@elnora-ai/linear 1.0.1 → 2.0.0

package/dist/utils/rate-limit.d.ts

@@ -0,0 +1,24 @@
+declare function isRateLimitError(error: unknown): boolean;
+/**
+ * Pull the retry delay (ms) out of a Linear SDK error.
+ *
+ * RatelimitedLinearError exposes `retryAfter` (seconds) directly — the SDK
+ * already parsed the retry-after header into a number. Earlier code tried to
+ * read `error.response.headers["retry-after"]`, but `headers` is a Fetch
+ * Headers object whose values are only readable via `.get()` — bracket access
+ * always returned undefined, so the wrapper silently fell back to the 60s
+ * default on every retry instead of honouring Linear's hint.
+ */
+declare function parseRetryAfter(error: unknown): number;
+/**
+ * Run fn, retry on 429 with Retry-After. Max 3 retries — after that the
+ * original error propagates.
+ */
+export declare function withRateLimit<T>(fn: () => Promise<T>): Promise<T>;
+export declare const _internal: {
+    isRateLimitError: typeof isRateLimitError;
+    parseRetryAfter: typeof parseRetryAfter;
+    MAX_RETRY_AFTER_MS: number;
+};
+export {};
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/utils/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/utils/rate-limit.ts"],"names":[],"mappings":"AAmBA,iBAAS,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAejD;AAED;;;;;;;;;GASG;AACH,iBAAS,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAI/C;AA2BD;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAgBvE;AAGD,eAAO,MAAM,SAAS;;;;CAA4D,CAAC"}

package/dist/utils/rate-limit.js

@@ -0,0 +1,89 @@
+// Rate-limit retry wrapper for Linear SDK calls.
+//
+// Linear returns rate-limit errors two ways depending on the surface:
+//   - GraphQL: HTTP 400 with errors[].extensions.code === "RATELIMITED"
+//     (current canonical signal — see https://linear.app/developers/rate-limiting)
+//   - Some paths: HTTP 429
+// The SDK normalises both into RatelimitedLinearError (errors[0].type ===
+// "ratelimited"), exposing retryAfter (seconds) parsed from the retry-after
+// header. We catch the SDK error, honour its retryAfter, and re-run the fn up
+// to MAX_RETRIES times.
+import { sleep } from "./sleep.js";
+const MAX_RETRIES = 3;
+const DEFAULT_RETRY_AFTER_MS = 60_000;
+// Cap so a hostile or buggy retry-after header can't stall the process for
+// hours. Linear's rate-limit windows reset in seconds-to-minutes.
+const MAX_RETRY_AFTER_MS = 60_000;
+function isRateLimitError(error) {
+    if (!error || typeof error !== "object")
+        return false;
+    const e = error;
+    return (e.name === "RatelimitedLinearError" ||
+        e.type === "Ratelimited" ||
+        e.type === "ratelimited" ||
+        e.status === 429 ||
+        e.response?.status === 429);
+}
+/**
+ * Pull the retry delay (ms) out of a Linear SDK error.
+ *
+ * RatelimitedLinearError exposes `retryAfter` (seconds) directly — the SDK
+ * already parsed the retry-after header into a number. Earlier code tried to
+ * read `error.response.headers["retry-after"]`, but `headers` is a Fetch
+ * Headers object whose values are only readable via `.get()` — bracket access
+ * always returned undefined, so the wrapper silently fell back to the 60s
+ * default on every retry instead of honouring Linear's hint.
+ */
+function parseRetryAfter(error) {
+    const raw = readRetryAfterMs(error);
+    const ms = raw ?? DEFAULT_RETRY_AFTER_MS;
+    return Math.min(ms, MAX_RETRY_AFTER_MS);
+}
+function readRetryAfterMs(error) {
+    if (!error || typeof error !== "object")
+        return null;
+    const e = error;
+    if (typeof e.retryAfter === "number" && e.retryAfter > 0) {
+        return e.retryAfter * 1000;
+    }
+    // Defensive fallback: also try to read the raw header in case a non-SDK
+    // caller wraps an error without the parsed retryAfter property.
+    const headers = e.response?.headers;
+    let rawHeader;
+    if (headers && typeof headers.get === "function") {
+        rawHeader = headers.get("retry-after");
+    }
+    else if (headers && typeof headers === "object") {
+        rawHeader = headers["retry-after"];
+    }
+    if (rawHeader) {
+        const seconds = parseInt(rawHeader, 10);
+        if (!Number.isNaN(seconds) && seconds > 0)
+            return seconds * 1000;
+    }
+    return null;
+}
+/**
+ * Run fn, retry on 429 with Retry-After. Max 3 retries — after that the
+ * original error propagates.
+ */
+export async function withRateLimit(fn) {
+    let lastError;
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            lastError = error;
+            if (!isRateLimitError(error) || attempt === MAX_RETRIES)
+                throw error;
+            const waitMs = parseRetryAfter(error);
+            process.stderr.write(`Linear API rate-limited: retrying in ${Math.ceil(waitMs / 1000)}s (attempt ${attempt + 1}/${MAX_RETRIES})...\n`);
+            await sleep(waitMs);
+        }
+    }
+    throw lastError;
+}
+// Exported for testing
+export const _internal = { isRateLimitError, parseRetryAfter, MAX_RETRY_AFTER_MS };
+//# sourceMappingURL=rate-limit.js.map

