@mastra/factory 0.0.0-aggregate-trace-20261015182851

package/dist/integrations/linear/integration.js

@@ -0,0 +1,900 @@
+import { IssueReconcileWorker } from "../issue-reconcile-worker.js";
+import { resolveLinearRules } from "./default-rules.js";
+import { attachLinearRules } from "./rules.js";
+import { attachLinearIssueReconciler } from "./issue-reconciler.js";
+import { linearIssueReconciliationEnabled, linearIssueReconciliationInterval } from "./reconciliation-config.js";
+import { buildLinearRoutes } from "./routes.js";
+import { buildLinearAgentTools } from "./agent-tools.js";
+//#region src/integrations/linear/integration.ts
+const LINEAR_GRAPHQL_URL = "https://api.linear.app/graphql";
+const LINEAR_TOKEN_URL = "https://api.linear.app/oauth/token";
+const LINEAR_AUTHORIZE_URL = "https://linear.app/oauth/authorize";
+const LINEAR_ISSUES_PAGE_SIZE = 30;
+const ISSUE_COMMENTS_PAGE_SIZE = 50;
+const LINEAR_TEAMS_PAGE_SIZE = 100;
+const LINEAR_TEAMS_MAX_PAGES = 20;
+/** Hard stop for comment pagination so a misbehaving cursor can't loop forever. */
+const ISSUE_COMMENTS_MAX_PAGES = 20;
+/** Refresh this many ms before the recorded expiry to absorb clock skew. */
+const TOKEN_REFRESH_SKEW_MS = 6e4;
+/** Re-check an org's Linear connection (and its scopes) at most this often. */
+const CONNECTION_TTL_MS = 6e4;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Thrown when the org's Linear authorization can no longer be renewed. */
+var LinearReauthRequiredError = class extends Error {
+	constructor() {
+		super("Linear authorization expired. Reconnect Linear to keep syncing intake issues.");
+	}
+};
+/** POST a GraphQL query to Linear with the given OAuth access token. */
+async function linearGraphql(accessToken, query, variables) {
+	const res = await fetch(LINEAR_GRAPHQL_URL, {
+		method: "POST",
+		signal: AbortSignal.timeout(15e3),
+		headers: {
+			"content-type": "application/json",
+			authorization: `Bearer ${accessToken}`
+		},
+		body: JSON.stringify({
+			query,
+			variables
+		})
+	});
+	if (!res.ok) {
+		let detail = null;
+		try {
+			detail = (await res.json()).errors?.[0]?.message ?? null;
+		} catch {}
+		const err = /* @__PURE__ */ new Error(`Linear API request failed (${res.status})${detail ? `: ${detail}` : ""}`);
+		err.status = res.status;
+		throw err;
+	}
+	const body = await res.json();
+	if (body.errors?.length) throw new Error(`Linear API error: ${body.errors[0]?.message ?? "unknown error"}`);
+	if (!body.data) throw new Error("Linear API returned no data.");
+	return body.data;
+}
+var LinearIntegration = class {
+	/** Stable integration identifier (see `../base.ts`). */
+	id = "linear";
+	/** Bound once by the factory via `initialize()` before any surface is used. */
+	#storage;
+	#projects;
+	#auth;
+	/** Bind Linear's slice of the generic integration storage, the projects domain, and the host auth seam. */
+	initialize({ storage, projects, auth }) {
+		this.#storage = storage;
+		this.#projects = projects;
+		this.#auth = auth;
+	}
+	get storage() {
+		if (!this.#storage) throw new Error("LinearIntegration is not initialized — the factory binds storage during prepare().");
+		return this.#storage;
+	}
+	/** Factory projects domain — maps a session's resourceId to its owning org. */
+	get projects() {
+		if (!this.#projects) throw new Error("LinearIntegration is not initialized — the factory binds storage during prepare().");
+		return this.#projects;
+	}
+	/**
+	* Whether the host runs with web auth enabled. Linear connections are
+	* org-owned, so every Linear surface is inert without a tenant auth seam.
