@gitkraken/core-gitlens 0.4.0 → 0.4.101

package/src/plus/integrations/integrationService.ts

@@ -1,6 +1,6 @@
 import type { Account } from '../../git/models/author.js';
 import type { IssueShape } from '../../git/models/issue.js';
-import type { PullRequest } from '../../git/models/pullRequest.js';
+import type { PullRequest, PullRequestShape, PullRequestStateFilter } from '../../git/models/pullRequest.js';
 import type { GitRemote } from '../../git/models/remote.js';
 import type { RemoteProviderId } from '../../git/models/remoteProvider.js';
 import type { ResourceDescriptor } from '../../git/models/resourceDescriptor.js';
@@ -12,12 +12,15 @@ import type { Event } from '../../utils/event.js';
 import { Emitter } from '../../utils/event.js';
 import { filterMap, flatten } from '../../utils/iterable.js';
 import { getScopedLogger } from '../../utils/logger.scoped.js';
+import { CloudIntegrationService } from './authentication/cloudIntegrationService.js';
+import type { ConfiguredIntegrationsChangeEvent } from './authentication/configuredIntegrationService.js';
+import { ConfiguredIntegrationService } from './authentication/configuredIntegrationService.js';
+import { IntegrationAuthenticationService } from './authentication/integrationAuthenticationService.js';
 import type {
-	ConfiguredIntegrationsChangeEvent,
-	ConfiguredIntegrationService,
-} from './authentication/configuredIntegrationService.js';
-import type { IntegrationAuthenticationService } from './authentication/integrationAuthenticationService.js';
-import type { ConfiguredIntegrationDescriptor } from './authentication/models.js';
+	CloudIntegrationConnection,
+	ConfiguredIntegrationDescriptor,
+	ProviderAuthenticationSession,
+} from './authentication/models.js';
 import {
 	getSupportedCloudIntegrationIds,
 	isSupportedCloudIntegrationId,
@@ -33,8 +36,19 @@ import {
 	GitSelfManagedHostIntegrationId,
 	IssuesCloudHostIntegrationId,
 } from './constants.js';
-import type { AuthenticationSessionsChangeEvent, IntegrationServiceContext } from './context.js';
-import type { GitHostIntegration } from './models/gitHostIntegration.js';
+import type {
+	AuthenticationSessionsChangeEvent,
+	IntegrationServiceContext,
+	IntegrationsRemoteConfig,
+} from './context.js';
+import type {
+	ClosedPullRequestSweepOptions,
+	ListOrgsOptions,
+	ListProjectsOptions,
+	ProviderBroadenOrg,
+	PullRequestSweepOptions,
+} from './manager.js';
+import type { GitHostIntegration, SearchMyPullRequestsOptions } from './models/gitHostIntegration.js';
 import type {
 	Integration,
 	IntegrationBase,
@@ -46,27 +60,55 @@ import type { IssuesIntegration } from './models/issuesIntegration.js';
 import type { ApiClients } from './providers/apiClients.js';
 import { createApiClients } from './providers/apiClients.js';
 import type { GitHubApi } from './providers/github/github.js';
+import type {
+	IssueFilter,
+	ProviderOrganization,
+	ProviderReposInput,
+	ProviderRepositoryShape,
+	PullRequestFilter,
+} from './providers/models.js';
+import { providersMetadata } from './providers/models.js';
 import type { ProvidersApi } from './providers/providersApi.js';
+import { broadenIssues } from './reads/broaden.js';
+import type { RepositoryResolutionContext } from './reads/context.js';
+import { getSupportedFilters } from './reads/filters.js';
+import { listOrgs, listProjects, listRepos } from './reads/hierarchy.js';
+import { listIssuesPage } from './reads/issues.js';
+import { listIssueTrackerIssuesPage } from './reads/issueTracker.js';
+import { listPullRequestsPage } from './reads/pullRequests.js';
+import { resolveRepository } from './reads/resolveRepository.js';
+import { sweepClosedPullRequests, sweepPullRequests } from './reads/sweeps.js';
+import { noConnectionWarning } from './reads/warnings.js';
+import type {
+	ConnectionStateChangeEvent,
+	ProviderBroadenResult,
+	ProviderPagedResult,
+	ProviderResult,
+	ProviderSweepResult,
+	ProviderWarning,
+	ResolveRepositoryResult,
+} from './results.js';
 import type { Source } from './telemetry.js';
+import { hostFromDomain } from './utils/domain.utils.js';
 import {
 	convertRemoteProviderIdToIntegrationId,
 	getIntegrationIdForRemote,
 	isCloudGitSelfManagedHostIntegrationId,
 	isGitCloudHostIntegrationId,
 	isGitSelfManagedHostIntegrationId,
+	isNonExpiringZeroTokenIntegrationId,
+	remoteProviderTypeForConfig,
+	remoteProviderTypeForIntegration,
 } from './utils/integration.utils.js';
 
-export interface ConnectionStateChangeEvent {
-	key: string;
-	reason: 'connected' | 'disconnected';
-}
-
 /** @internal Event emitted when an integration connection state changes  */
 export interface IntegrationConnectionChangeEvent extends ConnectionStateChangeEvent {
 	integration: IntegrationBase;
 }
 
-export class IntegrationService implements Disposable {
+const maxSmallIntegerV8 = 2 ** 30 - 1; // Max number that can be stored in V8's smis (small integers)
+
+export class IntegrationService implements Disposable, RepositoryResolutionContext {
 	get onDidChange(): Event<ConfiguredIntegrationsChangeEvent> {
 		return this.configuredIntegrationService.onDidChange;
 	}
@@ -193,6 +235,19 @@ export class IntegrationService implements Disposable {
 		return true;
 	}
 
+	/**
+	 * Starts the cloud connect flow without skipping an already-connected provider, allowing the host/GK Dev
+	 * flow to add another account for that provider instead of treating the existing primary as sufficient.
+	 * Returns whether a new connection was actually added (measured by a new cloud connection id appearing),
+	 * since {@link connectCloudIntegrations} only reports provider-level success and can't detect a newly added
+	 * secondary for an already-connected provider.
+	 */
+	async connectSecondary(id: SupportedCloudIntegrationIds, source?: Source): Promise<boolean> {
+		const before = new Set(this.getConfigured(id, { cloud: true }).map(c => c.id));
+		await this.connectCloudIntegrations({ integrationIds: [id], skipIfConnected: false }, source);
+		return this.getConfigured(id, { cloud: true }).some(c => !before.has(c.id));
+	}
+
 	get(id: GitCloudHostIntegrationId): Promise<GitHostIntegration>;
 	get(id: IssuesCloudHostIntegrationId): Promise<IssuesIntegration>;
 	get(
@@ -202,6 +257,14 @@ export class IntegrationService implements Disposable {
 	get(id: GitSelfManagedHostIntegrationId, domain: string): Promise<GitHostIntegration | undefined>;
 	get<T extends IntegrationIds>(id: T, domain?: string): Promise<IntegrationById<T> | undefined>;
 	async get<T extends IntegrationIds>(id: T, domain?: string): Promise<IntegrationById<T> | undefined> {
+		// Normalize to a bare host before anything keys off it. Callers pass a self-managed domain in both shapes
+		// — a full URL from a stored session/descriptor, a bare host from `hostFromDomain` — and the cache key is
+		// `${id}:${domain}`, so the same host arriving in two shapes would build two instances (and two
+		// "primaries") for one host.
+		if (isGitSelfManagedHostIntegrationId(id)) {
+			domain = hostFromDomain(domain) ?? domain;
+		}
+
 		let integration = this.getCached(id, domain);
 		if (integration == null) {
 			switch (id) {
@@ -224,7 +287,7 @@ export class IntegrationService implements Disposable {
 
