@gitkraken/core-gitlens 0.6.0 → 0.7.1

package/dist/plus/integrations/authentication/cloudIntegrationService.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloudIntegrationService.js","sourceRoot":"","sources":["../../../../src/plus/integrations/authentication/cloudIntegrationService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAQlE,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AA4BrD;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,MAAc;IACvC,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,GAAG,CAAC,CAAC,mCAAmC;QAC7C,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,CAAC;QACT,KAAK,GAAG;YACP,OAAO,IAAI,CAAC;QACb;YACC,OAAO,KAAK,CAAC;IACf,CAAC;AACF,CAAC;AAED,SAAS,SAAS,CAAC,IAAqB;IACvC,mGAAmG;IACnG,OAAO;QACN,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,EAAE,EAAE,IAAI,CAAC,OAAO;QAChB,MAAM,EAAE,IAAI,CAAC,MAAM;KACnB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,uBAAuB;IACN,GAAG;IAAhC,YAA6B,GAA8B;mBAA9B,GAAG;IAA8B,CAAC;IAE/D,KAAK,CAAC,cAAc;QACnB,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAEhC,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,KAAK,GAAI,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAyB,EAAE,KAAK,CAAC;YAC1E,MAAM,YAAY,GACjB,OAAO,KAAK,KAAK,QAAQ;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,CAAE,KAA8B,EAAE,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;YAC1E,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBACnB,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,iDAAiD,YAAY,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;YACtF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAI,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAwB,EAAE,IAEtD,CAAC;QACb,6FAA6F;QAC7F,qDAAqD;QACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAE3C,6FAA6F;QAC7F,yFAAyF;QACzF,MAAM,WAAW,GAAiC,EAAE,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,IAAI,CAAC,OAAO;gBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,IAAI,CAAC,WAAW;aAC7B,CAAC,CAAC;YACH,kGAAkG;YAClG,8EAA8E;YAC9E,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACjF,WAAW,CAAC,IAAI,CAAC;oBAChB,EAAE,EAAE,SAAS,CAAC,OAAO;oBACrB,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,QAAQ,EAAE,SAAS,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;oBAC7C,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;oBACvC,OAAO,EAAE,KAAK;oBACd,WAAW,EAAE,SAAS,CAAC,WAAW;iBAClC,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,OAAO,WAAW,CAAC;IACpB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CACzB,EAAkB,EAClB,YAAqB,EACrB,YAAqB;QAErB,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAEhC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QACtC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,oBAAoB,IAAI,IAAI,EAAE,CAAC;YAClC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,uCAAuC,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,cAAc,GAAG,YAAY;YAClC,CAAC,CAAC;gBACA,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACpB,YAAY,EAAE,YAAY;iBAC1B,CAAC;aACF;YACF,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAErB,gGAAgG;QAChG,mGAAmG;QACnG,yFAAyF;QACzF,MAAM,IAAI,GAAG,YAAY;YACxB,CAAC,CAAC,6BAA6B,kBAAkB,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7F,CAAC,CAAC,sBAAsB,oBAAoB,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,EAAE,KAAK,CAAC;YACtE,MAAM,YAAY,GACjB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA8B,EAAE,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvG,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBACnB,KAAK,EAAE,KAAK,CACX,SAAS,EACT,aAAa,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,sBAAsB,YAAY,EAAE,CAClF,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,CAAC;gBACrD,EAAE,EAAE,EAAE;gBACN,IAAI,EAAE,QAAQ,CAAC,MAAM;gBACrB,UAAU,EAAE,OAAO;aACnB,CAAC,CAAC;YAEH,IAAI,OAAO,EAAE,CAAC;gBACb,6FAA6F;gBAC7F,yFAAyF;gBACzF,MAAM,UAAU,GAAG,YAAY;oBAC9B,CAAC,CAAC,6BAA6B,kBAAkB,CAAC,YAAY,CAAC,EAAE;oBACjE,CAAC,CAAC,sBAAsB,oBAAoB,EAAE,CAAC;gBAChD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrF,IAAI,WAAW,CAAC,EAAE,EAAE,CAAC;oBACpB,MAAM,IAAI,GAAI,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAgC,EAAE,IAAI,CAAC;oBAC9E,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnD,CAAC;gBAED,8FAA8F;gBAC9F,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,CAAC;oBACrD,EAAE,EAAE,EAAE;oBACN,IAAI,EAAE,WAAW,CAAC,MAAM;oBACxB,UAAU,EAAE,KAAK;iBACjB,CAAC,CAAC;gBAEH,IAAI,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC;oBAAE,OAAO,SAAS,CAAC;gBAE3D,MAAM,IAAI,KAAK,CAAC,sBAAsB,WAAW,CAAC,MAAM,gBAAgB,EAAE,mBAAmB,CAAC,CAAC;YAChG,CAAC;YAED,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;YAExD,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,IAAI,GAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgC,EAAE,IAAI,CAAC;QAC3E,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAkB;QAClC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAEhC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,oBAAoB,IAAI,IAAI,EAAE,CAAC;YAClC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,uCAAuC,EAAE,EAAE,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,sBAAsB,oBAAoB,EAAE,EAAE;YAChG,MAAM,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,EAAE,KAAK,CAAC;YACtE,MAAM,YAAY,GACjB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA8B,EAAE,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvG,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBACnB,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,wBAAwB,EAAE,sBAAsB,YAAY,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC;gBAChD,EAAE,EAAE,EAAE;gBACN,IAAI,EAAE,QAAQ,CAAC,MAAM;aACrB,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CAAC,EAAkB,EAAE,YAAoB;QAClE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CACjD,6BAA6B,kBAAkB,CAAC,YAAY,CAAC,EAAE,EAC/D,EAAE,MAAM,EAAE,QAAQ,EAAE,CACpB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,EAAE,KAAK,CAAC;YACtE,MAAM,YAAY,GACjB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA8B,EAAE,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvG,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBACnB,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,oCAAoC,YAAY,SAAS,EAAE,KAAK,YAAY,EAAE,CAAC,CAAC;YACzG,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,OAAO,KAAK,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CAAC,EAAkB,EAAE,YAAoB;QAClE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CACjD,6BAA6B,kBAAkB,CAAC,YAAY,CAAC,UAAU,EACvE,EAAE,MAAM,EAAE,MAAM,EAAE,CAClB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,KAAK,GAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,EAAE,KAAK,CAAC;YACtE,MAAM,YAAY,GACjB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAA8B,EAAE,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvG,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;gBACnB,KAAK,EAAE,KAAK,CACX,SAAS,EACT,qCAAqC,YAAY,SAAS,EAAE,KAAK,YAAY,EAAE,CAC/E,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;CACD"}
+{"version":3,"file":"cloudIntegrationService.js","names":[],"sources":["../../../../../plus/integrations/src/authentication/cloudIntegrationService.ts"],"sourcesContent":["import { getScopedLogger } from '@gitlens/utils/logger.scoped.js';\nimport type { IntegrationIds } from '../constants.js';\nimport type { IntegrationServiceContext } from '../context.js';\nimport type {\n\tCloudIntegrationAuthenticationSession,\n\tCloudIntegrationConnection,\n\tCloudIntegrationType,\n} from './models.js';\nimport { toCloudIntegrationType } from './models.js';\n\n/**\n * Wire shape of a `v1/provider-tokens` connection descriptor. The list endpoint returns one such\n * entry per provider as the primary, with additional accounts nested under `secondaries`. Field casing\n * is the backend's (camelCase, `tokenId`).\n */\ninterface GKProviderTokenData {\n\ttokenId: string;\n\tprovider: CloudIntegrationType;\n\ttype: CloudIntegrationAuthenticationSession['type'];\n\tdomain: string;\n\t/** Human-readable account handle; the backend includes it on the connection when available. */\n\taccountName?: string;\n}\n\n/** Wire shape of a single `v1/provider-tokens/...` token response (`data`). */\ninterface GKProviderToken {\n\ttokenId?: string;\n\tisPrimary?: boolean;\n\taccessToken: string;\n\tappKey?: string;\n\texpiresIn: number;\n\tscopes: string;\n\ttype: CloudIntegrationAuthenticationSession['type'];\n\tdomain?: string;\n}\n\n/**\n * Whether the backend definitively answered that this connection has no fetchable token, so it can be\n * cleanly disconnected (#5497). Everything else is retryable — notably 401/403, which reject our GK\n * *account* token rather than the connection. The asymmetry is deliberate: a wrongly-kept descriptor\n * self-corrects on the next sync, a wrongly-dropped one needs a manual reconnect (#5569).