@gitkraken/core-gitlens 0.4.0 → 0.4.101

package/src/plus/integrations/authentication/integrationAuthenticationProvider.ts

@@ -3,12 +3,9 @@ import type { Disposable } from '../../../utils/disposable.js';
 import type { Event } from '../../../utils/event.js';
 import { Emitter } from '../../../utils/event.js';
 import type { IntegrationIds } from '../constants.js';
-import { GitCloudHostIntegrationId } from '../constants.js';
 import type { Sources } from '../telemetry.js';
-import {
-	isCloudGitSelfManagedHostIntegrationId,
-	isGitSelfManagedHostIntegrationId,
-} from '../utils/integration.utils.js';
+import { areDomainsOnSameHost } from '../utils/domain.utils.js';
+import { isGitSelfManagedHostIntegrationId, isNonExpiringZeroTokenIntegrationId } from '../utils/integration.utils.js';
 import type { ConfiguredIntegrationService } from './configuredIntegrationService.js';
 import type { IntegrationAuthenticationService } from './integrationAuthenticationService.js';
 import type { ProviderAuthenticationSession } from './models.js';
@@ -24,12 +21,31 @@ export interface IntegrationAuthenticationProviderDescriptor {
 export interface IntegrationAuthenticationSessionDescriptor {
 	domain: string;
 	scopes: string[];
+	/** When set, reads/deletes only the matching storage variant. */
+	cloud?: boolean;
+	/**
+	 * Targets a specific connection when a provider has multiple accounts connected. When omitted,
+	 * operations resolve to the provider's primary connection (see
+	 * {@link ConfiguredIntegrationService.resolveConnectionId}).
+	 */
+	connectionId?: string;
 	[key: string]: unknown;
 }
 
 export interface IntegrationAuthenticationProvider extends Disposable {
-	deleteSession(descriptor: IntegrationAuthenticationSessionDescriptor): Promise<void>;
-	deleteAllSessions(): Promise<void>;
+	/**
+	 * Clears the stored secret for one connection only (never the whole provider). Unlike
+	 * {@link deleteAllSessions}, this by default leaves the descriptor in `integrations:configured` — its
+	 * primary caller is a forced re-sync, which needs `getConfigured()` to keep reporting the connection
+	 * while a fresh session is fetched to replace the deleted secret. Implementers should not treat this as
+	 * a full disconnect. Pass `preserveConfigured: false` to also drop the descriptor (e.g. when the
+	 * re-sync's replacement fetch failed and the connection should no longer be reported as connected).
+	 */
+	deleteSession(
+		descriptor: IntegrationAuthenticationSessionDescriptor,
+		options?: { preserveConfigured?: boolean },
+	): Promise<void>;
+	deleteAllSessions(descriptor?: IntegrationAuthenticationSessionDescriptor): Promise<void>;
 	getSession(
 		descriptor: IntegrationAuthenticationSessionDescriptor,
 		options?:
@@ -61,13 +77,24 @@ abstract class IntegrationAuthenticationProviderBase<
 	protected abstract get authProviderId(): ID;
 
 	@trace()
-	async deleteSession(descriptor: IntegrationAuthenticationSessionDescriptor): Promise<void> {
+	async deleteSession(
+		descriptor: IntegrationAuthenticationSessionDescriptor,
+		options?: { preserveConfigured?: boolean },
+	): Promise<void> {
+		const domain = isGitSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined;
 		const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {
-			cloud: true,
-			domain: isGitSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined,
+			domain: domain,
 		});
 
-		await this.configuredIntegrationService.deleteStoredSessions(this.authProviderId, descriptor, undefined);
+		// Scope the descriptor to cloud so resolveConnectionId targets the cloud variant's id: this is a
+		// cloud-only delete, and a mixed local+cloud connection whose local descriptor is primary would
+		// otherwise resolve the local id and leave the cloud secret intact.
+		await this.configuredIntegrationService.deleteStoredSessions(
+			this.authProviderId,
+			{ ...descriptor, cloud: true },
+			true,
+			{ preserveConfigured: options?.preserveConfigured ?? true },
+		);
 
 		if (configured?.length) {
 			this.fireChange();
@@ -75,12 +102,15 @@ abstract class IntegrationAuthenticationProviderBase<
 	}
 
