh session is fetched to replace the deleted secret. Implementers should not treat this as
+     * a full disconnect. Pass `preserveConfigured: false` to also drop the descriptor (e.g. when the
+     * re-sync's replacement fetch failed and the connection should no longer be reported as connected).
+     */
+    deleteSession(descriptor: IntegrationAuthenticationSessionDescriptor, options?: {
+        preserveConfigured?: boolean;
+    }): Promise<void>;
+    deleteAllSessions(descriptor?: IntegrationAuthenticationSessionDescriptor): Promise<void>;
+    getSession(descriptor: IntegrationAuthenticationSessionDescriptor, options?: {
+        createIfNeeded?: boolean;
+        forceNewSession?: boolean;
+        sync?: never;
+        source?: Sources;
+    } | {
+        createIfNeeded?: never;
+        forceNewSession?: never;
+        sync: boolean;
+        source?: Sources;
+    }): Promise<ProviderAuthenticationSession | undefined>;
+    get onDidChange(): Event<void>;
+}
+declare abstract class IntegrationAuthenticationProviderBase<ID extends IntegrationIds = IntegrationIds> implements IntegrationAuthenticationProvider {
+    protected readonly authenticationService: IntegrationAuthenticationService;
+    protected readonly configuredIntegrationService: ConfiguredIntegrationService;
+    protected readonly disposables: Disposable[];
+    constructor(authenticationService: IntegrationAuthenticationService, configuredIntegrationService: ConfiguredIntegrationService);
+    dispose(): void;
+    private readonly _onDidChange;
+    get onDidChange(): Event<void>;
+    protected abstract get authProviderId(): ID;
+    deleteSession(descriptor: IntegrationAuthenticationSessionDescriptor, options?: {
+        preserveConfigured?: boolean;
+    }): Promise<void>;
+    deleteAllSessions(descriptor?: IntegrationAuthenticationSessionDescriptor): Promise<void>;
+    getSession(descriptor: IntegrationAuthenticationSessionDescriptor, options?: {
+        createIfNeeded?: boolean;
+        forceNewSession?: boolean;
+        sync?: never;
+        source?: Sources;
+    } | {
+        createIfNeeded?: never;
+        forceNewSession?: never;
+        sync: boolean;
+        source?: Sources;
+    }): Promise<ProviderAuthenticationSession | undefined>;
+    protected abstract getNewSession(descriptor: IntegrationAuthenticationSessionDescriptor, options?: {
+        createIfNeeded?: boolean;
+        forceNewSession?: boolean;
+        sync?: never;
+        refreshIfExpired?: boolean;
+        source?: Sources;
+    } | {
+        createIfNeeded?: never;
+        forceNewSession?: never;
+        sync: boolean;
+        refreshIfExpired?: boolean;
+        source?: Sources;
+    }): Promise<ProviderAuthenticationSession | undefined>;
+    protected fireChange(): void;
+}
+export declare class CloudIntegrationAuthenticationProvider<ID extends IntegrationIds = IntegrationIds> extends IntegrationAuthenticationProviderBase<ID> {
+    private readonly _authProviderId;
+    constructor(authenticationService: IntegrationAuthenticationService, configuredIntegrationService: ConfiguredIntegrationService, _authProviderId: ID);
+    protected get authProviderId(): ID;
+    protected getNewSession(descriptor: IntegrationAuthenticationSessionDescriptor, options?: {
+        createIfNeeded?: boolean;
+        forceNewSession?: boolean;
+        sync?: never;
+        refreshIfExpired?: boolean;
+        source?: Sources;
+    } | {
+        createIfNeeded?: never;
+        forceNewSession?: never;
+        sync: boolean;
+        refreshIfExpired?: boolean;
+        source?: Sources;
+    }): Promise<ProviderAuthenticationSession | undefined>;
+    private connectCloudSession;
+    private getCloudSession;
+    private disconnectCloudSession;
+}
+export {};
+//# sourceMappingURL=integrationAuthenticationProvider.d.ts.map