 						const configured = this.getConfigured(GitSelfManagedHostIntegrationId.CloudGitHubEnterprise);
 						if (configured.length) {
-							const { domain: configuredDomain } = configured[0];
+							const { domain: configuredDomain } = configured.find(c => c.primary) ?? configured[0];
 							if (configuredDomain == null) throw new Error(`Domain is required for '${id}' integration`);
 
 							integration = new (
@@ -275,7 +338,7 @@ export class IntegrationService implements Disposable {
 
 						const configured = this.getConfigured(GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted);
 						if (configured.length) {
-							const { domain: configuredDomain } = configured[0];
+							const { domain: configuredDomain } = configured.find(c => c.primary) ?? configured[0];
 							if (configuredDomain == null) throw new Error(`Domain is required for '${id}' integration`);
 
 							integration = new (
@@ -326,7 +389,7 @@ export class IntegrationService implements Disposable {
 
 						const configured = this.getConfigured(GitSelfManagedHostIntegrationId.BitbucketServer);
 						if (configured.length) {
-							const { domain: configuredDomain } = configured[0];
+							const { domain: configuredDomain } = configured.find(c => c.primary) ?? configured[0];
 							if (configuredDomain == null) throw new Error(`Domain is required for '${id}' integration`);
 
 							integration = new (
@@ -377,7 +440,7 @@ export class IntegrationService implements Disposable {
 
 						const configured = this.getConfigured(GitSelfManagedHostIntegrationId.AzureDevOpsServer);
 						if (configured.length) {
-							const { domain: configuredDomain } = configured[0];
+							const { domain: configuredDomain } = configured.find(c => c.primary) ?? configured[0];
 							if (configuredDomain == null) throw new Error(`Domain is required for '${id}' integration`);
 
 							integration = new (
@@ -430,6 +493,17 @@ export class IntegrationService implements Disposable {
 						this._onDidChangeIntegrationConnection,
 					) as IssuesIntegration as IntegrationById<T>;
 					break;
+
+				case IssuesCloudHostIntegrationId.Trello:
+					integration = new (
+						await import(/* webpackChunkName: "integrations" */ './providers/trello.js')
+					).TrelloIntegration(
+						this.ctx,
+						this.authenticationService,
+						this.getProvidersApi.bind(this),
+						this._onDidChangeIntegrationConnection,
+					) as IssuesIntegration as IntegrationById<T>;
+					break;
 				default:
 					throw new Error(`Integration with '${id}' is not supported`);
 			}
@@ -447,6 +521,20 @@ export class IntegrationService implements Disposable {
 		return this.configuredIntegrationService.getConfigured(id, options);
 	}
 
+	/**
+	 * The filters this provider's reads accept — part of the public {@link IntegrationManager} contract, so it
+	 * stays a method here even though it needs no instance state; see {@link getSupportedFilters} for the
+	 * capability table itself and why a consumer should intersect against it before reading.
+	 */
+	getSupportedFilters(providerId: IntegrationIds): {
+		pullRequests: PullRequestFilter[];
+		pullRequestsAccountWide: PullRequestFilter[];
+		issues: IssueFilter[];
+		issuesAccountWide: IssueFilter[];
+	} {
+		return getSupportedFilters(providerId);
+	}
+
 	/**
 	 * Returns the connected integration for a `GitRemote`, if any.
 	 * Internal counterpart to the host's `getRemoteIntegration(remote)` helper.
@@ -588,18 +676,22 @@ export class IntegrationService implements Disposable {
 	}
 
 	@debug({
-		args: integrationIds => ({ integrationIds: integrationIds?.length ? integrationIds.join(',') : '<undefined>' }),
+		args: (integrationIds, connectionId) => ({
+			integrationIds: integrationIds?.length ? integrationIds.join(',') : '<undefined>',
+			connectionId: connectionId ?? '<primary>',
+		}),
 	})
 	async getMyCurrentAccounts(
 		integrationIds: (GitCloudHostIntegrationId | CloudGitSelfManagedHostIntegrationIds)[],
+		connectionId?: string,
 	): Promise<Map<GitCloudHostIntegrationId | CloudGitSelfManagedHostIntegrationIds, Account>> {
 		const accounts = new Map<GitCloudHostIntegrationId | CloudGitSelfManagedHostIntegrationIds, Account>();
 		await Promise.allSettled(
 			integrationIds.map(async integrationId => {
-				const integration = await this.get(integrationId);
+				const integration = await this.getIntegrationForRead(integrationId, connectionId);
 				if (integration == null) return;
 
-				const account = await integration.getCurrentAccount();
+				const account = await integration.getCurrentAccount({ connectionId: connectionId });
 				if (account) {
 					accounts.set(integrationId, account);
 				}
@@ -615,6 +707,7 @@ export class IntegrationService implements Disposable {
 		integrationIds?: (GitCloudHostIntegrationId | CloudGitSelfManagedHostIntegrationIds)[],
 		cancellation?: AbortSignal,
 		silent?: boolean,
+		options?: SearchMyPullRequestsOptions,
 	): Promise<IntegrationResult<PullRequest[] | undefined>> {
 		const integrations: Map<GitHostIntegration, ResourceDescriptor[] | undefined> = new Map();
 		for (const integrationId of integrationIds?.length
@@ -630,13 +723,14 @@ export class IntegrationService implements Disposable {
 		}
 		if (integrations.size === 0) return undefined;
 
-		return this.getMyPullRequestsCore(integrations, cancellation, silent);
+		return this.getMyPullRequestsCore(integrations, cancellation, silent, options);
 	}
 
 	private async getMyPullRequestsCore(
 		integrations: Map<GitHostIntegration, ResourceDescriptor[] | undefined>,
 		cancellation?: AbortSignal,
 		silent?: boolean,
+		options?: SearchMyPullRequestsOptions,
 	): Promise<IntegrationResult<PullRequest[] | undefined>> {
 		const start = performance.now();
 
@@ -644,7 +738,7 @@ export class IntegrationService implements Disposable {
 		for (const [integration, repos] of integrations) {
 			if (integration == null) continue;
 
-			promises.push(integration.searchMyPullRequests(repos, cancellation, silent));
+			promises.push(integration.searchMyPullRequests(repos, cancellation, silent, undefined, undefined, options));
 		}
 
 		const results = await Promise.allSettled(promises);
@@ -717,17 +811,385 @@ export class IntegrationService implements Disposable {
 		return this.getMyPullRequestsCore(integrations);
 	}
 
