@gitkraken/core-gitlens 0.6.0 → 0.7.0

package/dist/plus/integrations/authentication/models.js

@@ -1,64 +1,65 @@
-import { microhash } from '../../../utils/hash.js';
-import { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId, IssuesCloudHostIntegrationId, supportedOrderedCloudIntegrationIds, } from '../constants.js';
-export function toTokenInfo(providerId, accessToken, info) {
-    return {
-        providerId: providerId,
-        microHash: microhash(accessToken, 3),
-        cloud: info.cloud,
-        type: info.type,
-        scopes: info.scopes,
-        expiresAt: info.expiresAt,
-    };
+import { microhash } from "../../../utils/hash.js";
+import { IssuesCloudHostIntegrationId, supportedOrderedCloudIntegrationIds } from "../constants.js";
+//#region ../plus/integrations/src/authentication/models.ts
+function toTokenInfo(providerId, accessToken, info) {
+	return {
+		providerId,
+		microHash: microhash(accessToken, 3),
+		cloud: info.cloud,
+		type: info.type,
+		scopes: info.scopes,
+		expiresAt: info.expiresAt
+	};
 }
-export function toTokenWithInfo(providerId, session, altToken) {
-    const { accessToken: sessionToken, ...sessionInfo } = session;
-    const accessToken = altToken ?? session.accessToken;
-    return {
-        // pass original token info to form the correlated microhash
-        ...toTokenInfo(providerId, sessionToken, sessionInfo),
-        // use the actual token used for the request
-        accessToken: accessToken,
-    };
+function toTokenWithInfo(providerId, session, altToken) {
+	const { accessToken: sessionToken, ...sessionInfo } = session;
+	const accessToken = altToken ?? session.accessToken;
+	return {
+		...toTokenInfo(providerId, sessionToken, sessionInfo),
+		accessToken
+	};
 }
-export const CloudIntegrationAuthenticationUriPathPrefix = 'did-authenticate-cloud-integration';
+const CloudIntegrationAuthenticationUriPathPrefix = "did-authenticate-cloud-integration";
 /** Returns all supported cloud integration ids. */
-export function getSupportedCloudIntegrationIds() {
-    // Return the shared const directly (readonly so callers can't mutate it) — this runs on hot,
-    // per-integration membership paths, so avoid allocating a fresh array per call.
-    return supportedOrderedCloudIntegrationIds;
+function getSupportedCloudIntegrationIds() {
+	return supportedOrderedCloudIntegrationIds;
 }
 /** Whether `id` is a supported cloud integration id. */
-export function isSupportedCloudIntegrationId(id) {
-    return getSupportedCloudIntegrationIds().includes(id);
+function isSupportedCloudIntegrationId(id) {
+	return getSupportedCloudIntegrationIds().includes(id);
 }
-export function isIssueCloudIntegrationId(id) {
-    const issueIds = Object.values(IssuesCloudHostIntegrationId);
-    return issueIds.includes(id);
+function isIssueCloudIntegrationId(id) {
+	return Object.values(IssuesCloudHostIntegrationId).includes(id);
 }
-export const toIntegrationId = {
-    jira: IssuesCloudHostIntegrationId.Jira,
-    linear: IssuesCloudHostIntegrationId.Linear,
-    trello: IssuesCloudHostIntegrationId.Trello,
-    gitlab: GitCloudHostIntegrationId.GitLab,
-    github: GitCloudHostIntegrationId.GitHub,
-    githubEnterprise: GitSelfManagedHostIntegrationId.CloudGitHubEnterprise,
-    gitlabSelfHosted: GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted,
-    bitbucket: GitCloudHostIntegrationId.Bitbucket,
-    bitbucketServer: GitSelfManagedHostIntegrationId.BitbucketServer,
-    azure: GitCloudHostIntegrationId.AzureDevOps,
-    azureDevopsServer: GitSelfManagedHostIntegrationId.AzureDevOpsServer,
+const toIntegrationId = {
+	jira: "jira",
+	jiraServer: "jira-server",
+	linear: "linear",
+	trello: "trello",
+	gitlab: "gitlab",
+	github: "github",