package/dist/plus/integrations/authentication/integrationAuthenticationProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrationAuthenticationProvider.d.ts","sourceRoot":"","sources":["../../../../src/plus/integrations/authentication/integrationAuthenticationProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAG/C,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACtF,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAKjE,MAAM,WAAW,2CAA2C;IAC3D,EAAE,EAAE,cAAc,CAAC;IACnB,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,0CAA0C;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,iEAAiE;IACjE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,iCAAkC,SAAQ,UAAU;IACpE;;;;;;;OAOG;IACH,aAAa,CACZ,UAAU,EAAE,0CAA0C,EACtD,OAAO,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACxC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,iBAAiB,CAAC,UAAU,CAAC,EAAE,0CAA0C,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,UAAU,CACT,UAAU,EAAE,0CAA0C,EACtD,OAAO,CAAC,EACL;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACvF;QAAE,cAAc,CAAC,EAAE,KAAK,CAAC;QAAC,eAAe,CAAC,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACrF,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAAC;IACtD,IAAI,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED,uBAAe,qCAAqC,CACnD,EAAE,SAAS,cAAc,GAAG,cAAc,CACzC,YAAW,iCAAiC;IAI5C,SAAS,CAAC,QAAQ,CAAC,qBAAqB,EAAE,gCAAgC;IAC1E,SAAS,CAAC,QAAQ,CAAC,4BAA4B,EAAE,4BAA4B;IAJ9E,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,EAAE,CAAM;IAElD,YACoB,qBAAqB,EAAE,gCAAgC,EACvD,4BAA4B,EAAE,4BAA4B,EAC1E;IAEJ,OAAO,IAAI,IAAI,CAEd;IAED,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuB;IACpD,IAAI,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,CAE7B;IAED,SAAS,CAAC,QAAQ,KAAK,cAAc,IAAI,EAAE,CAAC;IAGtC,aAAa,CAClB,UAAU,EAAE,0CAA0C,EACtD,OAAO,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACxC,OAAO,CAAC,IAAI,CAAC,CAmBf;IAGK,iBAAiB,CAAC,UAAU,CAAC,EAAE,0CAA0C,GAAG,OAAO,CAAC,IAAI,CAAC,CAa9F;IAGK,UAAU,CACf,UAAU,EAAE,0CAA0C,EACtD,OAAO,CAAC,EACL;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACvF;QAAE,cAAc,CAAC,EAAE,KAAK,CAAC;QAAC,eAAe,CAAC,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACrF,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAoCpD;IAED,SAAS,CAAC,QAAQ,CAAC,aAAa,CAC/B,UAAU,EAAE,0CAA0C,EACtD,OAAO,CAAC,EACL;QACA,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,IAAI,CAAC,EAAE,KAAK,CAAC;QACb,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAChB,GACD;QACA,cAAc,CAAC,EAAE,KAAK,CAAC;QACvB,eAAe,CAAC,EAAE,KAAK,CAAC;QACxB,IAAI,EAAE,OAAO,CAAC;QACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAChB,GACF,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CAAC;IAEtD,SAAS,CAAC,UAAU,IAAI,IAAI,CAE3B;CACD;AAED,qBAAa,sCAAsC,CAClD,EAAE,SAAS,cAAc,GAAG,cAAc,CACzC,SAAQ,qCAAqC,CAAC,EAAE,CAAC;IAIjD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAHjC,YACC,qBAAqB,EAAE,gCAAgC,EACvD,4BAA4B,EAAE,4BAA4B,EACzC,eAAe,EAAE,EAAE,EAGpC;IAED,SAAS,KAAK,cAAc,IAAI,EAAE,CAEjC;IAED,UAAyB,aAAa,CACrC,UAAU,EAAE,0CAA0C,EACtD,OAAO,CAAC,EACL;QACA,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,IAAI,CAAC,EAAE,KAAK,CAAC;QACb,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAChB,GACD;QACA,cAAc,CAAC,EAAE,KAAK,CAAC;QACvB,eAAe,CAAC,EAAE,KAAK,CAAC;QACxB,IAAI,EAAE,OAAO,CAAC;QACd,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;KAChB,GACF,OAAO,CAAC,6BAA6B,GAAG,SAAS,CAAC,CA4BpD;IAED,OAAO,CAAC,mBAAmB;YAoBb,eAAe;YAsFf,sBAAsB;CAOpC"}

package/dist/plus/integrations/authentication/integrationAuthenticationProvider.js

