@enrichlayer/el-linear 1.7.0 → 1.10.0

package/dist/queries/project-milestones-types.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Typed response shapes for the queries in `./project-milestones.ts`.
+ * See `./issues-types.ts` for the rationale (ALL-937).
+ *
+ * The selection sets vary across queries — some include `description`
+ * + `createdAt`, others only the lookup-relevant fields. Modelled as
+ * a base `MilestoneBaseRef` with extension shapes per query so each
+ * consumer reads only what was actually selected.
+ */
+import type { IssueNode } from "./issues-types.js";
+export interface MilestoneProjectRef {
+    id: string;
+    name: string;
+}
+/**
+ * Mirrors the milestone selection set in `LIST_PROJECT_MILESTONES_QUERY`
+ * — full milestone fields without the project-back-reference.
+ */
+export interface MilestoneListNode {
+    id: string;
+    name: string;
+    description: string | null;
+    targetDate: string | null;
+    sortOrder: number;
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * Mirrors the milestone selection set in `GET_PROJECT_MILESTONE_BY_ID_QUERY`
+ * — list shape + project + issues connection.
+ */
+export interface MilestoneDetailNode extends MilestoneListNode {
+    project: MilestoneProjectRef;
+    issues: {
+        nodes: IssueNode[];
+    };
+}
+/**
+ * Mirrors the milestone selection set in `FIND_PROJECT_MILESTONE_BY_NAME_*`
+ * — minimal lookup shape with project back-reference.
+ */
+export interface MilestoneLookupNode {
+    id: string;
+    name: string;
+    targetDate: string | null;
+    sortOrder: number;
+    project: MilestoneProjectRef;
+}
+/**
+ * Mirrors the milestone selection set on the create / update mutations —
+ * list shape + project (no issues connection).
+ */
+export interface MutatedMilestoneNode extends MilestoneListNode {
+    project: MilestoneProjectRef;
+}
+export interface ListProjectMilestonesResponse {
+    project: {
+        id: string;
+        name: string;
+        projectMilestones: {
+            nodes: MilestoneListNode[];
+        };
+    } | null;
+}
+export interface GetProjectMilestoneByIdResponse {
+    projectMilestone: MilestoneDetailNode | null;
+}
+export interface FindProjectMilestoneScopedResponse {
+    project: {
+        projectMilestones: {
+            nodes: MilestoneLookupNode[];
+        };
+    } | null;
+}
+export interface FindProjectMilestoneGlobalResponse {
+    projectMilestones: {
+        nodes: MilestoneLookupNode[];
+    };
+}
+export interface CreateProjectMilestoneResponse {
+    projectMilestoneCreate: {
+        success: boolean;
+        projectMilestone: MutatedMilestoneNode | null;
+    };
+}
+export interface UpdateProjectMilestoneResponse {
+    projectMilestoneUpdate: {
+        success: boolean;
+        projectMilestone: MutatedMilestoneNode | null;
+    };
+}

package/dist/queries/project-milestones-types.js

@@ -0,0 +1,10 @@
+/**
+ * Typed response shapes for the queries in `./project-milestones.ts`.
+ * See `./issues-types.ts` for the rationale (ALL-937).
+ *
+ * The selection sets vary across queries — some include `description`
+ * + `createdAt`, others only the lookup-relevant fields. Modelled as
+ * a base `MilestoneBaseRef` with extension shapes per query so each
+ * consumer reads only what was actually selected.
+ */
+export {};

