@gitkraken/core-gitlens 0.4.0 → 0.4.101

package/dist/plus/integrations/integrationService.js

@@ -10,10 +10,25 @@ import { fromDisposables } from '../../utils/disposable.js';
 import { Emitter } from '../../utils/event.js';
 import { filterMap, flatten } from '../../utils/iterable.js';
 import { getScopedLogger } from '../../utils/logger.scoped.js';
+import { CloudIntegrationService } from './authentication/cloudIntegrationService.js';
+import { ConfiguredIntegrationService } from './authentication/configuredIntegrationService.js';
+import { IntegrationAuthenticationService } from './authentication/integrationAuthenticationService.js';
 import { getSupportedCloudIntegrationIds, isSupportedCloudIntegrationId, toIntegrationId, } from './authentication/models.js';
 import { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId, IssuesCloudHostIntegrationId, } from './constants.js';
 import { createApiClients } from './providers/apiClients.js';
-import { convertRemoteProviderIdToIntegrationId, getIntegrationIdForRemote, isCloudGitSelfManagedHostIntegrationId, isGitCloudHostIntegrationId, isGitSelfManagedHostIntegrationId, } from './utils/integration.utils.js';
+import { providersMetadata } from './providers/models.js';
+import { broadenIssues } from './reads/broaden.js';
+import { getSupportedFilters } from './reads/filters.js';
+import { listOrgs, listProjects, listRepos } from './reads/hierarchy.js';
+import { listIssuesPage } from './reads/issues.js';
+import { listIssueTrackerIssuesPage } from './reads/issueTracker.js';
+import { listPullRequestsPage } from './reads/pullRequests.js';
+import { resolveRepository } from './reads/resolveRepository.js';
+import { sweepClosedPullRequests, sweepPullRequests } from './reads/sweeps.js';
+import { noConnectionWarning } from './reads/warnings.js';
+import { hostFromDomain } from './utils/domain.utils.js';
+import { convertRemoteProviderIdToIntegrationId, getIntegrationIdForRemote, isCloudGitSelfManagedHostIntegrationId, isGitCloudHostIntegrationId, isGitSelfManagedHostIntegrationId, isNonExpiringZeroTokenIntegrationId, remoteProviderTypeForConfig, remoteProviderTypeForIntegration, } from './utils/integration.utils.js';
+const maxSmallIntegerV8 = 2 ** 30 - 1; // Max number that can be stored in V8's smis (small integers)
 export class IntegrationService {
     authenticationService;
     configuredIntegrationService;
@@ -112,7 +127,26 @@ export class IntegrationService {
         }
         return true;
     }
+    /**
+     * Starts the cloud connect flow without skipping an already-connected provider, allowing the host/GK Dev
+     * flow to add another account for that provider instead of treating the existing primary as sufficient.
+     * Returns whether a new connection was actually added (measured by a new cloud connection id appearing),
+     * since {@link connectCloudIntegrations} only reports provider-level success and can't detect a newly added
+     * secondary for an already-connected provider.
+     */
+    async connectSecondary(id, source) {
+        const before = new Set(this.getConfigured(id, { cloud: true }).map(c => c.id));
+        await this.connectCloudIntegrations({ integrationIds: [id], skipIfConnected: false }, source);
+        return this.getConfigured(id, { cloud: true }).some(c => !before.has(c.id));
+    }
     async get(id, domain) {
+        // Normalize to a bare host before anything keys off it. Callers pass a self-managed domain in both shapes
+        // — a full URL from a stored session/descriptor, a bare host from `hostFromDomain` — and the cache key is
+        // `${id}:${domain}`, so the same host arriving in two shapes would build two instances (and two
+        // "primaries") for one host.
+        if (isGitSelfManagedHostIntegrationId(id)) {
+            domain = hostFromDomain(domain) ?? domain;
+        }
         let integration = this.getCached(id, domain);
         if (integration == null) {
             switch (id) {
@@ -127,7 +161,7 @@ export class IntegrationService {
                             return integration;
                         const configured = this.getConfigured(GitSelfManagedHostIntegrationId.CloudGitHubEnterprise);
                         if (configured.length) {
-                            const { domain: configuredDomain } = configured[0];
+                            const { domain: configuredDomain } = configured.find(c => c.primary) ?? configured[0];
                             if (configuredDomain == null)
                                 throw new Error(`Domain is required for '${id}' integration`);
                             integration = new (await import(/* webpackChunkName: "integrations" */ './providers/github.js')).GitHubEnterpriseIntegration(this.ctx, this.authenticationService, this.getProvidersApi.bind(this), this._onDidChangeIntegrationConnection, configuredDomain);
@@ -150,7 +184,7 @@ export class IntegrationService {
                             return integration;
                         const configured = this.getConfigured(GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted);
                         if (configured.length) {
-                            const { domain: configuredDomain } = configured[0];
+                            const { domain: configuredDomain } = configured.find(c => c.primary) ?? configured[0];
                             if (configuredDomain == null)
                                 throw new Error(`Domain is required for '${id}' integration`);
                             integration = new (await import(/* webpackChunkName: "integrations" */ './providers/gitlab.js')).GitLabSelfHostedIntegration(this.ctx, this.authenticationService, this.getProvidersApi.bind(this), this._onDidChangeIntegrationConnection, configuredDomain);
@@ -173,7 +207,7 @@ export class IntegrationService {
                             return integration;
                         const configured = this.getConfigured(GitSelfManagedHostIntegrationId.BitbucketServer);
                         if (configured.length) {
-                            const { domain: configuredDomain } = configured[0];
+                            const { domain: configuredDomain } = configured.find(c => c.primary) ?? configured[0];