+	*/
+	get authEnabled() {
+		return this.#auth?.enabled() ?? false;
+	}
+	/** Load the org's Linear connection, or `null` when not connected. */
+	async loadConnection(orgId) {
+		const connection = await this.storage.connections.get(orgId);
+		if (!connection) return null;
+		const { data } = connection;
+		return {
+			id: connection.id,
+			orgId: connection.orgId,
+			userId: connection.userId,
+			accessToken: data.accessToken,
+			scope: data.scope ?? null,
+			refreshToken: data.refreshToken ?? null,
+			expiresAt: data.expiresAtMs === null || data.expiresAtMs === void 0 ? null : new Date(data.expiresAtMs),
+			workspaceName: data.workspaceName ?? null,
+			workspaceUrlKey: data.workspaceUrlKey ?? null,
+			createdAt: connection.createdAt,
+			updatedAt: connection.updatedAt
+		};
+	}
+	/** Insert or replace the org's connection (one per org). */
+	async upsertConnection(input) {
+		await this.storage.connections.upsert(input.orgId, {
+			userId: input.userId,
+			data: {
+				accessToken: input.accessToken,
+				refreshToken: input.refreshToken,
+				expiresAtMs: input.expiresAt?.getTime() ?? null,
+				scope: input.scope,
+				workspaceName: input.workspaceName,
+				workspaceUrlKey: input.workspaceUrlKey
+			}
+		});
+		this.invalidateConnectionCache(input.orgId);
+	}
+	/** Persist a rotated token set on the org's existing connection row. */
+	async #updateTokens(orgId, tokens) {
+		await this.storage.connections.update(orgId, (data) => ({
+			...data,
+			accessToken: tokens.accessToken,
+			refreshToken: tokens.refreshToken,
+			expiresAtMs: tokens.expiresAt?.getTime() ?? null,
+			scope: tokens.scope ?? data.scope
+		}));
+	}
+	/**
+	* Whether the connection's token can post issue comments. Legacy rows
+	* without a recorded scope were minted with `read` only, so they count as
+	* read-only until the org reconnects Linear.
+	*/
+	canPostComments(connection) {
+		return (connection.scope ?? "").split(/[\s,]+/).filter(Boolean).some((scope) => scope === "comments:create" || scope === "write" || scope === "admin");
+	}
+	/**
+	* In-flight refreshes keyed by org. Linear rotates refresh tokens, so two
+	* concurrent refreshes with the same token would invalidate each other —
+	* single-flight ensures one exchange per org and shares the result.
+	*/
+	#inflightRefreshes = /* @__PURE__ */ new Map();
+	/**
+	* Return a usable access token for the connection, proactively refreshing
+	* it when the recorded expiry is past (or imminent). Throws
+	* `LinearReauthRequiredError` when the token is expired and cannot be
+	* refreshed — the org has to go through the OAuth flow again.
+	*/
+	async getFreshAccessToken(connection) {
+		if (!(connection.expiresAt !== null && connection.expiresAt.getTime() - TOKEN_REFRESH_SKEW_MS <= Date.now())) return connection.accessToken;
+		if (!connection.refreshToken) throw new LinearReauthRequiredError();
+		const existing = this.#inflightRefreshes.get(connection.orgId);
+		if (existing) return existing;
+		const latest = await this.loadConnection(connection.orgId);
+		if (!latest) throw new LinearReauthRequiredError();
+		const concurrent = this.#inflightRefreshes.get(connection.orgId);
+		if (concurrent) return concurrent;
+		if (!(latest.expiresAt !== null && latest.expiresAt.getTime() - TOKEN_REFRESH_SKEW_MS <= Date.now())) return latest.accessToken;
+		if (!latest.refreshToken) throw new LinearReauthRequiredError();
+		const refreshToken = latest.refreshToken;
+		const refresh = (async () => {
+			try {
+				const tokens = await this.refreshAccessToken(refreshToken);
+				await this.#updateTokens(connection.orgId, tokens);
+				return tokens.accessToken;
+			} catch (err) {
+				const status = err.status;
+				if (status === 400 || status === 401) throw new LinearReauthRequiredError();
+				throw err;
+			} finally {
+				this.#inflightRefreshes.delete(connection.orgId);
+			}
+		})();
+		this.#inflightRefreshes.set(connection.orgId, refresh);
+		return refresh;
+	}
+	/** Re-check an org's Linear connection (and its scopes) at most this often. */
+	#connectionChecks = /* @__PURE__ */ new Map();
+	/**
+	* Whether the org has an active connection and whether its granted scope
+	* allows posting comments. Cached per org with a short TTL — tool-set
+	* resolution runs on every request.
+	*/
+	async checkConnection(orgId) {
+		const cached = this.#connectionChecks.get(orgId);
+		if (cached && Date.now() - cached.checkedAt < CONNECTION_TTL_MS) return cached;
+		const connection = await this.loadConnection(orgId);
+		const check = {
+			connected: connection !== null,
+			canComment: connection !== null && this.canPostComments(connection),
+			checkedAt: Date.now()
+		};
+		this.#connectionChecks.set(orgId, check);
+		return check;
+	}
+	/**
+	* Drop the cached connection check for an org. Called after a connection is
+	* persisted so the tools show up on the very next run instead of after the
+	* TTL lapses.
+	*/
+	invalidateConnectionCache(orgId) {
+		this.#connectionChecks.delete(orgId);
+	}
+	/**
+	* A project's org never changes, so the resourceId → orgId mapping is
+	* cached forever. `null` marks resource ids that aren't factory projects
+	* (e.g. local default resources) so we don't re-query them on every
+	* tool-set resolution.