package/dist/queries/projects-types.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Typed response shapes for the queries in `./projects.ts`.
+ * See `./issues-types.ts` for the rationale (ALL-937).
+ */
+export interface ProjectTeamRef {
+    id: string;
+    key: string;
+    name: string;
+}
+export interface ProjectBaseNode {
+    id: string;
+    name: string;
+    teams: {
+        nodes: ProjectTeamRef[];
+    };
+}
+/**
+ * Mirrors the project selection set used by `SEARCH_PROJECTS_BY_NAME_QUERY`
+ * and `CREATE_PROJECT_MUTATION` — base fields + state.
+ */
+export interface ProjectWithStateNode extends ProjectBaseNode {
+    state: string;
+}
+export interface ProjectIssueRef {
+    id: string;
+    identifier: string;
+    title: string;
+}
+export interface ProjectWithIssuesNode extends ProjectBaseNode {
+    issues: {
+        nodes: ProjectIssueRef[];
+    };
+}
+export interface ProjectByIdResponse {
+    project: ProjectBaseNode | null;
+}
+export interface GetProjectResponse {
+    projects: {
+        nodes: ProjectBaseNode[];
+    };
+}
+export interface GetProjectTeamIssuesResponse {
+    project: ProjectWithIssuesNode | null;
+}
+export interface SearchProjectsByNameResponse {
+    projects: {
+        nodes: ProjectWithStateNode[];
+    };
+}
+export interface CreateProjectResponse {
+    projectCreate: {
+        success: boolean;
+        project: ProjectWithStateNode | null;
+    };
+}
+export interface UpdateProjectResponse {
+    projectUpdate: {
+        success: boolean;
+        project: ProjectBaseNode | null;
+    };
+}
+export interface ProjectArchiveEntity {
+    id: string;
+}
+export interface ProjectArchivePayload {
+    success: boolean;
+    lastSyncId: number;
+    entity: ProjectArchiveEntity | null;
+}
+export interface ArchiveProjectResponse {
+    projectArchive: ProjectArchivePayload;
+}
+export interface DeleteProjectResponse {
+    projectDelete: ProjectArchivePayload;
+}

package/dist/queries/projects-types.js

@@ -0,0 +1,5 @@
+/**
+ * Typed response shapes for the queries in `./projects.ts`.
+ * See `./issues-types.ts` for the rationale (ALL-937).
+ */
+export {};

package/dist/queries/projects.d.ts

@@ -5,3 +5,5 @@ export declare const GET_PROJECT_TEAM_ISSUES_QUERY = "\n  query GetProjectTeamIs
 export declare const SEARCH_PROJECTS_BY_NAME_QUERY = "\n  query SearchProjectsByName($name: String!) {\n    projects(filter: { name: { containsIgnoreCase: $name } }, first: 10) {\n      nodes {\n        id\n        name\n        state\n        teams {\n          nodes { id key name }\n        }\n      }\n    }\n  }\n";
 export declare const CREATE_PROJECT_MUTATION = "\n  mutation CreateProject($input: ProjectCreateInput!) {\n    projectCreate(input: $input) {\n      success\n      project {\n        id\n        name\n        state\n        teams {\n          nodes { id key name }\n        }\n      }\n    }\n  }\n";
 export declare const UPDATE_PROJECT_MUTATION = "\n  mutation UpdateProject($id: String!, $input: ProjectUpdateInput!) {\n    projectUpdate(id: $id, input: $input) {\n      success\n      project {\n        id\n        name\n        teams {\n          nodes {\n            id\n            key\n            name\n          }\n        }\n      }\n    }\n  }\n";
+export declare const ARCHIVE_PROJECT_MUTATION = "\n  mutation ArchiveProject($id: String!) {\n    projectArchive(id: $id) {\n      success\n      lastSyncId\n      entity {\n        id\n      }\n    }\n  }\n";
+export declare const DELETE_PROJECT_MUTATION = "\n  mutation DeleteProject($id: String!) {\n    projectDelete(id: $id) {\n      success\n      lastSyncId\n      entity {\n        id\n      }\n    }\n  }\n";

package/dist/queries/projects.js

@@ -102,3 +102,25 @@ export const UPDATE_PROJECT_MUTATION = `
     }
   }
 `;
+export const ARCHIVE_PROJECT_MUTATION = `
+  mutation ArchiveProject($id: String!) {
+    projectArchive(id: $id) {
+      success
+      lastSyncId
+      entity {
+        id
+      }
+    }
+  }
+`;
+export const DELETE_PROJECT_MUTATION = `
+  mutation DeleteProject($id: String!) {
+    projectDelete(id: $id) {
+      success
+      lastSyncId
+      entity {
+        id
+      }
+    }
+  }
+`;

