@humanbased/crosscheck 1.2.0-beta.81 → 1.2.0

package/dist/linear/identity.js

@@ -1,187 +0,0 @@
-// Tiered Linear identity (IN-2267 / IN-2269).
-//
-//   T0 api_key            — operator supplies a personal/workspace key. Writes carry a
-//                           `🤖 {actor} · {product}` signature line. Works everywhere,
-//                           weakest attribution.
-//   T1 client_credentials — operator creates an OAuth app in their own workspace and
-//                           enables the Client credentials toggle. We mint a Bearer app
-//                           token per run and pass `createAsUser` on every write, so
-//                           Linear renders them as the app (botActor), not a human.
-//
-// Hard requirements this module enforces:
-//   * Secrets travel in a POST body — never on argv, never in a URL, never logged.
-//   * A configured-but-failing T1 mint ABORTS. It must never silently downgrade to
-//     api_key, because that would re-attribute agent writes to a human account.
-const TOKEN_ENDPOINT = 'https://api.linear.app/oauth/token';
-const DEFAULT_PRODUCT = 'crosscheck';
-// Misconfiguration (missing env var, rejected credentials) is a user error, so it
-// must surface as exit 1 — the CLI contract reserves 2 for unexpected failures.
-// commands/review.ts already exits 1 here; the workflow path has to agree.
-export class LinearConfigError extends Error {
-    userError = true;
-    constructor(message) {
-        super(message);
-        this.name = 'LinearConfigError';
-    }
-}
-export function isLinearConfigError(err) {
-    return err instanceof LinearConfigError;
-}
-// Renders the signature template. Unknown placeholders are left alone; known ones
-// with no value resolve to empty, and the leftover punctuation is tidied so a
-// template like `🤖 {icon} {actor} · {product} · {model}` still reads correctly
-// when icon and model are unset.
-export function renderSignature(template, vars) {
-    const values = {
-        actor: vars.actor,
-        product: vars.product,
-        model: vars.model ?? '',
-        reviewer: vars.reviewer ?? '',
-        icon: vars.icon ?? '',
-    };
-    // Mark where an empty placeholder stood so tidying can target exactly those gaps
-    // and leave separators the operator wrote deliberately alone.
-    const HOLE = '\u0000';
-    const substituted = template.replace(/\{(actor|product|model|reviewer|icon)\}/g, (_match, key) => values[key] === '' ? HOLE : values[key]);
-    return tidyHoles(substituted, HOLE);
-}
-// Removes each empty-placeholder hole together with ONE adjacent separator, so
-// `{a} · {model} · {b}` with no model yields `a · b` rather than `a ·  · b`.
-// Separators the operator wrote between two present values are never touched.
-function tidyHoles(text, hole) {
-    const SEP = '(?:\\s*[·—|]\\s*|\\s+)';
-    return text
-        // hole with a separator on either side — drop the hole and one separator
-        .replace(new RegExp(`${SEP}${hole}(?=${SEP})`, 'g'), '')
-        // hole at the end of the string, with its leading separator
-        .replace(new RegExp(`${SEP}${hole}\\s*$`, 'g'), '')
-        // hole at the start, with its trailing separator
-        .replace(new RegExp(`^\\s*${hole}${SEP}`, 'g'), '')
-        // any hole left over (no adjacent separator)
-        .split(hole).join('')
-        .trim();
-}
-/** Wraps a configured icon URL as inline markdown, or '' when unset. */
-export function renderIcon(iconUrl) {
-    const trimmed = iconUrl.trim();
-    return trimmed ? `![](${trimmed})` : '';
-}
-// Linear's token endpoint documents scope as a COMMA-separated list, but OAuth 2.0
-// itself specifies space-separated, so operators write it both ways. Accept either
-// and always send commas.
-export function normalizeScopes(scopes) {
-    return scopes.split(/[\s,]+/).filter(Boolean).join(',');
-}
-export async function mintAppToken(creds, opts = {}) {
-    const doFetch = opts.fetchImpl ?? globalThis.fetch;
-    // URLSearchParams keeps the secret in the request body. Nothing here reaches argv.
-    const body = new URLSearchParams({
-        grant_type: 'client_credentials',
-        client_id: creds.clientId,
-        client_secret: creds.clientSecret,
-        scope: normalizeScopes(creds.scopes),
-    });
-    let response;
-    try {
-        response = await doFetch(TOKEN_ENDPOINT, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: body.toString(),
-        });
-    }
-    catch (err) {
-        // Transport failure — Linear is unreachable. Not a configuration problem, so
