@enrichlayer/el-linear 1.28.0 → 1.29.1

package/dist/commands/batch.js

@@ -1,4 +1,4 @@
-import { resolveAssignee, resolveLabels, resolveMember, resolveTeam, } from "../config/resolver.js";
+import { resolveAssignee, resolveLabels, resolveMemberWithRegistry, resolveTeam, } from "../config/resolver.js";
 import { createIssuesService } from "../utils/issues-service-bootstrap.js";
 import { logger } from "../utils/logger.js";
 import { handleAsyncCommand, outputSuccess, outputWarning, } from "../utils/output.js";
@@ -45,7 +45,7 @@ async function resolveTargetIssues(options, rootOpts) {
                 ? await resolveAssignee(filters.assignee, rootOpts)
                 : undefined,
             delegateId: filters.delegate
-                ? resolveMember(filters.delegate)
+                ? await resolveMemberWithRegistry(filters.delegate)
                 : undefined,
             project: filters.project
                 ? { kind: "id", id: filters.project }

package/dist/commands/issues/tree.js

@@ -18,6 +18,7 @@
  * connection has no top-level state filter).
  */
 import { buildIssueTreeQuery, DEFAULT_TREE_DEPTH, MAX_TREE_DEPTH, } from "../../queries/issue-tree.js";
+import { TERMINAL_STATE_TYPES } from "../../types/linear.js";
 import { formatTree } from "../../utils/format-tree.js";
 import { createIssuesService } from "../../utils/issues-service-bootstrap.js";
 import { handleAsyncCommand, outputSuccess } from "../../utils/output.js";
@@ -74,10 +75,11 @@ function parseDepth(raw) {
     return n;
 }
 /**
- * Walk the tree depth-first and drop any node whose `state.type` is
- * `completed` or `canceled`. Pure function — does not mutate the input.
- * A pruned child takes its entire subtree with it (consistent with how
- * `issues list --no-include-closed` excludes closed work entirely).
+ * Walk the tree depth-first and drop any node whose `state.type` is terminal
+ * (`completed` / `canceled` / `duplicate` — `TERMINAL_STATE_TYPES`, DEV-4879).
+ * Pure function — does not mutate the input. A pruned child takes its entire
+ * subtree with it (consistent with how `issues list --no-include-closed`
+ * excludes closed work entirely — same shared constant).
  *
  * Assumes Linear's parent → children graph stays single-parent (a tree,
  * not a DAG). If Linear ever ships multi-parent issues, this recursion
@@ -97,6 +99,5 @@ function pruneTerminalStates(root) {
     };
 }
 function isTerminalState(node) {
-    const t = node.state?.type;
-    return t === "completed" || t === "canceled";
+    return TERMINAL_STATE_TYPES.includes(node.state?.type ?? "");
 }