 	@trace()
-	async deleteAllSessions(): Promise<void> {
+	async deleteAllSessions(descriptor?: IntegrationAuthenticationSessionDescriptor): Promise<void> {
+		// Self-managed providers group every host under one provider id, so scope the clear to this
+		// descriptor's host when given; for cloud providers the domain stays undefined here, clearing every account.
+		const domain = isGitSelfManagedHostIntegrationId(this.authProviderId) ? descriptor?.domain : undefined;
 		const configured = this.configuredIntegrationService.getConfigured(this.authProviderId, {
-			cloud: true,
+			domain: domain,
 		});
 
-		await this.configuredIntegrationService.deleteAllStoredSessions(this.authProviderId, undefined);
+		await this.configuredIntegrationService.deleteAllStoredSessions(this.authProviderId, undefined, domain);
 
 		if (configured?.length) {
 			this.fireChange();
@@ -97,9 +127,18 @@ abstract class IntegrationAuthenticationProviderBase<
 		let session;
 		let previousToken;
 		if (options?.forceNewSession) {
-			await this.configuredIntegrationService.deleteStoredSessions(this.authProviderId, descriptor, undefined);
+			// Cloud-only delete (see deleteSession): scope to cloud so the cloud variant's id is cleared even
+			// when a mixed local+cloud connection's local descriptor is primary.
+			await this.configuredIntegrationService.deleteStoredSessions(
+				this.authProviderId,
+				{ ...descriptor, cloud: true },
+				true,
+			);
 		} else {
-			session = await this.configuredIntegrationService.getStoredSession(this.authProviderId, descriptor);
+			session = await this.configuredIntegrationService.getStoredSession(
+				this.authProviderId,
+				options?.sync ? { ...descriptor, cloud: true } : descriptor,
+			);
 			previousToken = session?.accessToken;
 		}
 
@@ -235,35 +274,68 @@ export class CloudIntegrationAuthenticationProvider<
 		if (!loggedIn) return undefined;
 
 		const cloudIntegrations = this.authenticationService.cloudIntegrations;
-		let session = await cloudIntegrations.getConnectionSession(this.authProviderId);
-
-		// Make an exception for GitHub and Cloud Self-Hosted integrations because they always return 0
+		// An unscoped descriptor (no explicit connectionId) would fetch the provider-global primary via
+		// `v1/provider-tokens/<provider>`. For a self-managed provider spanning multiple hosts that primary
+		// can belong to a different host, so a forced sync of host A would hydrate host B's token here (before
+		// reconcile corrects storage). Scope to this host's own configured connection when we have one; fall
+		// through to the provider-scoped path only when nothing is configured yet (legacy/first sync).
+		const connectionId =
+			descriptor.connectionId ??
+			(isGitSelfManagedHostIntegrationId(this.authProviderId)
+				? this.configuredIntegrationService.getConfiguredConnectionId(
+						this.authProviderId,
+						descriptor.domain,
+						true,
+					)
+				: undefined);
+		let session = await cloudIntegrations.getConnectionSession(this.authProviderId, undefined, connectionId);
 		if (
-			session?.expiresIn === 0 &&
-			(this.authProviderId === GitCloudHostIntegrationId.GitHub ||
-				isCloudGitSelfManagedHostIntegrationId(this.authProviderId))
+			session != null &&
+			isGitSelfManagedHostIntegrationId(this.authProviderId) &&
+			!areDomainsOnSameHost(session.domain, descriptor.domain)
 		) {
-			// It never expires so don't refresh it frequently:
+			return undefined;
+		}
+
+		// GitHub, the cloud self-managed hosts, and Trello return `expiresIn: 0` for a token that never
+		// expires; left as 0 the session would be built with `expiresAt = now` and rejected as expired on the
+		// next resolution. Map it to the maximum expiry so it isn't refreshed frequently.
+		if (session?.expiresIn === 0 && isNonExpiringZeroTokenIntegrationId(this.authProviderId)) {
 			session.expiresIn = maxSmallIntegerV8; // maximum expiration length
 		}
 
