@humanbased/crosscheck 1.2.0-beta.2 → 1.2.0-beta.35

package/dist/linear/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/linear/client.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,mFAAmF;AAInF,MAAM,gBAAgB,GAAG,gCAAgC,CAAA;AAkBzD,MAAM,kBAAkB,GAAG,oCAAoC,CAAA;AAE/D,SAAS,UAAU,CAAC,IAAwB;IAC1C,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAwB,EACxB,KAAa,EACb,SAAkC,EAClC,OAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAK,UAAU,CAAC,KAAmB,CAAA;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAA;IAElD,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;QACvC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE;QAChF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;KAC3C,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,MAA0D,CAAA;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iDAAiD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IACtF,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9E,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED,MAAM,UAAU,GAAG;;;;EAIjB,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAwB,EACxB,UAAkB,EAClB,OAA6B,EAAE;IAE/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uCAAuC,UAAU,2BAA2B,CAAC,CAAA;IAC/F,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,IAAI,EACJ,UAAU,EACV,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAC1E,IAAI,CACL,CAAA;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;AACrC,CAAC;AAED,MAAM,cAAc,GAAG;;;;;EAKrB,CAAA;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAwB,EACxB,OAAe,EACf,IAAY,EACZ,OAA6B,EAAE;IAE/B,MAAM,SAAS,GAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IAC5D,oDAAoD;IACpD,IAAI,IAAI,CAAC,YAAY;QAAE,SAAS,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAA;IAEjE,MAAM,IAAI,GAAG,MAAM,aAAa,CAC9B,IAAI,EACJ,cAAc,EACd,SAAS,EACT,IAAI,CACL,CAAA;IAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAA;AACnC,CAAC"}

package/dist/linear/comment.d.ts

@@ -0,0 +1,20 @@
+export interface LinearCommentInput {
+    /** `🤖 {actor} · {product}` — must lead the comment (IN-2260 step 3). */
+    signature: string;
+    verdict: string | null;
+    reviewer: string;
+    origin: string;
+    model: string;
+    prUrl: string;
+    prTitle: string;
+    sha?: string;
+    summary?: string;
+    service?: string;
+    /** Workflow step this verdict came from — a recheck must not read as a review. */
+    stepType?: string;
+    round?: number;
+}
+export declare function buildLinearCommentBody(input: LinearCommentInput): string;
+export declare function normalizeVerdict(verdict: string | null): string;
+export declare function shouldPostToLinear(verdict: string | null, commentOn: readonly string[]): boolean;
+//# sourceMappingURL=comment.d.ts.map

package/dist/linear/comment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment.d.ts","sourceRoot":"","sources":["../../src/linear/comment.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAsBD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAyBxE;AAKD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE/D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAGhG"}

package/dist/linear/comment.js

@@ -0,0 +1,53 @@
+// Body construction for the comment crosscheck posts back to a PR's Linear issue.
+import { buildAnnotation } from '../lib/annotation.js';
+const DEFAULT_SERVICE = 'crosscheck';
+// The visible line must agree with the annotation. Saying "review" on a recheck
+// made the human-readable text contradict the type=recheck sitting right below it.
+// Returns the whole connective phrase, including the preposition — "fix of" is
+// not English, so the label owns it rather than the template appending one.
+function stepLabel(stepType) {
+    switch (stepType) {
+        case 'recheck': return 'recheck of';
+        case 'fix': return 'fix for';
+        case 'conflict-resolve': return 'conflict resolution for';
+        default: return 'review of';
+    }
+}
+// A `]` in the PR title would terminate the markdown link label early.
+function escapeLinkLabel(text) {
+    return text.replace(/([[\]])/g, '\\$1');
+}
+export function buildLinearCommentBody(input) {
+    const verdict = input.verdict ?? 'UNKNOWN';
+    const service = input.service ?? DEFAULT_SERVICE;
+    const sections = [
+        input.signature,
+        '',
+        `**${verdict}** — ${input.reviewer} ${stepLabel(input.stepType)} [${escapeLinkLabel(input.prTitle)}](${input.prUrl})`,
+    ];
+    if (input.summary)
+        sections.push('', input.summary);
+    // Same annotation schema as the GitHub comment, so one parser reads both.
+    sections.push('', buildAnnotation({
+        origin: input.origin,
+        reviewer: input.reviewer,
+        model: input.model,
+        type: input.stepType ?? 'review',
+        round: input.round ?? 1,
+        verdict,
+        service,
+        ...(input.sha && { sha: input.sha }),
+    }));
+    return sections.join('\n');
+}
+// parseVerdict yields the human spelling `NEEDS WORK`, while config and the
+// annotation schema both use `NEEDS_WORK`. Comparing them raw silently dropped
+// every NEEDS WORK verdict — the most common actionable one.
+export function normalizeVerdict(verdict) {
+    return (verdict ?? 'UNKNOWN').trim().toUpperCase().replace(/\s+/g, '_');
+}
+export function shouldPostToLinear(verdict, commentOn) {
+    const wanted = normalizeVerdict(verdict);
+    return commentOn.some(v => normalizeVerdict(v) === wanted);
+}
+//# sourceMappingURL=comment.js.map