-        // this stays a plain Error and classifies as an unexpected failure (exit 2).
-        throw new Error(`Linear token mint failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    const text = await response.text();
-    if (!response.ok) {
-        // 4xx means Linear rejected these credentials or scopes — the operator can fix
-        // that. 5xx is an outage, and 429 is rate limiting: both are transient and must
-        // not be blamed on the config.
-        const message = `Linear token mint rejected (HTTP ${response.status})`;
-        const transient = response.status >= 500 || response.status === 429;
-        throw transient ? new Error(message) : new LinearConfigError(message);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        throw new Error(`Linear token mint returned a non-JSON response (HTTP ${response.status})`);
-    }
-    const token = parsed.access_token;
-    if (typeof token !== 'string' || token.length === 0) {
-        throw new Error('Linear token mint returned no access_token');
-    }
-    return token;
-}
-export async function resolveLinearAuth(config, creds, opts = {}) {
-    const product = opts.product ?? DEFAULT_PRODUCT;
-    const { actor, signature: template } = config.identity;
-    const signature = renderSignature(template, { actor, product });
-    if (config.auth.mode === 'client_credentials') {
-        const missing = [];
-        if (!creds.clientId)
-            missing.push(config.auth.client_id_env);
-        if (!creds.clientSecret)
-            missing.push(config.auth.client_secret_env);
-        if (missing.length > 0) {
-            // Abort rather than fall back — see the module header.
-            throw new LinearConfigError(`Linear auth mode is client_credentials but ${missing.join(' and ')} ` +
-                `${missing.length > 1 ? 'are' : 'is'} not set. ` +
-                'Set them, or switch linear.auth.mode to api_key.');
-        }
-        let token;
-        try {
-            token = await mintAppToken({ clientId: creds.clientId, clientSecret: creds.clientSecret, scopes: config.auth.scopes }, opts);
-        }
-        catch (err) {
-            // Preserve the classification the mint chose: a rejected credential stays a
-            // config error (exit 1), an outage stays unexpected (exit 2). Both abort —
-            // neither falls back to api_key.
-            // Name the variables to check. A bare "HTTP 401" leaves an operator with
-            // custom env names guessing which credential to rotate. Names only — never
-            // the values.
-            const message = `Linear client_credentials token mint failed — aborting rather than falling back ` +
-                `to an API key (that would attribute agent writes to a human). ` +
-                `Check ${config.auth.client_id_env} and ${config.auth.client_secret_env}. ` +
-                `${err instanceof Error ? err.message : String(err)}`;
-            throw isLinearConfigError(err) ? new LinearConfigError(message) : new Error(message);
-        }
-        return {
-            mode: 'client_credentials', token, bearer: true, actor, signature,
-            createAsUser: actor, signatureTemplate: template, product,
-        };
-    }
-    if (!creds.apiKey) {
-        throw new LinearConfigError(`Linear is enabled but ${config.auth.api_key_env} is not set. ` +
-            `Set it, or disable the linear block in your config.`);
-    }
-    return {
-        mode: 'api_key', token: creds.apiKey, bearer: false, actor, signature,
-        signatureTemplate: template, product,
-    };
-}
-// Derives a step-scoped identity: `crosscheck` → `crosscheck/review`.
-//
-// The epic calls for per-worker display names (its example is `symphony/worker-3`)
-// so a fleet of agents does not collapse into one indistinguishable bot. crosscheck's
-// natural axis is the workflow step that produced the write.
-//
-// T1 re-points createAsUser, which is what Linear actually renders. T0 has no
-// createAsUser, so the suffix only reaches the signature line — still an improvement,
-// since that is T0's whole attribution mechanism.
-export function withWorker(auth, worker) {
-    const trimmed = worker.trim();
-    if (!trimmed)
-        return auth;
-    const actor = `${auth.actor}/${trimmed}`;
-    return {
-        ...auth,
-        actor,
-        signature: renderSignature(auth.signatureTemplate, { actor, product: auth.product }),
-        ...(auth.createAsUser !== undefined && { createAsUser: actor }),
-    };
-}
-//# sourceMappingURL=identity.js.map