package/dist/utils/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/utils/rate-limit.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,mFAAmF;AACnF,2BAA2B;AAC3B,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,wBAAwB;AAExB,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,2EAA2E;AAC3E,kEAAkE;AAClE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,SAAS,gBAAgB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAKT,CAAC;IACF,OAAO,CACN,CAAC,CAAC,IAAI,KAAK,wBAAwB;QACnC,CAAC,CAAC,IAAI,KAAK,aAAa;QACxB,CAAC,CAAC,IAAI,KAAK,aAAa;QACxB,CAAC,CAAC,MAAM,KAAK,GAAG;QAChB,CAAC,CAAC,QAAQ,EAAE,MAAM,KAAK,GAAG,CAC1B,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,eAAe,CAAC,KAAc;IACtC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,EAAE,GAAG,GAAG,IAAI,sBAAsB,CAAC;IACzC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,KAGT,CAAC;IACF,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QAC1D,OAAO,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC;IAC5B,CAAC;IACD,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC;IACpC,IAAI,SAAoC,CAAC;IACzC,IAAI,OAAO,IAAI,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC/D,SAAS,GAAI,OAAmB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC;SAAM,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACnD,SAAS,GAAI,OAAkC,CAAC,aAAa,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;YAAE,OAAO,OAAO,GAAG,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,EAAoB;IAC1D,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC;YACJ,OAAO,MAAM,EAAE,EAAE,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,WAAW;gBAAE,MAAM,KAAK,CAAC;YACrE,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,wCAAwC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,cAAc,OAAO,GAAG,CAAC,IAAI,WAAW,QAAQ,CAChH,CAAC;YACF,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACF,CAAC;IACD,MAAM,SAAS,CAAC;AACjB,CAAC;AAED,uBAAuB;AACvB,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,gBAAgB,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/utils/resolve.d.ts