                             if (configuredDomain == null)
                                 throw new Error(`Domain is required for '${id}' integration`);
                             integration = new (await import(/* webpackChunkName: "integrations" */ './providers/bitbucket-server.js')).BitbucketServerIntegration(this.ctx, this.authenticationService, this.getProvidersApi.bind(this), this._onDidChangeIntegrationConnection, configuredDomain);
@@ -196,7 +230,7 @@ export class IntegrationService {
                             return integration;
                         const configured = this.getConfigured(GitSelfManagedHostIntegrationId.AzureDevOpsServer);
                         if (configured.length) {
-                            const { domain: configuredDomain } = configured[0];
+                            const { domain: configuredDomain } = configured.find(c => c.primary) ?? configured[0];
                             if (configuredDomain == null)
                                 throw new Error(`Domain is required for '${id}' integration`);
                             integration = new (await import(/* webpackChunkName: "integrations" */ './providers/azureDevOps.js')).AzureDevOpsServerIntegration(this.ctx, this.authenticationService, this.getProvidersApi.bind(this), this._onDidChangeIntegrationConnection, configuredDomain);
@@ -214,6 +248,9 @@ export class IntegrationService {
                 case IssuesCloudHostIntegrationId.Linear:
                     integration = new (await import(/* webpackChunkName: "integrations" */ './providers/linear.js')).LinearIntegration(this.ctx, this.authenticationService, this.getProvidersApi.bind(this), this._onDidChangeIntegrationConnection);
                     break;
+                case IssuesCloudHostIntegrationId.Trello:
+                    integration = new (await import(/* webpackChunkName: "integrations" */ './providers/trello.js')).TrelloIntegration(this.ctx, this.authenticationService, this.getProvidersApi.bind(this), this._onDidChangeIntegrationConnection);
+                    break;
                 default:
                     throw new Error(`Integration with '${id}' is not supported`);
             }
@@ -224,6 +261,14 @@ export class IntegrationService {
     getConfigured(id, options) {
         return this.configuredIntegrationService.getConfigured(id, options);
     }
+    /**
+     * The filters this provider's reads accept — part of the public {@link IntegrationManager} contract, so it
+     * stays a method here even though it needs no instance state; see {@link getSupportedFilters} for the
+     * capability table itself and why a consumer should intersect against it before reading.
+     */
+    getSupportedFilters(providerId) {
+        return getSupportedFilters(providerId);
+    }
     /**
      * Returns the connected integration for a `GitRemote`, if any.
      * Internal counterpart to the host's `getRemoteIntegration(remote)` helper.
@@ -332,20 +377,20 @@ export class IntegrationService {
         }
         return this.getMyIssuesCore(integrations);
     }
-    async getMyCurrentAccounts(integrationIds) {
+    async getMyCurrentAccounts(integrationIds, connectionId) {
         const accounts = new Map();
         await Promise.allSettled(integrationIds.map(async (integrationId) => {
-            const integration = await this.get(integrationId);
+            const integration = await this.getIntegrationForRead(integrationId, connectionId);
             if (integration == null)
                 return;
-            const account = await integration.getCurrentAccount();
+            const account = await integration.getCurrentAccount({ connectionId: connectionId });
             if (account) {
                 accounts.set(integrationId, account);
             }
         }));
         return accounts;
     }
-    async getMyPullRequests(integrationIds, cancellation, silent) {
+    async getMyPullRequests(integrationIds, cancellation, silent, options) {
         const integrations = new Map();
         for (const integrationId of integrationIds?.length
             ? integrationIds
@@ -361,15 +406,15 @@ export class IntegrationService {
         }
         if (integrations.size === 0)
             return undefined;
-        return this.getMyPullRequestsCore(integrations, cancellation, silent);
+        return this.getMyPullRequestsCore(integrations, cancellation, silent, options);
     }
-    async getMyPullRequestsCore(integrations, cancellation, silent) {
+    async getMyPullRequestsCore(integrations, cancellation, silent, options) {
         const start = performance.now();
         const promises = [];
         for (const [integration, repos] of integrations) {
             if (integration == null)
                 continue;
-            promises.push(integration.searchMyPullRequests(repos, cancellation, silent));
+            promises.push(integration.searchMyPullRequests(repos, cancellation, silent, undefined, undefined, options));
         }
         const results = await Promise.allSettled(promises);
         const successfulResults = [
@@ -418,17 +463,246 @@ export class IntegrationService {
         }
         return this.getMyPullRequestsCore(integrations);
     }
+    // #region ProviderBackend surface (#5438)
+    //
+    // Generic discovery (orgs/projects/repos) and page-oriented reads that Kepler's ProviderBackend
+    // adapter maps to its own DTOs. All results are neutral (`ProviderResult`/`ProviderPagedResult`) and
+    // carry per-provider warnings recovered from the read cores, so a single provider's auth/rate-limit
+    // failure degrades to a warning instead of failing the whole call. The reads are repo-scoped (they
+    // compose the git-host `*Result` cores); account-scoped fan-out is the adapter's responsibility.
+    /**
+     * Warnings for an early-returning read where the integration couldn't be resolved. When a specific
+     * `connectionId` or self-managed `domain` was requested, a missing integration means that target is
+     * unavailable — surface a `no-connection` warning + `fetchFailed` so the caller can tell it apart from
+     * a truly empty account. Without an explicit target, it's simply not connected, which stays a silent
+     * empty result.