package/dist/linear/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/linear/identity.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,uFAAuF;AACvF,uFAAuF;AACvF,iDAAiD;AACjD,qFAAqF;AACrF,wFAAwF;AACxF,qFAAqF;AACrF,oFAAoF;AACpF,EAAE;AACF,0CAA0C;AAC1C,mFAAmF;AACnF,mFAAmF;AACnF,gFAAgF;AAIhF,MAAM,cAAc,GAAG,oCAAoC,CAAA;AAuC3D,MAAM,eAAe,GAAG,YAAY,CAAA;AAEpC,kFAAkF;AAClF,gFAAgF;AAChF,2EAA2E;AAC3E,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,SAAS,GAAG,IAAI,CAAA;IACzB,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAA;IACjC,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,OAAO,GAAG,YAAY,iBAAiB,CAAA;AACzC,CAAC;AAaD,kFAAkF;AAClF,8EAA8E;AAC9E,gFAAgF;AAChF,iCAAiC;AACjC,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,IAAmB;IACnE,MAAM,MAAM,GAA2B;QACrC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;QAC7B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;KACtB,CAAA;IACD,iFAAiF;IACjF,8DAA8D;IAC9D,MAAM,IAAI,GAAG,QAAQ,CAAA;IACrB,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAClC,0CAA0C,EAC1C,CAAC,MAAM,EAAE,GAAW,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjE,CAAA;IACD,OAAO,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;AACrC,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,MAAM,GAAG,GAAG,wBAAwB,CAAA;IACpC,OAAO,IAAI;QACT,yEAAyE;SACxE,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QACxD,4DAA4D;SAC3D,OAAO,CAAC,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QACnD,iDAAiD;SAChD,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,GAAG,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QACnD,6CAA6C;SAC5C,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;SACpB,IAAI,EAAE,CAAA;AACX,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;AACzC,CAAC;AAED,mFAAmF;AACnF,mFAAmF;AACnF,0BAA0B;AAC1B,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAiE,EACjE,OAAoB,EAAE;IAEtB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAK,UAAU,CAAC,KAAmB,CAAA;IAEjE,mFAAmF;IACnF,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,aAAa,EAAE,KAAK,CAAC,YAAY;QACjC,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;KACrC,CAAC,CAAA;IAEF,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAClG,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,+EAA+E;QAC/E,gFAAgF;QAChF,+BAA+B;QAC/B,MAAM,OAAO,GAAG,oCAAoC,QAAQ,CAAC,MAAM,GAAG,CAAA;QACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAA;QACnE,MAAM,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wDAAwD,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAA;IAC7F,CAAC;IAED,MAAM,KAAK,GAAI,MAAqC,CAAC,YAAY,CAAA;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAoB,EACpB,KAAwB,EACxB,OAAuB,EAAE;IAEzB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAA;IAC/C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAA;IACtD,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAE/D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAC5D,IAAI,CAAC,KAAK,CAAC,YAAY;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QACpE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,uDAAuD;YACvD,MAAM,IAAI,iBAAiB,CACzB,8CAA8C,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG;gBACtE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY;gBAChD,kDAAkD,CACnD,CAAA;QACH,CAAC;QAED,IAAI,KAAa,CAAA;QACjB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,YAAY,CACxB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAa,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,EAC5F,IAAI,CACL,CAAA;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,4EAA4E;YAC5E,2EAA2E;YAC3E,iCAAiC;YACjC,yEAAyE;YACzE,2EAA2E;YAC3E,cAAc;YACd,MAAM,OAAO,GACX,kFAAkF;gBAClF,gEAAgE;gBAChE,SAAS,MAAM,CAAC,IAAI,CAAC,aAAa,QAAQ,MAAM,CAAC,IAAI,CAAC,iBAAiB,IAAI;gBAC3E,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAA;YACvD,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAA;QACtF,CAAC;QAED,OAAO;YACL,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS;YACjE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO;SAC1D,CAAA;IACH,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,IAAI,iBAAiB,CACzB,yBAAyB,MAAM,CAAC,IAAI,CAAC,WAAW,eAAe;YAC/D,qDAAqD,CACtD,CAAA;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS;QACrE,iBAAiB,EAAE,QAAQ,EAAE,OAAO;KACrC,CAAA;AACH,CAAC;AAED,sEAAsE;AACtE,EAAE;AACF,mFAAmF;AACnF,sFAAsF;AACtF,6DAA6D;AAC7D,EAAE;AACF,8EAA8E;AAC9E,sFAAsF;AACtF,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,IAAwB,EAAE,MAAc;IACjE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAEzB,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,EAAE,CAAA;IACxC,OAAO;QACL,GAAG,IAAI;QACP,KAAK;QACL,SAAS,EAAE,eAAe,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACpF,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;KAChE,CAAA;AACH,CAAC"}

