@pome-sh/cli 0.3.0 → 0.4.0

package/node_modules/@pome-sh/twin-linear/dist/src/twin.js

@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: Apache-2.0
+import { z } from "zod";
+import { defineTwin } from "@pome-sh/sdk";
+import { createApp } from "@pome-sh/sdk/server";
+import { Hono } from "hono";
+import { resolveLinearCredential } from "./auth-credential.js";
+import { LinearDomain } from "./domain/index.js";
+import { openLinearTwinDatabase } from "./db.js";
+import { linearErrorEnvelope, unauthorizedEnvelope, unsupportedEnvelope } from "./errors.js";
+import { LINEAR_MCP_TOOL_COUNT, linearTools } from "./mcp.js";
+import { registerOAuthRoutes } from "./oauth/routes.js";
+import { projectLinearRecording } from "./recording.js";
+import { registerLinearRoutes } from "./routes.js";
+import { defaultSeedState, linearSeedSchema } from "./seed.js";
+import { linearStateDelta } from "./state.js";
+import { DEFAULT_LINEAR_EMAIL, DEFAULT_SCOPES, LINEAR_PROVIDER_TOKEN_PREFIX, } from "./types.js";
+const seedSchema = z.preprocess((value) => (value === null || value === undefined ? defaultSeedState() : value), linearSeedSchema);
+export function createLinearTwinDefinition(db) {
+    return defineTwin({
+        id: "linear",
+        version: process.env.POME_TWIN_VERSION ?? "0.1.0",
+        implementation: "linear_twin",
+        packageName: "@pome-sh/twin-linear",
+        fidelity: { default: "semantic" },
+        seed: seedSchema,
+        domain: ({ db: injected, seed }) => {
+            if (injected && injected !== db) {
+                throw new Error("twin-linear: the db passed to createApp/serve must be the db the definition was created with");
+            }
+            const domain = new LinearDomain(db);
+            if (seed)
+                domain.seed(seed);
+            return domain;
+        },
+        routes: registerLinearRoutes,
+        tools: linearTools,
+        state: ({ domain }) => domain.exportState(),
+        admin: {
+            reset: ({ domain, reportDelta }) => {
+                const before = domain.exportState();
+                domain.resetToDefault();
+                reportDelta(linearStateDelta(before, domain.exportState()));
+                return { ok: true };
+            },
+            seed: ({ domain, seed, reportDelta }) => {
+                const before = domain.exportState();
+                domain.seed(seed);
+                reportDelta(linearStateDelta(before, domain.exportState()));
+                return { ok: true };
+            },
+        },
+        recordingProjection: projectLinearRecording,
+        errorEnvelope: linearErrorEnvelope,
+        unsupported: ({ method, path }) => unsupportedEnvelope(method, path),
+        healthz: () => ({
+            fidelity: "semantic",
+            tools: LINEAR_MCP_TOOL_COUNT,
+        }),
+        mountSessionAtRoot: true,
+        auth: {
+            providerToken: { provider: "linear", prefixes: [LINEAR_PROVIDER_TOKEN_PREFIX] },
+            requirePathSid: false,
+            allowRawBearer: true,
+            resolveCredential: (token) => resolveLinearCredential(db, token),
+            unauthorized: () => unauthorizedEnvelope("Bad credentials"),
+            sidMismatch: () => unauthorizedEnvelope("Session id mismatch"),
+            sessionExtras: (claims) => ({
+                linear_email: typeof claims.linear_email === "string" && claims.linear_email.length > 0
+                    ? claims.linear_email.toLowerCase()
+                    : DEFAULT_LINEAR_EMAIL,
+                scopes: [...DEFAULT_SCOPES],
+            }),
+            providerSession: (sid) => ({
+                linear_email: DEFAULT_LINEAR_EMAIL,
+                via: "provider_token",
+                sid,
+                scopes: [...DEFAULT_SCOPES],
+            }),
+        },
+    });
+}
+/**
+ * Mount OAuth outside bearerAuth. The engine's session router (including
+ * mountSessionAtRoot) requires a bearer; Linear authorize/token/revoke are
+ * public HTTP surfaces.
+ */
+export function withPublicOAuth(app, db) {
+    const root = new Hono();
+    registerOAuthRoutes(root, new LinearDomain(db));
+    root.route("/", app);
+    return root;
+}
+export function createLinearTwinApp(options = {}) {
+    const db = options.db ?? openLinearTwinDatabase(":memory:");
+    const definition = createLinearTwinDefinition(db);
+    const seed = options.noSeed
+        ? undefined
+        : (options.seed ?? (options.db ? undefined : defaultSeedState()));
+    const app = createApp(definition, {
+        db,
+        recorder: options.recorder,
+        runId: options.runId ?? "spawn",
+        seed,
+    });
+    return withPublicOAuth(app, db);
+}
+//# sourceMappingURL=twin.js.map