@@ -0,0 +1,84 @@
+import type { Issue, LinearClient } from "@linear/sdk";
+/**
+ * Minimal interface for SDK connection objects that support pagination. The
+ * SDK exports LinearConnection (no fetchNext) and internal Connection (with
+ * fetchNext). Concrete connections returned by client methods (e.g.
+ * client.projects()) implement this.
+ */
+interface PaginatedConnection<T> {
+    nodes: T[];
+    pageInfo: {
+        hasNextPage: boolean;
+    };
+    fetchNext(): Promise<PaginatedConnection<T>>;
+}
+/**
+ * Paginate through all nodes in a connection. Uses the SDK's built-in
+ * fetchNext() to break the 250-item ceiling.
+ */
+export declare function fetchAllNodes<T>(connection: PaginatedConnection<T>): Promise<T[]>;
+/** True if `value` is a UUID v4-shaped string. */
+export declare function isUUID(value: string): boolean;
+/**
+ * Resolve a team name or key to its UUID. Accepts: team name ("Engineering"),
+ * key ("ENG"), or UUID.
+ */
+export declare function resolveTeam(client: LinearClient, nameOrId: string): Promise<{
+    id: string;
+    name: string;
+    key: string;
+}>;
+/** Resolve a project name to its UUID. */
+export declare function resolveProject(client: LinearClient, nameOrId: string): Promise<{
+    id: string;
+    name: string;
+}>;
+/** Resolve a user name, email, or "me" to UUID. */
+export declare function resolveUser(client: LinearClient, nameOrId: string): Promise<{
+    id: string;
+    name: string;
+}>;
+/** Resolve comma-separated label names to UUIDs. */
+export declare function resolveLabels(client: LinearClient, labelNames: string): Promise<{
+    id: string;
+    name: string;
+}[]>;
+/** Resolve a workflow state name to UUID for a given team. */
+export declare function resolveState(client: LinearClient, stateName: string, teamId: string): Promise<{
+    id: string;
+    name: string;
+    type: string;
+}>;
+/** Resolve an initiative name to its UUID. */
+export declare function resolveInitiative(client: LinearClient, nameOrId: string): Promise<{
+    id: string;
+    name: string;
+}>;
+/**
+ * Parse an issue identifier like "ENG-123" into a searchable format. Returns
+ * the identifier as-is if it looks like a Linear issue ID.
+ */
+export declare function parseIssueIdentifier(input: string): string;
+/**
+ * Find an issue by Linear identifier (e.g., ENG-123) or UUID.
+ *
+ * Identifiers are split into team key + number and resolved through the
+ * standard client.issues({filter}) API in a single request. Earlier this
+ * function did searchIssues + client.issue() (two requests); the filter-based
+ * path returns full Issue objects directly so connection methods (.comments(),
+ * .labels(), .relations()) work the same as before.
+ */
+export declare function findIssueByIdentifier(client: LinearClient, id: string): Promise<Issue>;
+/**
+ * Resolve a project status by name (e.g. "Started") OR type
+ * (backlog|planned|started|paused|completed|canceled) to its UUID. Used by
+ * `projects update --state` since the SDK's ProjectUpdateInput takes statusId,
+ * not a state string.
+ */
+export declare function resolveProjectStatus(client: LinearClient, nameOrType: string): Promise<{
+    id: string;
+    name: string;
+    type: string;
+}>;
+export {};
+//# sourceMappingURL=resolve.d.ts.map

package/dist/utils/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/utils/resolve.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAIvD;;;;;GAKG;AACH,UAAU,mBAAmB,CAAC,CAAC;IAC9B,KAAK,EAAE,CAAC,EAAE,CAAC;IACX,QAAQ,EAAE;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;IACnC,SAAS,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;CAC7C;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAQvF;AAED,kDAAkD;AAClD,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAChC,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAWpD;AAED,0CAA0C;AAC1C,wBAAsB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAWlH;AAED,mDAAmD;AACnD,wBAAsB,WAAW,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAe/G;AAED,oDAAoD;AACpD,wBAAsB,aAAa,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,CAAC,CAkBrH;AAED,8DAA8D;AAC9D,wBAAsB,YAAY,CACjC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CASrD;AAED,8CAA8C;AAC9C,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAWrH;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI1D;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAW5F;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACzC,MAAM,EAAE,YAAY,EACpB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAWrD"}