+	githubEnterprise: "cloud-github-enterprise",
+	gitlabSelfHosted: "cloud-gitlab-self-hosted",
+	bitbucket: "bitbucket",
+	bitbucketServer: "bitbucket-server",
+	azure: "azureDevOps",
+	azureDevopsServer: "azure-devops-server"
 };
-export const toCloudIntegrationType = {
-    [IssuesCloudHostIntegrationId.Jira]: 'jira',
-    [IssuesCloudHostIntegrationId.Linear]: 'linear',
-    [IssuesCloudHostIntegrationId.Trello]: 'trello',
-    [GitCloudHostIntegrationId.GitLab]: 'gitlab',
-    [GitCloudHostIntegrationId.GitHub]: 'github',
-    [GitCloudHostIntegrationId.Bitbucket]: 'bitbucket',
-    [GitCloudHostIntegrationId.AzureDevOps]: 'azure',
-    [GitSelfManagedHostIntegrationId.AzureDevOpsServer]: 'azureDevopsServer',
-    [GitSelfManagedHostIntegrationId.CloudGitHubEnterprise]: 'githubEnterprise',
-    [GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted]: 'gitlabSelfHosted',
-    [GitSelfManagedHostIntegrationId.BitbucketServer]: 'bitbucketServer',
+const toCloudIntegrationType = {
+	["jira"]: "jira",
+	["jira-server"]: "jiraServer",
+	["linear"]: "linear",
+	["trello"]: "trello",
+	["gitlab"]: "gitlab",
+	["github"]: "github",
+	["bitbucket"]: "bitbucket",
+	["azureDevOps"]: "azure",
+	["azure-devops-server"]: "azureDevopsServer",
+	["cloud-github-enterprise"]: "githubEnterprise",
+	["cloud-gitlab-self-hosted"]: "gitlabSelfHosted",
+	["bitbucket-server"]: "bitbucketServer"
 };
+//#endregion
+export { CloudIntegrationAuthenticationUriPathPrefix, getSupportedCloudIntegrationIds, isIssueCloudIntegrationId, isSupportedCloudIntegrationId, toCloudIntegrationType, toIntegrationId, toTokenInfo, toTokenWithInfo };
+
 //# sourceMappingURL=models.js.map

package/dist/plus/integrations/authentication/models.js.map

@@ -1 +1 @@
-{"version":3,"file":"models.js","sourceRoot":"","sources":["../../../../src/plus/integrations/authentication/models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EACN,yBAAyB,EACzB,+BAA+B,EAC/B,4BAA4B,EAC5B,mCAAmC,GACnC,MAAM,iBAAiB,CAAC;AA0CzB,MAAM,UAAU,WAAW,CAC1B,UAAa,EACb,WAA+B,EAC/B,IAAkH;IAElH,OAAO;QACN,UAAU,EAAE,UAAU;QACtB,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;KACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC9B,UAAa,EACb,OAAsC,EACtC,QAAiB;IAEjB,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAC;IAC9D,MAAM,WAAW,GAAG,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC;IACpD,OAAO;QACN,4DAA4D;QAC5D,GAAG,WAAW,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,CAAC;QACrD,4CAA4C;QAC5C,WAAW,EAAE,WAAW;KACxB,CAAC;AACH,CAAC;AA+ED,MAAM,CAAC,MAAM,2CAA2C,GAAG,oCAAoC,CAAC;AAEhG,mDAAmD;AACnD,MAAM,UAAU,+BAA+B;IAC9C,6FAA6F;IAC7F,gFAAgF;IAChF,OAAO,mCAAmC,CAAC;AAC5C,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,6BAA6B,CAAC,EAAU;IACvD,OAAO,+BAA+B,EAAE,CAAC,QAAQ,CAAC,EAAkC,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,EAAU;IACnD,MAAM,QAAQ,GAAa,MAAM,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC;IACvE,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAsD;IACjF,IAAI,EAAE,4BAA4B,CAAC,IAAI;IACvC,MAAM,EAAE,4BAA4B,CAAC,MAAM;IAC3C,MAAM,EAAE,4BAA4B,CAAC,MAAM;IAC3C,MAAM,EAAE,yBAAyB,CAAC,MAAM;IACxC,MAAM,EAAE,yBAAyB,CAAC,MAAM;IACxC,gBAAgB,EAAE,+BAA+B,CAAC,qBAAqB;IACvE,gBAAgB,EAAE,+BAA+B,CAAC,qBAAqB;IACvE,SAAS,EAAE,yBAAyB,CAAC,SAAS;IAC9C,eAAe,EAAE,+BAA+B,CAAC,eAAe;IAChE,KAAK,EAAE,yBAAyB,CAAC,WAAW;IAC5C,iBAAiB,EAAE,+BAA+B,CAAC,iBAAiB;CACpE,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAkE;IACpG,CAAC,4BAA4B,CAAC,IAAI,CAAC,EAAE,MAAM;IAC3C,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,QAAQ;IAC/C,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,QAAQ;IAC/C,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,QAAQ;IAC5C,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,QAAQ;IAC5C,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,WAAW;IAClD,CAAC,yBAAyB,CAAC,WAAW,CAAC,EAAE,OAAO;IAChD,CAAC,+BAA+B,CAAC,iBAAiB,CAAC,EAAE,mBAAmB;IACxE,CAAC,+BAA+B,CAAC,qBAAqB,CAAC,EAAE,kBAAkB;IAC3E,CAAC,+BAA+B,CAAC,qBAAqB,CAAC,EAAE,kBAAkB;IAC3E,CAAC,+BAA+B,CAAC,eAAe,CAAC,EAAE,iBAAiB;CACpE,CAAC"}