package/node_modules/@pome-sh/twin-linear/dist/src/twin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"twin.js","sourceRoot":"","sources":["../../src/twin.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAuB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAsB,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAA8B,MAAM,WAAW,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,4BAA4B,GAG7B,MAAM,YAAY,CAAC;AAEpB,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAC/E,gBAAgB,CAC8B,CAAC;AAEjD,MAAM,UAAU,0BAA0B,CACxC,EAAsB;IAEtB,OAAO,UAAU,CAAC;QAChB,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO;QACjD,cAAc,EAAE,aAAa;QAC7B,WAAW,EAAE,sBAAsB;QACnC,QAAQ,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE;QACjC,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE;YACjC,IAAI,QAAQ,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC;YACpC,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE,WAAW;QAClB,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE;QAC3C,KAAK,EAAE;YACL,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE;gBACjC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,CAAC,cAAc,EAAE,CAAC;gBACxB,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;YACD,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;gBACtC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACtB,CAAC;SACF;QACD,mBAAmB,EAAE,sBAAsB;QAC3C,aAAa,EAAE,mBAAmB;QAClC,WAAW,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC;QACpE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACd,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,qBAAqB;SAC7B,CAAC;QACF,kBAAkB,EAAE,IAAI;QACxB,IAAI,EAAE;YACJ,aAAa,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,4BAA4B,CAAC,EAAE;YAC/E,cAAc,EAAE,KAAK;YACrB,cAAc,EAAE,IAAI;YACpB,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE,KAAK,CAAC;YAChE,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,iBAAiB,CAAC;YAC3D,WAAW,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,qBAAqB,CAAC;YAC9D,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC1B,YAAY,EACV,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;oBACvE,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE;oBACnC,CAAC,CAAC,oBAAoB;gBAC1B,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;aAC5B,CAAC;YACF,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACzB,YAAY,EAAE,oBAAoB;gBAClC,GAAG,EAAE,gBAAgB;gBACrB,GAAG;gBACH,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC;aAC5B,CAAC;SACH;KACF,CAAC,CAAC;AACL,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAS,EAAE,EAAsB;IAC/D,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;IACxB,mBAAmB,CAAC,IAAI,EAAE,IAAI,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAsC,EAAE;IAC1E,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,0BAA0B,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAuC,CAAC;IAC3G,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE;QAChC,EAAE;QACF,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO;QAC/B,IAAI;KACL,CAAC,CAAC;IACH,OAAO,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC"}