\n */\nfunction isTerminalStatus(status: number): boolean {\n\tswitch (status) {\n\t\tcase 400: // e.g. a non-uuid token id (#5497)\n\t\tcase 404:\n\t\tcase 410:\n\t\tcase 422:\n\t\t\treturn true;\n\t\tdefault:\n\t\t\treturn false;\n\t}\n}\n\nfunction toSession(data: GKProviderToken): CloudIntegrationAuthenticationSession {\n\t// Normalize the backend's `tokenId` onto our `id` so callers get a stable per-connection identity.\n\treturn {\n\t\ttype: data.type,\n\t\taccessToken: data.accessToken,\n\t\tdomain: data.domain ?? '',\n\t\texpiresIn: data.expiresIn,\n\t\tscopes: data.scopes,\n\t\tid: data.tokenId,\n\t\tappKey: data.appKey,\n\t};\n}\n\nexport class CloudIntegrationService {\n\tconstructor(private readonly ctx: IntegrationServiceContext) {}\n\n\tasync getConnections(): Promise<CloudIntegrationConnection[] | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\tconst providersRsp = await this.ctx.account.fetchGkApi('v1/provider-tokens', { method: 'GET' });\n\t\tif (!providersRsp.ok) {\n\t\t\tconst error = ((await providersRsp.json()) as { error?: unknown })?.error;\n\t\t\tconst errorMessage =\n\t\t\t\ttypeof error === 'string'\n\t\t\t\t\t? error\n\t\t\t\t\t: ((error as { message?: string })?.message ?? providersRsp.statusText);\n\t\t\tif (error != null) {\n\t\t\t\tscope?.error(undefined, `Failed to get connected providers from cloud: ${errorMessage}`);\n\t\t\t}\n\t\t\tthis.ctx.hooks?.connection?.onConnectionsFetchFailed?.({ code: providersRsp.status });\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst data = ((await providersRsp.json()) as { data?: unknown })?.data as\n\t\t\t| (GKProviderTokenData & { secondaries?: GKProviderTokenData[] })[]\n\t\t\t| undefined;\n\t\t// A non-array `data` (unexpected backend shape) would throw on iteration below and abort the\n\t\t// whole cloud-sync path, so bail gracefully instead.\n\t\tif (!Array.isArray(data)) return undefined;\n\n\t\t// Flatten the primary + `secondaries[]` grouping into one connection per account. Primacy is\n\t\t// positional on the wire (top-level entry = primary), so we set the `primary` flag here.\n\t\tconst connections: CloudIntegrationConnection[] = [];\n\t\tfor (const item of data) {\n\t\t\tconnections.push({\n\t\t\t\tid: item.tokenId,\n\t\t\t\ttype: item.type,\n\t\t\t\tprovider: item.provider,\n\t\t\t\tdomain: item.domain,\n\t\t\t\tprimary: true,\n\t\t\t\taccountName: item.accountName,\n\t\t\t});\n\t\t\t// `secondaries` comes from the same unknown payload as `data`; guard against a non-array shape so\n\t\t\t// an unexpected value doesn't throw here and abort the whole cloud-sync path.\n\t\t\tfor (const secondary of Array.isArray(item.secondaries) ? item.secondaries : []) {\n\t\t\t\tconnections.push({\n\t\t\t\t\tid: secondary.tokenId,\n\t\t\t\t\ttype: secondary.type,\n\t\t\t\t\tprovider: secondary.provider ?? item.provider,\n\t\t\t\t\tdomain: secondary.domain || item.domain,\n\t\t\t\t\tprimary: false,\n\t\t\t\t\taccountName: secondary.accountName,\n\t\t\t\t});\n\t\t\t}\n\t\t}\n\n\t\treturn connections;\n\t}\n\n\t/**\n\t * Fetches a connection's token, refreshing it first when `refreshToken` is given; `connectionId` targets\n\t * a specific connection (multi-account) rather than the provider's primary.\n\t *\n\t * Resolves `undefined` ONLY on a terminal failure (see {@link isTerminalStatus}, or an ok response with\n\t * no `data`), which callers may treat as \"the connection is gone\" (#5497). THROWS on every other\n\t * failure, which they must catch and treat as retryable instead of disconnecting (#5569).\n\t */\n\tasync getConnectionSession(\n\t\tid: IntegrationIds,\n\t\trefreshToken?: string,\n\t\tconnectionId?: string,\n\t): Promise<CloudIntegrationAuthenticationSession | undefined> {\n\t\tconst scope = getScopedLogger();\n\n\t\tconst refresh = Boolean(refreshToken);\n\t\tconst cloudIntegrationType = toCloudIntegrationType[id];\n\t\tif (cloudIntegrationType == null) {\n\t\t\tscope?.error(undefined, `Unsupported cloud integration type: ${id}`);\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst reqInitOptions = refreshToken\n\t\t\t? {\n\t\t\t\t\tmethod: 'POST',\n\t\t\t\t\tbody: JSON.stringify({\n\t\t\t\t\t\taccess_token: refreshToken,\n\t\t\t\t\t}),\n\t\t\t\t}\n\t\t\t: { method: 'GET' };\n\n\t\t// A specific connection (multi-account) is addressed by its token id under `/tokens/{tokenId}`,\n\t\t// including refresh (`/tokens/{tokenId}/refresh`). The provider-scoped endpoints only ever operate\n\t\t// on the provider's PRIMARY connection, so they must NOT be used to refresh a secondary.