+	// #region ProviderBackend surface (#5438)
+	//
+	// Generic discovery (orgs/projects/repos) and page-oriented reads that Kepler's ProviderBackend
+	// adapter maps to its own DTOs. All results are neutral (`ProviderResult`/`ProviderPagedResult`) and
+	// carry per-provider warnings recovered from the read cores, so a single provider's auth/rate-limit
+	// failure degrades to a warning instead of failing the whole call. The reads are repo-scoped (they
+	// compose the git-host `*Result` cores); account-scoped fan-out is the adapter's responsibility.
+
+	/**
+	 * Warnings for an early-returning read where the integration couldn't be resolved. When a specific
+	 * `connectionId` or self-managed `domain` was requested, a missing integration means that target is
+	 * unavailable — surface a `no-connection` warning + `fetchFailed` so the caller can tell it apart from
+	 * a truly empty account. Without an explicit target, it's simply not connected, which stays a silent
+	 * empty result.
+	 */
+	earlyReturnConnectionWarnings(
+		id: IntegrationIds,
+		connectionId: string | undefined,
+		domain?: string,
+	): { warnings: ProviderWarning[]; fetchFailed: boolean } {
+		const requestedDomain = isGitSelfManagedHostIntegrationId(id) ? domain : undefined;
+		const invalidDomain = this.isEmptyExplicitSelector(domain);
+		if (connectionId == null && requestedDomain == null && !invalidDomain) {
+			return { warnings: [], fetchFailed: false };
+		}
+
+		const resolvedDomain = invalidDomain
+			? domain?.trim()
+			: this.resolveDomainForRead(id, connectionId, requestedDomain);
+		return { warnings: [noConnectionWarning(id, resolvedDomain, connectionId)], fetchFailed: true };
+	}
+
+	private isEmptyExplicitSelector(value: string | undefined): boolean {
+		return value?.trim().length === 0;
+	}
+
+	domainForRead(
+		integration: Integration,
+		id: IntegrationIds,
+		connectionId: string | undefined,
+		domain?: string,
+	): string | undefined {
+		if (!isGitSelfManagedHostIntegrationId(id)) {
+			return connectionId != null ? this.getConfiguredConnectionDomain(id, connectionId) : integration.domain;
+		}
+
+		return this.resolveDomainForRead(id, connectionId, domain) ?? integration.domain;
+	}
+
+	/**
+	 * Resolves the right integration instance for a read. A configured connection domain takes precedence over
+	 * an explicit fallback domain; the latter lets external/manual authentication providers address a
+	 * self-managed host without persisting `ConfiguredIntegrationService` state.
+	 */
+	async getIntegrationForRead(
+		id: IntegrationIds,
+		connectionId: string | undefined,
+		domain?: string,
+	): Promise<Integration | undefined> {
+		// Empty explicit selectors are invalid targets, not an instruction to fall back to the primary
+		// connection. Keep this at the common read boundary so every public surface behaves consistently.
+		if (this.isEmptyExplicitSelector(connectionId) || this.isEmptyExplicitSelector(domain)) return undefined;
+
+		const resolvedDomain = this.resolveDomainForRead(id, connectionId, domain);
+		try {
+			return await this.get(id, resolvedDomain);
+		} catch {
+			return undefined;
+		}
+	}
+
+	resolveDomainForRead(
+		id: IntegrationIds,
+		connectionId: string | undefined,
+		domain: string | undefined,
+	): string | undefined {
+		if (!isGitSelfManagedHostIntegrationId(id)) return undefined;
+
+		return (
+			(connectionId != null ? this.getConfiguredConnectionDomain(id, connectionId) : undefined) ??
+			hostFromDomain(domain) ??
+			// With no explicit target, pin the primary configured host rather than leaving the domain undefined:
+			// `get(id, undefined)` falls back to `findCachedById`, which returns the FIRST entry by Map insertion
+			// order. With two hosts of the same provider that makes the instance depend on which host happened to
+			// be constructed first, so orgs/repos could come from one host and PRs from another in the same UI.
+			this.primaryConfiguredDomain(id)
+		);
+	}
+
+	/** The primary configured host for a self-managed provider (first configured when none is flagged primary). */
+	private primaryConfiguredDomain(id: IntegrationIds): string | undefined {
+		const configured = this.getConfigured(id);
+		return (configured.find(c => c.primary) ?? configured[0])?.domain;
+	}
+
+	/**
+	 * Forces a real session refresh before a read when `forceSync` is set, so the read consumes a freshly
+	 * exchanged token rather than a possibly-stale cached one. Both paths refresh, by different mechanisms: a
+	 * per-connection (`connectionId`) read syncs that specific connection's session directly through the auth
+	 * provider (the integration's primary-only sync path would never reach a secondary account), while a
+	 * primary read syncs via the integration's own cloud-connection machinery.
+	 * Best-effort — a failed sync is swallowed so the read still proceeds (and surfaces its own warning).
+	 */
+	async forceRefreshIfRequested(
+		integration: Integration,
+		forceSync: boolean | undefined,
+		connectionId: string | undefined,
+	): Promise<void> {
+		if (forceSync !== true) return;
+
+		try {
+			if (connectionId != null) {
+				// Refresh the specific connection's session directly; the primary-only sync path below would not
+				// reach a secondary account. `cloud: true` is required for multi-account backend connections.
+				const authProvider = await this.authenticationService.get(integration.authProvider.id);
+				const descriptor = { ...integration.authProviderDescriptor, connectionId: connectionId, cloud: true };
+				await authProvider?.deleteSession(descriptor);
+				await authProvider?.getSession(descriptor, { sync: true });
+			} else {
+				await integration.syncCloudConnection('connected', true);
+			}
+		} catch {}
+	}
+
+	/**
+	 * Lists the orgs/workspaces/groups (and issue-tracker resources) visible to the user, unified into
+	 * {@link ProviderOrganization}. Scoped to `providerId` when given, otherwise fanned out over every
+	 * supported provider. `connectionId` only makes sense with a single `providerId`.
+	 */
+	async listOrgs(options?: ListOrgsOptions): Promise<ProviderResult<ProviderOrganization>> {
+		return listOrgs(this, options);
+	}
+
+	/**
+	 * Lists the projects visible to the user, unified into the {@link ProviderOrganization}
+	 * `{ providerId, id, name, org?, url }` shape. Covers issue-tracker providers (Jira/Linear, which expose
+	 * projects under their resources) *and* git hosts that have a project tier (Azure DevOps, whose repos are
+	 * org + project scoped). Scoped to `providerId` when given, else fanned out over both the supported issue
+	 * trackers and Azure DevOps. Providers with no project tier (GitHub, GitLab, Bitbucket) contribute nothing.
+	 */
+	async listProjects(options?: ListProjectsOptions): Promise<ProviderResult<ProviderOrganization>> {
+		return listProjects(this, options);
+	}
+
+	/**
+	 * Lists repositories under an org for a git-host provider, one page at a time. Pass `page` (1-based)
+	 * to advance; the returned `cursor` is only meaningful for cursor-only hosts.
+	 */
+	async listRepos(options: {
+		providerId: IntegrationIds;
+		/**
+		 * Org/workspace/group to scope to. Omitted = the account-wide, user-affiliated walk (the org-less
+		 * `gk provider repos <provider>` equivalent) for hosts with a native user-repos read (GitHub, GitLab);
+		 * hosts without one (Bitbucket, Azure DevOps) report the org-less read as unsupported so the caller
+		 * fans out per org instead.
+		 */
+		org?: string;
+		project?: string;
+		page?: number;
+		cursor?: string;
+		itemsPerPage?: number;
+		connectionId?: string;
+		/**
+		 * Explicit self-managed host domain. Used only when the requested connection has no configured domain;
+		 * it must come from the trusted authentication configuration, not repository or remote data.
+		 */
+		domain?: string;
+	}): Promise<ProviderPagedResult<ProviderRepositoryShape>> {
+		return listRepos(this, options);
+	}
+
+	/**
+	 * Reads one page of the user's pull requests for the given git-host provider. With `repos`, reads those
+	 * repos' PRs (translating `page` ↔ the provider's opaque cursor) and maps the raw provider PRs to
+	 * {@link PullRequestShape}. With no `repos`, reads the current user's PRs account-wide — the
+	 * repo-scoped core rejects an empty `repos` input for GitHub/Bitbucket/Azure, so route to the
+	 * account-wide `searchMyPullRequests` core instead (which is already user-scoped and returns shapes).