 		if (session != null && session.expiresIn < 60) {
-			session = await cloudIntegrations.getConnectionSession(this.authProviderId, session.accessToken);
+			session = await cloudIntegrations.getConnectionSession(
+				this.authProviderId,
+				session.accessToken,
+				connectionId,
+			);
+			if (
+				session != null &&
+				isGitSelfManagedHostIntegrationId(this.authProviderId) &&
+				!areDomainsOnSameHost(session.domain, descriptor.domain)
+			) {
+				return undefined;
+			}
 		}
 
 		if (!session) return undefined;
 
 		let sessionProtocol;
-		try {
-			sessionProtocol = new URL(session.domain).protocol;
-		} catch {
-			// If the domain is invalid, we can't use it to create a session
-			sessionProtocol = undefined;
+		// Only derive a protocol from a domain carrying an explicit scheme; a bare `host:port` (e.g. a
+		// self-managed `ghe.example.com:8443`) parses the host as the protocol, corrupting the value.
+		if (/^[a-z][a-z\d+\-.]*:\/\//i.test(session.domain)) {
+			try {
+				sessionProtocol = new URL(session.domain).protocol;
+			} catch {
+				sessionProtocol = undefined;
+			}
 		}
 
-		// TODO: Once we care about domains, we should try to match the domain here against ours, and if it fails, return undefined
 		return {
-			id: this.configuredIntegrationService.getSessionId(descriptor),
+			// Prefer the backend's per-connection token id (multi-account); fall back to the resolved
+			// primary/legacy connection id so existing single-connection storage keys are preserved.
+			id: session.id ?? this.configuredIntegrationService.resolveConnectionId(this.authProviderId, descriptor),
 			accessToken: session.accessToken,
 			scopes: descriptor.scopes,
 			account: {
@@ -276,6 +348,8 @@ export class CloudIntegrationAuthenticationProvider<
 			// Note: do not use the session's domain, because the format is different than in our model
 			domain: descriptor.domain,
 			protocol: sessionProtocol ?? undefined,
+			// Carried for providers whose client needs an app key alongside the token (e.g. Trello).
+			appKey: session.appKey,
 		};
 	}
 

package/src/plus/integrations/authentication/integrationAuthenticationService.ts

@@ -86,12 +86,17 @@ export class IntegrationAuthenticationService implements Disposable {
 	}
 
 	supports(providerId: string): boolean {
+		// Linear and Trello are cloud-backed issue integrations (same as Jira): `ensureProvider` registers a
+		// cloud auth provider for them, so a disconnect must offer to sign out of the cloud token too —
+		// otherwise the backend token and configured connection survive the disable.
 		switch (providerId) {
 			case GitCloudHostIntegrationId.AzureDevOps:
 			case GitSelfManagedHostIntegrationId.AzureDevOpsServer:
 			case GitCloudHostIntegrationId.Bitbucket:
 			case GitCloudHostIntegrationId.GitLab:
 			case IssuesCloudHostIntegrationId.Jira:
+			case IssuesCloudHostIntegrationId.Linear:
+			case IssuesCloudHostIntegrationId.Trello:
 			case GitCloudHostIntegrationId.GitHub:
 				return true;
 			default:
@@ -108,8 +113,6 @@ export class IntegrationAuthenticationService implements Disposable {
 		// the package constructs its own cloud providers below (so GitLens's cloud auth needs no host hook).
 		const hostProvider = await this.ctx.hooks?.createAuthenticationProvider?.({
 			id: providerId,
-			auth: this,
-			configured: this.configuredIntegrationService,
 		});
 		if (hostProvider != null) {
 			this.providers.set(providerId, hostProvider);
@@ -128,6 +131,7 @@ export class IntegrationAuthenticationService implements Disposable {
 			case GitSelfManagedHostIntegrationId.BitbucketServer:
 			case IssuesCloudHostIntegrationId.Jira:
 			case IssuesCloudHostIntegrationId.Linear:
+			case IssuesCloudHostIntegrationId.Trello:
 				provider = new CloudIntegrationAuthenticationProvider(
 					this,
 					this.configuredIntegrationService,
@@ -135,7 +139,7 @@ export class IntegrationAuthenticationService implements Disposable {
 				);
 				break;
 			default:
-				throw new Error(`No authentication provider registered for integration '${providerId}'`);
+				throw new Error(`No authentication provider registered for integration '${String(providerId)}'`);
 		}
 