package/dist/utils/resolve.js

@@ -0,0 +1,172 @@
+// Batch resolution of human-readable identifiers to UUIDs.
+// Pattern borrowed from czottmann/linearis — resolve multiple entities in
+// minimal API calls.
+import { NotFoundError, ValidationError } from "./errors.js";
+/**
+ * Paginate through all nodes in a connection. Uses the SDK's built-in
+ * fetchNext() to break the 250-item ceiling.
+ */
+export async function fetchAllNodes(connection) {
+    let current = connection;
+    const all = [...current.nodes];
+    while (current.pageInfo.hasNextPage) {
+        current = await current.fetchNext();
+        all.push(...current.nodes);
+    }
+    return all;
+}
+/** True if `value` is a UUID v4-shaped string. */
+export function isUUID(value) {
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+/**
+ * Resolve a team name or key to its UUID. Accepts: team name ("Engineering"),
+ * key ("ENG"), or UUID.
+ */
+export async function resolveTeam(client, nameOrId) {
+    if (isUUID(nameOrId)) {
+        const team = await client.team(nameOrId);
+        return { id: team.id, name: team.name, key: team.key };
+    }
+    const connection = await client.teams({ first: 250 });
+    const allTeams = await fetchAllNodes(connection);
+    const lower = nameOrId.toLowerCase();
+    const match = allTeams.find((t) => t.name.toLowerCase() === lower || t.key.toLowerCase() === lower);
+    if (!match)
+        throw new NotFoundError("Team", nameOrId);
+    return { id: match.id, name: match.name, key: match.key };
+}
+/** Resolve a project name to its UUID. */
+export async function resolveProject(client, nameOrId) {
+    if (isUUID(nameOrId)) {
+        const project = await client.project(nameOrId);
+        return { id: project.id, name: project.name };
+    }
+    const connection = await client.projects({ first: 250 });
+    const allProjects = await fetchAllNodes(connection);
+    const lower = nameOrId.toLowerCase();
+    const match = allProjects.find((p) => p.name.toLowerCase() === lower);
+    if (!match)
+        throw new NotFoundError("Project", nameOrId);
+    return { id: match.id, name: match.name };
+}
+/** Resolve a user name, email, or "me" to UUID. */
+export async function resolveUser(client, nameOrId) {
+    if (nameOrId.toLowerCase() === "me") {
+        const me = await client.viewer;
+        return { id: me.id, name: me.name };
+    }
+    if (isUUID(nameOrId)) {
+        const user = await client.user(nameOrId);
+        return { id: user.id, name: user.name };
+    }
+    const connection = await client.users({ first: 250 });
+    const allUsers = await fetchAllNodes(connection);
+    const lower = nameOrId.toLowerCase();
+    const match = allUsers.find((u) => u.name.toLowerCase() === lower || (u.email && u.email.toLowerCase() === lower));
+    if (!match)
+        throw new NotFoundError("User", nameOrId);
+    return { id: match.id, name: match.name };
+}
+/** Resolve comma-separated label names to UUIDs. */
+export async function resolveLabels(client, labelNames) {
+    const names = labelNames
+        .split(",")
+        .map((n) => n.trim())
+        .filter(Boolean);
+    if (names.length === 0) {
+        throw new ValidationError("No valid label names provided. Separate multiple labels with commas.");
+    }
+    const connection = await client.issueLabels({ first: 250 });
+    const allLabels = await fetchAllNodes(connection);
+    const resolved = [];
+    for (const name of names) {
+        const lower = name.toLowerCase();
+        const match = allLabels.find((l) => l.name.toLowerCase() === lower);
+        if (!match)
+            throw new NotFoundError("Label", name);
+        resolved.push({ id: match.id, name: match.name });
+    }
+    return resolved;
+}
+/** Resolve a workflow state name to UUID for a given team. */
+export async function resolveState(client, stateName, teamId) {
+    const states = await client.workflowStates({
+        first: 250,
+        filter: { team: { id: { eq: teamId } } },
+    });
+    const lower = stateName.toLowerCase();
+    const match = states.nodes.find((s) => s.name.toLowerCase() === lower);
+    if (!match)
+        throw new NotFoundError("State", stateName);
+    return { id: match.id, name: match.name, type: match.type };
+}
+/** Resolve an initiative name to its UUID. */
+export async function resolveInitiative(client, nameOrId) {
+    if (isUUID(nameOrId)) {
+        const init = await client.initiative(nameOrId);
+        return { id: init.id, name: init.name };
+    }
+    const connection = await client.initiatives({ first: 250 });
+    const all = await fetchAllNodes(connection);
+    const lower = nameOrId.toLowerCase();
+    const match = all.find((i) => i.name.toLowerCase() === lower);
+    if (!match)
+        throw new NotFoundError("Initiative", nameOrId);
+    return { id: match.id, name: match.name };
+}
+/**
+ * Parse an issue identifier like "ENG-123" into a searchable format. Returns
+ * the identifier as-is if it looks like a Linear issue ID.
+ */
+export function parseIssueIdentifier(input) {
+    if (isUUID(input))
+        return input;
+    if (/^[A-Za-z]+-\d+$/.test(input))
+        return input;
+    throw new NotFoundError("Issue", input);
+}
+/**
+ * Find an issue by Linear identifier (e.g., ENG-123) or UUID.
+ *
+ * Identifiers are split into team key + number and resolved through the
+ * standard client.issues({filter}) API in a single request. Earlier this
+ * function did searchIssues + client.issue() (two requests); the filter-based
+ * path returns full Issue objects directly so connection methods (.comments(),
+ * .labels(), .relations()) work the same as before.
+ */
+export async function findIssueByIdentifier(client, id) {
+    if (isUUID(id))
+        return client.issue(id);
+    const match = id.toUpperCase().match(/^([A-Z]+)-(\d+)$/);
+    if (!match)
+        throw new NotFoundError("Issue", id);
+    const result = await client.issues({
+        filter: { team: { key: { eq: match[1] } }, number: { eq: parseInt(match[2], 10) } },
+        first: 1,
+    });
+    const issue = result.nodes[0];
+    if (issue)
+        return issue;
+    throw new NotFoundError("Issue", id);
+}
+/**
+ * Resolve a project status by name (e.g. "Started") OR type
+ * (backlog|planned|started|paused|completed|canceled) to its UUID. Used by
+ * `projects update --state` since the SDK's ProjectUpdateInput takes statusId,
+ * not a state string.
+ */
+export async function resolveProjectStatus(client, nameOrType) {
+    if (isUUID(nameOrType)) {
+        const status = await client.projectStatus(nameOrType);
+        return { id: status.id, name: status.name, type: status.type };
+    }
+    const connection = await client.projectStatuses({ first: 250 });
+    const all = await fetchAllNodes(connection);
+    const lower = nameOrType.toLowerCase();
+    const match = all.find((s) => s.name.toLowerCase() === lower || s.type.toLowerCase() === lower);
+    if (!match)
+        throw new NotFoundError("Project status", nameOrType);
+    return { id: match.id, name: match.name, type: match.type };
+}
+//# sourceMappingURL=resolve.js.map