+	 */
+	async listPullRequestsPage(options: {
+		providerId: IntegrationIds;
+		repos?: ProviderReposInput;
+		states?: PullRequestStateFilter[];
+		/**
+		 * PR relationship filters (e.g. `[Author, Assignee, ReviewRequested]`). On repo-scoped reads members
+		 * combine as provider query constraints (normally an intersection); on account-wide reads they form an
+		 * exact OR union. The whole set is validated against the selected path's capability.
+		 */
+		filters?: PullRequestFilter[];
+		/**
+		 * Account-wide only: include review-requested PRs when the provider's native "my PRs" query omits them.
+		 * This extends the provider-native result; it is not a narrowing filter.
+		 */
+		includeReviewRequested?: boolean;
+		page?: number;
+		cursor?: string;
+		itemsPerPage?: number;
+		forceSync?: boolean;
+		connectionId?: string;
+		/**
+		 * Explicit self-managed host domain when no configured connection supplies one. The value must come
+		 * from the trusted authentication configuration, not repository or remote data.
+		 */
+		domain?: string;
+	}): Promise<ProviderPagedResult<PullRequestShape>> {
+		return listPullRequestsPage(this, options);
+	}
+
+	async listIssuesPage(options: {
+		providerId: IntegrationIds;
+		repos?: ProviderReposInput;
+		/** Narrows the account-wide read to one org/account. Requires a host with a project layer (Azure). */
+		org?: string;
+		/** Narrows the account-wide read to one project. Requires a host with a project layer (Azure). */
+		project?: string;
+		/**
+		 * Narrows to the requested relationship(s). On the account-wide path this replaces the provider's own
+		 * definition of "my issues" (GitHub/GHE: authored ∪ assigned ∪ mentioned; Azure: assigned ∪ authored;
+		 * GitLab: assigned-to-me), so `[Assignee]` yields `assignee:@me` everywhere it's expressible. A set the
+		 * provider can't express server-side is refused whole (warning + `fetchFailed`), never widened — check
+		 * {@link IntegrationService.getSupportedFilters} first to avoid that path.
+		 */
+		filters?: IssueFilter[];
+		/** Broadens the read to every assignee. Contradicts `filters`; passing both is refused. */
+		includeAllAssignees?: boolean;
+		page?: number;
+		cursor?: string;
+		itemsPerPage?: number;
+		forceSync?: boolean;
+		connectionId?: string;
+		/**
+		 * Explicit self-managed host domain. Used only when the requested connection has no configured domain;
+		 * it must come from the trusted authentication configuration, not repository or remote data.
+		 */
+		domain?: string;
+	}): Promise<ProviderPagedResult<IssueShape>> {
+		return listIssuesPage(this, options);
+	}
+
+	/**
+	 * Reads the user's issues from an issue-tracker provider (Jira/Linear/Trello), whose issues live under
+	 * resource → project (not repos), so they can't go through {@link listIssuesPage} (git-host, repo-scoped).
+	 * Returns the normalized {@link IssueShape} these providers produce, aggregated across the projects of the
+	 * given `org` (or every visible resource/project when omitted). `includeAllAssignees` drops the
+	 * "assigned to me" scoping so unassigned issues are included. Best-effort: a per-step failure becomes a
+	 * warning without failing the whole read.
+	 *
+	 * Paginated by project: these providers have no single cross-project issue cursor, so a page is a bounded
+	 * window of projects (each drained by its own read). Pagination is opt-in — a caller that supplies none of
+	 * `page`/`cursor`/`itemsPerPage` reads every matched project in one page (`hasMore: false`), preserving the
+	 * "aggregate everything" contract for callers that don't page. When any of those is supplied, the read is
+	 * windowed to `itemsPerPage` projects (default 20) advanced 1-based via `page`/`cursor`, with `hasMore`/
+	 * `cursor` carrying the next window. Note: a project's own read has an internal page backstop (see the
+	 * per-provider drains); if a single project exceeds it, its extra issues can't be paged from here, but that
+	 * incompleteness IS surfaced as `page.truncated` (Jira/Linear report the backstop hit) rather than passed
+	 * off as a complete read.
+	 *
+	 * Takes no `domain`, unlike the git-host reads: every issue-tracker provider is cloud-only
+	 * ({@link IssuesCloudHostIntegrationId}), so there is no self-managed host to address.
+	 */
+	async listIssueTrackerIssuesPage(options: {
+		providerId: IntegrationIds;
+		org?: string;
+		project?: string;
+		filters?: IssueFilter[];
+		includeAllAssignees?: boolean;
+		forceSync?: boolean;
+		page?: number;
+		cursor?: string;
+		itemsPerPage?: number;
+		connectionId?: string;
+	}): Promise<ProviderPagedResult<IssueShape>> {
+		return listIssueTrackerIssuesPage(this, options);
+	}
+	/**
+	 * Sweeps the user's pull requests across providers by draining every page (an "all-pages" read),
+	 * returning the neutral sweep result with per-provider warnings. `truncated` is set when a provider
+	 * hit `maxPages` with more still available; `fetchFailed` when a drain aborted on a read error.
+	 * `targets` selects a connection/domain independently for each provider. The legacy `connectionId` is
+	 * honored only when `providerIds` resolves to a single provider (otherwise ambiguous).
+	 */
+	async sweepPullRequests(options?: PullRequestSweepOptions): Promise<ProviderSweepResult<PullRequestShape>> {
+		return sweepPullRequests(this, options);
+	}
+
+	/**
+	 * Closed/merged counterpart of {@link sweepPullRequests}, feeding Kepler's Kanban "done" column. Applies
+	 * the native cross-provider state filter (`Closed` + `Merged`) so it works beyond GitHub.
+	 */
+	async sweepClosedPullRequests(
+		options?: ClosedPullRequestSweepOptions,
+	): Promise<ProviderSweepResult<PullRequestShape>> {
+		return sweepClosedPullRequests(this, options);
+	}
+
+	/**
+	 * Broadens the user's issues by fanning out over the supplied orgs: for each org it lists the org's
+	 * repositories, then reads that org's issues. A per-org failure becomes a warning without failing the
+	 * whole fan-out. `broadenedProviderIds` lists the distinct providers whose issue read resolved (even
+	 * if every issue duplicated a baseline). `failedProviderIds` identifies providers with no usable org;
+	 * `incompleteProviderIds` identifies providers with both a usable org and a failed/truncated sibling.
+	 * `fanOutCount` is the number of org work items spawned.
+	 * Each org may carry its own `connectionId` (and, for a self-managed host with no configured connection, its
+	 * own `domain`) to target a specific account — the fan-out spans providers, so the target is scoped per org
+	 * rather than globally.
+	 */
+	async broadenIssues(options: {
+		orgs: ProviderBroadenOrg[];
+		page?: number;
+		cursor?: string;
+		forceSync?: boolean;
+	}): Promise<ProviderBroadenResult<IssueShape>> {
+		return broadenIssues(this, options);
+	}
+
+	/**
+	 * Resolves a repository from a remote URL to its provider identity, using core-gitlens' remote matcher
+	 * plus the provider's `getRepo` (the equivalent of `gk repo resolve`). Supports every provider whose
+	 * client exposes `getRepo`. Per-request outcomes preserve the distinctions consumers need for their
+	 * canonicalization policy.
+	 */
+	async resolveRepository(options: {
+		providerId?: IntegrationIds;
+		remoteUrl: string;
+		host?: string;
+		connectionId?: string;
+		/**
+		 * Explicit self-managed host domain used to select the integration instance. Used only when the requested
+		 * connection has no configured domain; it must come from the trusted authentication configuration, not
+		 * repository or remote data.
+		 */
+		domain?: string;
+	}): Promise<ResolveRepositoryResult> {
+		return resolveRepository(this, options);
+	}
+
+	/** {@link RepositoryResolutionContext} seam: the user's `remotes` configs, for the remote matcher. */
+	getRemoteConfigs(): readonly IntegrationsRemoteConfig[] {
+		return this.ctx.config.getRemoteConfigs();
+	}
+
+	/** {@link RepositoryResolutionContext} seam: instance lookup by host, for the cloud-host resolution branch. */
+	getIntegrationForDomain(id: IntegrationIds, domain: string | undefined): Promise<Integration | undefined> {
+		return this.get(id, domain);
+	}
+
+	// #endregion ProviderBackend surface (#5438)
+
 	private _ignoreSSLErrors = new Map<string, boolean | 'force'>();
 	ignoreSSLErrors(integration: GitHostIntegration | { id: IntegrationIds; domain?: string }): boolean | 'force' {
 		if (this.ctx.http.isWeb) return false;
 