+{"version":3,"file":"models.js","names":[],"sources":["../../../../../plus/integrations/src/authentication/models.ts"],"sourcesContent":["import { microhash } from '@gitlens/utils/hash.js';\nimport type { IntegrationIds, SupportedCloudIntegrationIds } from '../constants.js';\nimport {\n\tGitCloudHostIntegrationId,\n\tGitSelfManagedHostIntegrationId,\n\tIssuesCloudHostIntegrationId,\n\tIssuesSelfManagedHostIntegrationId,\n\tsupportedOrderedCloudIntegrationIds,\n} from '../constants.js';\n\n/**\n * Mirrors the shape of `vscode.AuthenticationSession` so the integrations\n * package can stay vscode-free. Host adapters bridge VS Code sessions to\n * this shape via {@link AuthenticationProvider}.\n */\nexport interface AuthenticationSessionLike {\n\treadonly id: string;\n\treadonly accessToken: string;\n\treadonly account: { readonly id: string; readonly label: string };\n\treadonly scopes: readonly string[];\n}\n\nexport interface ProviderAuthenticationSession extends AuthenticationSessionLike {\n\treadonly cloud: boolean;\n\treadonly type: CloudIntegrationAuthType | undefined;\n\treadonly expiresAt?: Date;\n\treadonly domain: string;\n\t/**\n\t * The connection's address exactly as it was configured, path and all, when that differs from\n\t * {@link domain}.\n\t *\n\t * `domain` is the IDENTITY a self-managed connection is keyed by, so it is normalized to a bare host\n\t * (`hostFromDomain`) and one host cannot key two connections. An instance mounted below a context path —\n\t * Jira Data Center's `/jira`, a reverse-proxied GitLab or Bitbucket — still has to be ADDRESSED at that\n\t * path, and normalizing it away is what made every request go to the root. Absent when the backend\n\t * reported nothing beyond the host, which is the common case.\n\t */\n\treadonly baseUrl?: string;\n\treadonly protocol?: string;\n\t/** The provider app key paired with the token for providers whose client needs one (e.g. Trello). */\n\treadonly appKey?: string;\n}\n\nexport interface TokenInfo<T extends IntegrationIds | 'gitkraken' = IntegrationIds | 'gitkraken'> {\n\treadonly providerId: T;\n\t/**\n\t * The first 3 characters of the md5 hash of the token.\n\t * It's a very obfuscated representation of the token that we can use in logs\n\t * to see whether the token survives refreshing or gets updated.\n\t */\n\treadonly microHash: string | undefined;\n\treadonly cloud: boolean;\n\treadonly type: CloudIntegrationAuthType | undefined;\n\treadonly scopes: readonly string[] | undefined;\n\treadonly expiresAt?: Date;\n}\n\nexport interface TokenWithInfo<T extends IntegrationIds = IntegrationIds> extends TokenInfo<T> {\n\treadonly accessToken: string;\n}\n\nexport function toTokenInfo<T extends IntegrationIds | 'gitkraken'>(\n\tproviderId: T,\n\taccessToken: string | undefined,\n\tinfo: { cloud: boolean; type: CloudIntegrationAuthType | undefined; scopes?: readonly string[]; expiresAt?: Date },\n): TokenInfo<T> {\n\treturn {\n\t\tproviderId: providerId,\n\t\tmicroHash: microhash(accessToken, 3),\n\t\tcloud: info.cloud,\n\t\ttype: info.type,\n\t\tscopes: info.scopes,\n\t\texpiresAt: info.expiresAt,\n\t};\n}\n\nexport function toTokenWithInfo<T extends IntegrationIds>(\n\tproviderId: T,\n\tsession: ProviderAuthenticationSession,\n\taltToken?: string,\n): TokenWithInfo<T> {\n\tconst { accessToken: sessionToken, ...sessionInfo } = session;\n\tconst accessToken = altToken ?? session.accessToken;\n\treturn {\n\t\t// pass original token info to form the correlated microhash\n\t\t...toTokenInfo(providerId, sessionToken, sessionInfo),\n\t\t// use the actual token used for the request\n\t\taccessToken: accessToken,\n\t};\n}\n\nexport type TokenOptInfo<T extends IntegrationIds = IntegrationIds> =\n\t| TokenWithInfo<T>\n\t// `connectionId` targets a specific connection (multi-account) when the token still has to be resolved.