package/dist/queries/releases-types.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Typed response shapes for the queries in `./releases.ts`.
+ * See `./issues-types.ts` for the rationale (ALL-937).
+ */
+export interface ReleaseStageRef {
+    id: string;
+    name: string;
+    type: string;
+    color: string | null;
+}
+export interface ReleasePipelineRef {
+    id: string;
+    name: string;
+}
+export interface ReleaseDocumentRef {
+    id: string;
+    title: string;
+    slugId: string;
+}
+/** Mirrors the release selection set used by `GET_RELEASES_QUERY`. */
+export interface ReleaseListNode {
+    id: string;
+    name: string;
+    description: string | null;
+    version: string | null;
+    url: string | null;
+    startDate: string | null;
+    targetDate: string | null;
+    startedAt: string | null;
+    completedAt: string | null;
+    canceledAt: string | null;
+    stage: ReleaseStageRef | null;
+    pipeline: ReleasePipelineRef | null;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Mirrors `GET_RELEASE_BY_ID_QUERY` — adds `documents`. */
+export interface ReleaseDetailNode extends ReleaseListNode {
+    documents: {
+        nodes: ReleaseDocumentRef[];
+    };
+}
+/**
+ * Mirrors the release selection set on `CREATE_RELEASE_MUTATION` —
+ * a subset of `ReleaseListNode` (no startDate/targetDate/lifecycle
+ * timestamps; no documents).
+ */
+export interface CreatedReleaseNode {
+    id: string;
+    name: string;
+    description: string | null;
+    version: string | null;
+    url: string | null;
+    stage: ReleaseStageRef | null;
+    pipeline: ReleasePipelineRef | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface ReleasePipelineNode {
+    id: string;
+    name: string;
+    stages: {
+        nodes: ReleaseStageRef[];
+    };
+}
+export interface GetReleasesResponse {
+    releases: {
+        nodes: ReleaseListNode[];
+    };
+}
+export interface GetReleaseByIdResponse {
+    release: ReleaseDetailNode | null;
+}
+export interface CreateReleaseResponse {
+    releaseCreate: {
+        success: boolean;
+        release: CreatedReleaseNode | null;
+    };
+}
+export interface GetReleasePipelinesResponse {
+    releasePipelines: {
+        nodes: ReleasePipelineNode[];
+    };
+}

package/dist/queries/releases-types.js

@@ -0,0 +1,5 @@
+/**
+ * Typed response shapes for the queries in `./releases.ts`.
+ * See `./issues-types.ts` for the rationale (ALL-937).
+ */
+export {};

package/dist/queries/search-types.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Typed response shapes for `SEMANTIC_SEARCH_QUERY` and the inline
+ * templates listing in `commands/search.ts`. See `./issues-types.ts`
+ * for the rationale (ALL-937).
+ */
+export interface SearchIssueRef {
+    id: string;
+    identifier: string;
+    title: string;
+    priority: number | null;
+    state: {
+        id: string;
+        name: string;
+    } | null;
+    team: {
+        id: string;
+        key: string;
+        name: string;
+    } | null;
+    assignee: {
+        id: string;
+        name: string;
+        url: string | null;
+    } | null;
+    project: {
+        id: string;
+        name: string;
+    } | null;
+}
+export interface SearchProjectRef {
+    id: string;
+    name: string;
+    state: string;
+}
+export interface SearchInitiativeRef {
+    id: string;
+    name: string;
+    status: string | null;
+}
+export interface SearchDocumentRef {
+    id: string;
+    title: string;
+    slugId: string | null;
+    project: {
+        id: string;
+        name: string;
+    } | null;
+}
+/**
+ * Mirrors a single semanticSearch result. The discriminator is `type`,
+ * but Linear returns *all* sub-objects nullable per row — only the one
+ * matching `type` is populated. Modelled as fully-optional sub-objects
+ * to match runtime reality.
+ */
+export interface SemanticSearchResult {
+    type: string;
+    issue: SearchIssueRef | null;
+    project: SearchProjectRef | null;
+    initiative: SearchInitiativeRef | null;
+    document: SearchDocumentRef | null;
+}
+export interface SemanticSearchResponse {
+    semanticSearch: {
+        results: SemanticSearchResult[];
+    } | null;
+}
+/**
+ * Mirrors the inline `TEMPLATES_QUERY` in `commands/search.ts` —
+ * a smaller selection set than the full templates query, dropping
+ * fields the search command doesn't display.
+ */
+export interface SearchTemplateNode {
+    id: string;
+    name: string;
+    type: string;
+    description: string | null;
+    team: {
+        key: string;
+    } | null;
+    creator: {
+        name: string;
+    } | null;
+}
+export interface SearchTemplatesResponse {
+    templates: SearchTemplateNode[];
+}

package/dist/queries/search-types.js

@@ -0,0 +1,6 @@
+/**
+ * Typed response shapes for `SEMANTIC_SEARCH_QUERY` and the inline
+ * templates listing in `commands/search.ts`. See `./issues-types.ts`
+ * for the rationale (ALL-937).
+ */
+export {};