package/dist/linear/comment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comment.js","sourceRoot":"","sources":["../../src/linear/comment.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAoBtD,MAAM,eAAe,GAAG,YAAY,CAAA;AAEpC,gFAAgF;AAChF,mFAAmF;AACnF,+EAA+E;AAC/E,4EAA4E;AAC5E,SAAS,SAAS,CAAC,QAA4B;IAC7C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,SAAS,CAAC,CAAC,OAAO,YAAY,CAAA;QACnC,KAAK,KAAK,CAAC,CAAC,OAAO,SAAS,CAAA;QAC5B,KAAK,kBAAkB,CAAC,CAAC,OAAO,yBAAyB,CAAA;QACzD,OAAO,CAAC,CAAC,OAAO,WAAW,CAAA;IAC7B,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAyB;IAC9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,SAAS,CAAA;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,eAAe,CAAA;IAEhD,MAAM,QAAQ,GAAG;QACf,KAAK,CAAC,SAAS;QACf,EAAE;QACF,KAAK,OAAO,QAAQ,KAAK,CAAC,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,KAAK,GAAG;KACtH,CAAA;IAED,IAAI,KAAK,CAAC,OAAO;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAEnD,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC;QACvB,OAAO;QACP,OAAO;QACP,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC;KACrC,CAAC,CAAC,CAAA;IAEH,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC5B,CAAC;AAED,4EAA4E;AAC5E,+EAA+E;AAC/E,6DAA6D;AAC7D,MAAM,UAAU,gBAAgB,CAAC,OAAsB;IACrD,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAsB,EAAE,SAA4B;IACrF,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACxC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAA;AAC5D,CAAC"}

package/dist/linear/identity.d.ts

@@ -0,0 +1,47 @@
+import type { LinearConfig } from '../config/schema.js';
+/** Injectable fetch, so tests never touch the network. */
+export type FetchLike = (url: string, init: RequestInit) => Promise<Response>;
+export type LinearAuthMode = 'api_key' | 'client_credentials';
+/** Credentials read from the environment. Resolved in config/loader.ts — never here. */
+export interface LinearCredentials {
+    apiKey?: string;
+    clientId?: string;
+    clientSecret?: string;
+}
+export interface ResolvedLinearAuth {
+    mode: LinearAuthMode;
+    /** Bare API key (T0) or minted app token (T1). Never log this. */
+    token: string;
+    /** T1 tokens need an `Authorization: Bearer` prefix; T0 keys are sent bare. */
+    bearer: boolean;
+    actor: string;
+    /** Rendered `🤖 {actor} · {product}` line. Leads every write in both tiers. */
+    signature: string;
+    /** Set in T1 only — Linear attributes the write to this display name. */
+    createAsUser?: string;
+    /** Retained so withWorker() can re-render the signature for a derived actor. */
+    signatureTemplate: string;
+    product: string;
+}
+export interface MintOptions {
+    fetchImpl?: FetchLike;
+}
+export interface ResolveOptions extends MintOptions {
+    /** Product name used in the signature template. */
+    product?: string;
+}
+export declare class LinearConfigError extends Error {
+    readonly userError = true;
+    constructor(message: string);
+}
+export declare function isLinearConfigError(err: unknown): boolean;
+export declare function renderSignature(template: string, actor: string, product: string): string;
+export declare function normalizeScopes(scopes: string): string;
+export declare function mintAppToken(creds: {
+    clientId: string;
+    clientSecret: string;
+    scopes: string;
+}, opts?: MintOptions): Promise<string>;
+export declare function resolveLinearAuth(config: LinearConfig, creds: LinearCredentials, opts?: ResolveOptions): Promise<ResolvedLinearAuth>;
+export declare function withWorker(auth: ResolvedLinearAuth, worker: string): ResolvedLinearAuth;
+//# sourceMappingURL=identity.d.ts.map