+     */
+    earlyReturnConnectionWarnings(id, connectionId, domain) {
+        const requestedDomain = isGitSelfManagedHostIntegrationId(id) ? domain : undefined;
+        const invalidDomain = this.isEmptyExplicitSelector(domain);
+        if (connectionId == null && requestedDomain == null && !invalidDomain) {
+            return { warnings: [], fetchFailed: false };
+        }
+        const resolvedDomain = invalidDomain
+            ? domain?.trim()
+            : this.resolveDomainForRead(id, connectionId, requestedDomain);
+        return { warnings: [noConnectionWarning(id, resolvedDomain, connectionId)], fetchFailed: true };
+    }
+    isEmptyExplicitSelector(value) {
+        return value?.trim().length === 0;
+    }
+    domainForRead(integration, id, connectionId, domain) {
+        if (!isGitSelfManagedHostIntegrationId(id)) {
+            return connectionId != null ? this.getConfiguredConnectionDomain(id, connectionId) : integration.domain;
+        }
+        return this.resolveDomainForRead(id, connectionId, domain) ?? integration.domain;
+    }
+    /**
+     * Resolves the right integration instance for a read. A configured connection domain takes precedence over
+     * an explicit fallback domain; the latter lets external/manual authentication providers address a
+     * self-managed host without persisting `ConfiguredIntegrationService` state.
+     */
+    async getIntegrationForRead(id, connectionId, domain) {
+        // Empty explicit selectors are invalid targets, not an instruction to fall back to the primary
+        // connection. Keep this at the common read boundary so every public surface behaves consistently.
+        if (this.isEmptyExplicitSelector(connectionId) || this.isEmptyExplicitSelector(domain))
+            return undefined;
+        const resolvedDomain = this.resolveDomainForRead(id, connectionId, domain);
+        try {
+            return await this.get(id, resolvedDomain);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    resolveDomainForRead(id, connectionId, domain) {
+        if (!isGitSelfManagedHostIntegrationId(id))
+            return undefined;
+        return ((connectionId != null ? this.getConfiguredConnectionDomain(id, connectionId) : undefined) ??
+            hostFromDomain(domain) ??
+            // With no explicit target, pin the primary configured host rather than leaving the domain undefined:
+            // `get(id, undefined)` falls back to `findCachedById`, which returns the FIRST entry by Map insertion
+            // order. With two hosts of the same provider that makes the instance depend on which host happened to
+            // be constructed first, so orgs/repos could come from one host and PRs from another in the same UI.
+            this.primaryConfiguredDomain(id));
+    }
+    /** The primary configured host for a self-managed provider (first configured when none is flagged primary). */
+    primaryConfiguredDomain(id) {
+        const configured = this.getConfigured(id);
+        return (configured.find(c => c.primary) ?? configured[0])?.domain;
+    }
+    /**
+     * Forces a real session refresh before a read when `forceSync` is set, so the read consumes a freshly
+     * exchanged token rather than a possibly-stale cached one. Both paths refresh, by different mechanisms: a
+     * per-connection (`connectionId`) read syncs that specific connection's session directly through the auth
+     * provider (the integration's primary-only sync path would never reach a secondary account), while a
+     * primary read syncs via the integration's own cloud-connection machinery.
+     * Best-effort — a failed sync is swallowed so the read still proceeds (and surfaces its own warning).
+     */
+    async forceRefreshIfRequested(integration, forceSync, connectionId) {
+        if (forceSync !== true)
+            return;
+        try {
+            if (connectionId != null) {
+                // Refresh the specific connection's session directly; the primary-only sync path below would not
+                // reach a secondary account. `cloud: true` is required for multi-account backend connections.
+                const authProvider = await this.authenticationService.get(integration.authProvider.id);
+                const descriptor = { ...integration.authProviderDescriptor, connectionId: connectionId, cloud: true };
+                await authProvider?.deleteSession(descriptor);
+                await authProvider?.getSession(descriptor, { sync: true });
+            }
+            else {
+                await integration.syncCloudConnection('connected', true);
+            }
+        }
+        catch { }
+    }
+    /**
+     * Lists the orgs/workspaces/groups (and issue-tracker resources) visible to the user, unified into
+     * {@link ProviderOrganization}. Scoped to `providerId` when given, otherwise fanned out over every
+     * supported provider. `connectionId` only makes sense with a single `providerId`.
+     */
+    async listOrgs(options) {
+        return listOrgs(this, options);
+    }
+    /**
+     * Lists the projects visible to the user, unified into the {@link ProviderOrganization}
+     * `{ providerId, id, name, org?, url }` shape. Covers issue-tracker providers (Jira/Linear, which expose
+     * projects under their resources) *and* git hosts that have a project tier (Azure DevOps, whose repos are
+     * org + project scoped). Scoped to `providerId` when given, else fanned out over both the supported issue
+     * trackers and Azure DevOps. Providers with no project tier (GitHub, GitLab, Bitbucket) contribute nothing.
+     */
+    async listProjects(options) {
+        return listProjects(this, options);
+    }
+    /**
+     * Lists repositories under an org for a git-host provider, one page at a time. Pass `page` (1-based)
+     * to advance; the returned `cursor` is only meaningful for cursor-only hosts.
+     */
+    async listRepos(options) {
+        return listRepos(this, options);
+    }
+    /**
+     * Reads one page of the user's pull requests for the given git-host provider. With `repos`, reads those
+     * repos' PRs (translating `page` ↔ the provider's opaque cursor) and maps the raw provider PRs to
+     * {@link PullRequestShape}. With no `repos`, reads the current user's PRs account-wide — the
+     * repo-scoped core rejects an empty `repos` input for GitHub/Bitbucket/Azure, so route to the
+     * account-wide `searchMyPullRequests` core instead (which is already user-scoped and returns shapes).
+     */
+    async listPullRequestsPage(options) {
+        return listPullRequestsPage(this, options);
+    }
+    async listIssuesPage(options) {
+        return listIssuesPage(this, options);
+    }
+    /**
+     * Reads the user's issues from an issue-tracker provider (Jira/Linear/Trello), whose issues live under
+     * resource → project (not repos), so they can't go through {@link listIssuesPage} (git-host, repo-scoped).