+	*/
+	#orgIdByResourceId = /* @__PURE__ */ new Map();
+	/** Map a session's resourceId to its owning org, or `null` when it isn't a project. */
+	async resolveOrgId(resourceId) {
+		const cached = this.#orgIdByResourceId.get(resourceId);
+		if (cached !== void 0) return cached;
+		if (!UUID_PATTERN.test(resourceId)) {
+			this.#orgIdByResourceId.set(resourceId, null);
+			return null;
+		}
+		let orgId;
+		try {
+			await this.projects.ensureReady();
+			orgId = (await this.projects.getById({ id: resourceId }))?.orgId ?? null;
+		} catch {
+			return null;
+		}
+		this.#orgIdByResourceId.set(resourceId, orgId);
+		return orgId;
+	}
+	/** Test hook: clear the org/connection caches between specs. */
+	clearCaches() {
+		this.#orgIdByResourceId.clear();
+		this.#connectionChecks.clear();
+	}
+	intake = {
+		resolveIntakeDispatch: (input) => this.#resolveIntakeDispatch(input),
+		listSources: async ({ orgId }) => {
+			const connection = await this.loadConnection(orgId);
+			if (!connection) return [];
+			const accessToken = await this.getFreshAccessToken(connection);
+			const [projects, teams] = await Promise.all([this.listProjects(accessToken), this.listTeams(accessToken)]);
+			return [...projects.map((project) => ({
+				id: project.id,
+				name: project.name,
+				type: "project"
+			})), ...teams.map((team) => ({
+				id: encodeSelfManagedTeamSourceId(team.id),
+				name: team.name,
+				type: "team",
+				metadata: { teamKey: team.key }
+			}))];
+		},
+		listItems: async ({ orgId, sourceIds, attributionSourceIds, cursor }) => {
+			if (sourceIds.length === 0) return {
+				items: [],
+				nextCursor: null
+			};
+			const connection = await this.loadConnection(orgId);
+			if (!connection) return {
+				items: [],
+				nextCursor: null
+			};
+			const accessToken = await this.getFreshAccessToken(connection);
+			const page = await this.#listIntakeIssues({
+				connection: {
+					type: "oauth",
+					accessToken
+				},
+				sourceIds,
+				attributionSourceIds,
+				cursor
+			});
+			return {
+				items: page.issues.flatMap((issue) => {
+					if (!issue.sourceId) return [];
+					return [{
+						source: {
+							type: "issue",
+							externalId: issue.id,
+							url: issue.url
+						},
+						sourceId: issue.sourceId,
+						title: `${issue.identifier}: ${issue.title}`,
+						status: issue.state ?? "",
+						labels: issue.labels,
+						assignee: issue.assignee,
+						createdAt: issue.createdAt,
+						updatedAt: issue.updatedAt,
+						metadata: {
+							identifier: issue.identifier,
+							...issue.projectId ? { linearProjectId: issue.projectId } : {},
+							stateType: issue.stateType,
+							priority: issue.priority,
+							team: issue.source
+						}
+					}];
+				}),
+				nextCursor: page.nextCursor
+			};
+		},
+		listIssues: (input) => this.#listIntakeIssues(input),
+		getIssue: (input) => this.#getIntakeIssue(input),
+		createComment: (input) => this.#createIntakeComment(input),
+		updateIssue: (input) => this.#updateIntakeIssue(input)
+	};
+	/**
+	* Background-dispatch context: the org's OAuth connection with a fresh
+	* token. Linear work items store the issue UUID directly as `externalId`.
+	*/
+	async #resolveIntakeDispatch({ orgId, externalSource }) {
+		if (externalSource.type !== "issue") return null;
+		const connection = await this.loadConnection(orgId);
+		if (!connection) return null;
+		return {
+			connection: {
+				type: "oauth",
+				accessToken: await this.getFreshAccessToken(connection)
+			},
+			issueId: externalSource.externalId
+		};
+	}
+	/**
+	* The OAuth connect/callback flow round-trips a signed `state` through
+	* Linear, so a multi-replica deploy needs a deployment-stable state secret.
+	*/
+	requiresStableStateSigner = true;
+	#clientId;
+	#clientSecret;
+	#rules;
+	get rules() {
+		return this.#rules;
+	}
+	constructor(config) {
+		this.#rules = resolveLinearRules(config.rules);
+		const missing = ["clientId", "clientSecret"].filter((key) => !config[key]);
+		if (missing.length > 0) throw new Error(`LinearIntegration is missing required config: ${missing.join(", ")}.`);
+		this.#clientId = config.clientId;
+		this.#clientSecret = config.clientSecret;
+	}
+	/**
+	* Build the OAuth authorize URL. `prompt=consent` forces the workspace
+	* picker even for an already-authorized user, so "reconnect" can switch
+	* workspaces.