package/dist/utils/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/utils/resolve.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,0EAA0E;AAC1E,qBAAqB;AAIrB,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAc7D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAI,UAAkC;IACxE,IAAI,OAAO,GAAG,UAAU,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,MAAM,CAAC,KAAa;IACnC,OAAO,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,MAAoB,EACpB,QAAgB;IAEhB,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IACpG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED,0CAA0C;AAC1C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAoB,EAAE,QAAgB;IAC1E,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAoB,EAAE,QAAgB;IACvE,IAAI,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC;IACnH,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAoB,EAAE,UAAkB;IAC3E,MAAM,KAAK,GAAG,UAAU;SACtB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,sEAAsE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAmC,EAAE,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnD,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,MAAoB,EACpB,SAAiB,EACjB,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC;QAC1C,KAAK,EAAE,GAAG;QACV,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;KACxC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED,8CAA8C;AAC9C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAoB,EAAE,QAAgB;IAC7E,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IACjD,IAAI,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAoB,EAAE,EAAU;IAC3E,IAAI,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;QAClC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE;QACnF,KAAK,EAAE,CAAC;KACR,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,MAAoB,EACpB,UAAkB;IAElB,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAChG,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,aAAa,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;IAClE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC"}

package/dist/utils/sleep.d.ts

@@ -0,0 +1,2 @@
+export declare function sleep(ms: number): Promise<void>;
+//# sourceMappingURL=sleep.d.ts.map

package/dist/utils/sleep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sleep.d.ts","sourceRoot":"","sources":["../../src/utils/sleep.ts"],"names":[],"mappings":"AAAA,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C"}

package/dist/utils/sleep.js

@@ -0,0 +1,4 @@
+export function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=sleep.js.map

