@enrichlayer/el-linear 1.28.0 → 1.29.0

package/dist/commands/batch.js

@@ -1,4 +1,4 @@
-import { resolveAssignee, resolveLabels, resolveMember, resolveTeam, } from "../config/resolver.js";
+import { resolveAssignee, resolveLabels, resolveMemberWithRegistry, resolveTeam, } from "../config/resolver.js";
 import { createIssuesService } from "../utils/issues-service-bootstrap.js";
 import { logger } from "../utils/logger.js";
 import { handleAsyncCommand, outputSuccess, outputWarning, } from "../utils/output.js";
@@ -45,7 +45,7 @@ async function resolveTargetIssues(options, rootOpts) {
                 ? await resolveAssignee(filters.assignee, rootOpts)
                 : undefined,
             delegateId: filters.delegate
-                ? resolveMember(filters.delegate)
+                ? await resolveMemberWithRegistry(filters.delegate)
                 : undefined,
             project: filters.project
                 ? { kind: "id", id: filters.project }

package/dist/commands/issues.js

@@ -2,7 +2,7 @@ import { execFileSync } from "node:child_process";
 import { loadConfig } from "../config/config.js";
 import { enrichProjectResolverError, enrichValidationErrors, } from "../config/error-enrichment.js";
 import { enforceValidation, validateIssueCreation, } from "../config/issue-validation.js";
-import { resolveAssignee, resolveLabels, resolveMember, resolveTeam, } from "../config/resolver.js";
+import { resolveAssignee, resolveLabels, resolveMemberWithRegistry, resolveTeam, } from "../config/resolver.js";
 import { resolveDefaultStatus } from "../config/status-defaults.js";
 import { enforceTerms } from "../config/term-enforcer.js";
 import { GET_ISSUE_RELATIONS_QUERY, GET_ISSUE_STATE_HISTORY_QUERY, } from "../queries/issues.js";
@@ -210,7 +210,7 @@ async function handleListIssues(options, command) {
                 ? await resolveAssignee(options.assignee, rootOpts)
                 : undefined,
             delegateId: options.delegate
-                ? resolveMember(options.delegate)
+                ? await resolveMemberWithRegistry(options.delegate)
                 : undefined,
             project: resolveProjectFlag(options.project),
             labelNames: options.labels ? splitList(options.labels) : undefined,
@@ -256,7 +256,7 @@ async function handleSearchIssues(query, options, command) {
             ? await resolveAssignee(options.assignee, rootOpts)
             : undefined,
         delegateId: options.delegate
-            ? resolveMember(options.delegate)
+            ? await resolveMemberWithRegistry(options.delegate)
             : undefined,
         project: resolveProjectFlag(options.project),
         status: explicitStatus,
@@ -384,7 +384,7 @@ async function resolveCreateInputs(title, options, rootOpts) {
         ? await resolveAssignee(effectiveAssignee, rootOpts)
         : undefined;
     const delegateId = options.delegate
-        ? resolveMember(options.delegate)
+        ? await resolveMemberWithRegistry(options.delegate)
         : undefined;
     let labelIds = [];
     if (options.labels) {
@@ -407,7 +407,10 @@ async function resolveCreateInputs(title, options, rootOpts) {
     });
     let subscriberIds;
     if (options.subscriber) {
-        subscriberIds = splitList(options.subscriber).map((s) => resolveMember(s));
+        // --subscriber resolves through the opt-in registry too (DEV-4880),
+        // matching --assignee / --delegate. Each entry falls back to config on a
+        // miss; resolveMemberWithRegistry is fail-open and dormant when unconfigured.
+        subscriberIds = await Promise.all(splitList(options.subscriber).map((s) => resolveMemberWithRegistry(s)));
     }
     const priority = effectivePriorityInput
         ? validatePriority(effectivePriorityInput)
@@ -843,7 +846,7 @@ async function handleUpdateIssue(issueId, options, command) {
     const delegateId = options.clearDelegate
         ? null
         : options.delegate
-            ? resolveMember(options.delegate)
+            ? await resolveMemberWithRegistry(options.delegate)
             : undefined;
     const updateArgs = buildUpdateArgs(issueId, options, assigneeId, delegateId);
     const result = await withProjectResolverEnrichment(() => issuesService.updateIssue(updateArgs, options.labelBy || "adding"), {