package/node_modules/@pome-sh/twin-linear/dist/src/types.d.ts

@@ -0,0 +1,360 @@
+import type { TwinDatabase } from "@pome-sh/sdk";
+export type LinearTwinDatabase = TwinDatabase;
+export type LinearWorkflowStateType = "backlog" | "unstarted" | "started" | "completed" | "canceled";
+export type LinearTokenType = "personal" | "oauth_access" | "oauth_refresh" | "client_credentials";
+export type LinearTokenActorType = "user" | "app";
+export type LinearIssuePriority = 0 | 1 | 2 | 3 | 4;
+export type LinearAgentActivityType = "thought" | "elicitation" | "action" | "response" | "error" | "prompt";
+export type LinearAgentSessionState = "pending" | "active" | "completed" | "failed" | "canceled";
+export type LinearProjectState = "planned" | "started" | "completed" | "canceled";
+export type LinearOrganization = {
+    id: string;
+    name: string;
+    urlKey: string;
+    url: string;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearUser = {
+    id: string;
+    email: string;
+    name: string;
+    displayName: string;
+    avatarUrl: string | null;
+    active: boolean;
+    admin: boolean;
+    app: boolean;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearTeam = {
+    id: string;
+    key: string;
+    name: string;
+    description: string | null;
+    private: boolean;
+    url: string;
+    issueSequence: number;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearWorkflowState = {
+    id: string;
+    teamId: string;
+    name: string;
+    type: LinearWorkflowStateType;
+    position: number;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearIssueLabel = {
+    id: string;
+    teamId: string | null;
+    name: string;
+    color: string;
+    description: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearProject = {
+    id: string;
+    teamId: string | null;
+    name: string;
+    description: string | null;
+    state: LinearProjectState;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearCycle = {
+    id: string;
+    teamId: string;
+    name: string;
+    number: number;
+    startsAt: string | null;
+    endsAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearIssueRelationType = "blocks" | "blocked_by" | "related";
+export type LinearIssueRelations = {
+    blocks: string[];
+    blockedBy: string[];
+    relatedTo: string[];
+};
+export type LinearIssue = {
+    id: string;
+    identifier: string;
+    number: number;
+    teamId: string;
+    title: string;
+    description: string | null;
+    priority: LinearIssuePriority;
+    estimate: number | null;
+    stateId: string;
+    assigneeId: string | null;
+    creatorId: string | null;
+    delegateId: string | null;
+    projectId: string | null;
+    cycleId: string | null;
+    parentId: string | null;
+    labelIds: string[];
+    url: string;
+    archivedAt: string | null;
+    canceledAt: string | null;
+    completedAt: string | null;
+    startedAt: string | null;
+    dueDate: string | null;
+    createAsUser: string | null;
+    displayIconUrl: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearComment = {
+    id: string;
+    issueId: string;
+    parentId: string | null;
+    userId: string | null;
+    body: string;
+    createAsUser: string | null;
+    displayIconUrl: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearDocument = {
+    id: string;
+    title: string;
+    content: string | null;
+    slug: string;
+    projectId: string | null;
+    teamId: string | null;
+    issueId: string | null;
+    cycleId: string | null;
+    icon: string | null;
+    color: string | null;
+    creatorId: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearOAuthApp = {
+    id: string;
+    clientId: string;
+    clientSecret: string;
+    name: string;
+    redirectUris: string[];
+    scopes: string[];
+    actor: LinearTokenActorType;
+    assignable: boolean;
+    mentionable: boolean;
+    appUserId: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearToken = {
+    token: string;
+    type: LinearTokenType;
+    actorType: LinearTokenActorType;
+    userId: string | null;
+    appId: string | null;
+    scopes: string[];
+    expiresAt: string | null;
+    revoked: boolean;
+    refreshToken: string | null;
+    sid: string;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearWebhook = {
+    id: string;
+    label: string;
+    url: string;
+    enabled: boolean;
+    resourceTypes: string[];
+    teamId: string | null;
+    allPublicTeams: boolean;
+    secret: string | null;
+    creatorId: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearWebhookDelivery = {
+    id: string;
+    webhookId: string;
+    event: string;
+    action: string;
+    url: string;
+    status: number | null;
+    error: string | null;
+    payload: unknown;
+    headers: Record<string, string>;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearAgentSession = {
+    id: string;
+    issueId: string | null;
+    commentId: string | null;
+    agentUserId: string;
+    state: LinearAgentSessionState;
+    plan: string | null;
+    externalUrl: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearAgentActivity = {
+    id: string;
+    sessionId: string;
+    userId: string | null;
+    type: LinearAgentActivityType;
+    body: string;
+    ephemeral: boolean;
+    createdAt: string;
+    updatedAt: string;
+};
+export type LinearStateSeed = {
+    clock?: string;
+    defaultSid?: string;
+    baseUrl?: string;
+    strictScopes?: boolean;
+    organization?: {
+        id?: string;
+        name?: string;
+        urlKey?: string;
+    };
+    users?: Array<{
+        id?: string;
+        email: string;
+        name?: string;
+        displayName?: string;
+        avatarUrl?: string | null;
+        active?: boolean;
+        admin?: boolean;
+        app?: boolean;
+    }>;
+    teams?: Array<{
+        id?: string;
+        key: string;
+        name: string;
+        description?: string | null;
+        private?: boolean;
+        states?: Array<{
+            id?: string;
+            name: string;
+            type?: LinearWorkflowStateType;
+            position?: number;
+        }>;
+    }>;
+    labels?: Array<{
+        id?: string;
+        name: string;
+        color?: string;
+        description?: string | null;
+        team?: string;
+    }>;
+    projects?: Array<{
+        id?: string;
+        name: string;
+        description?: string | null;
+        state?: LinearProjectState;
+        team?: string;
+    }>;
+    cycles?: Array<{
+        id?: string;
+        team: string;
+        name: string;
+        number?: number;
+        startsAt?: string | null;
+        endsAt?: string | null;
+    }>;
+    issues?: Array<{
+        id?: string;
+        team: string;
+        title: string;
+        description?: string | null;
+        priority?: LinearIssuePriority;
+        estimate?: number | null;
+        state?: string;
+        assignee?: string;
+        creator?: string;
+        delegate?: string;
+        project?: string;
+        cycle?: string;
+        parent?: string;
+        labels?: string[];
+        dueDate?: string | null;
+        createdAt?: string;
+        updatedAt?: string;
+    }>;
+    comments?: Array<{
+        id?: string;
+        issue: string;
+        body: string;
+        parent?: string;
+        user?: string;
+        createdAt?: string;
+    }>;
+    documents?: Array<{
+        id?: string;
+        title: string;
+        content?: string | null;
+        slug?: string;
+        project?: string;
+        team?: string;
+        issue?: string;
+        cycle?: string;
+        icon?: string | null;
+        color?: string | null;
+        creator?: string;
+        createdAt?: string;
+        updatedAt?: string;
+    }>;
+    oauthApps?: Array<{
+        id?: string;
+        clientId: string;
+        clientSecret: string;
+        name: string;
+        redirectUris: string[];
+        scopes?: string[] | string;
+        actor?: LinearTokenActorType;
+        assignable?: boolean;
+        mentionable?: boolean;
+        appUserId?: string | null;
+    }>;
+    tokens?: Array<{
+        token: string;
+        type?: Exclude<LinearTokenType, "oauth_refresh">;
+        user?: string;
+        app?: string;
+        scopes?: string[] | string;
+        actor?: LinearTokenActorType;
+        sid?: string;
+        expiresAt?: string | null;
+    }>;
+    webhooks?: Array<{
+        id?: string;
+        label?: string;
+        url: string;
+        resourceTypes?: string[] | string;
+        team?: string;
+        allPublicTeams?: boolean;
+        secret?: string | null;
+        enabled?: boolean;
+    }>;
+};
+export declare const DEFAULT_LINEAR_CLOCK = "2026-07-21T00:00:00.000Z";
+export declare const DEFAULT_LINEAR_EMAIL = "admin@pome-twin.test";
+export declare const DEFAULT_LINEAR_TOKEN = "lin_test_admin";
+export declare const LINEAR_PROVIDER_TOKEN_PREFIX = "lin_pome_";
+export declare const DEFAULT_LINEAR_SID = "standalone";
+export declare const DEFAULT_LINEAR_PORT = 3337;
+export declare const DEFAULT_SCOPES: readonly ["read", "write", "issues:create", "comments:create", "admin"];
+export declare const TITLE_MAX_BYTES = 512;
+export declare const BODY_MAX_BYTES = 65536;
+export declare const GRAPHQL_QUERY_MAX_BYTES = 100000;
+export declare const GRAPHQL_SELECTION_DEPTH_MAX = 20;
+export declare const MCP_PAGE_DEFAULT = 50;
+export declare const MCP_PAGE_MAX = 250;
+export declare const RELAY_PAGE_DEFAULT = 50;
+export declare const RELAY_PAGE_MAX = 250;
+export declare const STATE_EXPORT_CAP = 2000;
+export declare const OAUTH_CODE_TTL_SECONDS = 600;
+export declare const ACCESS_TOKEN_TTL_SECONDS = 3600;