\n\t\tconst path = connectionId\n\t\t\t? `v1/provider-tokens/tokens/${encodeURIComponent(connectionId)}${refresh ? '/refresh' : ''}`\n\t\t\t: `v1/provider-tokens/${cloudIntegrationType}${refresh ? '/refresh' : ''}`;\n\t\tconst tokenRsp = await this.ctx.account.fetchGkApi(path, reqInitOptions);\n\t\tif (!tokenRsp.ok) {\n\t\t\tconst error = ((await tokenRsp.json()) as { error?: unknown })?.error;\n\t\t\tconst errorMessage =\n\t\t\t\ttypeof error === 'string' ? error : ((error as { message?: string })?.message ?? tokenRsp.statusText);\n\t\t\tif (error != null) {\n\t\t\t\tscope?.error(\n\t\t\t\t\tundefined,\n\t\t\t\t\t`Failed to ${refresh ? 'refresh' : 'get'} ${id} token from cloud: ${errorMessage}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tthis.ctx.hooks?.connection?.onConnectionFetchFailed?.({\n\t\t\t\tid: id,\n\t\t\t\tcode: tokenRsp.status,\n\t\t\t\trefreshing: refresh,\n\t\t\t});\n\n\t\t\tif (refresh) {\n\t\t\t\t// try once to just get the latest token if the refresh fails, and give up if that fails too;\n\t\t\t\t// stay scoped to the same connection (by token id) so we don't fall back to the primary.\n\t\t\t\tconst latestPath = connectionId\n\t\t\t\t\t? `v1/provider-tokens/tokens/${encodeURIComponent(connectionId)}`\n\t\t\t\t\t: `v1/provider-tokens/${cloudIntegrationType}`;\n\t\t\t\tconst newTokenRsp = await this.ctx.account.fetchGkApi(latestPath, { method: 'GET' });\n\t\t\t\tif (newTokenRsp.ok) {\n\t\t\t\t\tconst data = ((await newTokenRsp.json()) as { data?: GKProviderToken })?.data;\n\t\t\t\t\treturn data != null ? toSession(data) : undefined;\n\t\t\t\t}\n\n\t\t\t\t// Report the fallback's own status (as a get, not a refresh) — it's what decides the outcome.\n\t\t\t\tthis.ctx.hooks?.connection?.onConnectionFetchFailed?.({\n\t\t\t\t\tid: id,\n\t\t\t\t\tcode: newTokenRsp.status,\n\t\t\t\t\trefreshing: false,\n\t\t\t\t});\n\n\t\t\t\tif (isTerminalStatus(newTokenRsp.status)) return undefined;\n\n\t\t\t\tthrow new Error(`Retryable failure (${newTokenRsp.status}) refreshing ${id} token from cloud`);\n\t\t\t}\n\n\t\t\tif (isTerminalStatus(tokenRsp.status)) return undefined;\n\n\t\t\tthrow new Error(`Retryable failure (${tokenRsp.status}) getting ${id} token from cloud`);\n\t\t}\n\n\t\tconst data = ((await tokenRsp.json()) as { data?: GKProviderToken })?.data;\n\t\treturn data != null ? toSession(data) : undefined;\n\t}\n\n\tasync disconnect(id: IntegrationIds): Promise<boolean> {\n\t\tconst scope = getScopedLogger();\n\n\t\tconst cloudIntegrationType = toCloudIntegrationType[id];\n\t\tif (cloudIntegrationType == null) {\n\t\t\tscope?.error(undefined, `Unsupported cloud integration type: ${id}`);\n\t\t\treturn false;\n\t\t}\n\n\t\tconst tokenRsp = await this.ctx.account.fetchGkApi(`v1/provider-tokens/${cloudIntegrationType}`, {\n\t\t\tmethod: 'DELETE',\n\t\t});\n\t\tif (!tokenRsp.ok) {\n\t\t\tconst error = ((await tokenRsp.json()) as { error?: unknown })?.error;\n\t\t\tconst errorMessage =\n\t\t\t\ttypeof error === 'string' ? error : ((error as { message?: string })?.message ?? tokenRsp.statusText);\n\t\t\tif (error != null) {\n\t\t\t\tscope?.error(undefined, `Failed to disconnect ${id} token from cloud: ${errorMessage}`);\n\t\t\t}\n\t\t\tthis.ctx.hooks?.connection?.onDisconnectFailed?.({\n\t\t\t\tid: id,\n\t\t\t\tcode: tokenRsp.status,\n\t\t\t});\n\t\t\treturn false;\n\t\t}\n\n\t\treturn true;\n\t}\n\n\t/**\n\t * Disconnects a single connection by its token id (multi-account). The backend promotes a secondary\n\t * to primary when the removed connection was the primary, so the provider stays connected if others\n\t * remain. Returns whether the delete succeeded.\n\t */\n\tasync disconnectConnection(id: IntegrationIds, connectionId: string): Promise<boolean> {\n\t\tconst scope = getScopedLogger();\n\n\t\tconst tokenRsp = await this.ctx.account.fetchGkApi(\n\t\t\t`v1/provider-tokens/tokens/${encodeURIComponent(connectionId)}`,\n\t\t\t{ method: 'DELETE' },\n\t\t);\n\t\tif (!tokenRsp.ok) {\n\t\t\tconst error = ((await tokenRsp.json()) as { error?: unknown })?.error;\n\t\t\tconst errorMessage =\n\t\t\t\ttypeof error === 'string' ? error : ((error as { message?: string })?.message ?? tokenRsp.statusText);\n\t\t\tif (error != null) {\n\t\t\t\tscope?.error(undefined, `Failed to disconnect connection '${connectionId}' for ${id}: ${errorMessage}`);\n\t\t\t}\n\t\t\tthis.ctx.hooks?.connection?.onDisconnectFailed?.