+	*/
+	buildAuthorizeUrl(state, redirectUri) {
+		const url = new URL(LINEAR_AUTHORIZE_URL);
+		url.searchParams.set("client_id", this.#clientId);
+		url.searchParams.set("redirect_uri", redirectUri);
+		url.searchParams.set("response_type", "code");
+		url.searchParams.set("scope", "read,comments:create");
+		url.searchParams.set("state", state);
+		url.searchParams.set("prompt", "consent");
+		return url.toString();
+	}
+	/** Exchange an OAuth `code` for a workspace-scoped token set. */
+	async exchangeOAuthCode(code, redirectUri) {
+		return this.#requestTokens({
+			grant_type: "authorization_code",
+			code,
+			redirect_uri: redirectUri
+		}, "token exchange");
+	}
+	/**
+	* Exchange a refresh token for a new token set. Linear rotates refresh
+	* tokens, so the returned set replaces the stored one entirely. A 400/401
+	* here means the refresh token is invalid/revoked and the org must
+	* re-authorize.
+	*/
+	async refreshAccessToken(refreshToken) {
+		return this.#requestTokens({
+			grant_type: "refresh_token",
+			refresh_token: refreshToken
+		}, "token refresh");
+	}
+	/** POST to Linear's token endpoint and normalize the response. */
+	async #requestTokens(params, label) {
+		const res = await fetch(LINEAR_TOKEN_URL, {
+			method: "POST",
+			signal: AbortSignal.timeout(1e4),
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: new URLSearchParams({
+				...params,
+				client_id: this.#clientId,
+				client_secret: this.#clientSecret
+			})
+		});
+		if (!res.ok) {
+			const err = /* @__PURE__ */ new Error(`Linear ${label} failed (${res.status})`);
+			err.status = res.status;
+			throw err;
+		}
+		const body = await res.json();
+		if (!body.access_token) throw new Error(`Linear ${label} returned no access token.`);
+		return {
+			accessToken: body.access_token,
+			refreshToken: body.refresh_token ?? null,
+			expiresAt: typeof body.expires_in === "number" ? new Date(Date.now() + body.expires_in * 1e3) : null,
+			scope: body.scope ?? null
+		};
+	}
+	/** Fetch the workspace (organization) the access token is scoped to. */
+	async fetchWorkspace(accessToken) {
+		const data = await linearGraphql(accessToken, `query { organization { name urlKey } }`);
+		return {
+			name: data.organization.name,
+			urlKey: data.organization.urlKey
+		};
+	}
+	async #listIntakeIssues(input) {
+		const accessToken = getLinearAccessToken(input.connection);
+		if (input.sourceIds.length === 0) return {
+			issues: [],
+			nextCursor: null
+		};
+		const attributionSourceIds = input.attributionSourceIds ?? input.sourceIds;
+		const { projectIds, teamIds } = splitSelfManagedSourceIds(input.sourceIds);
+		const cursors = await decodeSelfManagedListCursor(input.cursor, input.sourceIds, attributionSourceIds);
+		if (teamIds.length === 0) {
+			if (cursors.projects === null) return {
+				issues: [],
+				nextCursor: null
+			};
+			const result = await this.listActiveIssues(accessToken, cursors.projects, projectIds, input.labels);
+			return {
+				issues: result.issues.map((issue) => linearIssueToIntakeIssue(issue)),
+				nextCursor: await encodeSelfManagedListCursor({
+					projects: result.nextCursor,
+					teams: null
+				}, input.sourceIds, attributionSourceIds)
+			};
+		}
+		const projectResult = projectIds.length > 0 && cursors.projects !== null ? await this.listActiveIssues(accessToken, cursors.projects, projectIds, input.labels) : {
+			issues: [],
+			nextCursor: null
+		};
+		const teamResult = cursors.teams !== null ? await this.listActiveIssues(accessToken, cursors.teams, void 0, input.labels, teamIds) : {
+			issues: [],
+			nextCursor: null
+		};
+		const projectIssues = projectResult.issues.map((issue) => linearIssueToIntakeIssue(issue));
+		const selectedTeamSourceById = new Map(teamIds.map((teamId) => [teamId, encodeSelfManagedTeamSourceId(teamId)]));
+		const selectedProjectIds = new Set(splitSelfManagedSourceIds(attributionSourceIds).projectIds);
+		const teamIssues = teamResult.issues.filter((issue) => issue.projectId === null || !selectedProjectIds.has(issue.projectId)).map((issue) => {
+			const teamSourceId = issue.teamId ? selectedTeamSourceById.get(issue.teamId) : void 0;
+			if (!teamSourceId) throw new Error("Linear returned an issue outside the selected teams.");
+			return {
+				...linearIssueToIntakeIssue(issue),
+				sourceId: teamSourceId
+			};
+		});
+		return {