package/dist/queries/templates-types.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Typed response shapes for the queries in `./templates.ts`.
+ * See `./issues-types.ts` for the rationale (ALL-937).
+ *
+ * Note: `templates` is unusual — it returns the array directly rather
+ * than wrapped in `{ nodes: ... }`. The response type below mirrors
+ * what the API actually returns, not the connection convention.
+ */
+export interface TemplateTeamRef {
+    id: string;
+    key: string;
+    name: string;
+}
+export interface TemplateCreatorRef {
+    id: string;
+    name: string;
+}
+/**
+ * Mirrors the template selection set used by `TEMPLATES_LIST_QUERY` /
+ * `TEMPLATE_BY_ID_QUERY` / `TEMPLATE_CREATE_MUTATION` /
+ * `TEMPLATE_UPDATE_MUTATION`. (Some of those omit `creator` and
+ * `createdAt`; we model the union — consumers only read what their
+ * query selected.)
+ */
+export interface TemplateNode {
+    id: string;
+    name: string;
+    type: string;
+    description: string | null;
+    templateData: unknown;
+    createdAt: string;
+    updatedAt: string;
+    team: TemplateTeamRef | null;
+    creator: TemplateCreatorRef | null;
+}
+export interface TemplatesListResponse {
+    templates: TemplateNode[];
+}
+export interface GetTemplateResponse {
+    template: TemplateNode | null;
+}
+export interface CreateTemplateResponse {
+    templateCreate: {
+        success: boolean;
+        lastSyncId?: number;
+        template: TemplateNode | null;
+    };
+}
+export interface UpdateTemplateResponse {
+    templateUpdate: {
+        success: boolean;
+        lastSyncId?: number;
+        template: TemplateNode | null;
+    };
+}
+export interface DeleteTemplateResponse {
+    templateDelete: {
+        success: boolean;
+        lastSyncId?: number;
+    };
+}

package/dist/queries/templates-types.js

@@ -0,0 +1,9 @@
+/**
+ * Typed response shapes for the queries in `./templates.ts`.
+ * See `./issues-types.ts` for the rationale (ALL-937).
+ *
+ * Note: `templates` is unusual — it returns the array directly rather
+ * than wrapped in `{ nodes: ... }`. The response type below mirrors
+ * what the API actually returns, not the connection convention.
+ */
+export {};

package/dist/queries/templates.d.ts

@@ -1,2 +1,5 @@
 export declare const TEMPLATES_LIST_QUERY = "\n  query {\n    templates {\n      id\n      name\n      type\n      description\n      templateData\n      createdAt\n      updatedAt\n      team { id key name }\n      creator { id name }\n    }\n  }\n";
 export declare const TEMPLATE_BY_ID_QUERY = "\n  query ($id: String!) {\n    template(id: $id) {\n      id\n      name\n      type\n      description\n      templateData\n      createdAt\n      updatedAt\n      team { id key name }\n      creator { id name }\n    }\n  }\n";
+export declare const TEMPLATE_CREATE_MUTATION = "\n  mutation ($input: TemplateCreateInput!) {\n    templateCreate(input: $input) {\n      success\n      lastSyncId\n      template {\n        id\n        name\n        type\n        description\n        templateData\n        team { id key name }\n        createdAt\n        updatedAt\n      }\n    }\n  }\n";
+export declare const TEMPLATE_UPDATE_MUTATION = "\n  mutation ($id: String!, $input: TemplateUpdateInput!) {\n    templateUpdate(id: $id, input: $input) {\n      success\n      lastSyncId\n      template {\n        id\n        name\n        type\n        description\n        templateData\n        team { id key name }\n        updatedAt\n      }\n    }\n  }\n";
+export declare const TEMPLATE_DELETE_MUTATION = "\n  mutation ($id: String!) {\n    templateDelete(id: $id) {\n      success\n      lastSyncId\n    }\n  }\n";