@@ -0,0 +1,217 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { trace } from '../../../utils/decorators/log.js';
+import { Emitter } from '../../../utils/event.js';
+import { areDomainsOnSameHost } from '../utils/domain.utils.js';
+import { isGitSelfManagedHostIntegrationId, isNonExpiringZeroTokenIntegrationId } from '../utils/integration.utils.js';
+import { isSupportedCloudIntegrationId } from './models.js';
+const maxSmallIntegerV8 = 2 ** 30 - 1; // Max number that can be stored in V8's smis (small integers)
+class IntegrationAuthenticationProviderBase {
+    authenticationService;
+    configuredIntegrationService;
+    disposables = [];
+    constructor(authenticationService, configuredIntegrationService) {
+        this.authenticationService = authenticationService;
+        this.configuredIntegrationService = configuredIntegrationService;
+    }
+    dispose() {
+        this.disposables.forEach(d => d.dispose());
+    }
+    _onDidChange = new Emitter();
+    get onDidChange() {
+        return this._onDidChange.event;
+    }
+    async deleteSession(descriptor, options) {
+        const domain = isGitSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined;
+        const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {
+            domain: domain,
+        });
+        // Scope the descriptor to cloud so resolveConnectionId targets the cloud variant's id: this is a
+        // cloud-only delete, and a mixed local+cloud connection whose local descriptor is primary would
+        // otherwise resolve the local id and leave the cloud secret intact.
+        await this.configuredIntegrationService.deleteStoredSessions(this.authProviderId, { ...descriptor, cloud: true }, true, { preserveConfigured: options?.preserveConfigured ?? true });
+        if (configured?.length) {
+            this.fireChange();
+        }
+    }
+    async deleteAllSessions(descriptor) {
+        // Self-managed providers group every host under one provider id, so scope the clear to this
+        // descriptor's host when given; for cloud providers the domain stays undefined here, clearing every account.
+        const domain = isGitSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined;
+        const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {
+            domain: domain,
+        });
+        await this.configuredIntegrationService.deleteAllStoredSessions(this.authProviderId, undefined, domain);
+        if (configured?.length) {
+            this.fireChange();
+        }
+    }
+    async getSession(descriptor, options) {
+        let session;
+        let previousToken;
+        if (options?.forceNewSession) {
+            // Cloud-only delete (see deleteSession): scope to cloud so the cloud variant's id is cleared even
+            // when a mixed local+cloud connection's local descriptor is primary.
+            await this.configuredIntegrationService.deleteStoredSessions(this.authProviderId, { ...descriptor, cloud: true }, true);
+        }
+        else {
+            session = await this.configuredIntegrationService.getStoredSession(this.authProviderId, options?.sync ? { ...descriptor, cloud: true } : descriptor);
+            previousToken = session?.accessToken;
+        }
+        const isExpiredSession = session?.expiresAt != null && new Date(session.expiresAt).getTime() < Date.now();
+        if (session == null || isExpiredSession) {
+            session = await this.getNewSession(descriptor, {
+                ...options,
+                refreshIfExpired: isExpiredSession,
+            });
+            if (session != null) {
+                await this.configuredIntegrationService.storeSession(this.authProviderId, session);
+            }
+        }
+        if (previousToken !== session?.accessToken) {
+            this.fireChange();
+        }
+        return session;
+    }
+    fireChange() {
+        queueMicrotask(() => this._onDidChange.fire());
+    }
+}
+__decorate([
+    trace()
+], IntegrationAuthenticationProviderBase.prototype, "deleteSession", null);
+__decorate([
+    trace()
+], IntegrationAuthenticationProviderBase.prototype, "deleteAllSessions", null);
+__decorate([
+    trace()
+], IntegrationAuthenticationProviderBase.prototype, "getSession", null);
+export class CloudIntegrationAuthenticationProvider extends IntegrationAuthenticationProviderBase {
+    _authProviderId;
+    constructor(authenticationService, configuredIntegrationService, _authProviderId) {
+        super(authenticationService, configuredIntegrationService);
+        this._authProviderId = _authProviderId;
+    }
+    get authProviderId() {
+        return this._authProviderId;
+    }
+    async getNewSession(descriptor, options) {
+        if (options?.forceNewSession) {
+            if ((await this.disconnectCloudSession()) === 'failure') {
+                return undefined;
+            }
+            void this.connectCloudSession(false, options?.source);
+            return undefined;
+        }
+        // TODO: This is a stopgap to make sure we're not hammering the api on automatic calls to get the session.
+        // Ultimately we want to timestamp calls to syncCloudIntegrations and use that to determine whether we should
+        // make the call or not.
+        let session = options?.refreshIfExpired || options?.createIfNeeded || options?.forceNewSession || options?.sync
+            ? await this.getCloudSession(descriptor)
+            : undefined;
+        const shouldCreateSession = options?.createIfNeeded && session == null;
+        if (shouldCreateSession) {
+            const connected = await this.connectCloudSession(true, options?.source);
+            if (!connected)
+                return undefined;
+            // This should get us the session we just created with connectCloudSession, because a syncCloudIntegrations run from
+            // integration service should have resulted in it being created and stored by this provider
+            session = await this.getSession(descriptor, { source: options?.source });
+        }
+        return session;
+    }
+    connectCloudSession(skipIfConnected, source) {
+        // Capture in a const so the type guard narrows it to `SupportedCloudIntegrationIds` (a getter
+        // access wouldn't narrow), letting us call the service directly without a cast.
+        const id = this.authProviderId;
+        if (isSupportedCloudIntegrationId(id)) {
+            return this.authenticationService.connectCloudIntegrations({ integrationIds: [id], skipIfConnected: skipIfConnected, skipPreSync: true }, {
+                source: source ?? 'integrations',
+                detail: {
+                    action: 'connect',
+                    integration: id,
+                },
+            });
+        }
+        return Promise.resolve(false);
+    }
+    async getCloudSession(descriptor) {
+        const loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;
+        if (!loggedIn)
+            return undefined;
+        const cloudIntegrations = this.authenticationService.cloudIntegrations;
+        // An unscoped descriptor (no explicit connectionId) would fetch the provider-global primary via
+        // `v1/provider-tokens/<provider>`. For a self-managed provider spanning multiple hosts that primary
+        // can belong to a different host, so a forced sync of host A would hydrate host B's token here (before
+        // reconcile corrects storage). Scope to this host's own configured connection when we have one; fall
+        // through to the provider-scoped path only when nothing is configured yet (legacy/first sync).
+        const connectionId = descriptor.connectionId ??
+            (isGitSelfManagedHostIntegrationId(this.authProviderId)
+                ? this.configuredIntegrationService.getConfiguredConnectionId(this.authProviderId, descriptor.domain, true)
+                : undefined);
+        let session = await cloudIntegrations.getConnectionSession(this.authProviderId, undefined, connectionId);
+        if (session != null &&
+            isGitSelfManagedHostIntegrationId(this.authProviderId) &&
+            !areDomainsOnSameHost(session.domain, descriptor.domain)) {
+            return undefined;
+        }
+        // GitHub, the cloud self-managed hosts, and Trello return `expiresIn: 0` for a token that never
+        // expires; left as 0 the session would be built with `expiresAt = now` and rejected as expired on the
+        // next resolution. Map it to the maximum expiry so it isn't refreshed frequently.
+        if (session?.expiresIn === 0 && isNonExpiringZeroTokenIntegrationId(this.authProviderId)) {
+            session.expiresIn = maxSmallIntegerV8; // maximum expiration length
+        }
+        if (session != null && session.expiresIn < 60) {
+            session = await cloudIntegrations.getConnectionSession(this.authProviderId, session.accessToken, connectionId);
+            if (session != null &&
+                isGitSelfManagedHostIntegrationId(this.authProviderId) &&
+                !areDomainsOnSameHost(session.domain, descriptor.domain)) {
+                return undefined;
+            }
+        }
+        if (!session)
+            return undefined;
+        let sessionProtocol;
+        // Only derive a protocol from a domain carrying an explicit scheme; a bare `host:port` (e.g. a
+        // self-managed `ghe.example.com:8443`) parses the host as the protocol, corrupting the value.
+        if (/^[a-z][a-z\d+\-.]*:\/\//i.test(session.domain)) {
+            try {
+                sessionProtocol = new URL(session.domain).protocol;
+            }
+            catch {
+                sessionProtocol = undefined;
+            }
+        }
+        return {
+            // Prefer the backend's per-connection token id (multi-account); fall back to the resolved
+            // primary/legacy connection id so existing single-connection storage keys are preserved.
+            id: session.id ?? this.configuredIntegrationService.resolveConnectionId(this.authProviderId, descriptor),
+            accessToken: session.accessToken,
+            scopes: descriptor.scopes,
+            account: {
+                id: '',
+                label: '',
+            },
+            cloud: true,
+            type: session.type,
+            expiresAt: new Date(session.expiresIn * 1000 + Date.now()),
+            // Note: do not use the session's domain, because the format is different than in our model
+            domain: descriptor.domain,
+            protocol: sessionProtocol ?? undefined,
+            // Carried for providers whose client needs an app key alongside the token (e.g. Trello).
+            appKey: session.appKey,
+        };
+    }
+    async disconnectCloudSession() {
+        const loggedIn = (await this.authenticationService.ctx.account.getAccount()) != null;
+        if (!loggedIn)
+            return 'skip';
+        const cloudIntegrations = this.authenticationService.cloudIntegrations;
+        return (await cloudIntegrations.disconnect(this.authProviderId)) ? 'success' : 'failure';
+    }
+}
+//# sourceMappingURL=integrationAuthenticationProvider.js.map