\n\t// Omitted resolves the provider's primary connection, preserving the pre-multi-account behavior.\n\t| { providerId: T; accessToken?: undefined; connectionId?: string };\n\nexport interface ConfiguredIntegrationDescriptor {\n\t/**\n\t * Stable per-connection identifier, distinct from the domain, so multiple accounts can be\n\t * connected to the same provider+domain simultaneously. For legacy/migrated single connections\n\t * this is the domain (self-managed) or the provider's canonical domain (cloud), which keeps the\n\t * existing secret key (`integration.auth[.cloud]:{id}|{domain}`) valid with zero migration.\n\t */\n\treadonly id: string;\n\t/**\n\t * Whether this is the connection used by default for the provider. Optional: when no descriptor\n\t * for a provider+domain carries an explicit flag, the first one is treated as primary. Only\n\t * {@link ConfiguredIntegrationService.setPrimaryConnection} sets the flag (and clears it on siblings).\n\t */\n\treadonly primary?: boolean;\n\t/** The connection's auth type (`oauth`/`pat`), when known. */\n\treadonly type?: CloudIntegrationAuthType;\n\t/**\n\t * Human-readable account handle for this connection (e.g. the GitHub login). Resolved from the\n\t * provider API (the token backend doesn't expose it); absent until resolved or if the lookup fails.\n\t */\n\treadonly accountName?: string;\n\treadonly cloud: boolean;\n\treadonly integrationId: IntegrationIds;\n\treadonly scopes: string;\n\treadonly domain?: string;\n\t/**\n\t * The address this connection was configured with, path included — see\n\t * {@link ProviderAuthenticationSession.baseUrl}.\n\t *\n\t * Mirrored onto the descriptor so reconciliation can tell a re-pointed connection from an unchanged one\n\t * without reading its secret: {@link domain} is normalized to a bare host, so a backend connection moved\n\t * from one context path to another on the SAME host looks identical by domain alone.\n\t */\n\treadonly baseUrl?: string;\n\treadonly expiresAt?: string | Date;\n}\n\nexport interface CloudIntegrationAuthenticationSession {\n\ttype: CloudIntegrationAuthType;\n\taccessToken: string;\n\tdomain: string;\n\texpiresIn: number;\n\tscopes: string;\n\t/** Backend per-connection token identifier, when the provider-tokens backend supports multi-account. */\n\tid?: string;\n\t/** Provider app key paired with the token (e.g. Trello app key), when the backend supplies one. */\n\tappKey?: string;\n}\n\nexport interface CloudIntegrationAuthorization {\n\turl: string;\n}\n\nexport interface CloudIntegrationConnection {\n\ttype: CloudIntegrationAuthType;\n\tprovider: CloudIntegrationType;\n\tdomain: string;\n\t/** Backend per-connection token identifier, when the provider-tokens backend supports multi-account. */\n\tid?: string;\n\t/** Whether the backend marks this connection as the primary/default for the provider. */\n\tprimary?: boolean;\n\t/** Human-readable account handle, when the backend provides it on the connection (may be absent). */\n\taccountName?: string;\n}\n\nexport type CloudIntegrationType =\n\t| 'jira'\n\t| 'jiraServer'\n\t| 'linear'\n\t| 'trello'\n\t| 'gitlab'\n\t| 'github'\n\t| 'bitbucket'\n\t| 'bitbucketServer'\n\t| 'azure'\n\t| 'azureDevopsServer'\n\t| 'githubEnterprise'\n\t| 'gitlabSelfHosted';\n\nexport type CloudIntegrationAuthType = 'oauth' | 'pat';\n\nexport const CloudIntegrationAuthenticationUriPathPrefix = 'did-authenticate-cloud-integration';\n\n/** Returns all supported cloud integration ids. */\nexport function getSupportedCloudIntegrationIds(): readonly SupportedCloudIntegrationIds[] {\n\t// Return the shared const directly (readonly so callers can't mutate it) — this runs on hot,\n\t// per-integration membership paths, so avoid allocating a fresh array per call.