+			issues: dedupeSelfManagedIssues([...projectIssues, ...teamIssues]),
+			nextCursor: await encodeSelfManagedListCursor({
+				projects: projectResult.nextCursor,
+				teams: teamResult.nextCursor
+			}, input.sourceIds, attributionSourceIds)
+		};
+	}
+	async #getIntakeIssue(input) {
+		const accessToken = getLinearAccessToken(input.connection);
+		const issue = await this.fetchIssueDetail(accessToken, input.issueId);
+		if (!issue) return null;
+		return {
+			...linearIssueToIntakeIssue(issue),
+			description: issue.description,
+			commentCount: issue.comments.length,
+			comments: issue.comments
+		};
+	}
+	async #createIntakeComment(input) {
+		const accessToken = getLinearAccessToken(input.connection);
+		return this.createIssueComment(accessToken, input.issueId, input.body);
+	}
+	async #updateIntakeIssue(input) {
+		const accessToken = getLinearAccessToken(input.connection);
+		const issue = await this.fetchIssueDetail(accessToken, input.issueId);
+		if (!issue) return null;
+		const teamKey = issue.team;
+		if (!teamKey) return null;
+		const states = await this.#listTeamWorkflowStates(accessToken, teamKey);
+		let targetState = null;
+		if (input.state.kind === "byType") {
+			const wantedType = input.state.stateType;
+			targetState = states.find((state) => state.type === wantedType) ?? null;
+		} else {
+			const wanted = input.state.name.toLowerCase();
+			targetState = states.find((state) => state.name.toLowerCase() === wanted) ?? null;
+		}
+		if (!targetState) return null;
+		if (targetState.name === issue.state) return linearIssueToIntakeIssue(issue);
+		if (!(await linearGraphql(accessToken, `mutation UpdateIssueState($id: String!, $stateId: String!) {
+        issueUpdate(id: $id, input: { stateId: $stateId }) { success }
+      }`, {
+			id: issue.id,
+			stateId: targetState.id
+		})).issueUpdate.success) throw new Error("Linear did not accept the issue update.");
+		const fresh = await this.fetchIssueDetail(accessToken, issue.id);
+		if (!fresh) return null;
+		return linearIssueToIntakeIssue(fresh);
+	}
+	async #listTeamWorkflowStates(accessToken, teamKey) {
+		return (await linearGraphql(accessToken, `query TeamStates($key: String!) {
+        team(id: $key) { states(first: 100) { nodes { id name type } } }
+      }`, { key: teamKey })).team?.states.nodes ?? [];
+	}
+	/** List the workspace's projects (for the Settings intake-source picker). */
+	async listProjects(accessToken) {
+		return (await linearGraphql(accessToken, `query { projects(first: 100) { nodes { id name state teams(first: 10) { nodes { id key name } } } } }`)).projects.nodes.map((node) => ({
+			id: node.id,
+			name: node.name,
+			state: node.state,
+			teams: node.teams.nodes.map((team) => ({
+				id: team.id,
+				key: team.key,
+				name: team.name
+			}))
+		}));
+	}
+	/** List the workspace's teams (for the Settings intake-source picker). */
+	async listTeams(accessToken) {
+		const teams = [];
+		let after;
+		for (let page = 0; page < LINEAR_TEAMS_MAX_PAGES; page += 1) {
+			const data = await linearGraphql(accessToken, `query Teams($first: Int!, $after: String) {
+          teams(first: $first, after: $after) {
+            nodes { id key name }
+            pageInfo { hasNextPage endCursor }
+          }
+        }`, {
+				first: LINEAR_TEAMS_PAGE_SIZE,
+				...after ? { after } : {}
+			});
+			teams.push(...data.teams.nodes);
+			if (!data.teams.pageInfo.hasNextPage || !data.teams.pageInfo.endCursor) break;
+			if (data.teams.pageInfo.endCursor === after) throw invalidLinearCursor();
+			after = data.teams.pageInfo.endCursor;
+		}
+		return teams.map((team) => ({
+			id: team.id,
+			key: team.key,
+			name: team.name,
+			sourceId: encodeSelfManagedTeamSourceId(team.id)
+		}));
+	}
+	sourceMatchesIssue(sourceId, issue) {
+		return isSelfManagedTeamSourceId(sourceId) ? issue.teamId === decodeSelfManagedTeamSourceId(sourceId) : issue.projectId === sourceId;
+	}
+	/**
+	* List one page of the workspace's active issues (triage/backlog/unstarted/
+	* started — completed and canceled are excluded), most recently updated
+	* first. When `projectIds` is provided, only issues from those projects are
+	* returned. When `teamIds` is provided, only issues in those teams are
+	* returned, including issues that belong to no project. Callers list team
+	* sources and project sources in separate calls so the two filters are not
+	* AND-ed together.