 		this.providers.set(providerId, provider);

package/src/plus/integrations/authentication/manualTokenProvider.ts

@@ -37,6 +37,7 @@ export interface ManualTokenAuthProviderOptions {
 	readonly scopes?: readonly string[];
 	readonly domain?: string;
 	readonly cloud?: boolean;
+	readonly appKey?: string;
 }
 
 export function createManualTokenAuthProvider(
@@ -51,6 +52,7 @@ export function createManualTokenAuthProvider(
 		cloud: options.cloud ?? true,
 		type: undefined,
 		domain: options.domain ?? '',
+		appKey: options.appKey,
 	};
 
 	return {
@@ -58,13 +60,18 @@ export function createManualTokenAuthProvider(
 			return onDidChange.event;
 		},
 		getSession: (
-			_descriptor: IntegrationAuthenticationSessionDescriptor,
+			descriptor: IntegrationAuthenticationSessionDescriptor,
 			options?: Parameters<IntegrationAuthenticationProvider['getSession']>[1],
 		) =>
-			// A manual token can't be refreshed; on a forced new session, fail safe by returning undefined
-			// rather than handing back the same (likely-rejected) token, which would loop a caller's
-			// reauthenticate-on-failure flow.
-			Promise.resolve(options?.forceNewSession ? undefined : session),
+			// A manual token represents only the implicit primary connection. It cannot prove that an
+			// arbitrary connection selector owns the token, so fail closed instead of leaking it across
+			// accounts. Empty legacy selectors still resolve as primary.
+			//
+			// It also can't be refreshed; on a forced new session, return undefined rather than handing
+			// back the same likely-rejected token and looping a reauthenticate-on-failure flow.
+			Promise.resolve(
+				options?.forceNewSession || (descriptor.connectionId?.length ?? 0) > 0 ? undefined : session,
+			),
 		deleteSession: () => Promise.resolve(),
 		deleteAllSessions: () => Promise.resolve(),
 		dispose: () => onDidChange.dispose(),

package/src/plus/integrations/authentication/models.ts

@@ -25,6 +25,8 @@ export interface ProviderAuthenticationSession extends AuthenticationSessionLike
 	readonly expiresAt?: Date;
 	readonly domain: string;
 	readonly protocol?: string;
+	/** The provider app key paired with the token for providers whose client needs one (e.g. Trello). */
+	readonly appKey?: string;
 }
 
 export interface TokenInfo<T extends IntegrationIds | 'gitkraken' = IntegrationIds | 'gitkraken'> {
@@ -77,9 +79,31 @@ export function toTokenWithInfo<T extends IntegrationIds>(
 
 export type TokenOptInfo<T extends IntegrationIds = IntegrationIds> =
 	| TokenWithInfo<T>
-	| { providerId: T; accessToken?: undefined };
+	// `connectionId` targets a specific connection (multi-account) when the token still has to be resolved.
+	// Omitted resolves the provider's primary connection, preserving the pre-multi-account behavior.
+	| { providerId: T; accessToken?: undefined; connectionId?: string };
 