\n\treturn supportedOrderedCloudIntegrationIds;\n}\n\n/** Whether `id` is a supported cloud integration id. */\nexport function isSupportedCloudIntegrationId(id: string): id is SupportedCloudIntegrationIds {\n\treturn getSupportedCloudIntegrationIds().includes(id as SupportedCloudIntegrationIds);\n}\n\nexport function isIssueCloudIntegrationId(id: string): id is IssuesCloudHostIntegrationId {\n\tconst issueIds: string[] = Object.values(IssuesCloudHostIntegrationId);\n\treturn issueIds.includes(id);\n}\n\nexport const toIntegrationId: { [key in CloudIntegrationType]: IntegrationIds } = {\n\tjira: IssuesCloudHostIntegrationId.Jira,\n\tjiraServer: IssuesSelfManagedHostIntegrationId.JiraServer,\n\tlinear: IssuesCloudHostIntegrationId.Linear,\n\ttrello: IssuesCloudHostIntegrationId.Trello,\n\tgitlab: GitCloudHostIntegrationId.GitLab,\n\tgithub: GitCloudHostIntegrationId.GitHub,\n\tgithubEnterprise: GitSelfManagedHostIntegrationId.CloudGitHubEnterprise,\n\tgitlabSelfHosted: GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted,\n\tbitbucket: GitCloudHostIntegrationId.Bitbucket,\n\tbitbucketServer: GitSelfManagedHostIntegrationId.BitbucketServer,\n\tazure: GitCloudHostIntegrationId.AzureDevOps,\n\tazureDevopsServer: GitSelfManagedHostIntegrationId.AzureDevOpsServer,\n};\n\nexport const toCloudIntegrationType: { [key in IntegrationIds]: CloudIntegrationType | undefined } = {\n\t[IssuesCloudHostIntegrationId.Jira]: 'jira',\n\t[IssuesSelfManagedHostIntegrationId.JiraServer]: 'jiraServer',\n\t[IssuesCloudHostIntegrationId.Linear]: 'linear',\n\t[IssuesCloudHostIntegrationId.Trello]: 'trello',\n\t[GitCloudHostIntegrationId.GitLab]: 'gitlab',\n\t[GitCloudHostIntegrationId.GitHub]: 'github',\n\t[GitCloudHostIntegrationId.Bitbucket]: 'bitbucket',\n\t[GitCloudHostIntegrationId.AzureDevOps]: 'azure',\n\t[GitSelfManagedHostIntegrationId.AzureDevOpsServer]: 'azureDevopsServer',\n\t[GitSelfManagedHostIntegrationId.CloudGitHubEnterprise]: 'githubEnterprise',\n\t[GitSelfManagedHostIntegrationId.CloudGitLabSelfHosted]: 'gitlabSelfHosted',\n\t[GitSelfManagedHostIntegrationId.BitbucketServer]: 'bitbucketServer',\n};\n"],"mappings":";;;AA6DA,SAAgB,YACf,YACA,aACA,MACe;CACf,OAAO;EACM;EACZ,WAAW,UAAU,aAAa,CAAC;EACnC,OAAO,KAAK;EACZ,MAAM,KAAK;EACX,QAAQ,KAAK;EACb,WAAW,KAAK;CACjB;AACD;AAEA,SAAgB,gBACf,YACA,SACA,UACmB;CACnB,MAAM,EAAE,aAAa,cAAc,GAAG,gBAAgB;CACtD,MAAM,cAAc,YAAY,QAAQ;CACxC,OAAO;EAEN,GAAG,YAAY,YAAY,cAAc,WAAW;EAEvC;CACd;AACD;AAyFA,MAAa,8CAA8C;;AAG3D,SAAgB,kCAA2E;CAG1F,OAAO;AACR;;AAGA,SAAgB,8BAA8B,IAAgD;CAC7F,OAAO,gCAAgC,CAAC,CAAC,SAAS,EAAkC;AACrF;AAEA,SAAgB,0BAA0B,IAAgD;CAEzF,OAD2B,OAAO,OAAO,4BAC3B,CAAC,CAAC,SAAS,EAAE;AAC5B;AAEA,MAAa,kBAAqE;CACjF,MAAA;CACA,YAAA;CACA,QAAA;CACA,QAAA;CACA,QAAA;CACA,QAAA;CACA,kBAAA;CACA,kBAAA;CACA,WAAA;CACA,iBAAA;CACA,OAAA;CACA,mBAAA;AACD;AAEA,MAAa,yBAAwF;EAC/D,SAAA;EACY,gBAAA;EACV,WAAA;EACA,WAAA;EACH,WAAA;EACA,WAAA;EACG,cAAA;EACE,gBAAA;EACY,wBAAA;EACI,4BAAA;EACA,6BAAA;EACN,qBAAA;AACpD"}

package/dist/plus/integrations/authentication/rejectedTokenTracker.d.ts

@@ -1,3 +1,4 @@
+//#region ../plus/integrations/src/authentication/rejectedTokenTracker.d.ts
 /**
  * Per-connection recovery state for a cloud token the provider REFUSED — a revoked grant, retired scopes, an
  * app removed from the org. A purely predictive refresh (`expiresIn < 60`) cannot see that case, because the
@@ -18,22 +19,23 @@
  * tokens; a connection that is simply working never reaches here at all.