package/node_modules/@pome-sh/twin-linear/dist/src/types.js

@@ -0,0 +1,19 @@
+export const DEFAULT_LINEAR_CLOCK = "2026-07-21T00:00:00.000Z";
+export const DEFAULT_LINEAR_EMAIL = "admin@pome-twin.test";
+export const DEFAULT_LINEAR_TOKEN = "lin_test_admin";
+export const LINEAR_PROVIDER_TOKEN_PREFIX = "lin_pome_";
+export const DEFAULT_LINEAR_SID = "standalone";
+export const DEFAULT_LINEAR_PORT = 3337;
+export const DEFAULT_SCOPES = ["read", "write", "issues:create", "comments:create", "admin"];
+export const TITLE_MAX_BYTES = 512;
+export const BODY_MAX_BYTES = 65_536;
+export const GRAPHQL_QUERY_MAX_BYTES = 100_000;
+export const GRAPHQL_SELECTION_DEPTH_MAX = 20;
+export const MCP_PAGE_DEFAULT = 50;
+export const MCP_PAGE_MAX = 250;
+export const RELAY_PAGE_DEFAULT = 50;
+export const RELAY_PAGE_MAX = 250;
+export const STATE_EXPORT_CAP = 2000;
+export const OAUTH_CODE_TTL_SECONDS = 600;
+export const ACCESS_TOKEN_TTL_SECONDS = 3600;
+//# sourceMappingURL=types.js.map

package/node_modules/@pome-sh/twin-linear/dist/src/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAyXA,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAC3D,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACrD,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG,YAAY,CAAC;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,OAAO,CAAU,CAAC;AAEtG,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAC;AAChC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC"}