package/dist/commands/issues.js

@@ -2,7 +2,7 @@ import { execFileSync } from "node:child_process";
 import { loadConfig } from "../config/config.js";
 import { enrichProjectResolverError, enrichValidationErrors, } from "../config/error-enrichment.js";
 import { enforceValidation, validateIssueCreation, } from "../config/issue-validation.js";
-import { resolveAssignee, resolveLabels, resolveMember, resolveTeam, } from "../config/resolver.js";
+import { resolveAssignee, resolveLabels, resolveMemberWithRegistry, resolveTeam, } from "../config/resolver.js";
 import { resolveDefaultStatus } from "../config/status-defaults.js";
 import { enforceTerms } from "../config/term-enforcer.js";
 import { GET_ISSUE_RELATIONS_QUERY, GET_ISSUE_STATE_HISTORY_QUERY, } from "../queries/issues.js";
@@ -210,7 +210,7 @@ async function handleListIssues(options, command) {
                 ? await resolveAssignee(options.assignee, rootOpts)
                 : undefined,
             delegateId: options.delegate
-                ? resolveMember(options.delegate)
+                ? await resolveMemberWithRegistry(options.delegate)
                 : undefined,
             project: resolveProjectFlag(options.project),
             labelNames: options.labels ? splitList(options.labels) : undefined,
@@ -256,7 +256,7 @@ async function handleSearchIssues(query, options, command) {
             ? await resolveAssignee(options.assignee, rootOpts)
             : undefined,
         delegateId: options.delegate
-            ? resolveMember(options.delegate)
+            ? await resolveMemberWithRegistry(options.delegate)
             : undefined,
         project: resolveProjectFlag(options.project),
         status: explicitStatus,
@@ -384,7 +384,7 @@ async function resolveCreateInputs(title, options, rootOpts) {
         ? await resolveAssignee(effectiveAssignee, rootOpts)
         : undefined;
     const delegateId = options.delegate
-        ? resolveMember(options.delegate)
+        ? await resolveMemberWithRegistry(options.delegate)
         : undefined;
     let labelIds = [];
     if (options.labels) {
@@ -407,7 +407,10 @@ async function resolveCreateInputs(title, options, rootOpts) {
     });
     let subscriberIds;
     if (options.subscriber) {
-        subscriberIds = splitList(options.subscriber).map((s) => resolveMember(s));
+        // --subscriber resolves through the opt-in registry too (DEV-4880),
+        // matching --assignee / --delegate. Each entry falls back to config on a
+        // miss; resolveMemberWithRegistry is fail-open and dormant when unconfigured.
+        subscriberIds = await Promise.all(splitList(options.subscriber).map((s) => resolveMemberWithRegistry(s)));
     }
     const priority = effectivePriorityInput
         ? validatePriority(effectivePriorityInput)
@@ -843,7 +846,7 @@ async function handleUpdateIssue(issueId, options, command) {
     const delegateId = options.clearDelegate
         ? null
         : options.delegate
-            ? resolveMember(options.delegate)
+            ? await resolveMemberWithRegistry(options.delegate)
             : undefined;
     const updateArgs = buildUpdateArgs(issueId, options, assigneeId, delegateId);
     const result = await withProjectResolverEnrichment(() => issuesService.updateIssue(updateArgs, options.labelBy || "adding"), {

package/dist/config/registry-resolve.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Optional, opt-in resolution against the company-wide identity registry
+ * (DEV-4827 / DEV-4871). EL-only: this activates **solely** when
+ * `EL_IDENTITY_URL` is set. el-linear is MIT/open-source — a non-EL install
+ * leaves this dormant (no network, no config, nothing written), and the package
+ * never takes a dependency on EL-internal infrastructure. It mirrors the
+ * env-gated CF-Access pattern of the tools `@enrichlayer/el-identity` client but
+ * is kept self-contained so the OSS package carries no private dependency.
+ *
+ * The registry is an *enhancement* for EL users: callers try it first, then fall
+ * back to the bundled config (`resolveMember`). It must never throw or break a
+ * command because the registry is unreachable.
+ */
+/** True only when the registry is explicitly configured (opt-in). */
+export declare function isRegistryConfigured(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Resolve any identifier (alias, handle, email, name, Linear UUID) to a Linear
+ * UUID via the registry's `GET /api/people/resolve`. Returns `null` when the
+ * registry is not configured, when nothing matches, or on **any** failure
+ * (unreachable / timeout / CF-Access challenge / malformed response) — the
+ * caller falls back to the config-based resolver. Never throws.
+ */
+export declare function resolveViaRegistry(identifier: string, env?: NodeJS.ProcessEnv, fetchImpl?: typeof fetch): Promise<string | null>;