package/dist/linear/notify.d.ts

@@ -1,35 +0,0 @@
-import { type LinearRequestOptions } from './client.js';
-import { type ResolvedLinearAuth } from './identity.js';
-import type { LinearConfig } from '../config/schema.js';
-export type LinearNotifyStatus = 'posted' | 'skipped' | 'failed';
-export interface LinearNotifyResult {
-    status: LinearNotifyStatus;
-    /** Machine-readable reason for skipped/failed. */
-    reason?: string;
-    identifier?: string;
-    url?: string;
-}
-export interface LinearNotifyParams {
-    auth: ResolvedLinearAuth;
-    config: LinearConfig;
-    pr: {
-        branch?: string;
-        title: string;
-        body?: string;
-        url: string;
-        sha?: string;
-    };
-    verdict: string | null;
-    reviewer: string;
-    origin: string;
-    model: string;
-    summary?: string;
-    service?: string;
-    /** Workflow step that produced this verdict. Defaults to 'review'. */
-    stepType?: string;
-    /** 1-based workflow round. Defaults to 1. */
-    round?: number;
-}
-export declare function issueBelongsToWorkspace(issueUrl: string, workspace: string): boolean;
-export declare function notifyLinear(params: LinearNotifyParams, opts?: LinearRequestOptions): Promise<LinearNotifyResult>;
-//# sourceMappingURL=notify.d.ts.map

package/dist/linear/notify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/linear/notify.ts"],"names":[],"mappings":"AASA,OAAO,EAA4C,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAEjG,OAAO,EAA+B,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,CAAA;AAEhE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,kBAAkB,CAAA;IACxB,MAAM,EAAE,YAAY,CAAA;IACpB,EAAE,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAChF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAGD,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQpF;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CAwD7B"}

package/dist/linear/notify.js

@@ -1,76 +0,0 @@
-// Orchestrates the one Linear write crosscheck makes: mirroring a review verdict
-// onto the Linear issue the PR belongs to.
-//
-// This never throws. Auth is resolved up front (fail-fast, before the expensive
-// review runs), so anything that goes wrong here is a per-write problem on a review
-// that already succeeded and already posted to GitHub. The caller logs the returned
-// status — failures are reported, never swallowed.
-import { buildLinearCommentBody, shouldPostToLinear } from './comment.js';
-import { findIssueByIdentifier, postLinearComment } from './client.js';
-import { extractLinearRef } from './ref.js';
-import { renderIcon, renderSignature } from './identity.js';
-// Linear issue URLs are https://linear.app/<workspace>/issue/<ID>/<slug>.
-export function issueBelongsToWorkspace(issueUrl, workspace) {
-    try {
-        const segments = new URL(issueUrl).pathname.split('/').filter(Boolean);
-        return segments[0]?.toLowerCase() === workspace.toLowerCase();
-    }
-    catch {
-        // Unparseable URL from the API — fail closed rather than post to the wrong place.
-        return false;
-    }
-}
-export async function notifyLinear(params, opts = {}) {
-    const { auth, config, pr } = params;
-    if (!shouldPostToLinear(params.verdict, config.comment_on)) {
-        return { status: 'skipped', reason: 'verdict-not-configured' };
-    }
-    const ref = extractLinearRef({ branch: pr.branch, title: pr.title, body: pr.body }, config.team_keys);
-    if (!ref)
-        return { status: 'skipped', reason: 'no-issue-ref' };
-    try {
-        const issue = await findIssueByIdentifier(auth, ref.id, opts);
-        if (!issue)
-            return { status: 'skipped', reason: 'issue-not-found', identifier: ref.id };
-        // An explicit URL names a workspace, and identifiers repeat across workspaces.
-        // If the credentials resolve a different workspace, this is a same-numbered
-        // issue somewhere else — never the one the PR pointed at. Checked before any
-        // body is built, so a mismatch costs nothing.
-        if (ref.workspace && !issueBelongsToWorkspace(issue.url, ref.workspace)) {
-            return { status: 'skipped', reason: 'workspace-mismatch', identifier: ref.id };
-        }
-        // Re-render here rather than reusing auth.signature: this is the first point
-        // that knows the model and reviewer, which the template may reference.
-        const signature = renderSignature(auth.signatureTemplate, {
-            actor: auth.actor,
-            product: auth.product,
-            model: params.model === 'default' ? undefined : params.model,
-            reviewer: params.reviewer,
-            icon: renderIcon(config.identity.icon_url),
-        });
-        const body = buildLinearCommentBody({
-            signature,
-            verdict: params.verdict,
-            reviewer: params.reviewer,
-            origin: params.origin,
-            model: params.model,
-            prUrl: pr.url,
-            prTitle: pr.title,
-            ...(pr.sha && { sha: pr.sha }),
-            ...(params.stepType && { stepType: params.stepType }),
-            ...(params.round !== undefined && { round: params.round }),
-            ...(params.summary && { summary: params.summary }),
-            ...(params.service && { service: params.service }),
-        });
-        const comment = await postLinearComment(auth, issue.id, body, opts);
-        return { status: 'posted', identifier: issue.identifier, url: comment.url };
-    }
-    catch (err) {
-        return {
-            status: 'failed',
-            reason: err instanceof Error ? err.message : String(err),
-            identifier: ref.id,
-        };
-    }
-}
-//# sourceMappingURL=notify.js.map