+	*/
+	async listActiveIssues(accessToken, after, projectIds, labels, teamIds) {
+		const normalizedLabels = [...new Set((labels ?? []).map((label) => label.trim()).filter(Boolean))];
+		const projectFilter = projectIds?.length ? ", project: { id: { in: $projectIds } }" : "";
+		const projectVar = projectIds?.length ? ", $projectIds: [ID!]" : "";
+		const teamFilter = teamIds?.length ? ", team: { id: { in: $teamIds } }" : "";
+		const teamVar = teamIds?.length ? ", $teamIds: [ID!]" : "";
+		const labelFilter = normalizedLabels.length > 0 ? ", labels: { name: { in: $labels } }" : "";
+		const { nodes, pageInfo } = (await linearGraphql(accessToken, `query Intake($first: Int!, $after: String${projectVar}${teamVar}${normalizedLabels.length > 0 ? ", $labels: [String!]" : ""}) {
+        issues(
+          first: $first
+          after: $after
+          orderBy: updatedAt
+          filter: { state: { type: { in: ["triage", "backlog", "unstarted", "started"] } }${projectFilter}${teamFilter}${labelFilter} }
+        ) {
+          nodes {
+            id
+            identifier
+            title
+            url
+            priorityLabel
+            createdAt
+            updatedAt
+            state { name type }
+            project { id }
+            assignee { name }
+            creator { name }
+            team { id key }
+            labels { nodes { name } }
+          }
+          pageInfo { hasNextPage endCursor }
+        }
+      }`, {
+			first: LINEAR_ISSUES_PAGE_SIZE,
+			after: after ?? null,
+			...projectIds?.length ? { projectIds } : {},
+			...teamIds?.length ? { teamIds } : {},
+			...normalizedLabels.length > 0 ? { labels: normalizedLabels } : {}
+		})).issues;
+		return {
+			issues: nodes.map((node) => ({
+				id: node.id,
+				projectId: node.project?.id ?? null,
+				identifier: node.identifier,
+				title: node.title,
+				url: node.url,
+				state: node.state.name,
+				stateType: node.state.type,
+				priorityLabel: node.priorityLabel,
+				assignee: node.assignee?.name ?? null,
+				creator: node.creator?.name ?? null,
+				team: node.team?.key ?? null,
+				labels: node.labels.nodes.map((label) => label.name),
+				createdAt: node.createdAt,
+				updatedAt: node.updatedAt,
+				teamId: node.team?.id ?? null
+			})),
+			nextCursor: pageInfo.hasNextPage ? pageInfo.endCursor : null
+		};
+	}
+	/** Follow `comments.pageInfo` until exhausted so long discussions aren't truncated. */
+	async #fetchRemainingIssueComments(accessToken, issueId, firstPage) {
+		const nodes = [...firstPage.nodes];
+		let { hasNextPage, endCursor } = firstPage.pageInfo;
+		for (let page = 1; hasNextPage && endCursor && page < ISSUE_COMMENTS_MAX_PAGES; page++) {
+			const comments = (await linearGraphql(accessToken, `query IssueComments($id: String!, $first: Int!, $after: String!) {
+          issue(id: $id) {
+            comments(first: $first, after: $after) {
+              nodes { body createdAt user { name } }
+              pageInfo { hasNextPage endCursor }
+            }
+          }
+        }`, {
+				id: issueId,
+				first: ISSUE_COMMENTS_PAGE_SIZE,
+				after: endCursor
+			})).issue?.comments;
+			if (!comments) break;
+			nodes.push(...comments.nodes);
+			if (comments.pageInfo.hasNextPage && comments.pageInfo.endCursor === endCursor) throw invalidLinearCursor();
+			({hasNextPage, endCursor} = comments.pageInfo);
+		}
+		return nodes;
+	}
+	/**
+	* Fetch one issue with its description and comments. `idOrIdentifier`
+	* accepts both the Linear UUID and the human key (`ENG-123`). Returns
+	* `null` when the issue doesn't exist (Linear reports it as an "Entity not
+	* found" error).