  */
 export declare class RejectedTokenTracker {
-    private readonly _rejections;
-    /**
-     * Whether a read of `connectionId` must force the cloud refresh of a token known to be refused, spending
-     * the rejection so the refresh runs at most once. Spent here rather than after the read because a resolve
-     * that throws must not leave the refresh armed and ask the cloud again on the next read.
-     */
-    claimRefresh(connectionId: string): boolean;
-    /**
-     * Arms the recovery refresh for `connectionId`. Returns `false` once this connection has had its refresh
-     * (or already has one pending), so the caller falls back to its own failure handling: a token still
-     * refused after the refresh is not self-healing, and only the failure budget ends in a reconnect prompt.
-     */
-    recordRejection(connectionId: string): boolean;
-    /** Drops all state, for when the stored tokens a rejection could name are replaced or gone. */
-    clear(): void;
-    /** Whether any connection is holding a rejection. For assertions; the read path uses {@link claimRefresh}. */
-    get empty(): boolean;
+  private readonly _rejections;
+  /**
+   * Whether a read of `connectionId` must force the cloud refresh of a token known to be refused, spending
+   * the rejection so the refresh runs at most once. Spent here rather than after the read because a resolve
+   * that throws must not leave the refresh armed and ask the cloud again on the next read.
+   */
+  claimRefresh(connectionId: string): boolean;
+  /**
+   * Arms the recovery refresh for `connectionId`. Returns `false` once this connection has had its refresh
+   * (or already has one pending), so the caller falls back to its own failure handling: a token still
+   * refused after the refresh is not self-healing, and only the failure budget ends in a reconnect prompt.
+   */
+  recordRejection(connectionId: string): boolean;
+  /** Drops all state, for when the stored tokens a rejection could name are replaced or gone. */
+  clear(): void;
+  /** Whether any connection is holding a rejection. For assertions; the read path uses {@link claimRefresh}. */
+  get empty(): boolean;
 }
+//#endregion
 //# sourceMappingURL=rejectedTokenTracker.d.ts.map

package/dist/plus/integrations/authentication/rejectedTokenTracker.js

@@ -1,53 +1,55 @@
+//#region ../plus/integrations/src/authentication/rejectedTokenTracker.ts
 /**
- * Per-connection recovery state for a cloud token the provider REFUSED — a revoked grant, retired scopes, an
- * app removed from the org. A purely predictive refresh (`expiresIn < 60`) cannot see that case, because the
- * backend still believes the token is valid, so without this the refused token is re-sent on every read and
- * the failure only clears when the user reconnects by hand.
- *
- * One recovery refresh per connection, then the connection is the failure budget's problem:
- * - {@link recordRejection} on an `AuthenticationError` — arms the refresh, or reports that the rejection is
- *   not recoverable so the caller counts it as a real failure instead.
- * - {@link claimRefresh} before the next read resolves its session — spends the rejection, so the refresh
- *   fires once and no further read of that connection asks the cloud again.
- *
- * Deliberately NOT re-armed when the refresh hands back a different token. The GK cloud mints a new access
- * token on every `/refresh`, so a credential the provider refuses for a reason a refresh cannot fix (retired
- * scopes being the plain case) would look "rotated" on each attempt: re-arming on that would refresh on every
- * read forever and the failure budget — the thing that disconnects and prompts a reconnect — would never
- * advance. What resets this instead is {@link clear}, called by every path that replaces or removes the stored
- * tokens; a connection that is simply working never reaches here at all.
- */
-export class RejectedTokenTracker {
-    _rejections = new Map();
-    /**
-     * Whether a read of `connectionId` must force the cloud refresh of a token known to be refused, spending
-     * the rejection so the refresh runs at most once. Spent here rather than after the read because a resolve
-     * that throws must not leave the refresh armed and ask the cloud again on the next read.
-     */
-    claimRefresh(connectionId) {
-        if (this._rejections.get(connectionId) !== 'armed')
-            return false;
-        this._rejections.set(connectionId, 'spent');
-        return true;
-    }
-    /**
-     * Arms the recovery refresh for `connectionId`. Returns `false` once this connection has had its refresh
-     * (or already has one pending), so the caller falls back to its own failure handling: a token still
-     * refused after the refresh is not self-healing, and only the failure budget ends in a reconnect prompt.
-     */
-    recordRejection(connectionId) {
-        if (this._rejections.has(connectionId))
-            return false;
-        this._rejections.set(connectionId, 'armed');
-        return true;
-    }
-    /** Drops all state, for when the stored tokens a rejection could name are replaced or gone. */
-    clear() {
-        this._rejections.clear();
-    }
-    /** Whether any connection is holding a rejection. For assertions; the read path uses {@link claimRefresh}. */
-    get empty() {
-        return this._rejections.size === 0;
-    }
-}
+* Per-connection recovery state for a cloud token the provider REFUSED — a revoked grant, retired scopes, an
+* app removed from the org. A purely predictive refresh (`expiresIn < 60`) cannot see that case, because the
+* backend still believes the token is valid, so without this the refused token is re-sent on every read and
+* the failure only clears when the user reconnects by hand.