-		let ignoreSSLErrors = this._ignoreSSLErrors.get(integration.id);
+		// Key by id + domain: the config lookup is domain-scoped, so a value computed for one self-managed
+		// domain must not be reused for another domain of the same provider.
+		const cacheKey = `${integration.id}:${integration.domain ?? ''}`;
+		let ignoreSSLErrors = this._ignoreSSLErrors.get(cacheKey);
 		if (ignoreSSLErrors === undefined) {
-			const cfg = this.ctx.config
-				.getRemoteConfigs()
-				.find(remote => remote.type.toLowerCase() === integration.id && remote.domain === integration.domain);
+			// Normalize both sides to a RemoteProviderId before comparing: a lowercased config type
+			// (e.g. `AzureDevOps` → `azuredevops`, `BitbucketServer` → `bitbucketserver`) does not equal the
+			// integration id (`azureDevOps`, `bitbucket-server`), so a plain `toLowerCase()` compare misses them.
+			const integrationRemoteType = remoteProviderTypeForIntegration(integration.id);
+			const cfg = this.ctx.config.getRemoteConfigs().find(remote => {
+				if (integration.domain == null || integrationRemoteType == null) return false;
+				if (remoteProviderTypeForConfig(remote.type) !== integrationRemoteType) return false;
+				// Match domain- and regex-based remotes alike, so `ignoreSSLErrors` applies to a regex-configured
+				// self-managed host too (mirrors the matcher's own regex handling).
+				if (remote.domain != null) return remote.domain === integration.domain;
+
+				// Truthy (not just non-null): an empty regex would compile to a match-everything pattern.
+				if (remote.regex) {
+					try {
+						return new RegExp(remote.regex, 'i').test(integration.domain);
+					} catch {
+						return false;
+					}
+				}
+				return false;
+			});
 			ignoreSSLErrors = cfg?.ignoreSSLErrors ?? false;
-			this._ignoreSSLErrors.set(integration.id, ignoreSSLErrors);
+			this._ignoreSSLErrors.set(cacheKey, ignoreSSLErrors);
 		}
 