({ id: id, code: tokenRsp.status });\n\t\t\treturn false;\n\t\t}\n\n\t\treturn true;\n\t}\n\n\t/**\n\t * Promotes a connection to primary by its token id (multi-account), clearing primacy on the provider's\n\t * other connections server-side. Returns whether the switch succeeded.\n\t */\n\tasync setPrimaryConnection(id: IntegrationIds, connectionId: string): Promise<boolean> {\n\t\tconst scope = getScopedLogger();\n\n\t\tconst tokenRsp = await this.ctx.account.fetchGkApi(\n\t\t\t`v1/provider-tokens/tokens/${encodeURIComponent(connectionId)}/primary`,\n\t\t\t{ method: 'POST' },\n\t\t);\n\t\tif (!tokenRsp.ok) {\n\t\t\tconst error = ((await tokenRsp.json()) as { error?: unknown })?.error;\n\t\t\tconst errorMessage =\n\t\t\t\ttypeof error === 'string' ? error : ((error as { message?: string })?.message ?? tokenRsp.statusText);\n\t\t\tif (error != null) {\n\t\t\t\tscope?.error(\n\t\t\t\t\tundefined,\n\t\t\t\t\t`Failed to set primary connection '${connectionId}' for ${id}: ${errorMessage}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn false;\n\t\t}\n\n\t\treturn true;\n\t}\n}\n"],"mappings":";;;;;;;;;AA0CA,SAAS,iBAAiB,QAAyB;CAClD,QAAQ,QAAR;EACC,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,KACJ,OAAO;EACR,SACC,OAAO;CACT;AACD;AAEA,SAAS,UAAU,MAA8D;CAEhF,OAAO;EACN,MAAM,KAAK;EACX,aAAa,KAAK;EAClB,QAAQ,KAAK,UAAU;EACvB,WAAW,KAAK;EAChB,QAAQ,KAAK;EACb,IAAI,KAAK;EACT,QAAQ,KAAK;CACd;AACD;AAEA,IAAa,0BAAb,MAAqC;CACP;CAA7B,YAAY,KAAiD;EAAhC,KAAA,MAAA;CAAiC;CAE9D,MAAM,iBAAoE;EACzE,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,eAAe,MAAM,KAAK,IAAI,QAAQ,WAAW,sBAAsB,EAAE,QAAQ,MAAM,CAAC;EAC9F,IAAI,CAAC,aAAa,IAAI;GACrB,MAAM,SAAU,MAAM,aAAa,KAAK,EAAA,EAA4B;GACpE,MAAM,eACL,OAAO,UAAU,WACd,QACE,OAAgC,WAAW,aAAa;GAC9D,IAAI,SAAS,MACZ,OAAO,MAAM,KAAA,GAAW,iDAAiD,cAAc;GAExF,KAAK,IAAI,OAAO,YAAY,2BAA2B,EAAE,MAAM,aAAa,OAAO,CAAC;GACpF;EACD;EAEA,MAAM,QAAS,MAAM,aAAa,KAAK,EAAA,EAA2B;EAKlE,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG,OAAO,KAAA;EAIjC,MAAM,cAA4C,CAAC;EACnD,KAAK,MAAM,QAAQ,MAAM;GACxB,YAAY,KAAK;IAChB,IAAI,KAAK;IACT,MAAM,KAAK;IACX,UAAU,KAAK;IACf,QAAQ,KAAK;IACb,SAAS;IACT,aAAa,KAAK;GACnB,CAAC;GAGD,KAAK,MAAM,aAAa,MAAM,QAAQ,KAAK,WAAW,IAAI,KAAK,cAAc,CAAC,GAC7E,YAAY,KAAK;IAChB,IAAI,UAAU;IACd,MAAM,UAAU;IAChB,UAAU,UAAU,YAAY,KAAK;IACrC,QAAQ,UAAU,UAAU,KAAK;IACjC,SAAS;IACT,aAAa,UAAU;GACxB,CAAC;EAEH;EAEA,OAAO;CACR;;;;;;;;;CAUA,MAAM,qBACL,IACA,cACA,cAC6D;EAC7D,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,UAAU,QAAQ,YAAY;EACpC,MAAM,uBAAuB,uBAAuB;EACpD,IAAI,wBAAwB,MAAM;GACjC,OAAO,MAAM,KAAA,GAAW,uCAAuC,IAAI;GACnE;EACD;EAEA,MAAM,iBAAiB,eACpB;GACA,QAAQ;GACR,MAAM,KAAK,UAAU,EACpB,cAAc,aACf,CAAC;EACF,IACC,EAAE,QAAQ,MAAM;EAKnB,MAAM,OAAO,eACV,6BAA6B,mBAAmB,YAAY,IAAI,UAAU,aAAa,OACvF,sBAAsB,uBAAuB,UAAU,aAAa;EACvE,MAAM,WAAW,MAAM,KAAK,IAAI,QAAQ,WAAW,MAAM,cAAc;EACvE,IAAI,CAAC,SAAS,IAAI;GACjB,MAAM,SAAU,MAAM,SAAS,KAAK,EAAA,EAA4B;GAChE,MAAM,eACL,OAAO,UAAU,WAAW,QAAU,OAAgC,WAAW,SAAS;GAC3F,IAAI,SAAS,MACZ,OAAO,MACN,KAAA,GACA,aAAa,UAAU,YAAY,MAAM,GAAG,GAAG,qBAAqB,cACrE;GAED,KAAK,IAAI,OAAO,YAAY,0BAA0B;IACjD;IACJ,MAAM,SAAS;IACf,YAAY;GACb,CAAC;GAED,IAAI,SAAS;IAGZ,MAAM,aAAa,eAChB,6BAA6B,mBAAmB,YAAY,MAC5D,sBAAsB;IACzB,MAAM,cAAc,MAAM,KAAK,IAAI,QAAQ,WAAW,YAAY,EAAE,QAAQ,MAAM,CAAC;IACnF,IAAI,YAAY,IAAI;KACnB,MAAM,QAAS,MAAM,YAAY,KAAK,EAAA,EAAmC;KACzE,OAAO,QAAQ,OAAO,UAAU,IAAI,IAAI,KAAA;IACzC;IAGA,KAAK,IAAI,OAAO,YAAY,0BAA0B;KACjD;KACJ,MAAM,YAAY;KAClB,YAAY;IACb,CAAC;IAED,IAAI,iBAAiB,YAAY,MAAM,GAAG,OAAO,KAAA;IAEjD,MAAM,IAAI,MAAM,sBAAsB,YAAY,OAAO,eAAe,GAAG,kBAAkB;GAC9F;GAEA,IAAI,iBAAiB,SAAS,MAAM,GAAG,OAAO,KAAA;GAE9C,MAAM,IAAI,MAAM,sBAAsB,SAAS,OAAO,YAAY,GAAG,kBAAkB;EACxF;EAEA,MAAM,QAAS,MAAM,SAAS,KAAK,EAAA,EAAmC;EACtE,OAAO,QAAQ,OAAO,UAAU,IAAI,IAAI,KAAA;CACzC;CAEA,MAAM,WAAW,IAAsC;EACtD,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,uBAAuB,uBAAuB;EACpD,IAAI,wBAAwB,MAAM;GACjC,OAAO,MAAM,KAAA,GAAW,uCAAuC,IAAI;GACnE,OAAO;EACR;EAEA,MAAM,WAAW,MAAM,KAAK,IAAI,QAAQ,WAAW,sBAAsB,wBAAwB,EAChG,QAAQ,SACT,CAAC;EACD,IAAI,CAAC,SAAS,IAAI;GACjB,MAAM,SAAU,MAAM,SAAS,KAAK,EAAA,EAA4B;GAChE,MAAM,eACL,OAAO,UAAU,WAAW,QAAU,OAAgC,WAAW,SAAS;GAC3F,IAAI,SAAS,MACZ,OAAO,MAAM,KAAA,GAAW,wBAAwB,GAAG,qBAAqB,cAAc;GAEvF,KAAK,IAAI,OAAO,YAAY,qBAAqB;IAC5C;IACJ,MAAM,SAAS;GAChB,CAAC;GACD,OAAO;EACR;EAEA,OAAO;CACR;;;;;;CAOA,MAAM,qBAAqB,IAAoB,cAAwC;EACtF,