package/dist/config/registry-resolve.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Optional, opt-in resolution against the company-wide identity registry
+ * (DEV-4827 / DEV-4871). EL-only: this activates **solely** when
+ * `EL_IDENTITY_URL` is set. el-linear is MIT/open-source — a non-EL install
+ * leaves this dormant (no network, no config, nothing written), and the package
+ * never takes a dependency on EL-internal infrastructure. It mirrors the
+ * env-gated CF-Access pattern of the tools `@enrichlayer/el-identity` client but
+ * is kept self-contained so the OSS package carries no private dependency.
+ *
+ * The registry is an *enhancement* for EL users: callers try it first, then fall
+ * back to the bundled config (`resolveMember`). It must never throw or break a
+ * command because the registry is unreachable.
+ */
+/** True only when the registry is explicitly configured (opt-in). */
+export declare function isRegistryConfigured(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Resolve any identifier (alias, handle, email, name, Linear UUID) to a Linear
+ * UUID via the registry's `GET /api/people/resolve`. Returns `null` when the
+ * registry is not configured, when nothing matches, or on **any** failure
+ * (unreachable / timeout / CF-Access challenge / malformed response) — the
+ * caller falls back to the config-based resolver. Never throws.
+ */
+export declare function resolveViaRegistry(identifier: string, env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch): Promise<string | null>;

package/dist/config/registry-resolve.js

@@ -0,0 +1,59 @@
+/**
+ * Optional, opt-in resolution against the company-wide identity registry
+ * (DEV-4827 / DEV-4871). EL-only: this activates **solely** when
+ * `EL_IDENTITY_URL` is set. el-linear is MIT/open-source — a non-EL install
+ * leaves this dormant (no network, no config, nothing written), and the package
+ * never takes a dependency on EL-internal infrastructure. It mirrors the
+ * env-gated CF-Access pattern of the tools `@enrichlayer/el-identity` client but
+ * is kept self-contained so the OSS package carries no private dependency.
+ *
+ * The registry is an *enhancement* for EL users: callers try it first, then fall
+ * back to the bundled config (`resolveMember`). It must never throw or break a
+ * command because the registry is unreachable.
+ */
+const URL_ENV = "EL_IDENTITY_URL";
+const CF_ID_ENV = "EL_IDENTITY_CF_ACCESS_CLIENT_ID";
+const CF_SECRET_ENV = "EL_IDENTITY_CF_ACCESS_CLIENT_SECRET";
+const TIMEOUT_MS = 8000;
+/** True only when the registry is explicitly configured (opt-in). */
+export function isRegistryConfigured(env = process.env) {
+    return Boolean(env[URL_ENV]?.trim());
+}
+/**
+ * Resolve any identifier (alias, handle, email, name, Linear UUID) to a Linear
+ * UUID via the registry's `GET /api/people/resolve`. Returns `null` when the
+ * registry is not configured, when nothing matches, or on **any** failure
+ * (unreachable / timeout / CF-Access challenge / malformed response) — the
+ * caller falls back to the config-based resolver. Never throws.
+ */
+export async function resolveViaRegistry(identifier, env = process.env, fetchImpl = fetch) {
+    const base = env[URL_ENV]?.trim();
+    if (!base) {
+        return null;
+    }
+    const headers = { Accept: "application/json" };
+    const cfId = env[CF_ID_ENV];
+    const cfSecret = env[CF_SECRET_ENV];
+    if (cfId && cfSecret) {
+        headers["CF-Access-Client-Id"] = cfId;
+        headers["CF-Access-Client-Secret"] = cfSecret;
+    }
+    const url = `${base.replace(/\/+$/, "")}/api/people/resolve?identifier=${encodeURIComponent(identifier)}`;
+    try {
+        const res = await fetchImpl(url, {
+            headers,
+            // A 3xx is a Cloudflare Access SSO bounce, not a result — `redirect:
+            // "manual"` surfaces it as a non-ok status we treat as a miss.
+            redirect: "manual",
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (!res.ok) {
+            return null;
+        }
+        const record = (await res.json());
+        return record?.linearId ?? null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/config/resolver.d.ts

@@ -13,6 +13,17 @@ export declare function resolveMember(input: string): string;
  * Falls back to resolveMember for all other inputs.
  */
 export declare function resolveAssignee(input: string, rootOpts: Record<string, unknown>): Promise<string>;
+/**
+ * Resolve a member identifier (alias / handle / name) to a UUID, consulting the
+ * opt-in identity registry first when configured, then the bundled config
+ * (`resolveMember`). The shared async resolution path behind `--assignee` and
+ * `--delegate` (DEV-4871 / DEV-4872).
+ *
+ * EL-only and env-gated on `EL_IDENTITY_URL`; fail-open — when unconfigured, on
+ * a miss, or on any failure it falls back to config, so a non-EL install and an
+ * unreachable registry both behave exactly as before. Never throws.
+ */
+export declare function resolveMemberWithRegistry(input: string): Promise<string>;
 /**
  * Resolve a user's display name from their UUID via config fullNames map.
  * Returns the full name if found, otherwise returns the original name.