package/dist/linear/notify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/linear/notify.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,2CAA2C;AAC3C,EAAE;AACF,gFAAgF;AAChF,oFAAoF;AACpF,oFAAoF;AACpF,mDAAmD;AAEnD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAA6B,MAAM,aAAa,CAAA;AACjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,eAAe,EAA2B,MAAM,eAAe,CAAA;AA6BpF,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,SAAiB;IACzE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACtE,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,SAAS,CAAC,WAAW,EAAE,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;QAClF,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA0B,EAC1B,OAA6B,EAAE;IAE/B,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,CAAA;IAEnC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAA;IAChE,CAAC;IAED,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACrG,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;IAE9D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7D,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,CAAA;QAEvF,+EAA+E;QAC/E,4EAA4E;QAC5E,6EAA6E;QAC7E,8CAA8C;QAC9C,IAAI,GAAG,CAAC,SAAS,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACxE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,CAAA;QAChF,CAAC;QAED,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,iBAAiB,EAAE;YACxD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;YAC5D,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC3C,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,sBAAsB,CAAC;YAClC,SAAS;YACT,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,EAAE,CAAC,GAAG;YACb,OAAO,EAAE,EAAE,CAAC,KAAK;YACjB,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;YAC9B,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;YAClD,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;SACnD,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QACnE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAA;IAC7E,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YACxD,UAAU,EAAE,GAAG,CAAC,EAAE;SACnB,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/linear/ref.d.ts

@@ -1,13 +0,0 @@
-import { type TicketRef } from '../issues/ticket-ref.js';
-export interface LinearIssueRef extends TicketRef {
-    source: 'branch' | 'title' | 'body';
-    /** Workspace slug, when the ref came from an explicit URL. Bare refs have none. */
-    workspace?: string;
-}
-export interface PRMetadata {
-    branch?: string | null;
-    title?: string | null;
-    body?: string | null;
-}
-export declare function extractLinearRef(pr: PRMetadata, teamKeys: readonly string[]): LinearIssueRef | null;
-//# sourceMappingURL=ref.d.ts.map

package/dist/linear/ref.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ref.d.ts","sourceRoot":"","sources":["../../src/linear/ref.ts"],"names":[],"mappings":"AAYA,OAAO,EAAoC,KAAK,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAE1F,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAA;IACnC,mFAAmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAiED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,GAAG,IAAI,CAanG"}