package/dist/plus/integrations/authentication/integrationAuthenticationProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrationAuthenticationProvider.js","sourceRoot":"","sources":["../../../../src/plus/integrations/authentication/integrationAuthenticationProvider.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAGzD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAGlD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iCAAiC,EAAE,mCAAmC,EAAE,MAAM,+BAA+B,CAAC;AAIvH,OAAO,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,iBAAiB,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,8DAA8D;AA4CrG,MAAe,qCAAqC;IAM/B,qBAAqB;IACrB,4BAA4B;IAJ7B,WAAW,GAAiB,EAAE,CAAC;IAElD,YACoB,qBAAuD,EACvD,4BAA0D;qCAD1D,qBAAqB;4CACrB,4BAA4B;IAC7C,CAAC;IAEJ,OAAO;QACN,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEgB,YAAY,GAAG,IAAI,OAAO,EAAQ,CAAC;IACpD,IAAI,WAAW;QACd,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;IAChC,CAAC;IAKK,AAAN,KAAK,CAAC,aAAa,CAClB,UAAsD,EACtD,OAA0C;QAE1C,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,UAAU,GAAG,IAAI,CAAC,4BAA4B,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE;YACvF,MAAM,EAAE,MAAM;SACd,CAAC,CAAC;QAEH,iGAAiG;QACjG,gGAAgG;QAChG,oEAAoE;QACpE,MAAM,IAAI,CAAC,4BAA4B,CAAC,oBAAoB,CAC3D,IAAI,CAAC,cAAc,EACnB,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAC9B,IAAI,EACJ,EAAE,kBAAkB,EAAE,OAAO,EAAE,kBAAkB,IAAI,IAAI,EAAE,CAC3D,CAAC;QAEF,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;IACF,CAAC;IAGK,AAAN,KAAK,CAAC,iBAAiB,CAAC,UAAuD;QAC9E,4FAA4F;QAC5F,6GAA6G;QAC7G,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,UAAU,GAAG,IAAI,CAAC,4BAA4B,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE;YACvF,MAAM,EAAE,MAAM;SACd,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,4BAA4B,CAAC,uBAAuB,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAExG,IAAI,UAAU,EAAE,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;IACF,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CACf,UAAsD,EACtD,OAEuF;QAEvF,IAAI,OAAO,CAAC;QACZ,IAAI,aAAa,CAAC;QAClB,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;YAC9B,kGAAkG;YAClG,qEAAqE;YACrE,MAAM,IAAI,CAAC,4BAA4B,CAAC,oBAAoB,CAC3D,IAAI,CAAC,cAAc,EACnB,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAC9B,IAAI,CACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACP,OAAO,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,gBAAgB,CACjE,IAAI,CAAC,cAAc,EACnB,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAC3D,CAAC;YACF,aAAa,GAAG,OAAO,EAAE,WAAW,CAAC;QACtC,CAAC;QAED,MAAM,gBAAgB,GAAG,OAAO,EAAE,SAAS,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1G,IAAI,OAAO,IAAI,IAAI,IAAI,gBAAgB,EAAE,CAAC;YACzC,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE;gBAC9C,GAAG,OAAO;gBACV,gBAAgB,EAAE,gBAAgB;aAClC,CAAC,CAAC;YAEH,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACrB,MAAM,IAAI,CAAC,4BAA4B,CAAC,YAAY,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACpF,CAAC;QACF,CAAC;QAED,IAAI,aAAa,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QACnB,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAqBS,UAAU;QACnB,cAAc,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;CACD;AA1GM;IADL,KAAK,EAAE;0EAuBP;AAGK;IADL,KAAK,EAAE;8EAcP;AAGK;IADL,KAAK,EAAE;uEA0CP;AA0BF,MAAM,OAAO,sCAEX,SAAQ,qCAAyC;IAIhC,eAAe;IAHjC,YACC,qBAAuD,EACvD,4BAA0D,EACzC,eAAmB;QAEpC,KAAK,CAAC,qBAAqB,EAAE,4BAA4B,CAAC,CAAC;+BAF1C,eAAe;IAGjC,CAAC;IAED,IAAc,cAAc;QAC3B,OAAO,IAAI,CAAC,eAAe,CAAC;IAC7B,CAAC;IAEkB,KAAK,CAAC,aAAa,CACrC,UAAsD,EACtD,OAcI;QAEJ,IAAI,OAAO,EAAE,eAAe,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;gBACzD,OAAO,SAAS,CAAC;YAClB,CAAC;YAED,KAAK,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACtD,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,0GAA0G;QAC1G,6GAA6G;QAC7G,wBAAwB;QACxB,IAAI,OAAO,GACV,OAAO,EAAE,gBAAgB,IAAI,OAAO,EAAE,cAAc,IAAI,OAAO,EAAE,eAAe,IAAI,OAAO,EAAE,IAAI;YAChG,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,mBAAmB,GAAG,OAAO,EAAE,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC;QACvE,IAAI,mBAAmB,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YAEjC,oHAAoH;YACpH,2FAA2F;YAC3F,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,mBAAmB,CAAC,eAAwB,EAAE,MAA2B;QAChF,8FAA8F;QAC9F,gFAAgF;QAChF,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAC/B,IAAI,6BAA6B,CAAC,EAAE,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC,qBAAqB,CAAC,wBAAwB,CACzD,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,EAC7E;gBACC,MAAM,EAAE,MAAM,IAAI,cAAc;gBAChC,MAAM,EAAE;oBACP,MAAM,EAAE,SAAS;oBACjB,WAAW,EAAE,EAAE;iBACf;aACD,CACD,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,eAAe,CAC5B,UAAsD;QAEtD,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC;QACrF,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAEhC,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;QACvE,gGAAgG;QAChG,oGAAoG;QACpG,uGAAuG;QACvG,qGAAqG;QACrG,+FAA+F;QAC/F,MAAM,YAAY,GACjB,UAAU,CAAC,YAAY;YACvB,CAAC,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC;gBACtD,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,yBAAyB,CAC3D,IAAI,CAAC,cAAc,EACnB,UAAU,CAAC,MAAM,EACjB,IAAI,CACJ;gBACF,CAAC,CAAC,SAAS,CAAC,CAAC;QACf,IAAI,OAAO,GAAG,MAAM,iBAAiB,CAAC,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QACzG,IACC,OAAO,IAAI,IAAI;YACf,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC;YACtD,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EACvD,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,gGAAgG;QAChG,sGAAsG;QACtG,kFAAkF;QAClF,IAAI,OAAO,EAAE,SAAS,KAAK,CAAC,IAAI,mCAAmC,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1F,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC,CAAC,4BAA4B;QACpE,CAAC;QAED,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG,EAAE,EAAE,CAAC;YAC/C,OAAO,GAAG,MAAM,iBAAiB,CAAC,oBAAoB,CACrD,IAAI,CAAC,cAAc,EACnB,OAAO,CAAC,WAAW,EACnB,YAAY,CACZ,CAAC;YACF,IACC,OAAO,IAAI,IAAI;gBACf,iCAAiC,CAAC,IAAI,CAAC,cAAc,CAAC;gBACtD,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EACvD,CAAC;gBACF,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAE/B,IAAI,eAAe,CAAC;QACpB,+FAA+F;QAC/F,8FAA8F;QAC9F,IAAI,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC;gBACJ,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;YACpD,CAAC;YAAC,MAAM,CAAC;gBACR,eAAe,GAAG,SAAS,CAAC;YAC7B,CAAC;QACF,CAAC;QAED,OAAO;YACN,0FAA0F;YAC1F,yFAAyF;YACzF,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,4BAA4B,CAAC,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC;YACxG,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACR,EAAE,EAAE,EAAE;gBACN,KAAK,EAAE,EAAE;aACT;YACD,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1D,2FAA2F;YAC3F,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ,EAAE,eAAe,IAAI,SAAS;YACtC,yFAAyF;YACzF,MAAM,EAAE,OAAO,CAAC,MAAM;SACtB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB;QACnC,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,IAAI,CAAC;QACrF,IAAI,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC;QAE7B,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;QACvE,OAAO,CAAC,MAAM,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;CACD"}