package/dist/config/resolver.js

@@ -2,6 +2,7 @@ import { createGraphQLService } from "../utils/graphql-service.js";
 import { outputWarning } from "../utils/output.js";
 import { isUuid, isUuidPrefix } from "../utils/uuid.js";
 import { loadConfig } from "./config.js";
+import { isRegistryConfigured, resolveViaRegistry, } from "./registry-resolve.js";
 /**
  * Resolve a team key/name/alias to its UUID.
  * Case-insensitive: "fe" → FE UUID, "frontend" → FE UUID via alias.
@@ -98,6 +99,25 @@ export async function resolveAssignee(input, rootOpts) {
         }
         return result.viewer.id;
     }
+    return resolveMemberWithRegistry(input);
+}
+/**
+ * Resolve a member identifier (alias / handle / name) to a UUID, consulting the
+ * opt-in identity registry first when configured, then the bundled config
+ * (`resolveMember`). The shared async resolution path behind `--assignee` and
+ * `--delegate` (DEV-4871 / DEV-4872).
+ *
+ * EL-only and env-gated on `EL_IDENTITY_URL`; fail-open — when unconfigured, on
+ * a miss, or on any failure it falls back to config, so a non-EL install and an
+ * unreachable registry both behave exactly as before. Never throws.
+ */
+export async function resolveMemberWithRegistry(input) {
+    if (isRegistryConfigured()) {
+        const viaRegistry = await resolveViaRegistry(input);
+        if (viaRegistry) {
+            return viaRegistry;
+        }
+    }
     return resolveMember(input);
 }
 /**

package/dist/utils/graphql-issues-service.js

@@ -1,3 +1,4 @@
+import { isRegistryConfigured, resolveViaRegistry, } from "../config/registry-resolve.js";
 import { resolveUserDisplayName } from "../config/resolver.js";
 import { ARCHIVE_ISSUE_MUTATION, BATCH_GET_ISSUES_QUERY, BATCH_RESOLVE_FOR_CREATE_QUERY, BATCH_RESOLVE_FOR_SEARCH_QUERY, BATCH_RESOLVE_FOR_UPDATE_QUERY, buildResolveLabelsByNameQuery, CREATE_ISSUE_MUTATION, DELETE_ISSUE_MUTATION, FILTERED_SEARCH_ISSUES_QUERY, GET_ISSUE_BY_ID_QUERY, GET_ISSUE_BY_IDENTIFIER_QUERY, GET_ISSUE_CLAIM_CONTEXT_QUERY, GET_ISSUE_START_CONTEXT_QUERY, GET_ISSUE_TEAM_QUERY, GET_ISSUES_QUERY, SEARCH_ISSUES_QUERY, TEAM_STARTED_STATUSES_QUERY, UPDATE_ISSUE_MUTATION, } from "../queries/issues.js";
 import { CREATE_LABEL_MUTATION } from "../queries/labels.js";
@@ -1048,6 +1049,15 @@ export class GraphQLIssuesService {
         if (!assigneeId || isUuid(assigneeId)) {
             return assigneeId;
         }
+        // Opt-in registry resolution (DEV-4872): try the identity registry first,
+        // falling back to the Linear-API user lookup below on a miss. EL-only,
+        // env-gated, fail-open — a non-EL install never reaches the network here.
+        if (isRegistryConfigured()) {
+            const viaRegistry = await resolveViaRegistry(assigneeId);
+            if (viaRegistry) {
+                return viaRegistry;
+            }
+        }
         // A plain name (no `@`) resolves via the user lookup — same as
         // `resolveDelegateId`. Without this, a non-config full name like
         // "Yury Tsukerman" fell through unchanged and was sent to the
@@ -1068,6 +1078,14 @@ export class GraphQLIssuesService {
         if (!delegateId || isUuid(delegateId)) {
             return delegateId;
         }
+        // Opt-in registry resolution (DEV-4872): registry-first, Linear-API
+        // fallback. EL-only, env-gated, fail-open.
+        if (isRegistryConfigured()) {
+            const viaRegistry = await resolveViaRegistry(delegateId);
+            if (viaRegistry) {
+                return viaRegistry;
+            }
+        }
         if (!delegateId.includes("@")) {
             return this.linearService.resolveUserId(delegateId);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enrichlayer/el-linear",
-  "version": "1.28.0",
+  "version": "1.29.0",
   "description": "A pragmatic CLI for Linear.app — deterministic team/label/member resolution, structured issue validation, configurable term enforcement, and a GraphQL escape hatch.",
   "main": "dist/main.js",
   "types": "dist/main.d.ts",