package/dist/linear/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/linear/identity.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAIvD,0DAA0D;AAC1D,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE7E,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,oBAAoB,CAAA;AAE7D,wFAAwF;AACxF,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,cAAc,CAAA;IACpB,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb,+EAA+E;IAC/E,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,+EAA+E;IAC/E,SAAS,EAAE,MAAM,CAAA;IACjB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,gFAAgF;IAChF,iBAAiB,EAAE,MAAM,CAAA;IACzB,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAOD,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,SAAS,QAAO;gBACb,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAExF;AAKD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAsB,YAAY,CAChC,KAAK,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACjE,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,MAAM,CAAC,CA8CjB;AAED,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,iBAAiB,EACxB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAwD7B;AAWD,wBAAgB,UAAU,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAWvF"}

package/dist/linear/identity.js

@@ -0,0 +1,151 @@
+// Tiered Linear identity (IN-2267 / IN-2269).
+//
+//   T0 api_key            — operator supplies a personal/workspace key. Writes carry a
+//                           `🤖 {actor} · {product}` signature line. Works everywhere,
+//                           weakest attribution.
+//   T1 client_credentials — operator creates an OAuth app in their own workspace and
+//                           enables the Client credentials toggle. We mint a Bearer app
+//                           token per run and pass `createAsUser` on every write, so
+//                           Linear renders them as the app (botActor), not a human.
+//
+// Hard requirements this module enforces:
+//   * Secrets travel in a POST body — never on argv, never in a URL, never logged.
+//   * A configured-but-failing T1 mint ABORTS. It must never silently downgrade to
+//     api_key, because that would re-attribute agent writes to a human account.
+const TOKEN_ENDPOINT = 'https://api.linear.app/oauth/token';
+const DEFAULT_PRODUCT = 'crosscheck';
+// Misconfiguration (missing env var, rejected credentials) is a user error, so it
+// must surface as exit 1 — the CLI contract reserves 2 for unexpected failures.
+// commands/review.ts already exits 1 here; the workflow path has to agree.
+export class LinearConfigError extends Error {
+    userError = true;
+    constructor(message) {
+        super(message);
+        this.name = 'LinearConfigError';
+    }
+}
+export function isLinearConfigError(err) {
+    return err instanceof LinearConfigError;
+}
+export function renderSignature(template, actor, product) {
+    return template.replaceAll('{actor}', actor).replaceAll('{product}', product);
+}
+// Linear's token endpoint documents scope as a COMMA-separated list, but OAuth 2.0
+// itself specifies space-separated, so operators write it both ways. Accept either
+// and always send commas.
+export function normalizeScopes(scopes) {
+    return scopes.split(/[\s,]+/).filter(Boolean).join(',');
+}
+export async function mintAppToken(creds, opts = {}) {
+    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    // URLSearchParams keeps the secret in the request body. Nothing here reaches argv.
+    const body = new URLSearchParams({
+        grant_type: 'client_credentials',
+        client_id: creds.clientId,
+        client_secret: creds.clientSecret,
+        scope: normalizeScopes(creds.scopes),
+    });
+    let response;
+    try {
+        response = await doFetch(TOKEN_ENDPOINT, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        });
+    }
+    catch (err) {
+        // Transport failure — Linear is unreachable. Not a configuration problem, so
+        // this stays a plain Error and classifies as an unexpected failure (exit 2).
+        throw new Error(`Linear token mint failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const text = await response.text();
+    if (!response.ok) {
+        // 4xx means Linear rejected these credentials or scopes — the operator can fix
+        // that. 5xx is an outage, and 429 is rate limiting: both are transient and must
+        // not be blamed on the config.
+        const message = `Linear token mint rejected (HTTP ${response.status})`;
+        const transient = response.status >= 500 || response.status === 429;
+        throw transient ? new Error(message) : new LinearConfigError(message);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`Linear token mint returned a non-JSON response (HTTP ${response.status})`);
+    }
+    const token = parsed.access_token;
+    if (typeof token !== 'string' || token.length === 0) {
+        throw new Error('Linear token mint returned no access_token');
+    }
+    return token;
+}
+export async function resolveLinearAuth(config, creds, opts = {}) {
+    const product = opts.product ?? DEFAULT_PRODUCT;
+    const { actor, signature: template } = config.identity;
+    const signature = renderSignature(template, actor, product);
+    if (config.auth.mode === 'client_credentials') {
+        const missing = [];
+        if (!creds.clientId)
+            missing.push(config.auth.client_id_env);
+        if (!creds.clientSecret)
+            missing.push(config.auth.client_secret_env);
+        if (missing.length > 0) {
+            // Abort rather than fall back — see the module header.
+            throw new LinearConfigError(`Linear auth mode is client_credentials but ${missing.join(' and ')} ` +
+                `${missing.length > 1 ? 'are' : 'is'} not set. ` +
+                'Set them, or switch linear.auth.mode to api_key.');
+        }
+        let token;