 		return ignoreSSLErrors;
@@ -835,7 +1297,16 @@ export class IntegrationService implements Disposable {
 				).ProvidersApi(authenticationService);
 			}
 
-			this._providersApi = load();
+			// Never keep a rejected promise cached: a single failure (a module-resolution error, a transient
+			// construction failure) would otherwise poison every `ProvidersApi` read for the lifetime of the
+			// service, so consumers get instant empty results with no way to recover short of a restart.
+			const loading = (this._providersApi = load());
+			void loading.catch(() => {
+				// Only clear our own attempt, so a newer load already in flight isn't dropped
+				if (this._providersApi === loading) {
+					this._providersApi = undefined;
+				}
+			});
 		}
 
 		return this._providersApi;
@@ -852,25 +1323,64 @@ export class IntegrationService implements Disposable {
 		return isGitSelfManagedHostIntegrationId(id) ? (`${id}:${domain}` as const) : id;
 	}
 
-	private async *getSupportedCloudIntegrations(domainsById: Map<IntegrationIds, string>): AsyncIterable<Integration> {
+	private async *getSupportedCloudIntegrations(
+		domainsById: Map<IntegrationIds, Set<string>>,
+	): AsyncIterable<Integration> {
 		for (const id of getSupportedCloudIntegrationIds()) {
-			if (isCloudGitSelfManagedHostIntegrationId(id) && !domainsById.has(id)) {
-				// Try getting whatever we have now because we will need to disconnect
-				const integration = await this.get(id, undefined);
-				if (integration != null) {
-					yield integration;
+			if (isCloudGitSelfManagedHostIntegrationId(id)) {
+				const domains = new Set(domainsById.get(id) ?? []);
+				for (const domain of this.configuredIntegrationService
+					.getConfigured(id, { cloud: true })
+					.map(c => c.domain)
+					.filter((domain): domain is string => domain != null && domain.length > 0)) {
+					domains.add(hostFromDomain(domain) ?? domain);
 				}
-			} else {
-				const integration = await this.get(id, domainsById.get(id));
+
+				if (domains.size !== 0) {
+					for (const domain of domains) {
+						const integration = await this.get(id, domain);
+						if (integration != null) {
+							yield integration;
+						}
+					}
+
+					continue;
+				}
+
+				// Try getting whatever we have now because we will need to disconnect.
+				const integration = await this.get(id, undefined);
 				if (integration != null) {
 					yield integration;
 				}
+
+				continue;
+			}
+
+			const integration = await this.get(id);
+			if (integration != null) {
+				yield integration;
 			}
 		}
 	}
 