+*
+* One recovery refresh per connection, then the connection is the failure budget's problem:
+* - {@link recordRejection} on an `AuthenticationError` — arms the refresh, or reports that the rejection is
+*   not recoverable so the caller counts it as a real failure instead.
+* - {@link claimRefresh} before the next read resolves its session — spends the rejection, so the refresh
+*   fires once and no further read of that connection asks the cloud again.
+*
+* Deliberately NOT re-armed when the refresh hands back a different token. The GK cloud mints a new access
+* token on every `/refresh`, so a credential the provider refuses for a reason a refresh cannot fix (retired
+* scopes being the plain case) would look "rotated" on each attempt: re-arming on that would refresh on every
+* read forever and the failure budget — the thing that disconnects and prompts a reconnect — would never
+* advance. What resets this instead is {@link clear}, called by every path that replaces or removes the stored
+* tokens; a connection that is simply working never reaches here at all.
+*/
+var RejectedTokenTracker = class {
+	_rejections = /* @__PURE__ */ new Map();
+	/**
+	* Whether a read of `connectionId` must force the cloud refresh of a token known to be refused, spending
+	* the rejection so the refresh runs at most once. Spent here rather than after the read because a resolve
+	* that throws must not leave the refresh armed and ask the cloud again on the next read.
+	*/
+	claimRefresh(connectionId) {
+		if (this._rejections.get(connectionId) !== "armed") return false;
+		this._rejections.set(connectionId, "spent");
+		return true;
+	}
+	/**
+	* Arms the recovery refresh for `connectionId`. Returns `false` once this connection has had its refresh
+	* (or already has one pending), so the caller falls back to its own failure handling: a token still
+	* refused after the refresh is not self-healing, and only the failure budget ends in a reconnect prompt.
+	*/
+	recordRejection(connectionId) {
+		if (this._rejections.has(connectionId)) return false;
+		this._rejections.set(connectionId, "armed");
+		return true;
+	}
+	/** Drops all state, for when the stored tokens a rejection could name are replaced or gone. */
+	clear() {
+		this._rejections.clear();
+	}
+	/** Whether any connection is holding a rejection. For assertions; the read path uses {@link claimRefresh}. */
+	get empty() {
+		return this._rejections.size === 0;
+	}
+};
+//#endregion
+export { RejectedTokenTracker };
+
 //# sourceMappingURL=rejectedTokenTracker.js.map

package/dist/plus/integrations/authentication/rejectedTokenTracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"rejectedTokenTracker.js","sourceRoot":"","sources":["../../../../src/plus/integrations/authentication/rejectedTokenTracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,OAAO,oBAAoB;IACf,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAC;IAEpE;;;;OAIG;IACH,YAAY,CAAC,YAAoB;QAChC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QAEjE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,YAAoB;QACnC,IAAI,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,OAAO,KAAK,CAAC;QAErD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACb,CAAC;IAED,+FAA+F;IAC/F,KAAK;QACJ,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,8GAA8G;IAC9G,IAAI,KAAK;QACR,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,CAAC;IACpC,CAAC;CACD"}
+{"version":3,"file":"rejectedTokenTracker.js","names":[],"sources":["../../../../../plus/integrations/src/authentication/rejectedTokenTracker.ts"],"sourcesContent":["/**\n * Per-connection recovery state for a cloud token the provider REFUSED — a revoked grant, retired scopes, an\n * app removed from the org. A purely predictive refresh (`expiresIn < 60`) cannot see that case, because the\n * backend still believes the token is valid, so without this the refused token is re-sent on every read and\n * the failure only clears when the user reconnects by hand.\n *\n * One recovery refresh per connection, then the connection is the failure budget's problem:\n * - {@link recordRejection} on an `AuthenticationError` — arms the refresh, or reports that the rejection is\n *   not recoverable so the caller counts it as a real failure instead.\n * - {@link claimRefresh} before the next read resolves its session — spends the rejection, so the refresh\n *   fires once and no further read of that connection asks the cloud again.