package/dist/plus/integrations/authentication/integrationAuthenticationService.d.ts

@@ -0,0 +1,62 @@
+import type { GitRemote } from '../../../git/models/remote.js';
+import type { Disposable } from '../../../utils/disposable.js';
+import type { IntegrationIds, SupportedCloudIntegrationIds } from '../constants.js';
+import type { IntegrationServiceContext } from '../context.js';
+import type { IntegrationService } from '../integrationService.js';
+import type { GitHostIntegration } from '../models/gitHostIntegration.js';
+import type { ApiClients } from '../providers/apiClients.js';
+import type { Source } from '../telemetry.js';
+import type { CloudIntegrationService } from './cloudIntegrationService.js';
+import type { ConfiguredIntegrationService } from './configuredIntegrationService.js';
+import type { IntegrationAuthenticationProvider } from './integrationAuthenticationProvider.js';
+export declare class IntegrationAuthenticationService implements Disposable {
+    private readonly configuredIntegrationService;
+    readonly ctx: IntegrationServiceContext;
+    /**
+     * Lazy accessor for the owning {@link IntegrationService}. Injected by the composition root
+     * ({@link createIntegrationManager}) to break the auth↔service construction cycle without a
+     * mutable setter or a host round-trip; only resolved at runtime (long after construction).
+     */
+    private readonly getIntegrationService;
+    /** The package's cloud token-exchange client, constructed by the composition root. */
+    readonly cloudIntegrations: CloudIntegrationService;
+    private readonly providers;
+    constructor(configuredIntegrationService: ConfiguredIntegrationService, ctx: IntegrationServiceContext, 
+    /**
+     * Lazy accessor for the owning {@link IntegrationService}. Injected by the composition root
+     * ({@link createIntegrationManager}) to break the auth↔service construction cycle without a
+     * mutable setter or a host round-trip; only resolved at runtime (long after construction).
+     */
+    getIntegrationService: () => IntegrationService, 
+    /** The package's cloud token-exchange client, constructed by the composition root. */
+    cloudIntegrations: CloudIntegrationService);
+    dispose(): void;
+    /**
+     * Initiates the cloud-integration connect flow on the owning service. Cloud auth providers call
+     * this when they need a session that doesn't exist yet (see
+     * {@link CloudIntegrationAuthenticationProvider}).
+     */
+    connectCloudIntegrations(connect: {
+        integrationIds: SupportedCloudIntegrationIds[];
+        skipIfConnected?: boolean;
+        skipPreSync?: boolean;
+    }, source?: Source): Promise<boolean>;
+    /**
+     * Resolves the connected git-host integration for a `GitRemote`, via the owning service. Lets
+     * package-internal callers (e.g. the Bitbucket provider) resolve a remote's integration without a
+     * host round-trip.
+     */
+    getByRemote(remote: GitRemote): Promise<GitHostIntegration | undefined>;
+    /** Resolves the per-integration `ignoreSSLErrors` flag via the owning service (host-config-backed). */
+    ignoreSSLErrors(integration: GitHostIntegration | {
+        id: IntegrationIds;
+        domain?: string;
+    }): boolean | 'force';
+    /** The package-built per-provider API clients, via the owning service (built once + memoized there). */
+    get apis(): ApiClients;
+    get(providerId: IntegrationIds): Promise<IntegrationAuthenticationProvider>;
+    reset(): Promise<void>;
+    supports(providerId: string): boolean;
+    private ensureProvider;
+}
+//# sourceMappingURL=integrationAuthenticationService.d.ts.map