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,WAAW,MAAM,KAAK,IAAI,QAAQ,WACvC,6BAA6B,mBAAmB,YAAY,KAC5D,EAAE,QAAQ,SAAS,CACpB;EACA,IAAI,CAAC,SAAS,IAAI;GACjB,MAAM,SAAU,MAAM,SAAS,KAAK,EAAA,EAA4B;GAChE,MAAM,eACL,OAAO,UAAU,WAAW,QAAU,OAAgC,WAAW,SAAS;GAC3F,IAAI,SAAS,MACZ,OAAO,MAAM,KAAA,GAAW,oCAAoC,aAAa,QAAQ,GAAG,IAAI,cAAc;GAEvG,KAAK,IAAI,OAAO,YAAY,qBAAqB;IAAM;IAAI,MAAM,SAAS;GAAO,CAAC;GAClF,OAAO;EACR;EAEA,OAAO;CACR;;;;;CAMA,MAAM,qBAAqB,IAAoB,cAAwC;EACtF,MAAM,QAAQ,gBAAgB;EAE9B,MAAM,WAAW,MAAM,KAAK,IAAI,QAAQ,WACvC,6BAA6B,mBAAmB,YAAY,EAAE,WAC9D,EAAE,QAAQ,OAAO,CAClB;EACA,IAAI,CAAC,SAAS,IAAI;GACjB,MAAM,SAAU,MAAM,SAAS,KAAK,EAAA,EAA4B;GAChE,MAAM,eACL,OAAO,UAAU,WAAW,QAAU,OAAgC,WAAW,SAAS;GAC3F,IAAI,SAAS,MACZ,OAAO,MACN,KAAA,GACA,qCAAqC,aAAa,QAAQ,GAAG,IAAI,cAClE;GAED,OAAO;EACR;EAEA,OAAO;CACR;AACD"}

package/dist/plus/integrations/authentication/configuredIntegrationService.d.ts

@@ -1,115 +1,134 @@
-import type { Disposable } from '../../../utils/disposable.js';
-import type { Event } from '../../../utils/event.js';
-import type { IntegrationIds } from '../constants.js';
-import type { IntegrationServiceContext } from '../context.js';
-import type { IntegrationAuthenticationSessionDescriptor } from './integrationAuthenticationProvider.js';
-import type { CloudIntegrationAuthType, ConfiguredIntegrationDescriptor, ProviderAuthenticationSession } from './models.js';
+import { Disposable } from "../../../utils/disposable.js";
+import { Event } from "../../../utils/event.js";
+import { CloudIntegrationAuthType, ConfiguredIntegrationDescriptor, ProviderAuthenticationSession } from "./models.js";
+import { IntegrationIds } from "../constants.js";
+import { IntegrationAuthenticationSessionDescriptor } from "./integrationAuthenticationProvider.js";
+import { IntegrationServiceContext } from "../context.js";
+//#region ../plus/integrations/src/authentication/configuredIntegrationService.d.ts
 interface StoredSession {
+  id: string;
+  accessToken: string;
+  account?: {
+    label?: string;
+    displayName?: string;
     id: string;
-    accessToken: string;
-    account?: {
-        label?: string;
-        displayName?: string;
-        id: string;
-    };
-    scopes: string[];
-    cloud?: boolean;
-    type: CloudIntegrationAuthType | undefined;
-    expiresAt?: string;
-    domain?: string;
-    protocol?: string;
-    /** The provider app key paired with the token for providers whose client needs one (e.g. Trello). */
-    appKey?: string;
+  };
+  scopes: string[];
+  cloud?: boolean;
+  type: CloudIntegrationAuthType | undefined;
+  expiresAt?: string;
+  domain?: string;
+  /** See {@link ProviderAuthenticationSession.baseUrl}: the configured address, path included. */
+  baseUrl?: string;
+  protocol?: string;
+  /** The provider app key paired with the token for providers whose client needs one (e.g. Trello). */
+  appKey?: string;
 }
 export interface ConfiguredIntegrationsChangeEvent {
-    readonly added: readonly IntegrationIds[];
-    readonly removed: readonly IntegrationIds[];
+  readonly added: readonly IntegrationIds[];
+  readonly removed: readonly IntegrationIds[];
 }
 export declare class ConfiguredIntegrationService implements Disposable {
-    private readonly ctx;
-    private readonly _onDidChange;
-    private storeConfiguredQueue;
-    get onDidChange(): Event<ConfiguredIntegrationsChangeEvent>;
-    constructor(ctx: IntegrationServiceContext);
-    dispose(): void;
-    private _configured?;
-    private get configured();
-    getConfigured(id?: IntegrationIds, options?: {
-        cloud?: boolean;
-        domain?: string;
-    }): ConfiguredIntegrationDescriptor[];
-    private storeConfigured;
-    private addOrUpdateConfigured;
-    private removeConfigured;
-    storeSession(id: IntegrationIds, session: ProviderAuthenticationSession): Promise<void>;
-    getStoredSession(id: IntegrationIds, descriptor: IntegrationAuthenticationSessionDescriptor): Promise<ProviderAuthenticationSession | undefined>;
-    deleteStoredSessions(id: IntegrationIds, descriptor: IntegrationAuthenticationSessionDescriptor, cloud?: boolean, options?: {
-        preserveConfigured?: boolean;
-    }): Promise<void>;
-    deleteAllStoredSessions(id: IntegrationIds, cloud?: boolean, domain?: string): Promise<void>;
-    /**
-     * Reclaims all stored configuration + secrets for the given (typically retired) integration ids.