package/dist/linear/ref.js

@@ -1,90 +0,0 @@
-// Write-side ref resolution: which Linear issue should crosscheck comment on?
-//
-// Extraction primitives live in src/issues/ticket-ref.ts and are reused here —
-// this module only adds the two things the write path needs on top:
-//
-//   1. linear.app issue URLs, which are unambiguous and so need no configuration.
-//   2. A stricter policy for bare identifiers: they are only honoured for team keys
-//      the operator has configured. Enrichment can afford to match `UTF-8` and let
-//      the lookup return nothing, because a failed read is a no-op. A failed *write*
-//      would post a review comment onto an unrelated issue, so the write path
-//      requires the operator to name their team keys first.
-import { extractTicketRefs, parseTicketId } from '../issues/ticket-ref.js';
-// The identifier occupies one whole path segment. Lookaheads kept getting this
-// wrong in both directions: requiring `/` or end-of-path missed `IN-42.` at the
-// end of a sentence, and allowing any non-alphanumeric accepted `IN-123-typo` as
-// `IN-123`. Take the segment, strip trailing sentence punctuation, and require
-// parseTicketId to match it whole.
-const ISSUE_SEGMENTS = /^\/([^/]+)\/issue\/([^/]+)/i;
-// Leading punctuation is safe to allow — but only characters that cannot be part
-// of a hostname, so `notlinear.app` still cannot match. Missing `(linear.app/...)`
-// made it fall through to the bare-ID extractor, which returns no workspace and
-// so silently loses the workspace-mismatch protection.
-const BARE_URL = /(?:^|[\s([{<"'`,;])linear\.app\/([^/\s]+)\/issue\/([^/\s]+)/gi;
-// Absolute URLs are parsed and their hostname compared exactly. A boundary check
-// on the text is not enough: `https://evil.example/linear.app/acme/issue/IN-1`
-// satisfies any "character before linear.app" rule while pointing somewhere else.
-const ABSOLUTE_URL = /\bhttps?:\/\/[^\s<>()"'`]+/gi;
-/** Trailing sentence punctuation is never part of an identifier. */
-function stripTrailingPunctuation(segment) {
-    return segment.replace(/[.,;:!?)\]}>'"]+$/, '');
-}
-function fromUrl(text) {
-    for (const match of text.matchAll(ABSOLUTE_URL)) {
-        let parsed;
-        try {
-            parsed = new URL(match[0]);
-        }
-        catch {
-            continue;
-        }
-        if (parsed.hostname.toLowerCase() !== 'linear.app')
-            continue;
-        const segments = parsed.pathname.match(ISSUE_SEGMENTS);
-        if (!segments)
-            continue;
-        const ref = parseTicketId(stripTrailingPunctuation(segments[2]));
-        if (ref)
-            return withWorkspace(ref, segments[1]);
-    }
-    // Iterate, like the absolute-URL path above: a malformed candidate earlier in
-    // the text must not stop a valid one later from resolving.
-    for (const bare of text.matchAll(BARE_URL)) {
-        const ref = parseTicketId(stripTrailingPunctuation(bare[2]));
-        if (ref)
-            return withWorkspace(ref, bare[1]);
-    }
-    return null;
-}
-// An explicit URL names a workspace. Identifiers are only unique within one, so
-// dropping the slug lets a URL for workspace A resolve against credentials for
-// workspace B and comment on B's same-numbered issue.
-function withWorkspace(ref, workspace) {
-    return { ...ref, workspace: workspace.toLowerCase(), source: 'body' };
-}
-function matchField(text, teamKeys) {
-    const url = fromUrl(text);
-    if (url)
-        return url;
-    // Bare identifiers only for configured keys — see the module header.
-    if (teamKeys.length === 0)
-        return null;
-    const bare = extractTicketRefs({ title: text }, [...teamKeys])[0];
-    return bare ? { ...bare, source: 'body' } : null;
-}
-export function extractLinearRef(pr, teamKeys) {
-    const fields = [
-        [pr.branch, 'branch'],
-        [pr.title, 'title'],
-        [pr.body, 'body'],
-    ];
-    for (const [text, source] of fields) {
-        if (!text)
-            continue;
-        const ref = matchField(text, teamKeys);
-        if (ref)
-            return { ...ref, source };
-    }
-    return null;
-}
-//# sourceMappingURL=ref.js.map

package/dist/linear/ref.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ref.js","sourceRoot":"","sources":["../../src/linear/ref.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,oEAAoE;AACpE,EAAE;AACF,kFAAkF;AAClF,oFAAoF;AACpF,mFAAmF;AACnF,qFAAqF;AACrF,8EAA8E;AAC9E,4DAA4D;AAE5D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAkB,MAAM,yBAAyB,CAAA;AAc1F,+EAA+E;AAC/E,gFAAgF;AAChF,iFAAiF;AACjF,+EAA+E;AAC/E,mCAAmC;AACnC,MAAM,cAAc,GAAG,6BAA6B,CAAA;AACpD,iFAAiF;AACjF,mFAAmF;AACnF,gFAAgF;AAChF,uDAAuD;AACvD,MAAM,QAAQ,GAAG,+DAA+D,CAAA;AAEhF,iFAAiF;AACjF,+EAA+E;AAC/E,kFAAkF;AAClF,MAAM,YAAY,GAAG,8BAA8B,CAAA;AAEnD,oEAAoE;AACpE,SAAS,wBAAwB,CAAC,OAAe;IAC/C,OAAO,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAChD,IAAI,MAAW,CAAA;QACf,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,YAAY;YAAE,SAAQ;QAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACtD,IAAI,CAAC,QAAQ;YAAE,SAAQ;QACvB,MAAM,GAAG,GAAG,aAAa,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAChE,IAAI,GAAG;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACjD,CAAC;IAED,8EAA8E;IAC9E,2DAA2D;IAC3D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5D,IAAI,GAAG;YAAE,OAAO,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,sDAAsD;AACtD,SAAS,aAAa,CAAC,GAAc,EAAE,SAAiB;IACtD,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAA;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAA2B;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,IAAI,GAAG;QAAE,OAAO,GAAG,CAAA;IAEnB,qEAAqE;IACrE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACjE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,EAAc,EAAE,QAA2B;IAC1E,MAAM,MAAM,GAAiE;QAC3E,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QACrB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QACnB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;KAClB,CAAA;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACtC,IAAI,GAAG;YAAE,OAAO,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAA;IACpC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/linear/verify.d.ts