+	*/
+	async fetchIssueDetail(accessToken, idOrIdentifier, _sourceIds, _routedSourceIds) {
+		let data;
+		try {
+			data = await linearGraphql(accessToken, `query IssueDetail($id: String!, $commentsFirst: Int!) {
+          issue(id: $id) {
+            id
+            identifier
+            title
+            description
+            url
+            priorityLabel
+            createdAt
+            updatedAt
+            state { name type }
+            project { id }
+            assignee { name }
+            creator { name }
+            team { id key }
+            labels { nodes { name } }
+            comments(first: $commentsFirst) {
+              nodes { body createdAt user { name } }
+              pageInfo { hasNextPage endCursor }
+            }
+          }
+        }`, {
+				id: idOrIdentifier,
+				commentsFirst: ISSUE_COMMENTS_PAGE_SIZE
+			});
+		} catch (err) {
+			if (err instanceof Error && /entity not found/i.test(err.message)) return null;
+			throw err;
+		}
+		const issue = data.issue;
+		if (!issue) return null;
+		const comments = (await this.#fetchRemainingIssueComments(accessToken, issue.id, issue.comments)).sort((a, b) => new Date(a.createdAt).getTime() - new Date(b.createdAt).getTime());
+		return {
+			id: issue.id,
+			projectId: issue.project?.id ?? null,
+			teamId: issue.team?.id ?? null,
+			identifier: issue.identifier,
+			title: issue.title,
+			description: issue.description?.trim() ? issue.description : null,
+			url: issue.url,
+			state: issue.state.name,
+			stateType: issue.state.type,
+			priorityLabel: issue.priorityLabel,
+			assignee: issue.assignee?.name ?? null,
+			creator: issue.creator?.name ?? null,
+			team: issue.team?.key ?? null,
+			labels: issue.labels.nodes.map((label) => label.name),
+			createdAt: issue.createdAt,
+			updatedAt: issue.updatedAt,
+			comments: comments.map((comment) => ({
+				author: comment.user?.name ?? null,
+				body: comment.body,
+				createdAt: comment.createdAt
+			}))
+		};
+	}
+	/**
+	* Post a comment on an issue. `idOrIdentifier` accepts both the Linear UUID
+	* and the human key (`ENG-123`) — the identifier is resolved to a UUID
+	* first because `commentCreate` only accepts UUIDs. Returns `null` when the
+	* issue doesn't exist.
+	*/
+	async createIssueComment(accessToken, idOrIdentifier, body) {
+		let issueId;
+		try {
+			const data = await linearGraphql(accessToken, `query IssueId($id: String!) { issue(id: $id) { id } }`, { id: idOrIdentifier });
+			if (!data.issue) return null;
+			issueId = data.issue.id;
+		} catch (err) {
+			if (err instanceof Error && /entity not found/i.test(err.message)) return null;
+			throw err;
+		}
+		const data = await linearGraphql(accessToken, `mutation CommentCreate($input: CommentCreateInput!) {
+        commentCreate(input: $input) { success comment { id url } }
+      }`, { input: {
+			issueId,
+			body
+		} });
+		if (!data.commentCreate.success || !data.commentCreate.comment) throw new Error("Linear did not accept the comment.");
+		return data.commentCreate.comment;
+	}
+	workers(ctx) {
+		if (!linearIssueReconciliationEnabled()) return [];
+		const reconcile = attachLinearIssueReconciler(this, ctx);
+		if (!reconcile) return [];
+		const intervalMs = linearIssueReconciliationInterval();
+		return [new IssueReconcileWorker({
+			integrationId: this.id,
+			reconcile,
+			...intervalMs ? { intervalMs } : {}
+		})];
+	}
+	/**
+	* The integration's HTTP surface: `/web/linear/*` + `/auth/linear/*` Mastra
+	* `apiRoutes` (status, OAuth connect/callback, projects + issues for
+	* Intake). Handlers operate on this instance.
+	*/
+	routes(ctx) {
+		return buildLinearRoutes({
+			linear: this,
+			auth: ctx.auth,
+			stateSigner: ctx.stateSigner,
+			baseUrl: ctx.baseUrl,
+			intake: ctx.storage.intake,
+			projects: ctx.storage.projects,
+			ingestFactoryIssues: attachLinearRules(this, ctx),
+			workItems: ctx.runtime?.workItems,
+			boards: ctx.runtime?.boards
+		});
+	}
+	/**
+	* Org-scoped agent tools: issue detail + comment tools for sessions whose
+	* project belongs to an org with an active Linear connection.
+	*/
+	async agentTools(args) {
+		return buildLinearAgentTools({
+			requestContext: args.requestContext,
+			linear: this
+		});
+	}
+	/** Non-secret config snapshot for system diagnostics/startup logs. */
+	diagnostics() {
+		return { oauthAppConfigured: true };
+	}
+};
+function getLinearAccessToken(connection) {
+	if (connection.type !== "oauth") throw new Error("Linear capabilities require an OAuth connection.");
+	return connection.accessToken;
+}
+/**
+* Self-managed source ids. Projects use their raw Linear project id (no prefix,
+* preserving existing intake bindings). Teams are prefixed so the two never
+* collide and callers can tell them apart.