+        try {
+            token = await mintAppToken({ clientId: creds.clientId, clientSecret: creds.clientSecret, scopes: config.auth.scopes }, opts);
+        }
+        catch (err) {
+            // Preserve the classification the mint chose: a rejected credential stays a
+            // config error (exit 1), an outage stays unexpected (exit 2). Both abort —
+            // neither falls back to api_key.
+            // Name the variables to check. A bare "HTTP 401" leaves an operator with
+            // custom env names guessing which credential to rotate. Names only — never
+            // the values.
+            const message = `Linear client_credentials token mint failed — aborting rather than falling back ` +
+                `to an API key (that would attribute agent writes to a human). ` +
+                `Check ${config.auth.client_id_env} and ${config.auth.client_secret_env}. ` +
+                `${err instanceof Error ? err.message : String(err)}`;
+            throw isLinearConfigError(err) ? new LinearConfigError(message) : new Error(message);
+        }
+        return {
+            mode: 'client_credentials', token, bearer: true, actor, signature,
+            createAsUser: actor, signatureTemplate: template, product,
+        };
+    }
+    if (!creds.apiKey) {
+        throw new LinearConfigError(`Linear is enabled but ${config.auth.api_key_env} is not set. ` +
+            `Set it, or disable the linear block in your config.`);
+    }
+    return {
+        mode: 'api_key', token: creds.apiKey, bearer: false, actor, signature,
+        signatureTemplate: template, product,
+    };
+}
+// Derives a step-scoped identity: `crosscheck` → `crosscheck/review`.
+//
+// The epic calls for per-worker display names (its example is `symphony/worker-3`)
+// so a fleet of agents does not collapse into one indistinguishable bot. crosscheck's
+// natural axis is the workflow step that produced the write.
+//
+// T1 re-points createAsUser, which is what Linear actually renders. T0 has no
+// createAsUser, so the suffix only reaches the signature line — still an improvement,
+// since that is T0's whole attribution mechanism.
+export function withWorker(auth, worker) {
+    const trimmed = worker.trim();
+    if (!trimmed)
+        return auth;
+    const actor = `${auth.actor}/${trimmed}`;
+    return {
+        ...auth,
+        actor,
+        signature: renderSignature(auth.signatureTemplate, actor, auth.product),
+        ...(auth.createAsUser !== undefined && { createAsUser: actor }),
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/linear/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/linear/identity.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,uFAAuF;AACvF,uFAAuF;AACvF,iDAAiD;AACjD,qFAAqF;AACrF,wFAAwF;AACxF,qFAAqF;AACrF,oFAAoF;AACpF,EAAE;AACF,0CAA0C;AAC1C,mFAAmF;AACnF,mFAAmF;AACnF,gFAAgF;AAIhF,MAAM,cAAc,GAAG,oCAAoC,CAAA;AAuC3D,MAAM,eAAe,GAAG,YAAY,CAAA;AAEpC,kFAAkF;AAClF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,SAAS,GAAG,IAAI,CAAA;IACzB,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO,GAAG,YAAY,iBAAiB,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,KAAa,EAAE,OAAe;IAC9E,OAAO,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;AAC/E,CAAC;AAED,mFAAmF;AACnF,mFAAmF;AACnF,0BAA0B;AAC1B,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiE,EACjE,OAAoB,EAAE;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAK,UAAU,CAAC,KAAmB,CAAA;IAEjE,mFAAmF;IACnF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;KACrC,CAAC,CAAA;IAEF,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAClG,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,+EAA+E;QAC/E,gFAAgF;QAChF,+BAA+B;QAC/B,MAAM,OAAO,GAAG,oCAAoC,QAAQ,CAAC,MAAM,GAAG,CAAA;QACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAA;QACnE,MAAM,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wDAAwD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IAC7F,CAAC;IAED,MAAM,KAAK,GAAI,MAAqC,CAAC,YAAY,CAAA;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAoB,EACpB,KAAwB,EACxB,OAAuB,EAAE;IAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAA;IAC/C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAA;IACtD,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;IAE3D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC5D,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,uDAAuD;YACvD,MAAM,IAAI,iBAAiB,CACzB,8CAA8C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG;gBACtE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY;gBAChD,kDAAkD,CACnD,CAAA;QACH,CAAC;QAED,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,YAAY,CACxB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAa,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAC5F,IAAI,CACL,CAAA;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,4EAA4E;YAC5E,2EAA2E;YAC3E,iCAAiC;YACjC,yEAAyE;YACzE,2EAA2E;YAC3E,cAAc;YACd,MAAM,OAAO,GACX,kFAAkF;gBAClF,gEAAgE;gBAChE,SAAS,MAAM,CAAC,IAAI,CAAC,aAAa,QAAQ,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI;gBAC3E,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;YACvD,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;QACtF,CAAC;QAED,OAAO;YACL,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS;YACjE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO;SAC1D,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,MAAM,CAAC,IAAI,CAAC,WAAW,eAAe;YAC/D,qDAAqD,CACtD,CAAA;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS;QACrE,iBAAiB,EAAE,QAAQ,EAAE,OAAO;KACrC,CAAA;AACH,CAAC;AAED,sEAAsE;AACtE,EAAE;AACF,mFAAmF;AACnF,sFAAsF;AACtF,6DAA6D;AAC7D,EAAE;AACF,8EAA8E;AAC9E,sFAAsF;AACtF,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,IAAwB,EAAE,MAAc;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAEzB,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,CAAA;IACxC,OAAO;QACL,GAAG,IAAI;QACP,KAAK;QACL,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;KAChE,CAAA;AACH,CAAC"}