package/dist/utils/sleep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sleep.js","sourceRoot":"","sources":["../../src/utils/sleep.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,KAAK,CAAC,EAAU;IAC/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/utils/webhook-verify.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The header Linear sends with every webhook payload. Re-exported as a
+ * constant so server templates can import it from one place.
+ */
+export declare const LINEAR_SIGNATURE_HEADER = "linear-signature";
+/**
+ * Default replay window: 60 seconds. Matches Linear's published recommendation
+ * (https://linear.app/developers/webhooks): "verify it's within a minute of
+ * the time your system sees it to guard against replay attacks."
+ */
+export declare const DEFAULT_WEBHOOK_MAX_AGE_MS: number;
+export interface VerifyOptions {
+    /** Raw request body, exactly as Linear sent it (do not re-stringify a parsed object). */
+    rawBody: string | Buffer;
+    /** Value of the `linear-signature` header. */
+    signature: string;
+    /** The webhook signing secret stored in your env. */
+    secret: string;
+    /**
+     * The `webhookTimestamp` field from the parsed body (Unix ms). When set,
+     * the verifier rejects payloads older than maxAgeMs. Strongly recommended
+     * for any production receiver — without it, captured requests replay
+     * forever.
+     */
+    timestamp?: number;
+    /** Replay window in milliseconds. Defaults to 60 seconds. Only consulted when timestamp is set. */
+    maxAgeMs?: number;
+    /** Override the current time (for testing). Defaults to Date.now(). */
+    nowMs?: number;
+}
+/**
+ * Verify a Linear webhook payload's HMAC-SHA256 signature. Returns true on
+ * match, false otherwise. Never throws.
+ *
+ * Both inputs are length-checked before timingSafeEqual since timingSafeEqual
+ * itself throws on length mismatch — that throw would itself be a timing leak.
+ *
+ * If timestamp is provided, the function also enforces a replay window:
+ * payloads older than maxAgeMs are rejected even with a valid HMAC.
+ */
+export declare function verifyLinearWebhook(opts: VerifyOptions): boolean;
+//# sourceMappingURL=webhook-verify.d.ts.map

package/dist/utils/webhook-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verify.d.ts","sourceRoot":"","sources":["../../src/utils/webhook-verify.ts"],"names":[],"mappings":"AAeA;;;GAGG;AACH,eAAO,MAAM,uBAAuB,qBAAqB,CAAC;AAE1D;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,QAAY,CAAC;AAEpD,MAAM,WAAW,aAAa;IAC7B,yFAAyF;IACzF,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACzB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CA2BhE"}

package/dist/utils/webhook-verify.js

@@ -0,0 +1,65 @@
+// Webhook signature verification.
+//
+// Linear's signing scheme is HMAC-SHA256 of the raw request body, hex-encoded,
+// delivered in the `linear-signature` header. The SDK ships a
+// LinearWebhookClient but its verify method is private. We compute the digest
+// ourselves with node:crypto and use timingSafeEqual to prevent timing attacks
+// — this is also the pattern Linear's docs recommend.
+//
+// Beyond HMAC, the payload carries a `webhookTimestamp` (Unix ms). When the
+// caller passes that timestamp into verify(), we reject deltas older than
+// maxAgeMs (default 60 seconds, per Linear's published recommendation) so a
+// captured request can't be replayed indefinitely.
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * The header Linear sends with every webhook payload. Re-exported as a
+ * constant so server templates can import it from one place.
+ */
+export const LINEAR_SIGNATURE_HEADER = "linear-signature";
+/**
+ * Default replay window: 60 seconds. Matches Linear's published recommendation
+ * (https://linear.app/developers/webhooks): "verify it's within a minute of
+ * the time your system sees it to guard against replay attacks."
+ */
+export const DEFAULT_WEBHOOK_MAX_AGE_MS = 60 * 1000;
+/**
+ * Verify a Linear webhook payload's HMAC-SHA256 signature. Returns true on
+ * match, false otherwise. Never throws.
+ *
+ * Both inputs are length-checked before timingSafeEqual since timingSafeEqual
+ * itself throws on length mismatch — that throw would itself be a timing leak.
+ *
+ * If timestamp is provided, the function also enforces a replay window:
+ * payloads older than maxAgeMs are rejected even with a valid HMAC.
+ */
+export function verifyLinearWebhook(opts) {
+    if (!opts.signature || !opts.secret)
+        return false;
+    // `Buffer.from(value, "hex")` silently drops invalid characters and odd
+    // trailing nibbles. Reject anything that isn't a clean even-length hex
+    // string up front so a partially-garbled header can't slip past the
+    // length-vs-expected check below by accident.
+    if (!/^[0-9a-f]+$/i.test(opts.signature) || opts.signature.length % 2 !== 0)
+        return false;
+    const body = typeof opts.rawBody === "string" ? Buffer.from(opts.rawBody, "utf-8") : opts.rawBody;
+    const expectedHex = createHmac("sha256", opts.secret).update(body).digest("hex");
+    const expected = Buffer.from(expectedHex, "hex");
+    const received = Buffer.from(opts.signature, "hex");
+    if (received.length !== expected.length)
+        return false;
+    if (!timingSafeEqual(received, expected))
+        return false;
+    if (typeof opts.timestamp === "number") {
+        const maxAgeMs = opts.maxAgeMs ?? DEFAULT_WEBHOOK_MAX_AGE_MS;
+        const now = opts.nowMs ?? Date.now();
+        // Reject anything outside [now - maxAgeMs, now + maxAgeMs]. The forward
+        // bound catches future-dated forgeries (clock skew + a small grace).
+        if (!Number.isFinite(opts.timestamp))
+            return false;
+        const delta = Math.abs(now - opts.timestamp);
+        if (delta > maxAgeMs)
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=webhook-verify.js.map