package/dist/plus/integrations/authentication/integrationAuthenticationService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrationAuthenticationService.d.ts","sourceRoot":"","sources":["../../../../src/plus/integrations/authentication/integrationAuthenticationService.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAG/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAMpF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,mCAAmC,CAAC;AACtF,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAGhG,qBAAa,gCAAiC,YAAW,UAAU;IAIjE,OAAO,CAAC,QAAQ,CAAC,4BAA4B;IAC7C,QAAQ,CAAC,GAAG,EAAE,yBAAyB;IACvC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACtC,sFAAsF;IACtF,QAAQ,CAAC,iBAAiB,EAAE,uBAAuB;IAZpD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgE;IAE1F,YACkB,4BAA4B,EAAE,4BAA4B,EAClE,GAAG,EAAE,yBAAyB;IACvC;;;;OAIG;IACc,qBAAqB,EAAE,MAAM,kBAAkB;IAChE,sFAAsF;IAC7E,iBAAiB,EAAE,uBAAuB,EAChD;IAEJ,OAAO,IAAI,IAAI,CAGd;IAED;;;;OAIG;IACH,wBAAwB,CACvB,OAAO,EAAE;QAAE,cAAc,EAAE,4BAA4B,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,EAC7G,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,CAAC,CAElB;IAED;;;;OAIG;IACH,WAAW,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAEtE;IAED,uGAAuG;IACvG,eAAe,CAAC,WAAW,EAAE,kBAAkB,GAAG;QAAE,EAAE,EAAE,cAAc,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,GAAG,OAAO,CAE5G;IAED,wGAAwG;IACxG,IAAI,IAAI,IAAI,UAAU,CAErB;IAEK,GAAG,CAAC,UAAU,EAAE,cAAc,GAAG,OAAO,CAAC,iCAAiC,CAAC,CAEhF;IAGK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAO3B;IAED,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAiBpC;YAGa,cAAc;CAwC5B"}

package/dist/plus/integrations/authentication/integrationAuthenticationService.js

@@ -0,0 +1,126 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { gate } from '../../../utils/decorators/gate.js';
+import { debug } from '../../../utils/decorators/log.js';
+import { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId, IssuesCloudHostIntegrationId, } from '../constants.js';
+import { supportedIntegrationIds } from '../utils/integration.utils.js';
+import { CloudIntegrationAuthenticationProvider } from './integrationAuthenticationProvider.js';
+export class IntegrationAuthenticationService {
+    configuredIntegrationService;
+    ctx;
+    getIntegrationService;
+    cloudIntegrations;
+    providers = new Map();
+    constructor(configuredIntegrationService, ctx, 
+    /**
+     * Lazy accessor for the owning {@link IntegrationService}. Injected by the composition root
+     * ({@link createIntegrationManager}) to break the auth↔service construction cycle without a
+     * mutable setter or a host round-trip; only resolved at runtime (long after construction).
+     */
+    getIntegrationService, 
+    /** The package's cloud token-exchange client, constructed by the composition root. */
+    cloudIntegrations) {
+        this.configuredIntegrationService = configuredIntegrationService;
+        this.ctx = ctx;
+        this.getIntegrationService = getIntegrationService;
+        this.cloudIntegrations = cloudIntegrations;
+    }
+    dispose() {
+        this.providers.forEach(p => p.dispose());
+        this.providers.clear();
+    }
+    /**
+     * Initiates the cloud-integration connect flow on the owning service. Cloud auth providers call
+     * this when they need a session that doesn't exist yet (see
+     * {@link CloudIntegrationAuthenticationProvider}).
+     */
+    connectCloudIntegrations(connect, source) {
+        return this.getIntegrationService().connectCloudIntegrations(connect, source);
+    }
+    /**
+     * Resolves the connected git-host integration for a `GitRemote`, via the owning service. Lets
+     * package-internal callers (e.g. the Bitbucket provider) resolve a remote's integration without a
+     * host round-trip.
+     */
+    getByRemote(remote) {
+        return this.getIntegrationService().getByRemote(remote);
+    }
+    /** Resolves the per-integration `ignoreSSLErrors` flag via the owning service (host-config-backed). */
+    ignoreSSLErrors(integration) {
+        return this.getIntegrationService().ignoreSSLErrors(integration);
+    }
+    /** The package-built per-provider API clients, via the owning service (built once + memoized there). */
+    get apis() {
+        return this.getIntegrationService().apis;
+    }
+    async get(providerId) {
+        return this.ensureProvider(providerId);
+    }
+    async reset() {
+        // TODO: This really isn't ideal, since it will only work for "cloud" providers as we won't have any more specific descriptors
+        await Promise.allSettled(supportedIntegrationIds.map(async (providerId) => (await this.ensureProvider(providerId)).deleteAllSessions()));
+    }
+    supports(providerId) {
+        // Linear and Trello are cloud-backed issue integrations (same as Jira): `ensureProvider` registers a
+        // cloud auth provider for them, so a disconnect must offer to sign out of the cloud token too —
+        // otherwise the backend token and configured connection survive the disable.
+        switch (providerId) {
+            case GitCloudHostIntegrationId.AzureDevOps:
+            case GitSelfManagedHostIntegrationId.AzureDevOpsServer:
+            case GitCloudHostIntegrationId.Bitbucket:
+            case GitCloudHostIntegrationId.GitLab:
+            case IssuesCloudHostIntegrationId.Jira:
+            case IssuesCloudHostIntegrationId.Linear:
+            case IssuesCloudHostIntegrationId.Trello:
+            case GitCloudHostIntegrationId.GitHub:
+                return true;
+            default:
+                return false;
+        }
+    }
+    async ensureProvider(providerId) {
+        let provider = this.providers.get(providerId);
+        if (provider != null)
+            return provider;
+        // Optional consumer override for custom auth (e.g. a manual-token provider). GitLens omits it —
+        // the package constructs its own cloud providers below (so GitLens's cloud auth needs no host hook).
+        const hostProvider = await this.ctx.hooks?.createAuthenticationProvider?.({
+            id: providerId,
+        });
+        if (hostProvider != null) {
+            this.providers.set(providerId, hostProvider);
+            return hostProvider;
+        }
+        // Every cloud integration shares one provider, parameterized by id (cloud-only).
+        switch (providerId) {
+            case GitCloudHostIntegrationId.GitHub:
+            case GitSelfManagedHostIntegrationId.CloudGitHubEnterprise:
+            case GitCloudHostIntegrationId.GitLab:
+            case GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted:
+            case GitCloudHostIntegrationId.AzureDevOps:
+            case GitSelfManagedHostIntegrationId.AzureDevOpsServer:
+            case GitCloudHostIntegrationId.Bitbucket:
+            case GitSelfManagedHostIntegrationId.BitbucketServer:
+            case IssuesCloudHostIntegrationId.Jira:
+            case IssuesCloudHostIntegrationId.Linear:
+            case IssuesCloudHostIntegrationId.Trello:
+                provider = new CloudIntegrationAuthenticationProvider(this, this.configuredIntegrationService, providerId);
+                break;
+            default:
+                throw new Error(`No authentication provider registered for integration '${String(providerId)}'`);
+        }
+        this.providers.set(providerId, provider);
+        return provider;
+    }
+}
+__decorate([
+    debug()
+], IntegrationAuthenticationService.prototype, "reset", null);
+__decorate([
+    gate()
+], IntegrationAuthenticationService.prototype, "ensureProvider", null);
+//# sourceMappingURL=integrationAuthenticationService.js.map