package/dist/linear/notify.d.ts

@@ -0,0 +1,35 @@
+import { type LinearRequestOptions } from './client.js';
+import type { ResolvedLinearAuth } from './identity.js';
+import type { LinearConfig } from '../config/schema.js';
+export type LinearNotifyStatus = 'posted' | 'skipped' | 'failed';
+export interface LinearNotifyResult {
+    status: LinearNotifyStatus;
+    /** Machine-readable reason for skipped/failed. */
+    reason?: string;
+    identifier?: string;
+    url?: string;
+}
+export interface LinearNotifyParams {
+    auth: ResolvedLinearAuth;
+    config: LinearConfig;
+    pr: {
+        branch?: string;
+        title: string;
+        body?: string;
+        url: string;
+        sha?: string;
+    };
+    verdict: string | null;
+    reviewer: string;
+    origin: string;
+    model: string;
+    summary?: string;
+    service?: string;
+    /** Workflow step that produced this verdict. Defaults to 'review'. */
+    stepType?: string;
+    /** 1-based workflow round. Defaults to 1. */
+    round?: number;
+}
+export declare function issueBelongsToWorkspace(issueUrl: string, workspace: string): boolean;
+export declare function notifyLinear(params: LinearNotifyParams, opts?: LinearRequestOptions): Promise<LinearNotifyResult>;
+//# sourceMappingURL=notify.d.ts.map

package/dist/linear/notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/linear/notify.ts"],"names":[],"mappings":"AASA,OAAO,EAA4C,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEjG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEhE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,kBAAkB,CAAA;IACxB,MAAM,EAAE,YAAY,CAAA;IACpB,EAAE,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAChF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAGD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQpF;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CA6C7B"}

package/dist/linear/notify.js

@@ -0,0 +1,65 @@
+// Orchestrates the one Linear write crosscheck makes: mirroring a review verdict
+// onto the Linear issue the PR belongs to.
+//
+// This never throws. Auth is resolved up front (fail-fast, before the expensive
+// review runs), so anything that goes wrong here is a per-write problem on a review
+// that already succeeded and already posted to GitHub. The caller logs the returned
+// status — failures are reported, never swallowed.
+import { buildLinearCommentBody, shouldPostToLinear } from './comment.js';
+import { findIssueByIdentifier, postLinearComment } from './client.js';
+import { extractLinearRef } from './ref.js';
+// Linear issue URLs are https://linear.app/<workspace>/issue/<ID>/<slug>.
+export function issueBelongsToWorkspace(issueUrl, workspace) {
+    try {
+        const segments = new URL(issueUrl).pathname.split('/').filter(Boolean);
+        return segments[0]?.toLowerCase() === workspace.toLowerCase();
+    }
+    catch {
+        // Unparseable URL from the API — fail closed rather than post to the wrong place.
+        return false;
+    }
+}
+export async function notifyLinear(params, opts = {}) {
+    const { auth, config, pr } = params;
+    if (!shouldPostToLinear(params.verdict, config.comment_on)) {
+        return { status: 'skipped', reason: 'verdict-not-configured' };
+    }
+    const ref = extractLinearRef({ branch: pr.branch, title: pr.title, body: pr.body }, config.team_keys);
+    if (!ref)
+        return { status: 'skipped', reason: 'no-issue-ref' };
+    try {
+        const issue = await findIssueByIdentifier(auth, ref.id, opts);
+        if (!issue)
+            return { status: 'skipped', reason: 'issue-not-found', identifier: ref.id };
+        // An explicit URL names a workspace, and identifiers repeat across workspaces.
+        // If the credentials resolve a different workspace, this is a same-numbered
+        // issue somewhere else — never the one the PR pointed at.
+        if (ref.workspace && !issueBelongsToWorkspace(issue.url, ref.workspace)) {
+            return { status: 'skipped', reason: 'workspace-mismatch', identifier: ref.id };
+        }
+        const body = buildLinearCommentBody({
+            signature: auth.signature,
+            verdict: params.verdict,
+            reviewer: params.reviewer,
+            origin: params.origin,
+            model: params.model,
+            prUrl: pr.url,
+            prTitle: pr.title,
+            ...(pr.sha && { sha: pr.sha }),
+            ...(params.stepType && { stepType: params.stepType }),
+            ...(params.round !== undefined && { round: params.round }),
+            ...(params.summary && { summary: params.summary }),
+            ...(params.service && { service: params.service }),
+        });
+        const comment = await postLinearComment(auth, issue.id, body, opts);
+        return { status: 'posted', identifier: issue.identifier, url: comment.url };
+    }
+    catch (err) {
+        return {
+            status: 'failed',
+            reason: err instanceof Error ? err.message : String(err),
+            identifier: ref.id,
+        };
+    }
+}
+//# sourceMappingURL=notify.js.map