+	private getCloudConnectionState(
+		integration: Integration,
+		connectedIntegrations: Set<IntegrationIds>,
+		domainsById: Map<IntegrationIds, Set<string>>,
+	): 'connected' | 'disconnected' {
+		if (isCloudGitSelfManagedHostIntegrationId(integration.id)) {
+			const host = hostFromDomain(integration.domain) ?? integration.domain;
+			return domainsById.get(integration.id)?.has(host) ? 'connected' : 'disconnected';
+		}
+
+		return connectedIntegrations.has(integration.id) ? 'connected' : 'disconnected';
+	}
+
 	private findCachedById<T extends IntegrationIds>(id: T): IntegrationById<T> | undefined {
-		const key = this.getCacheKey(id, '');
+		const cached = this._integrations.get(id as IntegrationKey);
+		if (cached != null) return cached as IntegrationById<T>;
+
+		const key = `${id}:`;
 		for (const [k, integration] of this._integrations) {
 			if (k.startsWith(key)) {
 				return integration as IntegrationById<T>;
@@ -879,46 +1389,427 @@ export class IntegrationService implements Disposable {
 		return undefined;
 	}
 
+	private getCachedForDomain<T extends IntegrationIds>(id: T, domain?: string): IntegrationById<T> | undefined {
+		return isGitSelfManagedHostIntegrationId(id) ? this.getCached(id, domain) : this.findCachedById(id);
+	}
+
+	private getConfiguredCloudConnection(id: IntegrationIds, connectionId: string): ConfiguredIntegrationDescriptor {
+		const connection = this.configuredIntegrationService
+			.getConfigured(id, { cloud: true })
+			.find(c => c.id === connectionId);
+		if (connection == null) {
+			throw new Error(`Connection '${connectionId}' is not configured for '${id}'`);
+		}
+		return connection;
+	}
+
+	private getConfiguredConnectionDomain(id: IntegrationIds, connectionId: string): string | undefined {
+		if (!isGitSelfManagedHostIntegrationId(id)) return undefined;
+		return this.configuredIntegrationService.getConfigured(id).find(c => c.id === connectionId)?.domain;
+	}
+
+	private getCloudPrimaryConnectionIdsByDomain(id: IntegrationIds): Map<string | undefined, string> {
+		const primaryByDomain = new Map<string | undefined, string>();
+		const fallbackByDomain = new Map<string | undefined, string>();
+
+		for (const descriptor of this.configuredIntegrationService.getConfigured(id, { cloud: true })) {
+			const domain = isGitSelfManagedHostIntegrationId(id)
+				? (hostFromDomain(descriptor.domain) ?? descriptor.domain)
+				: undefined;
+			if (!fallbackByDomain.has(domain)) {
+				fallbackByDomain.set(domain, descriptor.id);
+			}
+			if (descriptor.primary && !primaryByDomain.has(domain)) {
+				primaryByDomain.set(domain, descriptor.id);
+			}
+		}
+
+		for (const [domain, connectionId] of fallbackByDomain) {
+			if (!primaryByDomain.has(domain)) {
+				primaryByDomain.set(domain, connectionId);
+			}
+		}
+
+		return primaryByDomain;
+	}
+
 	@gate()
 	@trace()
-	private async syncCloudIntegrations(forceConnect: boolean) {
+	private async syncCloudIntegrations(forceConnect: boolean): Promise<Set<IntegrationIds> | undefined> {
 		const scope = getScopedLogger();
 		const connectedIntegrations = new Set<IntegrationIds>();
-		const domainsById = new Map<IntegrationIds, string>();
+		const domainsById = new Map<IntegrationIds, Set<string>>();
+		const connectionsById = new Map<IntegrationIds, CloudIntegrationConnection[]>();
 
 		const loggedIn = (await this.ctx.account.getAccount()) != null;
 		if (loggedIn) {
 			const connections = await this.authenticationService.cloudIntegrations.getConnections();
 			if (connections == null) return;
 
-			connections.map(p => {
+			for (const p of connections) {
 				const integrationId = toIntegrationId[p.provider];
 				// GKDev includes some integrations like "google" that we don't support
-				if (integrationId == null) return;
+				if (integrationId == null) continue;
+
+				connectedIntegrations.add(integrationId);
+
+				const list = connectionsById.get(integrationId);
+				if (list != null) {
+					list.push(p);
+				} else {
+					connectionsById.set(integrationId, [p]);
+				}
 
-				connectedIntegrations.add(toIntegrationId[p.provider]);
 				if (p.domain?.length > 0) {
-					try {
-						const host = new URL(p.domain).host;
-						domainsById.set(integrationId, host);
-					} catch {
+					const host = hostFromDomain(p.domain);
+					if (host != null) {
+						let domains = domainsById.get(integrationId);
+						if (domains == null) {
+							domains = new Set<string>();
+							domainsById.set(integrationId, domains);
+						}
+						domains.add(host);
+					} else {
 						scope?.warn(`Invalid domain for ${integrationId} integration: ${p.domain}. Ignoring.`);
 					}
 				}
-			});
+			}
 		}
 
 		for await (const integration of this.getSupportedCloudIntegrations(domainsById)) {
 			await integration.syncCloudConnection(
-				connectedIntegrations.has(integration.id) ? 'connected' : 'disconnected',
+				this.getCloudConnectionState(integration, connectedIntegrations, domainsById),
 				forceConnect,
 			);
 		}
 
+		// Persist every account when the backend advertises per-connection identity (multi-account). This
+		// is a strict no-op for backends that return a single, id-less connection per provider.
+		for (const [integrationId, connections] of connectionsById) {
+			await this.reconcileCloudConnections(integrationId, connections, forceConnect);
+		}
+
 		this.ctx.hooks?.connection?.onConnectedChanged?.({
 			integrationIds: [...connectedIntegrations.values()],
 		});
 