@@ -1,26 +0,0 @@
-import { type LinearAuthMode, type LinearCredentials, type ResolveOptions, type ResolvedLinearAuth } from './identity.js';
-import { type LinearRequestOptions } from './client.js';
-import type { LinearConfig } from '../config/schema.js';
-export interface LinearIdentityReport {
-    ok: boolean;
-    mode: LinearAuthMode;
-    /** Actor name writes will carry, including any per-step suffix the caller applies. */
-    actor: string;
-    organization?: string;
-    /**
-     * 'app'  — writes render as the OAuth application (botActor). The goal state.
-     * 'user' — writes attribute to a human account. What IN-2271 is eliminating.
-     */
-    attribution: 'app' | 'user';
-    /** In api_key mode, the human account writes currently attribute to. */
-    attributesTo?: string;
-    /** Populated when ok is false. Never contains credential material. */
-    error?: string;
-    /**
-     * The identity this probe resolved, so callers can reuse it instead of minting
-     * a second token. Absent when resolution failed.
-     */
-    auth?: ResolvedLinearAuth;
-}
-export declare function verifyLinearIdentity(config: LinearConfig, creds: LinearCredentials, opts?: ResolveOptions & LinearRequestOptions): Promise<LinearIdentityReport>;
-//# sourceMappingURL=verify.d.ts.map

package/dist/linear/verify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/linear/verify.ts"],"names":[],"mappings":"AAWA,OAAO,EAAqB,KAAK,cAAc,EAAE,KAAK,iBAAiB,EAAE,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAC5I,OAAO,EAAiB,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAEvD,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,EAAE,cAAc,CAAA;IACpB,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,WAAW,EAAE,KAAK,GAAG,MAAM,CAAA;IAC3B,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,sEAAsE;IACtE,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,IAAI,CAAC,EAAE,kBAAkB,CAAA;CAC1B;AAQD,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,iBAAiB,EACxB,IAAI,GAAE,cAAc,GAAG,oBAAyB,GAC/C,OAAO,CAAC,oBAAoB,CAAC,CAoD/B"}

package/dist/linear/verify.js

@@ -1,67 +0,0 @@
-// Answers the one question a deployment cutover needs answered (IN-2271):
-// when this daemon writes to Linear, whose name is on it?
-//
-// The acceptance criterion for switching Humanbased's deployments to the HB Agent
-// Gateway is "zero writes from symphony/crosscheck attribute to a human account".
-// That is checkable ahead of time — resolve the identity, confirm the token is
-// accepted, and report what the write would render as.
-//
-// Never throws. A verification that fails is a report with ok: false, because the
-// caller is a status command that must still print the rest of its output.
-import { resolveLinearAuth } from './identity.js';
-import { linearGraphQL } from './client.js';
-const ORG_QUERY = `query { organization { name } }`;
-const VIEWER_QUERY = `query { viewer { name email } organization { name } }`;
-export async function verifyLinearIdentity(config, creds, opts = {}) {
-    const mode = config.auth.mode;
-    const attribution = mode === 'client_credentials' ? 'app' : 'user';
-    let auth;
-    try {
-        auth = await resolveLinearAuth(config, creds, opts);
-    }
-    catch (err) {
-        return {
-            ok: false,
-            mode,
-            actor: config.identity.actor,
-            attribution,
-            error: err instanceof Error ? err.message : String(err),
-        };
-    }
-    try {
-        if (auth.mode === 'client_credentials') {
-            // An app token has no viewer — it acts as itself. Reaching the org at all is
-            // proof the minted token is accepted.
-            const data = await linearGraphQL(auth, ORG_QUERY, {}, opts);
-            return {
-                ok: true,
-                mode: auth.mode,
-                actor: auth.actor,
-                attribution: 'app',
-                auth,
-                ...(data.organization && { organization: data.organization.name }),
-            };
-        }
-        const data = await linearGraphQL(auth, VIEWER_QUERY, {}, opts);
-        const who = data.viewer?.email ?? data.viewer?.name ?? undefined;
-        return {
-            ok: true,
-            mode: auth.mode,
-            actor: auth.actor,
-            attribution: 'user',
-            auth,
-            ...(data.organization && { organization: data.organization.name }),
-            ...(who && { attributesTo: who }),
-        };
-    }
-    catch (err) {
-        return {
-            ok: false,
-            mode: auth.mode,
-            actor: auth.actor,
-            attribution,
-            error: err instanceof Error ? err.message : String(err),
-        };
-    }
-}
-//# sourceMappingURL=verify.js.map