package/dist/utils/webhook-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-verify.js","sourceRoot":"","sources":["../../src/utils/webhook-verify.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,EAAE;AACF,+EAA+E;AAC/E,8DAA8D;AAC9D,8EAA8E;AAC9E,+EAA+E;AAC/E,sDAAsD;AACtD,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,mDAAmD;AAEnD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAE1D;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,IAAI,CAAC;AAsBpD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAmB;IACtD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAElD,wEAAwE;IACxE,uEAAuE;IACvE,oEAAoE;IACpE,8CAA8C;IAC9C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1F,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IAClG,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvD,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,0BAA0B,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,KAAK,GAAG,QAAQ;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elnora-ai/linear",
-  "version": "1.0.1",
+  "version": "2.0.0",
   "description": "Linear workspace for Claude Code — search, bulk edit, agents, and a config-driven curator",
   "type": "module",
   "bin": {
@@ -13,8 +13,11 @@
     "commands/",
     "skills/",
     "schemas/",
+    "scripts/postinstall.mjs",
+    "references/*.md",
     "references/*.placeholder.json",
     "references/*.example.json",
+    "templates/",
     ".claude-plugin/",
     "README.md",
     "LICENSE",
@@ -34,7 +37,8 @@
     "lint": "biome check src/ __tests__/",
     "lint:fix": "biome check --write src/ __tests__/",
     "format": "biome format --write src/ __tests__/",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "tsc --noEmit",
+    "postinstall": "node scripts/postinstall.mjs"
   },
   "keywords": [
     "linear",
@@ -66,6 +70,7 @@
     "vitest": "^4.1.2"
   },
   "dependencies": {
+    "@anthropic-ai/sdk": "^0.96.0",
     "@linear/sdk": "^84.0.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",

package/references/agent-description-template.md

@@ -0,0 +1,31 @@
+# Description template (full path)
+
+Used by `linear-issue-creator` on the full path when the caller did not supply a description body. Fast path passes the caller's description verbatim and does not read this file.
+
+```bash
+elnora-linear issues create "Concise actionable title" \
+  --team "<your-team-name>" \
+  --description "$(cat <<'EOF'
+## Overview
+[What and why, 1–2 sentences]
+
+## Problem Statement
+[Pain point or gap]
+
+## Proposed Solution
+[Approach]
+
+## Acceptance Criteria
+- [ ] Criterion 1
+- [ ] Criterion 2
+
+## Resources
+[Links if any]
+EOF
+)" \
+  --project "Project Name" \
+  --labels "Type: feature,Layer: frontend" \
+  --priority 3 --assignee "<assignee>"
+```
+
+For compliance issues, replace the description body with the loaded compliance template content (from `templates/<template>.md` in this repo) as-is.