package/dist/config/registry-resolve.js

@@ -0,0 +1,59 @@
+/**
+ * Optional, opt-in resolution against the company-wide identity registry
+ * (DEV-4827 / DEV-4871). EL-only: this activates **solely** when
+ * `EL_IDENTITY_URL` is set. el-linear is MIT/open-source — a non-EL install
+ * leaves this dormant (no network, no config, nothing written), and the package
+ * never takes a dependency on EL-internal infrastructure. It mirrors the
+ * env-gated CF-Access pattern of the tools `@enrichlayer/el-identity` client but
+ * is kept self-contained so the OSS package carries no private dependency.
+ *
+ * The registry is an *enhancement* for EL users: callers try it first, then fall
+ * back to the bundled config (`resolveMember`). It must never throw or break a
+ * command because the registry is unreachable.
+ */
+const URL_ENV = "EL_IDENTITY_URL";
+const CF_ID_ENV = "EL_IDENTITY_CF_ACCESS_CLIENT_ID";
+const CF_SECRET_ENV = "EL_IDENTITY_CF_ACCESS_CLIENT_SECRET";
+const TIMEOUT_MS = 8000;
+/** True only when the registry is explicitly configured (opt-in). */
+export function isRegistryConfigured(env = process.env) {
+    return Boolean(env[URL_ENV]?.trim());
+}
+/**
+ * Resolve any identifier (alias, handle, email, name, Linear UUID) to a Linear
+ * UUID via the registry's `GET /api/people/resolve`. Returns `null` when the
+ * registry is not configured, when nothing matches, or on **any** failure
+ * (unreachable / timeout / CF-Access challenge / malformed response) — the
+ * caller falls back to the config-based resolver. Never throws.
+ */
+export async function resolveViaRegistry(identifier, env = process.env, fetchImpl = fetch) {
+    const base = env[URL_ENV]?.trim();
+    if (!base) {
+        return null;
+    }
+    const headers = { Accept: "application/json" };
+    const cfId = env[CF_ID_ENV];
+    const cfSecret = env[CF_SECRET_ENV];
+    if (cfId && cfSecret) {
+        headers["CF-Access-Client-Id"] = cfId;
+        headers["CF-Access-Client-Secret"] = cfSecret;
+    }
+    const url = `${base.replace(/\/+$/, "")}/api/people/resolve?identifier=${encodeURIComponent(identifier)}`;
+    try {
+        const res = await fetchImpl(url, {
+            headers,
+            // A 3xx is a Cloudflare Access SSO bounce, not a result — `redirect:
+            // "manual"` surfaces it as a non-ok status we treat as a miss.
+            redirect: "manual",
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (!res.ok) {
+            return null;
+        }
+        const record = (await res.json());
+        return record?.linearId ?? null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/config/resolver.d.ts

@@ -13,6 +13,17 @@ export declare function resolveMember(input: string): string;
  * Falls back to resolveMember for all other inputs.
  */
 export declare function resolveAssignee(input: string, rootOpts: Record<string, unknown>): Promise<string>;
+/**
+ * Resolve a member identifier (alias / handle / name) to a UUID, consulting the
+ * opt-in identity registry first when configured, then the bundled config
+ * (`resolveMember`). The shared async resolution path behind `--assignee` and
+ * `--delegate` (DEV-4871 / DEV-4872).
+ *
+ * EL-only and env-gated on `EL_IDENTITY_URL`; fail-open — when unconfigured, on
+ * a miss, or on any failure it falls back to config, so a non-EL install and an
+ * unreachable registry both behave exactly as before. Never throws.
+ */
+export declare function resolveMemberWithRegistry(input: string): Promise<string>;
 /**
  * Resolve a user's display name from their UUID via config fullNames map.
  * Returns the full name if found, otherwise returns the original name.

package/dist/config/resolver.js

@@ -2,6 +2,7 @@ import { createGraphQLService } from "../utils/graphql-service.js";
 import { outputWarning } from "../utils/output.js";
 import { isUuid, isUuidPrefix } from "../utils/uuid.js";
 import { loadConfig } from "./config.js";
+import { isRegistryConfigured, resolveViaRegistry, } from "./registry-resolve.js";
 /**
  * Resolve a team key/name/alias to its UUID.
  * Case-insensitive: "fe" → FE UUID, "frontend" → FE UUID via alias.
@@ -98,6 +99,25 @@ export async function resolveAssignee(input, rootOpts) {
         }
         return result.viewer.id;
     }
+    return resolveMemberWithRegistry(input);
+}
+/**
+ * Resolve a member identifier (alias / handle / name) to a UUID, consulting the
+ * opt-in identity registry first when configured, then the bundled config
+ * (`resolveMember`). The shared async resolution path behind `--assignee` and
+ * `--delegate` (DEV-4871 / DEV-4872).
+ *
+ * EL-only and env-gated on `EL_IDENTITY_URL`; fail-open — when unconfigured, on
+ * a miss, or on any failure it falls back to config, so a non-EL install and an
+ * unreachable registry both behave exactly as before. Never throws.
+ */
+export async function resolveMemberWithRegistry(input) {
+    if (isRegistryConfigured()) {
+        const viaRegistry = await resolveViaRegistry(input);
+        if (viaRegistry) {
+            return viaRegistry;
+        }
+    }
     return resolveMember(input);
 }
 /**