+     * Returns the normalized {@link IssueShape} these providers produce, aggregated across the projects of the
+     * given `org` (or every visible resource/project when omitted). `includeAllAssignees` drops the
+     * "assigned to me" scoping so unassigned issues are included. Best-effort: a per-step failure becomes a
+     * warning without failing the whole read.
+     *
+     * Paginated by project: these providers have no single cross-project issue cursor, so a page is a bounded
+     * window of projects (each drained by its own read). Pagination is opt-in — a caller that supplies none of
+     * `page`/`cursor`/`itemsPerPage` reads every matched project in one page (`hasMore: false`), preserving the
+     * "aggregate everything" contract for callers that don't page. When any of those is supplied, the read is
+     * windowed to `itemsPerPage` projects (default 20) advanced 1-based via `page`/`cursor`, with `hasMore`/
+     * `cursor` carrying the next window. Note: a project's own read has an internal page backstop (see the
+     * per-provider drains); if a single project exceeds it, its extra issues can't be paged from here, but that
+     * incompleteness IS surfaced as `page.truncated` (Jira/Linear report the backstop hit) rather than passed
+     * off as a complete read.
+     *
+     * Takes no `domain`, unlike the git-host reads: every issue-tracker provider is cloud-only
+     * ({@link IssuesCloudHostIntegrationId}), so there is no self-managed host to address.
+     */
+    async listIssueTrackerIssuesPage(options) {
+        return listIssueTrackerIssuesPage(this, options);
+    }
+    /**
+     * Sweeps the user's pull requests across providers by draining every page (an "all-pages" read),
+     * returning the neutral sweep result with per-provider warnings. `truncated` is set when a provider
+     * hit `maxPages` with more still available; `fetchFailed` when a drain aborted on a read error.
+     * `targets` selects a connection/domain independently for each provider. The legacy `connectionId` is
+     * honored only when `providerIds` resolves to a single provider (otherwise ambiguous).
+     */
+    async sweepPullRequests(options) {
+        return sweepPullRequests(this, options);
+    }
+    /**
+     * Closed/merged counterpart of {@link sweepPullRequests}, feeding Kepler's Kanban "done" column. Applies
+     * the native cross-provider state filter (`Closed` + `Merged`) so it works beyond GitHub.
+     */
+    async sweepClosedPullRequests(options) {
+        return sweepClosedPullRequests(this, options);
+    }
+    /**
+     * Broadens the user's issues by fanning out over the supplied orgs: for each org it lists the org's
+     * repositories, then reads that org's issues. A per-org failure becomes a warning without failing the
+     * whole fan-out. `broadenedProviderIds` lists the distinct providers whose issue read resolved (even
+     * if every issue duplicated a baseline). `failedProviderIds` identifies providers with no usable org;
+     * `incompleteProviderIds` identifies providers with both a usable org and a failed/truncated sibling.
+     * `fanOutCount` is the number of org work items spawned.
+     * Each org may carry its own `connectionId` (and, for a self-managed host with no configured connection, its
+     * own `domain`) to target a specific account — the fan-out spans providers, so the target is scoped per org
+     * rather than globally.
+     */
+    async broadenIssues(options) {
+        return broadenIssues(this, options);
+    }
+    /**
+     * Resolves a repository from a remote URL to its provider identity, using core-gitlens' remote matcher
+     * plus the provider's `getRepo` (the equivalent of `gk repo resolve`). Supports every provider whose
+     * client exposes `getRepo`. Per-request outcomes preserve the distinctions consumers need for their
+     * canonicalization policy.
+     */
+    async resolveRepository(options) {
+        return resolveRepository(this, options);
+    }
+    /** {@link RepositoryResolutionContext} seam: the user's `remotes` configs, for the remote matcher. */
+    getRemoteConfigs() {
+        return this.ctx.config.getRemoteConfigs();
+    }
+    /** {@link RepositoryResolutionContext} seam: instance lookup by host, for the cloud-host resolution branch. */
+    getIntegrationForDomain(id, domain) {
+        return this.get(id, domain);
+    }
+    // #endregion ProviderBackend surface (#5438)
     _ignoreSSLErrors = new Map();
     ignoreSSLErrors(integration) {
         if (this.ctx.http.isWeb)
             return false;
-        let ignoreSSLErrors = this._ignoreSSLErrors.get(integration.id);
+        // Key by id + domain: the config lookup is domain-scoped, so a value computed for one self-managed
+        // domain must not be reused for another domain of the same provider.
+        const cacheKey = `${integration.id}:${integration.domain ?? ''}`;
+        let ignoreSSLErrors = this._ignoreSSLErrors.get(cacheKey);
         if (ignoreSSLErrors === undefined) {
-            const cfg = this.ctx.config
-                .getRemoteConfigs()
-                .find(remote => remote.type.toLowerCase() === integration.id && remote.domain === integration.domain);
+            // Normalize both sides to a RemoteProviderId before comparing: a lowercased config type
+            // (e.g. `AzureDevOps` → `azuredevops`, `BitbucketServer` → `bitbucketserver`) does not equal the
+            // integration id (`azureDevOps`, `bitbucket-server`), so a plain `toLowerCase()` compare misses them.
+            const integrationRemoteType = remoteProviderTypeForIntegration(integration.id);
+            const cfg = this.ctx.config.getRemoteConfigs().find(remote => {
+                if (integration.domain == null || integrationRemoteType == null)
+                    return false;
+                if (remoteProviderTypeForConfig(remote.type) !== integrationRemoteType)
+                    return false;
+                // Match domain- and regex-based remotes alike, so `ignoreSSLErrors` applies to a regex-configured
+                // self-managed host too (mirrors the matcher's own regex handling).