-     * Used to clean up state left behind when an id is removed from the model — e.g. the local
-     * self-managed `github-enterprise`/`gitlab-self-hosted` ids dropped when integrations went cloud-only.
-     * Domains are read from the stored config (secrets are keyed by domain); ids with no stored config
-     * are a no-op.
-     */
-    purgeStoredConfiguration(ids: readonly string[]): Promise<void>;
-    deleteSecrets(id: IntegrationIds, connectionId: string, cloud?: boolean, options?: {
-        preserveConfigured?: boolean;
-    }): Promise<void>;
-    deleteAllSecrets(id: IntegrationIds, cloud?: boolean, domain?: string): Promise<void>;
-    writeSecret(id: IntegrationIds, session: ProviderAuthenticationSession | StoredSession): Promise<void>;
-    readSecret(id: IntegrationIds, sessionId: string, cloud?: boolean): Promise<StoredSession | undefined>;
-    private getSecretKey;
-    private getLocalSecretKey;
-    private getCloudSecretKey;
-    private getPrimaryScope;
-    private isInPrimaryScope;
-    /**
-     * Resolves the connection id used as the secret-key session id for an auth descriptor.
-     * - If the descriptor targets a specific connection (`connectionId`), that wins.
-     * - Otherwise returns the primary connection's id for the provider (matching the descriptor's domain
-     *   for self-managed hosts; any connection for cloud hosts, where the stored domain is undefined).
-     * - Falls back to the descriptor domain when nothing is configured yet, preserving legacy
-     *   (pre-multi-account) reads with zero secret migration.
-     */
-    resolveConnectionId(id: IntegrationIds, descriptor: IntegrationAuthenticationSessionDescriptor): string;
-    /**
-     * Returns the id of the configured connection an unscoped descriptor resolves to (the primary for the
-     * descriptor's domain, matching {@link resolveConnectionId}'s selection), or `undefined` when nothing is
-     * configured for it. Unlike {@link resolveConnectionId} this only returns a genuine per-connection cloud
-     * token id (never a local/PAT or domain-derived legacy id), so callers can safely use it to scope a cloud
-     * token fetch to one host of a multi-host self-managed provider, or fall through to the provider-global
-     * primary endpoint on `undefined`.
-     */
-    getConfiguredConnectionId(id: IntegrationIds, domain: string | undefined, cloud?: boolean): string | undefined;
-    /**
-     * Selects configured descriptors for a provider matching `domain`, further narrowed to the `cloud`
-     * variant when specified. A connection id can have both a local (PAT) and cloud descriptor whose ids
-     * differ (e.g. a legacy local descriptor keyed by domain alongside a real cloud token id); scoping by
-     * `cloud` keeps a cloud-scoped read/delete from resolving the local id (and vice versa). Falls back to
-     * the domain-only set when no variant matches, so legacy single-variant resolution is unchanged.
-     */
-    private scopeConnectionCandidates;
-    /**
-     * Marks the given connection as the primary/default for the provider and clears the flag on its
-     * siblings. Persists immediately instead of relying on a session re-store to carry the primary flag.
-     */
-    setPrimaryConnection(id: IntegrationIds, connectionId: string): Promise<void>;
-    /**
-     * Removes a single connection (its secret + configured descriptor). If it was the primary and other
-     * connections remain, a secondary is promoted (see {@link removeConfigured}). Unlike
-     * {@link deleteAllStoredSessions}, this only affects the targeted connection. Pass `cloud` to scope
-     * the removal to the cloud/local variant when a local PAT and a cloud session share a connection id.
-     */
-    deleteConnection(id: IntegrationIds, connectionId: string, cloud?: boolean): Promise<void>;
-    private _addedIds;
-    private _removedIds;
-    private _fireChangeDebounced?;
-    private normalizeConfiguredDomain;
-    private domainsMatch;
-    private fireChange;
+  private readonly ctx;
+  private readonly _onDidChange;
+  private storeConfiguredQueue;
+  get onDidChange(): Event<ConfiguredIntegrationsChangeEvent>;
+  constructor(ctx: IntegrationServiceContext);
+  dispose(): void;
+  private _configured?;
+  private get configured();
+  getConfigured(id?: IntegrationIds, options?: {
+    cloud?: boolean;
+    domain?: string;
+  }): ConfiguredIntegrationDescriptor[];
+  private storeConfigured;
+  private addOrUpdateConfigured;
+  private removeConfigured;
+  storeSession(id: IntegrationIds, session: ProviderAuthenticationSession): Promise<void>;
+  getStoredSession(id: IntegrationIds, descriptor: IntegrationAuthenticationSessionDescriptor): Promise<ProviderAuthenticationSession | undefined>;
+  deleteStoredSessions(id: IntegrationIds, descriptor: IntegrationAuthenticationSessionDescriptor, cloud?: boolean, options?: {
+    preserveConfigured?: boolean;
+  }): Promise<void>;
+  deleteAllStoredSessions(id: IntegrationIds, cloud?: boolean, domain?: string): Promise<void>;
+  /**
+   * Reclaims all stored configuration + secrets for the given (typically retired) integration ids.