 export interface ConfiguredIntegrationDescriptor {
+	/**
+	 * Stable per-connection identifier, distinct from the domain, so multiple accounts can be
+	 * connected to the same provider+domain simultaneously. For legacy/migrated single connections
+	 * this is the domain (self-managed) or the provider's canonical domain (cloud), which keeps the
+	 * existing secret key (`integration.auth[.cloud]:{id}|{domain}`) valid with zero migration.
+	 */
+	readonly id: string;
+	/**
+	 * Whether this is the connection used by default for the provider. Optional: when no descriptor
+	 * for a provider+domain carries an explicit flag, the first one is treated as primary. Only
+	 * {@link ConfiguredIntegrationService.setPrimaryConnection} sets the flag (and clears it on siblings).
+	 */
+	readonly primary?: boolean;
+	/** The connection's auth type (`oauth`/`pat`), when known. */
+	readonly type?: CloudIntegrationAuthType;
+	/**
+	 * Human-readable account handle for this connection (e.g. the GitHub login). Resolved from the
+	 * provider API (the token backend doesn't expose it); absent until resolved or if the lookup fails.
+	 */
+	readonly accountName?: string;
 	readonly cloud: boolean;
 	readonly integrationId: IntegrationIds;
 	readonly scopes: string;
@@ -93,6 +117,10 @@ export interface CloudIntegrationAuthenticationSession {
 	domain: string;
 	expiresIn: number;
 	scopes: string;
+	/** Backend per-connection token identifier, when the provider-tokens backend supports multi-account. */
+	id?: string;
+	/** Provider app key paired with the token (e.g. Trello app key), when the backend supplies one. */
+	appKey?: string;
 }
 
 export interface CloudIntegrationAuthorization {
@@ -103,6 +131,12 @@ export interface CloudIntegrationConnection {
 	type: CloudIntegrationAuthType;
 	provider: CloudIntegrationType;
 	domain: string;
+	/** Backend per-connection token identifier, when the provider-tokens backend supports multi-account. */
+	id?: string;
+	/** Whether the backend marks this connection as the primary/default for the provider. */
+	primary?: boolean;
+	/** Human-readable account handle, when the backend provides it on the connection (may be absent). */
+	accountName?: string;
 }
 