package/dist/linear/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/linear/notify.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,2CAA2C;AAC3C,EAAE;AACF,gFAAgF;AAChF,oFAAoF;AACpF,oFAAoF;AACpF,mDAAmD;AAEnD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAA6B,MAAM,aAAa,CAAA;AACjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AA8B3C,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,SAAiB;IACzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACtE,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;QAClF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA0B,EAC1B,OAA6B,EAAE;IAE/B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAA;IAEnC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IAChE,CAAC;IAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACrG,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IAE9D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7D,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,CAAA;QAEvF,+EAA+E;QAC/E,4EAA4E;QAC5E,0DAA0D;QAC1D,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,CAAA;QAChF,CAAC;QAED,MAAM,IAAI,GAAG,sBAAsB,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,EAAE,CAAC,GAAG;YACb,OAAO,EAAE,EAAE,CAAC,KAAK;YACjB,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAClD,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;SACnD,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;IAC7E,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACxD,UAAU,EAAE,GAAG,CAAC,EAAE;SACnB,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/linear/ref.d.ts

@@ -0,0 +1,13 @@
+import { type TicketRef } from '../issues/ticket-ref.js';
+export interface LinearIssueRef extends TicketRef {
+    source: 'branch' | 'title' | 'body';
+    /** Workspace slug, when the ref came from an explicit URL. Bare refs have none. */
+    workspace?: string;
+}
+export interface PRMetadata {
+    branch?: string | null;
+    title?: string | null;
+    body?: string | null;
+}
+export declare function extractLinearRef(pr: PRMetadata, teamKeys: readonly string[]): LinearIssueRef | null;
+//# sourceMappingURL=ref.d.ts.map

package/dist/linear/ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref.d.ts","sourceRoot":"","sources":["../../src/linear/ref.ts"],"names":[],"mappings":"AAYA,OAAO,EAAoC,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAE1F,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAA;IACnC,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAiED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,GAAG,IAAI,CAanG"}