+   * Used to clean up state left behind when an id is removed from the model — e.g. the local
+   * self-managed `github-enterprise`/`gitlab-self-hosted` ids dropped when integrations went cloud-only.
+   * Domains are read from the stored config (secrets are keyed by domain); ids with no stored config
+   * are a no-op.
+   */
+  purgeStoredConfiguration(ids: readonly string[]): Promise<void>;
+  deleteSecrets(id: IntegrationIds, connectionId: string, cloud?: boolean, options?: {
+    preserveConfigured?: boolean;
+  }): Promise<void>;
+  deleteAllSecrets(id: IntegrationIds, cloud?: boolean, domain?: string): Promise<void>;
+  writeSecret(id: IntegrationIds, session: ProviderAuthenticationSession | StoredSession): Promise<void>;
+  readSecret(id: IntegrationIds, sessionId: string, cloud?: boolean): Promise<StoredSession | undefined>;
+  private getSecretKey;
+  private getLocalSecretKey;
+  private getCloudSecretKey;
+  private getPrimaryScope;
+  private isInPrimaryScope;
+  /**
+   * Resolves the connection id used as the secret-key session id for an auth descriptor.
+   * - If the descriptor targets a specific connection (`connectionId`), that wins.
+   * - Otherwise returns the primary connection's id for the provider (matching the descriptor's domain
+   *   for self-managed hosts; any connection for cloud hosts, where the stored domain is undefined).
+   * - Falls back to the descriptor domain when nothing is configured yet, preserving legacy
+   *   (pre-multi-account) reads with zero secret migration.
+   */
+  resolveConnectionId(id: IntegrationIds, descriptor: IntegrationAuthenticationSessionDescriptor): string;
+  /**
+   * Returns the id of the configured connection an unscoped descriptor resolves to (the primary for the
+   * descriptor's domain, matching {@link resolveConnectionId}'s selection), or `undefined` when nothing is
+   * configured for it. Unlike {@link resolveConnectionId} this only returns a genuine per-connection cloud
+   * token id (never a local/PAT or domain-derived legacy id), so callers can safely use it to scope a cloud
+   * token fetch to one host of a multi-host self-managed provider, or fall through to the provider-global
+   * primary endpoint on `undefined`.
+   */
+  /**
+   * The address already stored for a self-managed connection — see {@link ConfiguredIntegrationDescriptor.baseUrl}.
+   *
+   * Exists so a session rebuilt from a backend response that omits the domain can keep the address the
+   * connection was configured with, rather than silently falling back to the bare host and losing a context
+   * path the user never changed. Looked up by connection id first, then by host for an unscoped fetch.
+   */
+  /**
+   * Whether `connectionId` names a cloud connection configured for `domain`'s host.
+   *
+   * The caller-facing question is "is this id evidence that a token belongs to this host". A connection id
+   * can arrive from a caller rather than from our own configuration, so it is only evidence once it matches
+   * a descriptor we stored for that host — see the host guard in `CloudIntegrationAuthenticationProvider`.
+   */
+  isConnectionConfiguredForHost(id: IntegrationIds, connectionId: string | undefined, domain: string | undefined): boolean;
+  getConfiguredBaseUrl(id: IntegrationIds, connectionId: string | undefined, domain?: string): string | undefined;
+  getConfiguredConnectionId(id: IntegrationIds, domain: string | undefined, cloud?: boolean): string | undefined;
+  /**
+   * Selects configured descriptors for a provider matching `domain`, further narrowed to the `cloud`
+   * variant when specified. A connection id can have both a local (PAT) and cloud descriptor whose ids
+   * differ (e.g. a legacy local descriptor keyed by domain alongside a real cloud token id); scoping by
+   * `cloud` keeps a cloud-scoped read/delete from resolving the local id (and vice versa). Falls back to
+   * the domain-only set when no variant matches, so legacy single-variant resolution is unchanged.
+   */
+  private scopeConnectionCandidates;
+  /**
+   * Marks the given connection as the primary/default for the provider and clears the flag on its
+   * siblings. Persists immediately instead of relying on a session re-store to carry the primary flag.
+   */
+  setPrimaryConnection(id: IntegrationIds, connectionId: string): Promise<void>;
+  /**
+   * Removes a single connection (its secret + configured descriptor). If it was the primary and other
+   * connections remain, a secondary is promoted (see {@link removeConfigured}). Unlike
+   * {@link deleteAllStoredSessions}, this only affects the targeted connection. Pass `cloud` to scope
+   * the removal to the cloud/local variant when a local PAT and a cloud session share a connection id.
+   */
+  deleteConnection(id: IntegrationIds, connectionId: string, cloud?: boolean): Promise<void>;
+  private _addedIds;
+  private _removedIds;
+  private _fireChangeDebounced?;
+  private normalizeConfiguredDomain;
+  private domainsMatch;
+  private fireChange;
 }
-export {};
+//#endregion
 //# sourceMappingURL=configuredIntegrationService.d.ts.map