package/dist/queries/templates.js

@@ -28,3 +28,46 @@ export const TEMPLATE_BY_ID_QUERY = `
     }
   }
 `;
+export const TEMPLATE_CREATE_MUTATION = `
+  mutation ($input: TemplateCreateInput!) {
+    templateCreate(input: $input) {
+      success
+      lastSyncId
+      template {
+        id
+        name
+        type
+        description
+        templateData
+        team { id key name }
+        createdAt
+        updatedAt
+      }
+    }
+  }
+`;
+export const TEMPLATE_UPDATE_MUTATION = `
+  mutation ($id: String!, $input: TemplateUpdateInput!) {
+    templateUpdate(id: $id, input: $input) {
+      success
+      lastSyncId
+      template {
+        id
+        name
+        type
+        description
+        templateData
+        team { id key name }
+        updatedAt
+      }
+    }
+  }
+`;
+export const TEMPLATE_DELETE_MUTATION = `
+  mutation ($id: String!) {
+    templateDelete(id: $id) {
+      success
+      lastSyncId
+    }
+  }
+`;

package/dist/types/linear.d.ts

@@ -208,8 +208,14 @@ type GraphQLPrimitive = string | number | boolean | null | undefined;
 type GraphQLValue = GraphQLPrimitive | GraphQLResponseData | GraphQLResponseData[];
 /**
  * Recursive index type for raw GraphQL responses.
- * All nested property access requires narrowing via `as GraphQLResponseData`
- * or `as string` etc. — this prevents `any` from leaking into the type system.
+ *
+ * **Prefer per-query response types** (see `src/queries/*-types.ts`)
+ * over `GraphQLResponseData` for any new consumer. ALL-937 swept the
+ * old service/command consumers; this type is kept as the fallback
+ * for the few generic transports (e.g. `graphql-service.rawRequest`'s
+ * default generic). Don't reach for `as GraphQLResponseData` to skip
+ * a typed shape — the per-query types catch query/consumer drift at
+ * compile time. This type cannot.
  */
 export interface GraphQLResponseData {
     [key: string]: GraphQLValue;

package/dist/utils/auth.js

@@ -1,5 +1,5 @@
 import fs from "node:fs";
-import { LEGACY_LINCTL_TOKEN_PATH, LEGACY_TOKEN_PATH, resolveActiveProfile, TOKEN_PATH, } from "../config/paths.js";
+import { LEGACY_LINCTL_TOKEN_PATH, LEGACY_TOKEN_PATH, resolveActiveProfile, } from "../config/paths.js";
 import { maybeEmitMigrationHint } from "./migration-hint.js";
 export function getApiToken(options) {
     if (options.apiToken) {
@@ -9,18 +9,16 @@ export function getApiToken(options) {
         return process.env.LINEAR_API_TOKEN;
     }
     // Profile-aware: read from <CONFIG_DIR>/profiles/<name>/token when a
-    // profile is active, falling back to the legacy single-file path
-    // (TOKEN_PATH) for the no-profile case.
+    // profile is active. When the user has explicitly selected a profile
+    // (--profile / EL_LINEAR_PROFILE / active-profile marker), do NOT
+    // fall back to the legacy single-file token — that path silently
+    // posts writes to the wrong workspace when a profile token is missing.
     const active = resolveActiveProfile();
     if (fs.existsSync(active.tokenPath)) {
         return fs.readFileSync(active.tokenPath, "utf8").trim();
     }
-    // Even when a profile is selected, fall through to the legacy token
-    // path so an operator who only has the single-file layout doesn't
-    // suddenly fail. The active-profile name is informational only when
-    // no profile-scoped token exists yet.
-    if (active.tokenPath !== TOKEN_PATH && fs.existsSync(TOKEN_PATH)) {
-        return fs.readFileSync(TOKEN_PATH, "utf8").trim();
+    if (active.name !== null) {
+        throw new Error(`No token for active profile \`${active.name}\` (expected at ${active.tokenPath}). Run \`el-linear init token --profile ${active.name}\` (or unset --profile / EL_LINEAR_PROFILE / \`el-linear profile use <name>\`) before retrying. Refusing to fall back to the legacy single-file token to avoid posting writes to the wrong workspace.`);
     }
     // Fallback to the linctl-era token (the CLI was briefly published as
     // `@enrichlayer/linctl` then reverted). Kept for one release.