 export type CloudIntegrationType =

package/src/plus/integrations/collectionMetadata.ts

@@ -0,0 +1,143 @@
+import type { CollectionMetadata, CollectionScopeFailure } from '@gitkraken/provider-apis';
+import { AuthenticationError, RequestNotFoundError, RequestRateLimitError } from '../../git/errors.js';
+import type { IntegrationIds } from './constants.js';
+import { isRateLimitResponse } from './errors.js';
+import type { ProviderWarning } from './results.js';
+import { appendDedupedWarning } from './results.js';
+
+/**
+ * Maps a caught GitLens request error to the SDK collection failure vocabulary used inside provider fan-outs.
+ */
+export function toCollectionFailureKind(ex: unknown): CollectionScopeFailure['kind'] {
+	if (ex instanceof AuthenticationError) return 'authentication';
+	if (ex instanceof RequestRateLimitError) return 'rate-limit';
+	if (ex instanceof RequestNotFoundError) return 'not-found';
+	return 'provider';
+}
+
+/** Builds a structured SDK scope failure from a caught GitLens request error. */
+export function toCollectionScopeFailure(scope: CollectionScopeFailure['scope'], ex: unknown): CollectionScopeFailure {
+	return {
+		scope: scope,
+		kind: toCollectionFailureKind(ex),
+		...(ex instanceof Error && ex.message ? { message: ex.message } : {}),
+	};
+}
+
+function collectionFailureKindToWarningKind(kind: CollectionScopeFailure['kind']): ProviderWarning['kind'] {
+	switch (kind) {
+		case 'authentication':
+			return 'auth';
+		case 'rate-limit':
+			return 'rate-limit';
+		case 'not-found':
+			return 'not-found';
+		default:
+			return 'other';
+	}
+}
+
+function getCollectionFailureStatus(message: string | undefined): number | undefined {
+	if (message == null) return undefined;
+
+	const match = /\((\d{3})\)/.exec(message) ?? /^(?:HTTP\s+)?(\d{3})\b/i.exec(message.trim());
+	return match != null ? Number(match[1]) : undefined;
+}
+
+function toCollectionFailureWarningKind(failure: CollectionScopeFailure): ProviderWarning['kind'] {
+	const mapped = collectionFailureKindToWarningKind(failure.kind);
+	if (mapped !== 'other' || (failure.kind !== 'provider' && failure.kind !== 'unknown')) return mapped;
+
+	// provider-apis currently groups several HTTP statuses under `provider` in partial fan-outs. The custom
+	// fetch adapter retains the status in `message`, so recover the same neutral classification the thrown-error
+	// path exposes instead of downgrading these structured failures to `other`.
+	const status = getCollectionFailureStatus(failure.message);
+	switch (status) {
+		case 401:
+			return 'auth';
+		case 403:
+			return isRateLimitResponse({ status: status, message: failure.message }) ? 'rate-limit' : 'auth';
+		case 404:
+		case 410:
+		case 422:
+			return 'not-found';
+		case 429:
+			return 'rate-limit';
+		default:
+			return mapped;
+	}
+}
+
+function collectionFailureMessage(failure: CollectionScopeFailure): string {
+	const scope = failure.scope;
+	const parts: string[] = [];
+	if (scope?.resourceId != null) {
+		parts.push(`resource ${scope.resourceId}`);
+	}
+	if (scope?.projectId != null) {
+		parts.push(`project ${scope.projectId}`);
+	}
+	if (scope?.repositoryId != null) {
+		parts.push(`repository ${scope.repositoryId}`);
+	}
+
+	const scopeText = parts.length ? ` (${parts.join(', ')})` : '';
+	const detail = failure.message != null ? `: ${failure.message}` : '';
+	return `Failed to read ${failure.kind} scope${scopeText}${detail}`;
+}
+
+/** Converts internal SDK collection metadata into neutral provider facade signals. */
+export function assessCollectionMetadata(
+	providerId: IntegrationIds,
+	domain: string | undefined,
+	connectionId: string | undefined,
+	metadata: CollectionMetadata | undefined,
+): { warnings: ProviderWarning[]; fetchFailed: boolean; truncated: boolean } {
+	if (metadata == null) return { warnings: [], fetchFailed: false, truncated: false };
+
+	const warnings: ProviderWarning[] = [];
+	const failures = metadata.failures ?? [];
+	for (const failure of failures) {
+		const kind = toCollectionFailureWarningKind(failure);
+		appendDedupedWarning(warnings, {
+			providerId: providerId,
+			domain: domain,
+			connectionId: connectionId,
+			message: collectionFailureMessage(failure),
+			kind: kind,
+			isAuth: kind === 'auth',
+		});
+	}
+
+	const incomplete = metadata.completeness !== 'complete';
+	if (incomplete && failures.length === 0) {
+		appendDedupedWarning(warnings, {
+			providerId: providerId,
+			domain: domain,
+			connectionId: connectionId,
+			message:
+				metadata.completeness === 'partial'
+					? 'Some results were omitted; the read is incomplete'
+					: 'Result completeness could not be confirmed',
+			kind: 'other',
+			isAuth: false,
+		});
+	}
+
+	return { warnings: warnings, fetchFailed: failures.length > 0, truncated: incomplete };
+}
+
+/** Appends neutral warnings derived from SDK metadata and returns its failure/truncation assessment. */
+export function mergeAssessmentInto(
+	warnings: ProviderWarning[],
+	providerId: IntegrationIds,
+	domain: string | undefined,
+	connectionId: string | undefined,
+	metadata: CollectionMetadata | undefined,
+): { fetchFailed: boolean; truncated: boolean } {
+	const assessment = assessCollectionMetadata(providerId, domain, connectionId, metadata);
+	for (const warning of assessment.warnings) {
+		appendDedupedWarning(warnings, warning);
+	}
+	return { fetchFailed: assessment.fetchFailed, truncated: assessment.truncated };
+}

package/src/plus/integrations/constants.ts

@@ -1,3 +1,7 @@
+import type { CloudIntegrationAuthType } from './authentication/models.js';
+
+export const providerFanOutConcurrency = 6;
+
 export enum GitCloudHostIntegrationId {
 	GitHub = 'github',
 	GitLab = 'gitlab',
@@ -32,6 +36,7 @@ export type IntegrationIds = GitHostIntegrationIds | IssuesHostIntegrationIds;
 export const supportedOrderedCloudIssuesIntegrationIds = [
 	IssuesCloudHostIntegrationId.Jira,
 	IssuesCloudHostIntegrationId.Linear,
+	IssuesCloudHostIntegrationId.Trello,
 ];
 export const supportedOrderedCloudIntegrationIds = [
 	GitCloudHostIntegrationId.GitHub,
@@ -44,6 +49,7 @@ export const supportedOrderedCloudIntegrationIds = [
 	GitSelfManagedHostIntegrationId.BitbucketServer,
 	IssuesCloudHostIntegrationId.Jira,
 	IssuesCloudHostIntegrationId.Linear,
+	IssuesCloudHostIntegrationId.Trello,
 ];
 
 export const integrationIds = [
@@ -82,6 +88,14 @@ export interface IntegrationDescriptor {
 