+                if (remote.domain != null)
+                    return remote.domain === integration.domain;
+                // Truthy (not just non-null): an empty regex would compile to a match-everything pattern.
+                if (remote.regex) {
+                    try {
+                        return new RegExp(remote.regex, 'i').test(integration.domain);
+                    }
+                    catch {
+                        return false;
+                    }
+                }
+                return false;
+            });
             ignoreSSLErrors = cfg?.ignoreSSLErrors ?? false;
-            this._ignoreSSLErrors.set(integration.id, ignoreSSLErrors);
+            this._ignoreSSLErrors.set(cacheKey, ignoreSSLErrors);
         }
         return ignoreSSLErrors;
     }
@@ -511,7 +785,16 @@ export class IntegrationService {
             async function load() {
                 return new (await import(/* webpackChunkName: "integrations" */ './providers/providersApi.js')).ProvidersApi(authenticationService);
             }
-            this._providersApi = load();
+            // Never keep a rejected promise cached: a single failure (a module-resolution error, a transient
+            // construction failure) would otherwise poison every `ProvidersApi` read for the lifetime of the
+            // service, so consumers get instant empty results with no way to recover short of a restart.
+            const loading = (this._providersApi = load());
+            void loading.catch(() => {
+                // Only clear our own attempt, so a newer load already in flight isn't dropped
+                if (this._providersApi === loading) {
+                    this._providersApi = undefined;
+                }
+            });
         }
         return this._providersApi;
     }
@@ -523,23 +806,48 @@ export class IntegrationService {
     }
     async *getSupportedCloudIntegrations(domainsById) {
         for (const id of getSupportedCloudIntegrationIds()) {
-            if (isCloudGitSelfManagedHostIntegrationId(id) && !domainsById.has(id)) {
-                // Try getting whatever we have now because we will need to disconnect
+            if (isCloudGitSelfManagedHostIntegrationId(id)) {
+                const domains = new Set(domainsById.get(id) ?? []);
+                for (const domain of this.configuredIntegrationService
+                    .getConfigured(id, { cloud: true })
+                    .map(c => c.domain)
+                    .filter((domain) => domain != null && domain.length > 0)) {
+                    domains.add(hostFromDomain(domain) ?? domain);
+                }
+                if (domains.size !== 0) {
+                    for (const domain of domains) {
+                        const integration = await this.get(id, domain);
+                        if (integration != null) {
+                            yield integration;
+                        }
+                    }
+                    continue;
+                }
+                // Try getting whatever we have now because we will need to disconnect.
                 const integration = await this.get(id, undefined);
                 if (integration != null) {
                     yield integration;
                 }
+                continue;
             }
-            else {
-                const integration = await this.get(id, domainsById.get(id));
-                if (integration != null) {
-                    yield integration;
-                }
+            const integration = await this.get(id);
+            if (integration != null) {
+                yield integration;
             }
         }
     }
+    getCloudConnectionState(integration, connectedIntegrations, domainsById) {
+        if (isCloudGitSelfManagedHostIntegrationId(integration.id)) {
+            const host = hostFromDomain(integration.domain) ?? integration.domain;
+            return domainsById.get(integration.id)?.has(host) ? 'connected' : 'disconnected';
+        }
+        return connectedIntegrations.has(integration.id) ? 'connected' : 'disconnected';
+    }
     findCachedById(id) {
-        const key = this.getCacheKey(id, '');
+        const cached = this._integrations.get(id);
+        if (cached != null)
+            return cached;
+        const key = `${id}:`;
         for (const [k, integration] of this._integrations) {
             if (k.startsWith(key)) {
                 return integration;
@@ -547,40 +855,295 @@ export class IntegrationService {
         }
         return undefined;
     }
+    getCachedForDomain(id, domain) {
+        return isGitSelfManagedHostIntegrationId(id) ? this.getCached(id, domain) : this.findCachedById(id);
+    }
+    getConfiguredCloudConnection(id, connectionId) {
+        const connection = this.configuredIntegrationService
+            .getConfigured(id, { cloud: true })
+            .find(c => c.id === connectionId);
+        if (connection == null) {
+            throw new Error(`Connection '${connectionId}' is not configured for '${id}'`);
+        }
+        return connection;
+    }
+    getConfiguredConnectionDomain(id, connectionId) {
+        if (!isGitSelfManagedHostIntegrationId(id))
+            return undefined;
+        return this.configuredIntegrationService.getConfigured(id).find(c => c.id === connectionId)?.domain;
+    }
+    getCloudPrimaryConnectionIdsByDomain(id) {
+        const primaryByDomain = new Map();
+        const fallbackByDomain = new Map();
+        for (const descriptor of this.configuredIntegrationService.getConfigured(id, { cloud: true })) {
+            const domain = isGitSelfManagedHostIntegrationId(id)
+                ? (hostFromDomain(descriptor.domain) ?? descriptor.domain)
+                : undefined;
+            if (!fallbackByDomain.has(domain)) {
+                fallbackByDomain.set(domain, descriptor.id);
+            }
+            if (descriptor.primary && !primaryByDomain.has(domain)) {
+                primaryByDomain.set(domain, descriptor.id);
+            }
+        }
+        for (const [domain, connectionId] of fallbackByDomain) {
+            if (!primaryByDomain.has(domain)) {
+                primaryByDomain.set(domain, connectionId);
+            }
+        }
+        return primaryByDomain;
+    }
     async syncCloudIntegrations(forceConnect) {
         const scope = getScopedLogger();
         const connectedIntegrations = new Set();
         const domainsById = new Map();
+        const connectionsById = new Map();
         const loggedIn = (await this.ctx.account.getAccount()) != null;
         if (loggedIn) {
             const connections = await this.authenticationService.cloudIntegrations.getConnections();
             if (connections == null)