package/dist/plus/integrations/authentication/integrationAuthenticationService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrationAuthenticationService.js","sourceRoot":"","sources":["../../../../src/plus/integrations/authentication/integrationAuthenticationService.ts"],"names":[],"mappings":";;;;;;AACA,OAAO,EAAE,IAAI,EAAE,MAAM,mCAAmC,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,kCAAkC,CAAC;AAGzD,OAAO,EACN,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,GAC5B,MAAM,iBAAiB,CAAC;AAMzB,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAIxE,OAAO,EAAE,sCAAsC,EAAE,MAAM,wCAAwC,CAAC;AAEhG,MAAM,OAAO,gCAAgC;IAI1B,4BAA4B;IACpC,GAAG;IAMK,qBAAqB;IAE7B,iBAAiB;IAZV,SAAS,GAAG,IAAI,GAAG,EAAqD,CAAC;IAE1F,YACkB,4BAA0D,EAClE,GAA8B;IACvC;;;;OAIG;IACc,qBAA+C;IAChE,sFAAsF;IAC7E,iBAA0C;4CATlC,4BAA4B;mBACpC,GAAG;qCAMK,qBAAqB;iCAE7B,iBAAiB;IACxB,CAAC;IAEJ,OAAO;QACN,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED;;;;OAIG;IACH,wBAAwB,CACvB,OAA6G,EAC7G,MAAe;QAEf,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/E,CAAC;IAED;;;;OAIG;IACH,WAAW,CAAC,MAAiB;QAC5B,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,uGAAuG;IACvG,eAAe,CAAC,WAAyE;QACxF,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC;IAED,wGAAwG;IACxG,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,qBAAqB,EAAE,CAAC,IAAI,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAA0B;QACnC,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK;QACV,8HAA8H;QAC9H,MAAM,OAAO,CAAC,UAAU,CACvB,uBAAuB,CAAC,GAAG,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE,CAC9C,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAC3D,CACD,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,UAAkB;QAC1B,qGAAqG;QACrG,gGAAgG;QAChG,6EAA6E;QAC7E,QAAQ,UAAU,EAAE,CAAC;YACpB,KAAK,yBAAyB,CAAC,WAAW,CAAC;YAC3C,KAAK,+BAA+B,CAAC,iBAAiB,CAAC;YACvD,KAAK,yBAAyB,CAAC,SAAS,CAAC;YACzC,KAAK,yBAAyB,CAAC,MAAM,CAAC;YACtC,KAAK,4BAA4B,CAAC,IAAI,CAAC;YACvC,KAAK,4BAA4B,CAAC,MAAM,CAAC;YACzC,KAAK,4BAA4B,CAAC,MAAM,CAAC;YACzC,KAAK,yBAAyB,CAAC,MAAM;gBACpC,OAAO,IAAI,CAAC;YACb;gBACC,OAAO,KAAK,CAAC;QACf,CAAC;IACF,CAAC;IAGa,AAAN,KAAK,CAAC,cAAc,CAAC,UAA0B;QACtD,IAAI,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,QAAQ,IAAI,IAAI;YAAE,OAAO,QAAQ,CAAC;QAEtC,gGAAgG;QAChG,qGAAqG;QACrG,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACzE,EAAE,EAAE,UAAU;SACd,CAAC,CAAC;QACH,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;YAC7C,OAAO,YAAY,CAAC;QACrB,CAAC;QAED,iFAAiF;QACjF,QAAQ,UAAU,EAAE,CAAC;YACpB,KAAK,yBAAyB,CAAC,MAAM,CAAC;YACtC,KAAK,+BAA+B,CAAC,qBAAqB,CAAC;YAC3D,KAAK,yBAAyB,CAAC,MAAM,CAAC;YACtC,KAAK,+BAA+B,CAAC,qBAAqB,CAAC;YAC3D,KAAK,yBAAyB,CAAC,WAAW,CAAC;YAC3C,KAAK,+BAA+B,CAAC,iBAAiB,CAAC;YACvD,KAAK,yBAAyB,CAAC,SAAS,CAAC;YACzC,KAAK,+BAA+B,CAAC,eAAe,CAAC;YACrD,KAAK,4BAA4B,CAAC,IAAI,CAAC;YACvC,KAAK,4BAA4B,CAAC,MAAM,CAAC;YACzC,KAAK,4BAA4B,CAAC,MAAM;gBACvC,QAAQ,GAAG,IAAI,sCAAsC,CACpD,IAAI,EACJ,IAAI,CAAC,4BAA4B,EACjC,UAAU,CACV,CAAC;gBACF,MAAM;YACP;gBACC,MAAM,IAAI,KAAK,CAAC,0DAA0D,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACnG,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC;IACjB,CAAC;CACD;AArEM;IADL,KAAK,EAAE;6DAQP;AAsBa;IADb,IAAI,EAAE;sEAwCN"}