package/dist/types/linear.d.ts

@@ -35,6 +35,17 @@ interface StateRef {
      */
     type?: string;
 }
+/**
+ * Workflow-state types treated as terminal / closed for default filtering.
+ * `issues list` / `issues search` exclude these unless `--include-closed` (or
+ * an explicit `--status`) is passed (DEV-4478).
+ *
+ * `duplicate` is included (DEV-4879) because this workspace parks resolved
+ * duplicates in a `duplicate`-typed state — they carry a `duplicate-of`
+ * relation and are semantically closed, so they must not leak into the default
+ * open-issues view the way `completed` / `canceled` don't.
+ */
+export declare const TERMINAL_STATE_TYPES: readonly string[];
 interface ProjectRef {
     id: string;
     name: string;

package/dist/types/linear.js

@@ -3,4 +3,18 @@
  * These represent the public API surface — GraphQL responses are
  * transformed into these shapes at the service boundary.
  */
-export {};
+/**
+ * Workflow-state types treated as terminal / closed for default filtering.
+ * `issues list` / `issues search` exclude these unless `--include-closed` (or
+ * an explicit `--status`) is passed (DEV-4478).
+ *
+ * `duplicate` is included (DEV-4879) because this workspace parks resolved
+ * duplicates in a `duplicate`-typed state — they carry a `duplicate-of`
+ * relation and are semantically closed, so they must not leak into the default
+ * open-issues view the way `completed` / `canceled` don't.
+ */
+export const TERMINAL_STATE_TYPES = [
+    "completed",
+    "canceled",
+    "duplicate",
+];

package/dist/utils/format-tree.js

@@ -10,6 +10,7 @@
  * Pure rendering — does not fetch or filter. The depth bound and the
  * terminal-state exclusion are enforced by the caller before this runs.
  */
+import { TERMINAL_STATE_TYPES } from "../types/linear.js";
 const BRANCH_TEE = "├── ";
 const BRANCH_END = "└── ";
 const VERTICAL = "│   ";
@@ -40,7 +41,7 @@ function formatStateSuffix(state) {
     // Only annotate terminal-typed states; the renderer is otherwise
     // state-name-agnostic so workspace-custom workflow states (e.g. "In
     // Review") don't get a noisy suffix.
-    if (state.type === "completed" || state.type === "canceled") {
+    if (TERMINAL_STATE_TYPES.includes(state.type)) {
         return ` [${state.name}]`;
     }
     return "";

package/dist/utils/graphql-issues-service.d.ts

@@ -42,7 +42,8 @@ export interface SearchIssueArgs {
     /** Issue states to include (e.g. `["Todo", "In Progress"]`). */
     status?: string[];
     /**
-     * Exclude terminal states (workflow type `completed` or `canceled`).
+     * Exclude terminal states (workflow type `completed`, `canceled`, or
+     * `duplicate` — see `TERMINAL_STATE_TYPES`).
      * Default `false` for back-compat at the service layer; the CLI's
      * `issues list` / `issues search` flip this to `true` by default
      * (DEV-4478) and accept `--include-closed` to opt back in. When