package/dist/linear/ref.js

@@ -0,0 +1,90 @@
+// Write-side ref resolution: which Linear issue should crosscheck comment on?
+//
+// Extraction primitives live in src/issues/ticket-ref.ts and are reused here —
+// this module only adds the two things the write path needs on top:
+//
+//   1. linear.app issue URLs, which are unambiguous and so need no configuration.
+//   2. A stricter policy for bare identifiers: they are only honoured for team keys
+//      the operator has configured. Enrichment can afford to match `UTF-8` and let
+//      the lookup return nothing, because a failed read is a no-op. A failed *write*
+//      would post a review comment onto an unrelated issue, so the write path
+//      requires the operator to name their team keys first.
+import { extractTicketRefs, parseTicketId } from '../issues/ticket-ref.js';
+// The identifier occupies one whole path segment. Lookaheads kept getting this
+// wrong in both directions: requiring `/` or end-of-path missed `IN-42.` at the
+// end of a sentence, and allowing any non-alphanumeric accepted `IN-123-typo` as
+// `IN-123`. Take the segment, strip trailing sentence punctuation, and require
+// parseTicketId to match it whole.
+const ISSUE_SEGMENTS = /^\/([^/]+)\/issue\/([^/]+)/i;
+// Leading punctuation is safe to allow — but only characters that cannot be part
+// of a hostname, so `notlinear.app` still cannot match. Missing `(linear.app/...)`
+// made it fall through to the bare-ID extractor, which returns no workspace and
+// so silently loses the workspace-mismatch protection.
+const BARE_URL = /(?:^|[\s([{<"'`,;])linear\.app\/([^/\s]+)\/issue\/([^/\s]+)/gi;
+// Absolute URLs are parsed and their hostname compared exactly. A boundary check
+// on the text is not enough: `https://evil.example/linear.app/acme/issue/IN-1`
+// satisfies any "character before linear.app" rule while pointing somewhere else.
+const ABSOLUTE_URL = /\bhttps?:\/\/[^\s<>()"'`]+/gi;
+/** Trailing sentence punctuation is never part of an identifier. */
+function stripTrailingPunctuation(segment) {
+    return segment.replace(/[.,;:!?)\]}>'"]+$/, '');
+}
+function fromUrl(text) {
+    for (const match of text.matchAll(ABSOLUTE_URL)) {
+        let parsed;
+        try {
+            parsed = new URL(match[0]);
+        }
+        catch {
+            continue;
+        }
+        if (parsed.hostname.toLowerCase() !== 'linear.app')
+            continue;
+        const segments = parsed.pathname.match(ISSUE_SEGMENTS);
+        if (!segments)
+            continue;
+        const ref = parseTicketId(stripTrailingPunctuation(segments[2]));
+        if (ref)
+            return withWorkspace(ref, segments[1]);
+    }
+    // Iterate, like the absolute-URL path above: a malformed candidate earlier in
+    // the text must not stop a valid one later from resolving.
+    for (const bare of text.matchAll(BARE_URL)) {
+        const ref = parseTicketId(stripTrailingPunctuation(bare[2]));
+        if (ref)
+            return withWorkspace(ref, bare[1]);
+    }
+    return null;
+}
+// An explicit URL names a workspace. Identifiers are only unique within one, so
+// dropping the slug lets a URL for workspace A resolve against credentials for
+// workspace B and comment on B's same-numbered issue.
+function withWorkspace(ref, workspace) {
+    return { ...ref, workspace: workspace.toLowerCase(), source: 'body' };
+}
+function matchField(text, teamKeys) {
+    const url = fromUrl(text);
+    if (url)
+        return url;
+    // Bare identifiers only for configured keys — see the module header.
+    if (teamKeys.length === 0)
+        return null;
+    const bare = extractTicketRefs({ title: text }, [...teamKeys])[0];
+    return bare ? { ...bare, source: 'body' } : null;
+}
+export function extractLinearRef(pr, teamKeys) {
+    const fields = [
+        [pr.branch, 'branch'],
+        [pr.title, 'title'],
+        [pr.body, 'body'],
+    ];
+    for (const [text, source] of fields) {
+        if (!text)
+            continue;
+        const ref = matchField(text, teamKeys);
+        if (ref)
+            return { ...ref, source };
+    }
+    return null;
+}
+//# sourceMappingURL=ref.js.map

package/dist/linear/ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref.js","sourceRoot":"","sources":["../../src/linear/ref.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,oEAAoE;AACpE,EAAE;AACF,kFAAkF;AAClF,oFAAoF;AACpF,mFAAmF;AACnF,qFAAqF;AACrF,8EAA8E;AAC9E,4DAA4D;AAE5D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAkB,MAAM,yBAAyB,CAAA;AAc1F,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,mCAAmC;AACnC,MAAM,cAAc,GAAG,6BAA6B,CAAA;AACpD,iFAAiF;AACjF,mFAAmF;AACnF,gFAAgF;AAChF,uDAAuD;AACvD,MAAM,QAAQ,GAAG,+DAA+D,CAAA;AAEhF,iFAAiF;AACjF,+EAA+E;AAC/E,kFAAkF;AAClF,MAAM,YAAY,GAAG,8BAA8B,CAAA;AAEnD,oEAAoE;AACpE,SAAS,wBAAwB,CAAC,OAAe;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,IAAI,MAAW,CAAA;QACf,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,YAAY;YAAE,SAAQ;QAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACtD,IAAI,CAAC,QAAQ;YAAE,SAAQ;QACvB,MAAM,GAAG,GAAG,aAAa,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAChE,IAAI,GAAG;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,8EAA8E;IAC9E,2DAA2D;IAC3D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5D,IAAI,GAAG;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,sDAAsD;AACtD,SAAS,aAAa,CAAC,GAAc,EAAE,SAAiB;IACtD,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAA2B;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,GAAG;QAAE,OAAO,GAAG,CAAA;IAEnB,qEAAqE;IACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAc,EAAE,QAA2B;IAC1E,MAAM,MAAM,GAAiE;QAC3E,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QACrB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QACnB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;KAClB,CAAA;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACtC,IAAI,GAAG;YAAE,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAA;IACpC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/linear/verify.d.ts