                 return;
-            connections.map(p => {
+            for (const p of connections) {
                 const integrationId = toIntegrationId[p.provider];
                 // GKDev includes some integrations like "google" that we don't support
                 if (integrationId == null)
-                    return;
-                connectedIntegrations.add(toIntegrationId[p.provider]);
+                    continue;
+                connectedIntegrations.add(integrationId);
+                const list = connectionsById.get(integrationId);
+                if (list != null) {
+                    list.push(p);
+                }
+                else {
+                    connectionsById.set(integrationId, [p]);
+                }
                 if (p.domain?.length > 0) {
-                    try {
-                        const host = new URL(p.domain).host;
-                        domainsById.set(integrationId, host);
+                    const host = hostFromDomain(p.domain);
+                    if (host != null) {
+                        let domains = domainsById.get(integrationId);
+                        if (domains == null) {
+                            domains = new Set();
+                            domainsById.set(integrationId, domains);
+                        }
+                        domains.add(host);
                     }
-                    catch {
+                    else {
                         scope?.warn(`Invalid domain for ${integrationId} integration: ${p.domain}. Ignoring.`);
                     }
                 }
-            });
+            }
         }
         for await (const integration of this.getSupportedCloudIntegrations(domainsById)) {
-            await integration.syncCloudConnection(connectedIntegrations.has(integration.id) ? 'connected' : 'disconnected', forceConnect);
+            await integration.syncCloudConnection(this.getCloudConnectionState(integration, connectedIntegrations, domainsById), forceConnect);
+        }
+        // Persist every account when the backend advertises per-connection identity (multi-account). This
+        // is a strict no-op for backends that return a single, id-less connection per provider.
+        for (const [integrationId, connections] of connectionsById) {
+            await this.reconcileCloudConnections(integrationId, connections, forceConnect);
         }
         this.ctx.hooks?.connection?.onConnectedChanged?.({
             integrationIds: [...connectedIntegrations.values()],
         });
         return connectedIntegrations;
     }
+    /**
+     * Whether the user has locally disconnected this provider/host. Mirrors the integration model's
+     * `connected:${key}` workspace flag (key = id for cloud, `${id}:${domain}` for self-managed), which is
+     * set to `false` on a local disconnect and cleared on (re)connect.
+     */
+    isLocallyDisconnected(id, host) {
+        const key = isGitSelfManagedHostIntegrationId(id) ? `connected:${id}:${host ?? ''}` : `connected:${id}`;
+        return this.ctx.storage.getWorkspace(key) === false;
+    }
+    /**
+     * Reconciles the locally stored connections for a provider with what the backend reports, so that
+     * multiple accounts on the same provider coexist. Only engages when the backend provides
+     * per-connection ids; otherwise the single-connection flow above already handled the primary.
+     */
+    async reconcileCloudConnections(id, connections, forceConnect) {
+        const scope = getScopedLogger();
+        const identified = connections.filter((c) => c.id != null);
+        if (identified.length === 0)
+            return;
+        // Capture the effective primary before any mutation (sync store, prune-driven promotion, or the
+        // backend primary selection below) so we can tell whether it actually changed. The prune step can
+        // promote a secondary to primary via removeConfigured, so sampling this after pruning would miss it.
+        const primaryBefore = this.getCloudPrimaryConnectionIdsByDomain(id);
+        const cloudIntegrations = this.authenticationService.cloudIntegrations;
+        // Fetch + store each connection's session so getConfigured() reflects every account.
+        const syncedIds = new Set();
+        const syncEligibleIds = new Set();
+        const syncedPrimaryIdsByDomain = new Map();
+        // Snapshot existing cloud descriptors by id once, so the per-connection account-name lookup below is
+        // O(1) instead of re-filtering the whole configured list each iteration (O(n²) with multi-account).
+        // Each backend connection id is processed once, so reading the pre-loop snapshot is sufficient.
+        const existingById = new Map(this.configuredIntegrationService.getConfigured(id, { cloud: true }).map(c => [c.id, c]));
+        for (const connection of identified) {
+            // The wire `domain` is usually a full URL, though cloud providers can return a bare host.
+            // Self-managed integrations are keyed/constructed by host.
+            const host = hostFromDomain(connection.domain);
+            // Self-managed connections are keyed by host, so an unparseable/empty domain would store the
+            // session and descriptor under an empty host — producing ambiguous keys (`connected:<id>:`) that
+            // break later resolution and local-disconnect checks. Skip such a connection rather than corrupt
+            // state; cloud providers key off their canonical domain and are unaffected.
+            if (isGitSelfManagedHostIntegrationId(id) && !host) {
+                scope?.warn(`Skipping connection '${connection.id}' for ${id}: unresolved host from domain`);
+                continue;
+            }
+            // Don't resurrect a connection the user disconnected locally: a host "disconnect" only clears
+            // local state (the backend still lists the token), so without this the next non-forced sync would
+            // re-store the secret/config. A forced reconnect clears this flag (in the sync loop above) before
+            // reconcile runs, so it proceeds normally.
+            if (this.isLocallyDisconnected(id, host))
+                continue;
+            syncEligibleIds.add(connection.id);
+            // On a routine (non-forced) check-in, skip the token fetch + secret write for a connection we
+            // already have stored and that hasn't expired: nothing to refresh, so avoid the extra GK API
+            // traffic and secret churn. Still treat it as synced (so it doesn't trip the prune guard) and
+            // record its primary below. Forced syncs, new connections, and expired tokens fall through and
+            // fetch as before.