package/dist/plus/integrations/authentication/manualTokenProvider.d.ts

@@ -0,0 +1,16 @@
+import type { IntegrationIds } from '../constants.js';
+import type { IntegrationAuthenticationProvider } from './integrationAuthenticationProvider.js';
+export interface ManualTokenAuthProviderOptions {
+    readonly id: IntegrationIds;
+    readonly token: string;
+    readonly account: {
+        readonly id: string;
+        readonly label: string;
+    };
+    readonly scopes?: readonly string[];
+    readonly domain?: string;
+    readonly cloud?: boolean;
+    readonly appKey?: string;
+}
+export declare function createManualTokenAuthProvider(options: ManualTokenAuthProviderOptions): IntegrationAuthenticationProvider;
+//# sourceMappingURL=manualTokenProvider.d.ts.map

package/dist/plus/integrations/authentication/manualTokenProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manualTokenProvider.d.ts","sourceRoot":"","sources":["../../../../src/plus/integrations/authentication/manualTokenProvider.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,KAAK,EACX,iCAAiC,EAEjC,MAAM,wCAAwC,CAAC;AAGhD,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,CAAC,EAAE,EAAE,cAAc,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,8BAA8B,GACrC,iCAAiC,CAkCnC"}

package/dist/plus/integrations/authentication/manualTokenProvider.js

@@ -0,0 +1,53 @@
+// Convenience for "manual token" auth — when a consumer already has an access
+// token (CLI flag, env var, secret manager) and just wants the package to use
+// it without an OAuth dance. Wire it into the manager via the
+// `createAuthenticationProvider` hook:
+//
+//   const manager = createIntegrationManager({
+//       ...runtime,
+//       hooks: {
+//           createAuthenticationProvider: async ({ id }) =>
+//               id === GitCloudHostIntegrationId.GitHub
+//                   ? createManualTokenAuthProvider({
+//                         id: id,
+//                         token: process.env.GITHUB_TOKEN!,
+//                         account: { id: 'me', label: 'CLI Token' },
+//                     })
+//                   : undefined,
+//       },
+//   });
+//
+// The provider is intentionally minimal — sessions are non-cancellable, never
+// expire, and persist for the lifetime of the manager. For OAuth flows or
+// refreshable tokens, implement `IntegrationAuthenticationProvider` yourself.
+import { Emitter } from '../../../utils/event.js';
+export function createManualTokenAuthProvider(options) {
+    const onDidChange = new Emitter();
+    const session = {
+        id: `manual:${options.id}`,
+        accessToken: options.token,
+        account: options.account,
+        scopes: options.scopes ?? [],
+        cloud: options.cloud ?? true,
+        type: undefined,
+        domain: options.domain ?? '',
+        appKey: options.appKey,
+    };
+    return {
+        get onDidChange() {
+            return onDidChange.event;
+        },
+        getSession: (descriptor, options) => 
+        // A manual token represents only the implicit primary connection. It cannot prove that an
+        // arbitrary connection selector owns the token, so fail closed instead of leaking it across
+        // accounts. Empty legacy selectors still resolve as primary.
+        //
+        // It also can't be refreshed; on a forced new session, return undefined rather than handing
+        // back the same likely-rejected token and looping a reauthenticate-on-failure flow.
+        Promise.resolve(options?.forceNewSession || (descriptor.connectionId?.length ?? 0) > 0 ? undefined : session),
+        deleteSession: () => Promise.resolve(),
+        deleteAllSessions: () => Promise.resolve(),
+        dispose: () => onDidChange.dispose(),
+    };
+}
+//# sourceMappingURL=manualTokenProvider.js.map

package/dist/plus/integrations/authentication/manualTokenProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manualTokenProvider.js","sourceRoot":"","sources":["../../../../src/plus/integrations/authentication/manualTokenProvider.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,8DAA8D;AAC9D,uCAAuC;AACvC,EAAE;AACF,+CAA+C;AAC/C,oBAAoB;AACpB,iBAAiB;AACjB,4DAA4D;AAC5D,wDAAwD;AACxD,sDAAsD;AACtD,kCAAkC;AAClC,4DAA4D;AAC5D,qEAAqE;AACrE,yBAAyB;AACzB,iCAAiC;AACjC,WAAW;AACX,QAAQ;AACR,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAG9E,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAkBlD,MAAM,UAAU,6BAA6B,CAC5C,OAAuC;IAEvC,MAAM,WAAW,GAAG,IAAI,OAAO,EAAQ,CAAC;IACxC,MAAM,OAAO,GAAkC;QAC9C,EAAE,EAAE,UAAU,OAAO,CAAC,EAAE,EAAE;QAC1B,WAAW,EAAE,OAAO,CAAC,KAAK;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC5B,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC;IAEF,OAAO;QACN,IAAI,WAAW;YACd,OAAO,WAAW,CAAC,KAAK,CAAC;QAC1B,CAAC;QACD,UAAU,EAAE,CACX,UAAsD,EACtD,OAAwE,EACvE,EAAE;QACH,0FAA0F;QAC1F,4FAA4F;QAC5F,6DAA6D;QAC7D,EAAE;QACF,4FAA4F;QAC5F,oFAAoF;QACpF,OAAO,CAAC,OAAO,CACd,OAAO,EAAE,eAAe,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAC5F;QACF,aAAa,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;QACtC,iBAAiB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;QAC1C,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE;KACpC,CAAC;AACH,CAAC"}