@@ -0,0 +1,21 @@
+import { type LinearAuthMode, type LinearCredentials, type ResolveOptions } from './identity.js';
+import { type LinearRequestOptions } from './client.js';
+import type { LinearConfig } from '../config/schema.js';
+export interface LinearIdentityReport {
+    ok: boolean;
+    mode: LinearAuthMode;
+    /** Actor name writes will carry, including any per-step suffix the caller applies. */
+    actor: string;
+    organization?: string;
+    /**
+     * 'app'  — writes render as the OAuth application (botActor). The goal state.
+     * 'user' — writes attribute to a human account. What IN-2271 is eliminating.
+     */
+    attribution: 'app' | 'user';
+    /** In api_key mode, the human account writes currently attribute to. */
+    attributesTo?: string;
+    /** Populated when ok is false. Never contains credential material. */
+    error?: string;
+}
+export declare function verifyLinearIdentity(config: LinearConfig, creds: LinearCredentials, opts?: ResolveOptions & LinearRequestOptions): Promise<LinearIdentityReport>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/linear/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/linear/verify.ts"],"names":[],"mappings":"AAWA,OAAO,EAAqB,KAAK,cAAc,EAAE,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAA;AACnH,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,EAAE,cAAc,CAAA;IACpB,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,WAAW,EAAE,KAAK,GAAG,MAAM,CAAA;IAC3B,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAQD,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,iBAAiB,EACxB,IAAI,GAAE,cAAc,GAAG,oBAAyB,GAC/C,OAAO,CAAC,oBAAoB,CAAC,CAkD/B"}

package/dist/linear/verify.js

@@ -0,0 +1,65 @@
+// Answers the one question a deployment cutover needs answered (IN-2271):
+// when this daemon writes to Linear, whose name is on it?
+//
+// The acceptance criterion for switching Humanbased's deployments to the HB Agent
+// Gateway is "zero writes from symphony/crosscheck attribute to a human account".
+// That is checkable ahead of time — resolve the identity, confirm the token is
+// accepted, and report what the write would render as.
+//
+// Never throws. A verification that fails is a report with ok: false, because the
+// caller is a status command that must still print the rest of its output.
+import { resolveLinearAuth } from './identity.js';
+import { linearGraphQL } from './client.js';
+const ORG_QUERY = `query { organization { name } }`;
+const VIEWER_QUERY = `query { viewer { name email } organization { name } }`;
+export async function verifyLinearIdentity(config, creds, opts = {}) {
+    const mode = config.auth.mode;
+    const attribution = mode === 'client_credentials' ? 'app' : 'user';
+    let auth;
+    try {
+        auth = await resolveLinearAuth(config, creds, opts);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            mode,
+            actor: config.identity.actor,
+            attribution,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+    try {
+        if (auth.mode === 'client_credentials') {
+            // An app token has no viewer — it acts as itself. Reaching the org at all is
+            // proof the minted token is accepted.
+            const data = await linearGraphQL(auth, ORG_QUERY, {}, opts);
+            return {
+                ok: true,
+                mode: auth.mode,
+                actor: auth.actor,
+                attribution: 'app',
+                ...(data.organization && { organization: data.organization.name }),
+            };
+        }
+        const data = await linearGraphQL(auth, VIEWER_QUERY, {}, opts);
+        const who = data.viewer?.email ?? data.viewer?.name ?? undefined;
+        return {
+            ok: true,
+            mode: auth.mode,
+            actor: auth.actor,
+            attribution: 'user',
+            ...(data.organization && { organization: data.organization.name }),
+            ...(who && { attributesTo: who }),
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            mode: auth.mode,
+            actor: auth.actor,
+            attribution,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/linear/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/linear/verify.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,kFAAkF;AAClF,2EAA2E;AAE3E,OAAO,EAAE,iBAAiB,EAAoE,MAAM,eAAe,CAAA;AACnH,OAAO,EAAE,aAAa,EAA6B,MAAM,aAAa,CAAA;AAoBtE,MAAM,SAAS,GAAG,iCAAiC,CAAA;AACnD,MAAM,YAAY,GAAG,uDAAuD,CAAA;AAK5E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAoB,EACpB,KAAwB,EACxB,OAA8C,EAAE;IAEhD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,MAAM,WAAW,GAAG,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;IAElE,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YAC5B,WAAW;YACX,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACvC,6EAA6E;YAC7E,sCAAsC;YACtC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAc,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;YACxE,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,KAAK;gBAClB,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;aACnE,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAiB,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,SAAS,CAAA;QAChE,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,MAAM;YACnB,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YAClE,GAAG,CAAC,GAAG,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;SAClC,CAAA;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW;YACX,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAA;IACH,CAAC;AACH,CAAC"}