+            const cached = existingById.get(connection.id);
+            if (!forceConnect && cached != null && !isDescriptorExpired(cached)) {
+                syncedIds.add(connection.id);
+                if (connection.primary) {
+                    const domain = isGitSelfManagedHostIntegrationId(id) ? host : undefined;
+                    if (!syncedPrimaryIdsByDomain.has(domain)) {
+                        syncedPrimaryIdsByDomain.set(domain, connection.id);
+                    }
+                }
+                continue;
+            }
+            try {
+                const session = await cloudIntegrations.getConnectionSession(id, undefined, connection.id);
+                if (session == null)
+                    continue;
+                let providerSession = toProviderSession(id, connection, session, host);
+                // Resolve a human-readable account handle with the same precedence as the gk CLI:
+                // (1) the value the backend put on the connection, (2) a previously-resolved name cached in
+                // our configured store (keyed by connection id), (3) a live provider-API lookup. This keeps
+                // provider round-trips to the first sight of a connection; degrade to undefined on failure.
+                const existing = existingById.get(connection.id);
+                const accountName = normalizeAccountName(connection.accountName) ??
+                    normalizeAccountName(existing?.accountName) ??
+                    (await this.resolveAccountName(id, host, providerSession));
+                if (accountName != null) {
+                    providerSession = {
+                        ...providerSession,
+                        account: { ...providerSession.account, label: accountName },
+                    };
+                }
+                await this.configuredIntegrationService.storeSession(id, providerSession);
+                syncedIds.add(connection.id);
+                if (connection.primary) {
+                    const domain = isGitSelfManagedHostIntegrationId(id) ? host : undefined;
+                    if (!syncedPrimaryIdsByDomain.has(domain)) {
+                        syncedPrimaryIdsByDomain.set(domain, connection.id);
+                    }
+                }
+            }
+            catch (ex) {
+                scope?.warn(`Failed to sync connection '${connection.id}' for ${id}: ${ex instanceof Error ? ex.message : String(ex)}`);
+            }
+        }
+        // Prune stored cloud connections that no longer exist on the backend — but only when every backend
+        // connection that should sync did sync this cycle. Otherwise a transient token fetch failure would
+        // delete a still-valid connection with no replacement (e.g. a legacy single connection during the
+        // backend id rollout); defer pruning to a later clean cycle. Deliberately skipped connections (local
+        // disconnects or invalid self-managed hosts) don't block pruning of unrelated stale descriptors.
+        // Scope deletes to cloud so a local PAT sharing the id survives.
+        const prunedDomains = new Set();
+        if ([...syncEligibleIds].every(connectionId => syncedIds.has(connectionId))) {
+            const liveIds = new Set(identified.map(c => c.id));
+            for (const descriptor of this.configuredIntegrationService.getConfigured(id, { cloud: true })) {
+                if (!liveIds.has(descriptor.id)) {
+                    prunedDomains.add(isGitSelfManagedHostIntegrationId(id) ? descriptor.domain : undefined);
+                    await this.configuredIntegrationService.deleteConnection(id, descriptor.id, true);
+                }
+            }
+        }
+        // Apply the backend's primary selection, then refresh any warm model only when the effective primary
+        // actually changed (vs the pre-reconcile value captured above). switchConnection() drops the in-memory
+        // session and fires change events, so calling it on every check-in (when the primary is unchanged)
+        // causes needless churn for multi-account providers. Self-managed providers can have one primary per
+        // host, so apply and refresh by host scope rather than by provider id alone.
+        for (const connectionId of syncedPrimaryIdsByDomain.values()) {
+            await this.configuredIntegrationService.setPrimaryConnection(id, connectionId);
+        }
+        const primaryAfter = this.getCloudPrimaryConnectionIdsByDomain(id);
+        const domains = new Set(primaryBefore.keys());
+        for (const domain of primaryAfter.keys()) {
+            domains.add(domain);
+        }
+        for (const domain of prunedDomains) {
+            domains.add(domain);
+        }
+        for (const domain of domains) {
+            if (primaryBefore.get(domain) === primaryAfter.get(domain) && !prunedDomains.has(domain))
+                continue;
+            this.getCachedForDomain(id, domain)?.switchConnection();
+        }
+    }
+    /**
+     * Switches the default connection for a provider to `connectionId` (its backend token id). Performs
+     * the server-side primary switch first, then mirrors it locally and refreshes any warm model. Throws
+     * if the backend switch fails so the caller can surface it (local state stays untouched).
+     */
+    async setPrimaryConnection(id, connectionId) {
+        const connection = this.getConfiguredCloudConnection(id, connectionId);
+        if (!(await this.authenticationService.cloudIntegrations.setPrimaryConnection(id, connectionId))) {
+            throw new Error(`Failed to set primary connection '${connectionId}' for '${id}'`);
+        }
+        await this.configuredIntegrationService.setPrimaryConnection(id, connectionId);
+        this.getCachedForDomain(id, connection.domain)?.switchConnection();
+    }
+    /**
+     * Removes a single connection for a provider by its backend token id. The backend removes the
+     * connection (auto-promoting a secondary to primary when the removed one was primary); we then mirror
+     * that locally and refresh any warm model. Unlike {@link IntegrationBase.disconnect}, this targets one
+     * account. This always talks to the cloud backend, so the local mirror is cloud-scoped and preserves any
+     * local PAT that happens to share the same id.
+     * Throws if the backend delete fails so the caller can surface it (local state stays untouched).