\n *\n * Deliberately NOT re-armed when the refresh hands back a different token. The GK cloud mints a new access\n * token on every `/refresh`, so a credential the provider refuses for a reason a refresh cannot fix (retired\n * scopes being the plain case) would look \"rotated\" on each attempt: re-arming on that would refresh on every\n * read forever and the failure budget — the thing that disconnects and prompts a reconnect — would never\n * advance. What resets this instead is {@link clear}, called by every path that replaces or removes the stored\n * tokens; a connection that is simply working never reaches here at all.\n */\nexport class RejectedTokenTracker {\n\tprivate readonly _rejections = new Map<string, 'armed' | 'spent'>();\n\n\t/**\n\t * Whether a read of `connectionId` must force the cloud refresh of a token known to be refused, spending\n\t * the rejection so the refresh runs at most once. Spent here rather than after the read because a resolve\n\t * that throws must not leave the refresh armed and ask the cloud again on the next read.\n\t */\n\tclaimRefresh(connectionId: string): boolean {\n\t\tif (this._rejections.get(connectionId) !== 'armed') return false;\n\n\t\tthis._rejections.set(connectionId, 'spent');\n\t\treturn true;\n\t}\n\n\t/**\n\t * Arms the recovery refresh for `connectionId`. Returns `false` once this connection has had its refresh\n\t * (or already has one pending), so the caller falls back to its own failure handling: a token still\n\t * refused after the refresh is not self-healing, and only the failure budget ends in a reconnect prompt.\n\t */\n\trecordRejection(connectionId: string): boolean {\n\t\tif (this._rejections.has(connectionId)) return false;\n\n\t\tthis._rejections.set(connectionId, 'armed');\n\t\treturn true;\n\t}\n\n\t/** Drops all state, for when the stored tokens a rejection could name are replaced or gone. */\n\tclear(): void {\n\t\tthis._rejections.clear();\n\t}\n\n\t/** Whether any connection is holding a rejection. For assertions; the read path uses {@link claimRefresh}. */\n\tget empty(): boolean {\n\t\treturn this._rejections.size === 0;\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAmBA,IAAa,uBAAb,MAAkC;CACjC,8BAA+B,IAAI,IAA+B;;;;;;CAOlE,aAAa,cAA+B;EAC3C,IAAI,KAAK,YAAY,IAAI,YAAY,MAAM,SAAS,OAAO;EAE3D,KAAK,YAAY,IAAI,cAAc,OAAO;EAC1C,OAAO;CACR;;;;;;CAOA,gBAAgB,cAA+B;EAC9C,IAAI,KAAK,YAAY,IAAI,YAAY,GAAG,OAAO;EAE/C,KAAK,YAAY,IAAI,cAAc,OAAO;EAC1C,OAAO;CACR;;CAGA,QAAc;EACb,KAAK,YAAY,MAAM;CACxB;;CAGA,IAAI,QAAiB;EACpB,OAAO,KAAK,YAAY,SAAS;CAClC;AACD"}

package/dist/plus/integrations/collectionMetadata.d.ts

@@ -1,7 +1,8 @@
-import type { CollectionMetadata, CollectionScopeFailure } from '@gitkraken/provider-apis';
-import type { TokenWithInfo } from './authentication/models.js';
-import type { IntegrationIds } from './constants.js';
-import type { ProviderWarning } from './results.js';
+import { TokenWithInfo } from "./authentication/models.js";
+import { IntegrationIds } from "./constants.js";
+import { ProviderWarning } from "./results.js";
+import { CollectionMetadata, CollectionScopeFailure } from "@gitkraken/provider-apis";
+//#region ../plus/integrations/src/collectionMetadata.d.ts
 /**
  * Re-throws an error that is a fact about the CALL rather than about one scope of a fan-out.
  *
@@ -41,9 +42,9 @@ export declare function toCollectionFailureError(failure: CollectionScopeFailure
 export declare function isIncompleteCollection(metadata: CollectionMetadata | undefined): boolean;
 /** Converts internal SDK collection metadata into neutral provider facade signals. */
 export declare function assessCollectionMetadata(providerId: IntegrationIds, domain: string | undefined, connectionId: string | undefined, metadata: CollectionMetadata | undefined): {
-    warnings: ProviderWarning[];
-    fetchFailed: boolean;
-    truncated: boolean;
+  warnings: ProviderWarning[];
+  fetchFailed: boolean;
+  truncated: boolean;
 };
 /**
  * Appends neutral warnings derived from SDK metadata and returns its failure/truncation assessment.
@@ -60,8 +61,9 @@ export declare function assessCollectionMetadata(providerId: IntegrationIds, dom
  * that explains everything. Gating on it would restate exactly the case this field exists to keep quiet.
  */
 export declare function mergeAssessmentInto(warnings: ProviderWarning[], providerId: IntegrationIds, domain: string | undefined, connectionId: string | undefined, metadata: CollectionMetadata | undefined): {
-    fetchFailed: boolean;
-    truncated: boolean;
-    reported: boolean;
+  fetchFailed: boolean;
+  truncated: boolean;
+  reported: boolean;
 };
+//#endregion
 //# sourceMappingURL=collectionMetadata.d.ts.map