package/dist/linear/verify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/linear/verify.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,+EAA+E;AAC/E,uDAAuD;AACvD,EAAE;AACF,kFAAkF;AAClF,2EAA2E;AAE3E,OAAO,EAAE,iBAAiB,EAA6F,MAAM,eAAe,CAAA;AAC5I,OAAO,EAAE,aAAa,EAA6B,MAAM,aAAa,CAAA;AAyBtE,MAAM,SAAS,GAAG,iCAAiC,CAAA;AACnD,MAAM,YAAY,GAAG,uDAAuD,CAAA;AAK5E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAoB,EACpB,KAAwB,EACxB,OAA8C,EAAE;IAEhD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAA;IAC7B,MAAM,WAAW,GAAG,IAAI,KAAK,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;IAElE,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IACrD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK;YAC5B,WAAW;YACX,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACvC,6EAA6E;YAC7E,sCAAsC;YACtC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAc,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;YACxE,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,KAAK;gBAClB,IAAI;gBACJ,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;aACnE,CAAA;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAiB,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,SAAS,CAAA;QAChE,OAAO;YACL,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,MAAM;YACnB,IAAI;YACJ,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YAClE,GAAG,CAAC,GAAG,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC;SAClC,CAAA;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW;YACX,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/skills/attribution.d.ts

@@ -1,4 +0,0 @@
-import type { SkillMetadata } from './broker.js';
-export declare function formatSkillAttribution(skills: SkillMetadata[]): string;
-export declare function renderSkillAttributionLine(skills: SkillMetadata[]): string;
-//# sourceMappingURL=attribution.d.ts.map

package/dist/skills/attribution.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"attribution.d.ts","sourceRoot":"","sources":["../../src/skills/attribution.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,CAEtE;AAID,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,CAG1E"}

package/dist/skills/attribution.js

@@ -1,14 +0,0 @@
-import { formatSkillIdentity } from './catalog.js';
-// Skills are separated by a middot and kept on one line: the receipt has to be
-// present for licensing, but it is metadata about the run, not part of it.
-export function formatSkillAttribution(skills) {
-    return skills.map(formatSkillIdentity).join(' · ');
-}
-// One italic line, same weight as the reviewer attribution it sits beneath.
-// Empty string when nothing activated, so callers can concatenate blind.
-export function renderSkillAttributionLine(skills) {
-    if (skills.length === 0)
-        return '';
-    return `_Skills: ${formatSkillAttribution(skills)}_`;
-}
-//# sourceMappingURL=attribution.js.map

package/dist/skills/attribution.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"attribution.js","sourceRoot":"","sources":["../../src/skills/attribution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAGlD,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CAAC,MAAuB;IAC5D,OAAO,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACpD,CAAC;AAED,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,UAAU,0BAA0B,CAAC,MAAuB;IAChE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAClC,OAAO,YAAY,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAA;AACtD,CAAC"}

package/dist/skills/broker-server.d.ts

@@ -1,2 +0,0 @@
-export declare function runSkillBrokerProxy(socketPath: string): Promise<void>;
-//# sourceMappingURL=broker-server.d.ts.map

package/dist/skills/broker-server.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"broker-server.d.ts","sourceRoot":"","sources":["../../src/skills/broker-server.ts"],"names":[],"mappings":"AASA,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM3E"}

package/dist/skills/broker-server.js

@@ -1,17 +0,0 @@
-import { once } from 'events';
-import { createConnection } from 'net';
-function parseSocketPath(argv) {
-    const index = argv.indexOf('--socket');
-    if (index === -1 || !argv[index + 1])
-        throw new Error('--socket <path> is required');
-    return argv[index + 1];
-}
-export async function runSkillBrokerProxy(socketPath) {
-    const socket = createConnection(socketPath);
-    await once(socket, 'connect');
-    process.stdin.pipe(socket);
-    socket.pipe(process.stdout);
-    await once(socket, 'close');
-}
-await runSkillBrokerProxy(parseSocketPath(process.argv.slice(2)));
-//# sourceMappingURL=broker-server.js.map

package/dist/skills/broker-server.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"broker-server.js","sourceRoot":"","sources":["../../src/skills/broker-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAA;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAA;AAEtC,SAAS,eAAe,CAAC,IAAc;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IACpF,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAA;IAC3C,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC7B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAC7B,CAAC;AAED,MAAM,mBAAmB,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA"}