+     */
+    async deleteConnection(id, connectionId) {
+        const connection = this.getConfiguredCloudConnection(id, connectionId);
+        if (!(await this.authenticationService.cloudIntegrations.disconnectConnection(id, connectionId))) {
+            throw new Error(`Failed to delete connection '${connectionId}' for '${id}'`);
+        }
+        await this.configuredIntegrationService.deleteConnection(id, connectionId, true);
+        this.getCachedForDomain(id, connection.domain)?.switchConnection();
+    }
+    /**
+     * Resolves a human-readable account handle (e.g. the GitHub login) for a connection by asking the
+     * provider API with that connection's token. The token backend doesn't expose it. Routes through the
+     * integration model so the correct provider API base URL (incl. self-managed domains) and auth type
+     * are used. Best-effort: returns undefined on any failure so callers degrade gracefully.
+     */
+    async resolveAccountName(id, host, session) {
+        const scope = getScopedLogger();
+        try {
+            // Route through the integration so the correct provider API base URL (incl. the self-managed
+            // host) and auth type are used. Cloud providers ignore the host.
+            const integration = await this.get(id, host);
+            const account = await integration?.getProviderAccountForSession(session);
+            return account?.username ?? account?.name ?? undefined;
+        }
+        catch (ex) {
+            scope?.warn(`Failed to resolve account name for '${id}': ${ex instanceof Error ? ex.message : String(ex)}`);
+            return undefined;
+        }
+    }
+    /**
+     * Forces a refresh of connected cloud integrations from the backend (equivalent to a "--sync" list),
+     * reconciling local state (multi-account connections, primary flags, account names) so a subsequent
+     * {@link getConfigured} reflects the latest server-side connections. Intended for consumers that need
+     * an up-to-date connection list on demand. Rejects when the authoritative backend connection list cannot
+     * be read, so callers never mistake stale local state for a successful refresh.
+     */
+    async refreshConnections() {
+        const connected = await this.syncCloudIntegrations(true);
+        if (connected == null) {
+            throw new Error('Failed to refresh provider connections');
+        }
+    }
 }
 __decorate([
     debug()
@@ -599,7 +1162,10 @@ __decorate([
 ], IntegrationService.prototype, "getMyIssuesForRemotes", null);
 __decorate([
     debug({
-        args: integrationIds => ({ integrationIds: integrationIds?.length ? integrationIds.join(',') : '<undefined>' }),
+        args: (integrationIds, connectionId) => ({
+            integrationIds: integrationIds?.length ? integrationIds.join(',') : '<undefined>',
+            connectionId: connectionId ?? '<primary>',
+        }),
     })
 ], IntegrationService.prototype, "getMyCurrentAccounts", null);
 __decorate([
@@ -624,4 +1190,74 @@ __decorate([
     gate(),
     trace()
 ], IntegrationService.prototype, "syncCloudIntegrations", null);
+/** Internal factory used by the GitLens host and integration tests that need the full service surface. */
+export function createIntegrationService(ctx) {
+    const configured = new ConfiguredIntegrationService(ctx);
+    const cloud = new CloudIntegrationService(ctx);
+    let service;
+    const auth = new IntegrationAuthenticationService(configured, ctx, () => service, cloud);
+    service = new IntegrationService(auth, configured, ctx);
+    void purgeRetiredIntegrationStorage(ctx, configured);
+    return service;
+}
+const retiredIntegrationsStorageKey = 'integrations:migrated:cloudOnly';
+async function purgeRetiredIntegrationStorage(ctx, configured) {
+    if (ctx.storage.get(retiredIntegrationsStorageKey))
+        return;
+    try {
+        await configured.purgeStoredConfiguration(['github-enterprise', 'gitlab-self-hosted']);
+        await ctx.storage.store(retiredIntegrationsStorageKey, true);
+    }
+    catch {
+        // Best-effort cleanup retries on the next startup while the migration flag remains unset.
+    }
+}
+function protocolFromDomain(domain) {
+    const value = domain?.trim();
+    if (!value)
+        return undefined;
+    if (!/^[a-z][a-z\d+\-.]*:\/\//i.test(value))
+        return undefined;
+    try {
+        return new URL(value).protocol || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function normalizeAccountName(accountName) {
+    const value = accountName?.trim();
+    return value ? value : undefined;
+}
+/**
+ * Whether a stored connection descriptor's token has expired. A missing `expiresAt` is treated as
+ * not-expired (non-expiring/legacy tokens, e.g. GitHub and self-managed cloud, carry no meaningful
+ * expiry), matching the session-expiry checks elsewhere.
+ */
+function isDescriptorExpired(descriptor) {
+    if (descriptor.expiresAt == null)
+        return false;
+    return new Date(descriptor.expiresAt).getTime() < Date.now();
+}
+function toProviderSession(id, connection, session, host) {
+    // GitHub, the cloud self-managed hosts, and Trello return `expiresIn: 0` for a non-expiring token; left
+    // as 0 the session's `expiresAt` would be `now` and rejected as expired on the next read. Map it to the
+    // maximum expiry (mirrors the auth provider's own guard).
+    const expiresIn = session.expiresIn === 0 && isNonExpiringZeroTokenIntegrationId(id) ? maxSmallIntegerV8 : session.expiresIn;
+    const protocol = protocolFromDomain(connection.domain);
+    return {
+        id: connection.id,
+        accessToken: session.accessToken,
+        account: { id: '', label: '' },
+        scopes: session.scopes ? session.scopes.split(',') : [],
+        cloud: true,
+        type: session.type,
+        expiresAt: new Date(expiresIn * 1000 + Date.now()),
+        // Self-managed connections are keyed by their host; cloud providers use the canonical domain.
+        domain: isGitSelfManagedHostIntegrationId(id) ? (host ?? '') : (providersMetadata[id]?.domain ?? ''),
+        ...(protocol != null ? { protocol: protocol } : {}),
+        // Carried for providers whose client needs an app key alongside the token (e.g. Trello).
+        ...(session.appKey != null ? { appKey: session.appKey } : {}),
+    };
+}
 //# sourceMappingURL=integrationService.js.map