 /** Stored shape of a configured-integration descriptor in workspace state. */
 export interface StoredConfiguredIntegrationDescriptor {
+	/** Stable per-connection identifier. Backfilled from the domain for pre-multi-account stored data. */
+	id?: string;
+	/** Whether this is the primary/default connection for the provider. */
+	primary?: boolean;
+	/** The connection's auth type (`oauth`/`pat`), when known. */
+	type?: CloudIntegrationAuthType;
+	/** Human-readable account handle for this connection (e.g. the GitHub login), when resolved. */
+	accountName?: string;
 	cloud: boolean;
 	integrationId: IntegrationIds;
 	domain?: string;
@@ -166,4 +180,11 @@ export const supportedCloudIntegrationDescriptors: IntegrationDescriptor[] = [
 		supports: ['issues'],
 		requiresPro: true,
 	},
+	{
+		id: IssuesCloudHostIntegrationId.Trello,
+		name: 'Trello',
+		icon: 'gl-provider-trello',
+		supports: ['issues'],
+		requiresPro: true,
+	},
 ];

package/src/plus/integrations/context.ts

@@ -8,9 +8,7 @@ import type { RepositoryMetadata } from '../../git/models/repositoryMetadata.js'
 import type { ResourceDescriptor } from '../../git/models/resourceDescriptor.js';
 import type { Event } from '../../utils/event.js';
 import type { CacheController } from '../../utils/promiseCache.js';
-import type { ConfiguredIntegrationService } from './authentication/configuredIntegrationService.js';
 import type { IntegrationAuthenticationProvider } from './authentication/integrationAuthenticationProvider.js';
-import type { IntegrationAuthenticationService } from './authentication/integrationAuthenticationService.js';
 import type { IntegrationIds } from './constants.js';
 import type { GitHostIntegration } from './models/gitHostIntegration.js';
 import type { IntegrationBase } from './models/integration.js';
@@ -155,7 +153,7 @@ export interface IntegrationCacheProvider {
 	getCurrentAccount(
 		integration: IntegrationBase,
 		cacheable: Cacheable<Account>,
-		options?: CacheExpiryOptions,
+		options?: CacheExpiryOptions & { connectionId?: string; etag?: string },
 	): CacheResult<Account>;
 }
 
@@ -240,7 +238,12 @@ export interface AuthenticationSessionsChangeEvent {
  */
 export interface IntegrationsRemoteConfig {
 	readonly type: string;
-	readonly domain: string;
+	/** Exact-match domain (mutually exclusive with `regex`) */
+	readonly domain?: string;
+	/** Regex pattern for flexible host matching (mutually exclusive with `domain`) */
+	readonly regex?: string;
+	/** URL protocol override (e.g., `'https'`) */
+	readonly protocol?: string;
 	readonly ignoreSSLErrors?: boolean | 'force';
 }
 
@@ -320,11 +323,7 @@ export interface IntegrationServiceHooks {
 	 * cloud-OAuth provider. GitLens omits this — the package builds its cloud providers internally; an
 	 * external consumer can plug in any auth strategy here.
 	 */
-	createAuthenticationProvider?(args: {
-		id: IntegrationIds;
-		auth: IntegrationAuthenticationService;
-		configured: ConfiguredIntegrationService;
-	}): Promise<IntegrationAuthenticationProvider | undefined>;
+	createAuthenticationProvider?(args: { id: IntegrationIds }): Promise<IntegrationAuthenticationProvider | undefined>;
 
 	/**
 	 * Outbound behavioral events, nested by domain — mirroring `@gitkraken/core-gitlens/git`'s `GitServiceHooks`. The