package/dist/utils/graphql-issues-service.js

@@ -1,6 +1,8 @@
+import { isRegistryConfigured, resolveViaRegistry, } from "../config/registry-resolve.js";
 import { resolveUserDisplayName } from "../config/resolver.js";
 import { ARCHIVE_ISSUE_MUTATION, BATCH_GET_ISSUES_QUERY, BATCH_RESOLVE_FOR_CREATE_QUERY, BATCH_RESOLVE_FOR_SEARCH_QUERY, BATCH_RESOLVE_FOR_UPDATE_QUERY, buildResolveLabelsByNameQuery, CREATE_ISSUE_MUTATION, DELETE_ISSUE_MUTATION, FILTERED_SEARCH_ISSUES_QUERY, GET_ISSUE_BY_ID_QUERY, GET_ISSUE_BY_IDENTIFIER_QUERY, GET_ISSUE_CLAIM_CONTEXT_QUERY, GET_ISSUE_START_CONTEXT_QUERY, GET_ISSUE_TEAM_QUERY, GET_ISSUES_QUERY, SEARCH_ISSUES_QUERY, TEAM_STARTED_STATUSES_QUERY, UPDATE_ISSUE_MUTATION, } from "../queries/issues.js";
 import { CREATE_LABEL_MUTATION } from "../queries/labels.js";
+import { TERMINAL_STATE_TYPES } from "../types/linear.js";
 import { toISOStringOrNow } from "./date-format.js";
 import { extractEmbeds } from "./embed-parser.js";
 import { multipleMatchesError, notFoundError } from "./error-messages.js";
@@ -980,7 +982,7 @@ export class GraphQLIssuesService {
         else if (filters.excludeTerminalStates) {
             // Implicit terminal-state exclusion (DEV-4478). Explicit `status`
             // always wins — the user already named the states they want.
-            filtered = filtered.filter((issue) => issue.state?.type !== "completed" && issue.state?.type !== "canceled");
+            filtered = filtered.filter((issue) => !TERMINAL_STATE_TYPES.includes(issue.state?.type ?? ""));
         }
         if (filters.labelNames && filters.labelNames.length > 0) {
             const lowerNames = filters.labelNames.map((n) => n.toLowerCase());
@@ -1023,7 +1025,7 @@ export class GraphQLIssuesService {
         else if (filters.excludeTerminalStates) {
             // Implicit terminal-state exclusion (DEV-4478). Explicit `status`
             // always wins — the user already named the states they want.
-            filter.state = { type: { nin: ["completed", "canceled"] } };
+            filter.state = { type: { nin: [...TERMINAL_STATE_TYPES] } };
         }
         if (filters.labelNames && filters.labelNames.length > 0) {
             if (filters.labelNames.length === 1) {
@@ -1048,6 +1050,15 @@ export class GraphQLIssuesService {
         if (!assigneeId || isUuid(assigneeId)) {
             return assigneeId;
         }
+        // Opt-in registry resolution (DEV-4872): try the identity registry first,
+        // falling back to the Linear-API user lookup below on a miss. EL-only,
+        // env-gated, fail-open — a non-EL install never reaches the network here.
+        if (isRegistryConfigured()) {
+            const viaRegistry = await resolveViaRegistry(assigneeId);
+            if (viaRegistry) {
+                return viaRegistry;
+            }
+        }
         // A plain name (no `@`) resolves via the user lookup — same as
         // `resolveDelegateId`. Without this, a non-config full name like
         // "Yury Tsukerman" fell through unchanged and was sent to the
@@ -1068,6 +1079,14 @@ export class GraphQLIssuesService {
         if (!delegateId || isUuid(delegateId)) {
             return delegateId;
         }
+        // Opt-in registry resolution (DEV-4872): registry-first, Linear-API
+        // fallback. EL-only, env-gated, fail-open.
+        if (isRegistryConfigured()) {
+            const viaRegistry = await resolveViaRegistry(delegateId);
+            if (viaRegistry) {
+                return viaRegistry;
+            }
+        }
         if (!delegateId.includes("@")) {
             return this.linearService.resolveUserId(delegateId);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enrichlayer/el-linear",
-  "version": "1.28.0",
+  "version": "1.29.1",
   "description": "A pragmatic CLI for Linear.app — deterministic team/label/member resolution, structured issue validation, configurable term enforcement, and a GraphQL escape hatch.",
   "main": "dist/main.js",
   "types": "dist/main.d.ts",