package/dist/utils/auto-link-references.js

@@ -26,37 +26,44 @@ function mergeCandidates(...sources) {
     }
     return [...byId.values()];
 }
-function mergeRelationNodes(nodes, peerKey, normalizeType, out) {
-    for (const rel of nodes ?? []) {
-        const peer = rel[peerKey];
+function mergeOutgoingRelations(nodes, out) {
+    for (const rel of nodes) {
+        const peer = rel.relatedIssue;
         if (!peer) {
             continue;
         }
-        const id = peer.identifier;
-        const uuid = peer.id;
-        const type = normalizeType(rel.type);
-        if (id && !out.byIdentifier.has(id)) {
-            out.byIdentifier.set(id, type);
+        if (!out.byIdentifier.has(peer.identifier)) {
+            out.byIdentifier.set(peer.identifier, rel.type);
         }
-        if (uuid && !out.byUuid.has(uuid)) {
-            out.byUuid.set(uuid, type);
+        if (!out.byUuid.has(peer.id)) {
+            out.byUuid.set(peer.id, rel.type);
+        }
+    }
+}
+function mergeIncomingRelations(nodes, out) {
+    for (const rel of nodes) {
+        const peer = rel.issue;
+        if (!peer) {
+            continue;
+        }
+        // Normalize incoming "blocks" → "blockedBy" so the reported type reads naturally
+        const type = rel.type === "blocks" ? "blockedBy" : rel.type;
+        if (!out.byIdentifier.has(peer.identifier)) {
+            out.byIdentifier.set(peer.identifier, type);
+        }
+        if (!out.byUuid.has(peer.id)) {
+            out.byUuid.set(peer.id, type);
         }
     }
 }
 async function fetchExistingRelations(issueId, graphQLService) {
-    const result = await graphQLService.rawRequest(GET_ISSUE_RELATIONS_QUERY, {
-        id: issueId,
-    });
-    const issue = result.issue;
+    const result = await graphQLService.rawRequest(GET_ISSUE_RELATIONS_QUERY, { id: issueId });
     const out = { byIdentifier: new Map(), byUuid: new Map() };
-    if (!issue) {
+    if (!result.issue) {
         return out;
     }
-    const outgoing = issue.relations;
-    mergeRelationNodes(outgoing?.nodes, "relatedIssue", (raw) => raw, out);
-    const incoming = issue.inverseRelations;
-    // Normalize incoming "blocks" → "blockedBy" so the reported type reads naturally
-    mergeRelationNodes(incoming?.nodes, "issue", (raw) => (raw === "blocks" ? "blockedBy" : raw), out);
+    mergeOutgoingRelations(result.issue.relations.nodes, out);
+    mergeIncomingRelations(result.issue.inverseRelations.nodes, out);
     return out;
 }
 function describeError(err) {
@@ -70,11 +77,9 @@ async function createTypedRelation(ref, sourceId, resolvedId, graphQLService) {
             type: ref.type,
         },
     });
-    const create = result.issueRelationCreate;
-    const issueRelation = create?.issueRelation;
+    const issueRelation = result.issueRelationCreate.issueRelation;
     // The peer (the issue NOT identified by `sourceId`) is whichever side wasn't the source
-    const peerKey = ref.reverse ? "issue" : "relatedIssue";
-    const peer = issueRelation?.[peerKey];
+    const peer = ref.reverse ? issueRelation?.issue : issueRelation?.relatedIssue;
     return {
         identifier: peer?.identifier ?? ref.identifier,
         title: peer?.title ?? "",
@@ -155,7 +160,21 @@ export async function autoLinkReferences(input) {
     const failed = [];
     const descriptionRefs = extractIssueReferences(description ?? "", identifier);
     const commentRefs = (comments ?? []).flatMap((body) => extractIssueReferences(body, identifier));
-    const candidates = mergeCandidates(descriptionRefs, commentRefs);
+    const merged = mergeCandidates(descriptionRefs, commentRefs);
+    // Cap the number of candidates we'll resolve per call. A malicious
+    // (or merely careless) issue body containing hundreds of fake
+    // identifiers — `AAA-1, AAA-2, …, AAA-999` — would otherwise trigger
+    // 999 GraphQL roundtrips before deciding none resolve. Realistic
+    // human-authored bodies stay well under this cap.
+    const MAX_CANDIDATES_PER_CALL = 50;
+    const candidates = merged.slice(0, MAX_CANDIDATES_PER_CALL);
+    if (merged.length > MAX_CANDIDATES_PER_CALL) {
+        const overflow = merged.length - MAX_CANDIDATES_PER_CALL;
+        failed.push({
+            identifier: `+${overflow} more`,
+            reason: `Too many candidate references (${merged.length}); only the first ${MAX_CANDIDATES_PER_CALL} are processed.`,
+        });
+    }
     if (candidates.length === 0) {
         return { linked, skipped, failed };
     }