+*/
+const SELF_MANAGED_TEAM_SOURCE_PREFIX = "linear-team:";
+function encodeSelfManagedTeamSourceId(teamId) {
+	return `${SELF_MANAGED_TEAM_SOURCE_PREFIX}${teamId}`;
+}
+function isSelfManagedTeamSourceId(sourceId) {
+	return sourceId.startsWith(SELF_MANAGED_TEAM_SOURCE_PREFIX);
+}
+function decodeSelfManagedTeamSourceId(sourceId) {
+	return sourceId.slice(12);
+}
+/**
+* Split selected source ids into raw project ids and raw team ids. A team
+* source id carries the `linear-team:` prefix; everything else is a project id.
+*/
+function splitSelfManagedSourceIds(sourceIds) {
+	const projectIds = [];
+	const teamIds = [];
+	for (const sourceId of sourceIds) if (isSelfManagedTeamSourceId(sourceId)) teamIds.push(decodeSelfManagedTeamSourceId(sourceId));
+	else projectIds.push(sourceId);
+	return {
+		projectIds,
+		teamIds
+	};
+}
+async function linearSourceSetFingerprint(sourceIds, attributionSourceIds) {
+	const scope = {
+		sourceIds: [...new Set(sourceIds)].sort(),
+		attributionSourceIds: [...new Set(attributionSourceIds)].sort()
+	};
+	const bytes = new TextEncoder().encode(JSON.stringify(scope));
+	return Buffer.from(await globalThis.crypto.subtle.digest("SHA-256", bytes)).toString("base64url");
+}
+function invalidLinearCursor() {
+	return Object.assign(/* @__PURE__ */ new Error("Linear cursor is invalid or stale."), { code: "invalid_cursor" });
+}
+function isCursorValue(value) {
+	return value === null || typeof value === "string";
+}
+async function decodeSelfManagedListCursor(cursor, sourceIds, attributionSourceIds) {
+	const { projectIds, teamIds } = splitSelfManagedSourceIds(sourceIds);
+	if (!cursor) return {
+		projects: projectIds.length > 0 ? void 0 : null,
+		teams: teamIds.length > 0 ? void 0 : null
+	};
+	try {
+		const parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+		if (parsed.v !== 1 || parsed.sourceSet !== await linearSourceSetFingerprint(sourceIds, attributionSourceIds) || !isCursorValue(parsed.projects) || !isCursorValue(parsed.teams)) throw invalidLinearCursor();
+		return {
+			projects: parsed.projects,
+			teams: parsed.teams
+		};
+	} catch {
+		throw invalidLinearCursor();
+	}
+}
+async function encodeSelfManagedListCursor(state, sourceIds, attributionSourceIds) {
+	if (state.projects === null && state.teams === null) return null;
+	return Buffer.from(JSON.stringify({
+		v: 1,
+		sourceSet: await linearSourceSetFingerprint(sourceIds, attributionSourceIds),
+		...state
+	})).toString("base64url");
+}
+/**
+* Deduplicate issues that surfaced from both a selected team and one of its
+* selected projects. Keeps one entry per Linear issue UUID.
+*
+* Tie-breaker — MOST-SPECIFIC-WINS: an issue in a selected project is
+* attributed to that project source (routes to the project's board); the team
+* source covers only the remainder (projectless issues and issues in projects
+* that were not separately selected). Change the comparison here to change the
+* routing policy — this is the single precedence point for the self-managed
+* integration, mirroring the platform-backed one.
+*/
+function dedupeSelfManagedIssues(issues) {
+	const isProjectSource = (sourceId) => typeof sourceId === "string" && sourceId.length > 0 && !isSelfManagedTeamSourceId(sourceId);
+	const winners = /* @__PURE__ */ new Map();
+	for (const issue of issues) {
+		const existing = winners.get(issue.id);
+		if (!existing) {
+			winners.set(issue.id, issue);
+			continue;
+		}
+		if (isProjectSource(issue.sourceId) && !isProjectSource(existing.sourceId)) winners.set(issue.id, issue);
+	}
+	const seen = /* @__PURE__ */ new Set();
+	const ordered = [];
+	for (const issue of issues) {
+		if (seen.has(issue.id)) continue;
+		seen.add(issue.id);
+		ordered.push(winners.get(issue.id));
+	}
+	return ordered;
+}
+function linearIssueToIntakeIssue(issue) {
+	return {
+		id: issue.id,
+		sourceId: issue.projectId ?? null,
+		projectId: issue.projectId ?? null,
+		identifier: issue.identifier,
+		title: issue.title,
+		url: issue.url,
+		author: issue.creator,
+		state: issue.state,
+		stateType: issue.stateType,
+		priority: issue.priorityLabel,
+		assignee: issue.assignee,
+		source: issue.team,
+		labels: issue.labels,
+		commentCount: null,
+		createdAt: issue.createdAt,
+		updatedAt: issue.updatedAt
+	};
+}
+//#endregion
+export { LinearIntegration, LinearReauthRequiredError };
+
+//# sourceMappingURL=integration.js.map