 		return connectedIntegrations;
 	}
+
+	/**
+	 * Whether the user has locally disconnected this provider/host. Mirrors the integration model's
+	 * `connected:${key}` workspace flag (key = id for cloud, `${id}:${domain}` for self-managed), which is
+	 * set to `false` on a local disconnect and cleared on (re)connect.
+	 */
+	private isLocallyDisconnected(id: IntegrationIds, host: string | undefined): boolean {
+		const key = isGitSelfManagedHostIntegrationId(id) ? `connected:${id}:${host ?? ''}` : `connected:${id}`;
+		return this.ctx.storage.getWorkspace<boolean>(key) === false;
+	}
+
+	/**
+	 * Reconciles the locally stored connections for a provider with what the backend reports, so that
+	 * multiple accounts on the same provider coexist. Only engages when the backend provides
+	 * per-connection ids; otherwise the single-connection flow above already handled the primary.
+	 */
+	private async reconcileCloudConnections(
+		id: IntegrationIds,
+		connections: CloudIntegrationConnection[],
+		forceConnect: boolean,
+	): Promise<void> {
+		const scope = getScopedLogger();
+
+		const identified = connections.filter((c): c is CloudIntegrationConnection & { id: string } => c.id != null);
+		if (identified.length === 0) return;
+
+		// Capture the effective primary before any mutation (sync store, prune-driven promotion, or the
+		// backend primary selection below) so we can tell whether it actually changed. The prune step can
+		// promote a secondary to primary via removeConfigured, so sampling this after pruning would miss it.
+		const primaryBefore = this.getCloudPrimaryConnectionIdsByDomain(id);
+
+		const cloudIntegrations = this.authenticationService.cloudIntegrations;
+
+		// Fetch + store each connection's session so getConfigured() reflects every account.
+		const syncedIds = new Set<string>();
+		const syncEligibleIds = new Set<string>();
+		const syncedPrimaryIdsByDomain = new Map<string | undefined, string>();
+		// Snapshot existing cloud descriptors by id once, so the per-connection account-name lookup below is
+		// O(1) instead of re-filtering the whole configured list each iteration (O(n²) with multi-account).
+		// Each backend connection id is processed once, so reading the pre-loop snapshot is sufficient.
+		const existingById = new Map(
+			this.configuredIntegrationService.getConfigured(id, { cloud: true }).map(c => [c.id, c]),
+		);
+		for (const connection of identified) {
+			// The wire `domain` is usually a full URL, though cloud providers can return a bare host.
+			// Self-managed integrations are keyed/constructed by host.
+			const host = hostFromDomain(connection.domain);
+
+			// Self-managed connections are keyed by host, so an unparseable/empty domain would store the
+			// session and descriptor under an empty host — producing ambiguous keys (`connected:<id>:`) that
+			// break later resolution and local-disconnect checks. Skip such a connection rather than corrupt
+			// state; cloud providers key off their canonical domain and are unaffected.
+			if (isGitSelfManagedHostIntegrationId(id) && !host) {
+				scope?.warn(`Skipping connection '${connection.id}' for ${id}: unresolved host from domain`);
+				continue;
+			}
+
+			// Don't resurrect a connection the user disconnected locally: a host "disconnect" only clears
+			// local state (the backend still lists the token), so without this the next non-forced sync would
+			// re-store the secret/config. A forced reconnect clears this flag (in the sync loop above) before
+			// reconcile runs, so it proceeds normally.
+			if (this.isLocallyDisconnected(id, host)) continue;
+
+			syncEligibleIds.add(connection.id);
+
+			// On a routine (non-forced) check-in, skip the token fetch + secret write for a connection we
+			// already have stored and that hasn't expired: nothing to refresh, so avoid the extra GK API
+			// traffic and secret churn. Still treat it as synced (so it doesn't trip the prune guard) and
+			// record its primary below. Forced syncs, new connections, and expired tokens fall through and
+			// fetch as before.
+			const cached = existingById.get(connection.id);
+			if (!forceConnect && cached != null && !isDescriptorExpired(cached)) {
+				syncedIds.add(connection.id);
+				if (connection.primary) {
+					const domain = isGitSelfManagedHostIntegrationId(id) ? host : undefined;
+					if (!syncedPrimaryIdsByDomain.has(domain)) {
+						syncedPrimaryIdsByDomain.set(domain, connection.id);
+					}
+				}
+				continue;
+			}
+
+			try {
+				const session = await cloudIntegrations.getConnectionSession(id, undefined, connection.id);
+				if (session == null) continue;
+
+				let providerSession = toProviderSession(id, connection, session, host);
+
+				// Resolve a human-readable account handle with the same precedence as the gk CLI:
+				// (1) the value the backend put on the connection, (2) a previously-resolved name cached in
+				// our configured store (keyed by connection id), (3) a live provider-API lookup. This keeps
+				// provider round-trips to the first sight of a connection; degrade to undefined on failure.
+				const existing = existingById.get(connection.id);
+				const accountName =
+					normalizeAccountName(connection.accountName) ??
+					normalizeAccountName(existing?.accountName) ??
+					(await this.resolveAccountName(id, host, providerSession));
+				if (accountName != null) {
+					providerSession = {
+						...providerSession,
+						account: { ...providerSession.account, label: accountName },
+					};
+				}
+
+				await this.configuredIntegrationService.storeSession(id, providerSession);
+				syncedIds.add(connection.id);
+				if (connection.primary) {
+					const domain = isGitSelfManagedHostIntegrationId(id) ? host : undefined;
+					if (!syncedPrimaryIdsByDomain.has(domain)) {
+						syncedPrimaryIdsByDomain.set(domain, connection.id);
+					}
+				}
+			} catch (ex) {
+				scope?.warn(
+					`Failed to sync connection '${connection.id}' for ${id}: ${ex instanceof Error ? ex.message : String(ex)}`,
+				);
+			}
+		}
+
+		// Prune stored cloud connections that no longer exist on the backend — but only when every backend
+		// connection that should sync did sync this cycle. Otherwise a transient token fetch failure would
+		// delete a still-valid connection with no replacement (e.g. a legacy single connection during the
+		// backend id rollout); defer pruning to a later clean cycle. Deliberately skipped connections (local
+		// disconnects or invalid self-managed hosts) don't block pruning of unrelated stale descriptors.
+		// Scope deletes to cloud so a local PAT sharing the id survives.
+		const prunedDomains = new Set<string | undefined>();
+		if ([...syncEligibleIds].every(connectionId => syncedIds.has(connectionId))) {
+			const liveIds = new Set(identified.map(c => c.id));
+			for (const descriptor of this.configuredIntegrationService.getConfigured(id, { cloud: true })) {
+				if (!liveIds.has(descriptor.id)) {
+					prunedDomains.add(isGitSelfManagedHostIntegrationId(id) ? descriptor.domain : undefined);
+					await this.configuredIntegrationService.deleteConnection(id, descriptor.id, true);
+				}
+			}
+		}
+
+		// Apply the backend's primary selection, then refresh any warm model only when the effective primary
+		// actually changed (vs the pre-reconcile value captured above). switchConnection() drops the in-memory
+		// session and fires change events, so calling it on every check-in (when the primary is unchanged)
+		// causes needless churn for multi-account providers. Self-managed providers can have one primary per
+		// host, so apply and refresh by host scope rather than by provider id alone.
+		for (const connectionId of syncedPrimaryIdsByDomain.values()) {
+			await this.configuredIntegrationService.setPrimaryConnection(id, connectionId);
+		}
+		const primaryAfter = this.getCloudPrimaryConnectionIdsByDomain(id);
+		const domains = new Set<string | undefined>(primaryBefore.keys());
+		for (const domain of primaryAfter.keys()) {
+			domains.add(domain);
+		}
+		for (const domain of prunedDomains) {
+			domains.add(domain);
+		}
+		for (const domain of domains) {
+			if (primaryBefore.get(domain) === primaryAfter.get(domain) && !prunedDomains.has(domain)) continue;
+
+			this.getCachedForDomain(id, domain)?.switchConnection();
+		}
+	}
+
+	/**
+	 * Switches the default connection for a provider to `connectionId` (its backend token id). Performs
+	 * the server-side primary switch first, then mirrors it locally and refreshes any warm model. Throws
+	 * if the backend switch fails so the caller can surface it (local state stays untouched).
+	 */
+	async setPrimaryConnection(id: IntegrationIds, connectionId: string): Promise<void> {
+		const connection = this.getConfiguredCloudConnection(id, connectionId);
+		if (!(await this.authenticationService.cloudIntegrations.setPrimaryConnection(id, connectionId))) {
+			throw new Error(`Failed to set primary connection '${connectionId}' for '${id}'`);
+		}
+
+		await this.configuredIntegrationService.setPrimaryConnection(id, connectionId);
+		this.getCachedForDomain(id, connection.domain)?.switchConnection();
+	}
+
+	/**
+	 * Removes a single connection for a provider by its backend token id. The backend removes the
+	 * connection (auto-promoting a secondary to primary when the removed one was primary); we then mirror
+	 * that locally and refresh any warm model. Unlike {@link IntegrationBase.disconnect}, this targets one
+	 * account. This always talks to the cloud backend, so the local mirror is cloud-scoped and preserves any
+	 * local PAT that happens to share the same id.
+	 * Throws if the backend delete fails so the caller can surface it (local state stays untouched).
+	 */
+	async deleteConnection(id: IntegrationIds, connectionId: string): Promise<void> {
+		const connection = this.getConfiguredCloudConnection(id, connectionId);
+		if (!(await this.authenticationService.cloudIntegrations.disconnectConnection(id, connectionId))) {
+			throw new Error(`Failed to delete connection '${connectionId}' for '${id}'`);
+		}
+
+		await this.configuredIntegrationService.deleteConnection(id, connectionId, true);
+		this.getCachedForDomain(id, connection.domain)?.switchConnection();
+	}
+
+	/**
+	 * Resolves a human-readable account handle (e.g. the GitHub login) for a connection by asking the
+	 * provider API with that connection's token. The token backend doesn't expose it. Routes through the
+	 * integration model so the correct provider API base URL (incl. self-managed domains) and auth type
+	 * are used. Best-effort: returns undefined on any failure so callers degrade gracefully.
+	 */
+	private async resolveAccountName(
+		id: IntegrationIds,
+		host: string | undefined,
+		session: ProviderAuthenticationSession,
+	): Promise<string | undefined> {
+		const scope = getScopedLogger();
+		try {
+			// Route through the integration so the correct provider API base URL (incl. the self-managed
+			// host) and auth type are used. Cloud providers ignore the host.
+			const integration = await this.get(id, host);
+			const account = await integration?.getProviderAccountForSession(session);
+			return account?.username ?? account?.name ?? undefined;
+		} catch (ex) {
+			scope?.warn(`Failed to resolve account name for '${id}': ${ex instanceof Error ? ex.message : String(ex)}`);
+			return undefined;
+		}
+	}
+
+	/**
+	 * Forces a refresh of connected cloud integrations from the backend (equivalent to a "--sync" list),
+	 * reconciling local state (multi-account connections, primary flags, account names) so a subsequent
+	 * {@link getConfigured} reflects the latest server-side connections. Intended for consumers that need
+	 * an up-to-date connection list on demand. Rejects when the authoritative backend connection list cannot
+	 * be read, so callers never mistake stale local state for a successful refresh.
+	 */
+	async refreshConnections(): Promise<void> {
+		const connected = await this.syncCloudIntegrations(true);
+		if (connected == null) {
+			throw new Error('Failed to refresh provider connections');
+		}
+	}
+}
+
+/** Internal factory used by the GitLens host and integration tests that need the full service surface. */
+export function createIntegrationService(ctx: IntegrationServiceContext): IntegrationService {
+	const configured = new ConfiguredIntegrationService(ctx);
+	const cloud = new CloudIntegrationService(ctx);
+	let service: IntegrationService;
+	const auth = new IntegrationAuthenticationService(configured, ctx, () => service, cloud);
+	service = new IntegrationService(auth, configured, ctx);
+	void purgeRetiredIntegrationStorage(ctx, configured);
+	return service;
+}
+
+const retiredIntegrationsStorageKey = 'integrations:migrated:cloudOnly';
+async function purgeRetiredIntegrationStorage(
+	ctx: IntegrationServiceContext,
+	configured: ConfiguredIntegrationService,
+): Promise<void> {
+	if (ctx.storage.get<boolean>(retiredIntegrationsStorageKey)) return;
+
+	try {
+		await configured.purgeStoredConfiguration(['github-enterprise', 'gitlab-self-hosted']);
+		await ctx.storage.store(retiredIntegrationsStorageKey, true);
+	} catch {
+		// Best-effort cleanup retries on the next startup while the migration flag remains unset.
+	}
+}
+
+function protocolFromDomain(domain: string | undefined): string | undefined {
+	const value = domain?.trim();
+	if (!value) return undefined;
+	if (!/^[a-z][a-z\d+\-.]*:\/\//i.test(value)) return undefined;
+
+	try {
+		return new URL(value).protocol || undefined;
+	} catch {
+		return undefined;
+	}
+}
+
+function normalizeAccountName(accountName: string | undefined): string | undefined {
+	const value = accountName?.trim();
+	return value ? value : undefined;
+}
+
+/**
+ * Whether a stored connection descriptor's token has expired. A missing `expiresAt` is treated as
+ * not-expired (non-expiring/legacy tokens, e.g. GitHub and self-managed cloud, carry no meaningful
+ * expiry), matching the session-expiry checks elsewhere.
+ */
+function isDescriptorExpired(descriptor: ConfiguredIntegrationDescriptor): boolean {
+	if (descriptor.expiresAt == null) return false;
+	return new Date(descriptor.expiresAt).getTime() < Date.now();
+}
+
+function toProviderSession(
+	id: IntegrationIds,
+	connection: CloudIntegrationConnection & { id: string },
+	session: {
+		accessToken: string;
+		expiresIn: number;
+		scopes: string;
+		type: CloudIntegrationConnection['type'];
+		appKey?: string;
+	},
+	host: string | undefined,
+): ProviderAuthenticationSession {
+	// GitHub, the cloud self-managed hosts, and Trello return `expiresIn: 0` for a non-expiring token; left
+	// as 0 the session's `expiresAt` would be `now` and rejected as expired on the next read. Map it to the
+	// maximum expiry (mirrors the auth provider's own guard).
+	const expiresIn =
+		session.expiresIn === 0 && isNonExpiringZeroTokenIntegrationId(id) ? maxSmallIntegerV8 : session.expiresIn;
+	const protocol = protocolFromDomain(connection.domain);
+
+	return {
+		id: connection.id,
+		accessToken: session.accessToken,
+		account: { id: '', label: '' },
+		scopes: session.scopes ? session.scopes.split(',') : [],
+		cloud: true,
+		type: session.type,
+		expiresAt: new Date(expiresIn * 1000 + Date.now()),
+		// Self-managed connections are keyed by their host; cloud providers use the canonical domain.
+		domain: isGitSelfManagedHostIntegrationId(id) ? (host ?? '') : (providersMetadata[id]?.domain ?? ''),
+		...(protocol != null ? { protocol: protocol } : {}),
+		// Carried for providers whose client needs an app key alongside the token (e.g. Trello).
+		...(session.appKey != null ? { appKey: session.appKey } : {}),
+	};
 }