package/node_modules/@pome-sh/twin-linear/dist/src/webhook-policy.d.ts

@@ -0,0 +1,27 @@
+/**
+ * SSRF guard for outbound webhook delivery.
+ *
+ * Default-deny: loopback, link-local (incl. the 169.254.169.254 cloud metadata
+ * endpoint), private, unique-local, and other non-public destinations are
+ * blocked. Hostnames are validated against their *resolved* addresses at
+ * dispatch time so a public name that resolves to an internal IP is also caught.
+ *
+ * Loopback/private delivery (trusted lab callbacks, local dev) is opt-in via the
+ * LINEAR_TWIN_ALLOW_PRIVATE_WEBHOOKS environment flag — an operator/deployment
+ * trust decision, never something the agent under test can set.
+ */
+export declare function privateWebhooksAllowed(env?: NodeJS.ProcessEnv): boolean;
+/** True when an IP literal is a loopback/private/link-local/reserved address. */
+export declare function isBlockedIp(ip: string): boolean;
+type LookupFn = (hostname: string) => Promise<Array<{
+    address: string;
+}>>;
+/**
+ * Resolve a webhook URL's host and decide whether delivery must be refused.
+ * Returns true when the destination is blocked under the default-deny policy.
+ */
+export declare function webhookDestinationBlocked(url: string, opts?: {
+    allowPrivate?: boolean;
+    resolve?: LookupFn;
+}): Promise<boolean>;
+export {};

package/node_modules/@pome-sh/twin-linear/dist/src/webhook-policy.js

@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: Apache-2.0
+import { isIP } from "node:net";
+import { lookup } from "node:dns/promises";
+/**
+ * SSRF guard for outbound webhook delivery.
+ *
+ * Default-deny: loopback, link-local (incl. the 169.254.169.254 cloud metadata
+ * endpoint), private, unique-local, and other non-public destinations are
+ * blocked. Hostnames are validated against their *resolved* addresses at
+ * dispatch time so a public name that resolves to an internal IP is also caught.
+ *
+ * Loopback/private delivery (trusted lab callbacks, local dev) is opt-in via the
+ * LINEAR_TWIN_ALLOW_PRIVATE_WEBHOOKS environment flag — an operator/deployment
+ * trust decision, never something the agent under test can set.
+ */
+export function privateWebhooksAllowed(env = process.env) {
+    const value = env.LINEAR_TWIN_ALLOW_PRIVATE_WEBHOOKS;
+    return value === "1" || value === "true";
+}
+/** True when an IP literal is a loopback/private/link-local/reserved address. */
+export function isBlockedIp(ip) {
+    const version = isIP(ip);
+    if (version === 4)
+        return isBlockedIpv4(ip);
+    if (version === 6)
+        return isBlockedIpv6(ip.toLowerCase());
+    // Not a valid literal — treat as blocked; callers only pass real addresses.
+    return true;
+}
+function isBlockedIpv4(ip) {
+    const parts = ip.split(".").map((p) => Number(p));
+    if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255))
+        return true;
+    const [a, b] = parts;
+    if (a === 0)
+        return true; // 0.0.0.0/8 "this" network
+    if (a === 10)
+        return true; // private
+    if (a === 127)
+        return true; // loopback
+    if (a === 169 && b === 254)
+        return true; // link-local (incl. 169.254.169.254 metadata)
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // private
+    if (a === 192 && b === 168)
+        return true; // private
+    if (a === 100 && b >= 64 && b <= 127)
+        return true; // carrier-grade NAT (100.64/10)
+    if (a === 192 && b === 0 && parts[2] === 0)
+        return true; // 192.0.0.0/24 IETF protocol assignments
+    if (a === 198 && (b === 18 || b === 19))
+        return true; // 198.18/15 benchmarking
+    if (a >= 224)
+        return true; // multicast + reserved + 255.255.255.255 broadcast
+    return false;
+}
+function isBlockedIpv6(ip) {
+    if (ip === "::" || ip === "::1")
+        return true; // unspecified / loopback
+    // IPv4-mapped/embedded (e.g. ::ffff:169.254.169.254) — classify the v4 tail.
+    if (ip.includes(".")) {
+        const v4 = ip.slice(ip.lastIndexOf(":") + 1);
+        if (isIP(v4) === 4)
+            return isBlockedIpv4(v4);
+    }
+    if (ip.startsWith("fc") || ip.startsWith("fd"))
+        return true; // fc00::/7 unique local
+    if (/^fe[89ab]/.test(ip))
+        return true; // fe80::/10 link-local
+    if (ip.startsWith("ff"))
+        return true; // ff00::/8 multicast
+    return false;
+}
+/**
+ * Resolve a webhook URL's host and decide whether delivery must be refused.
+ * Returns true when the destination is blocked under the default-deny policy.
+ */
+export async function webhookDestinationBlocked(url, opts = {}) {
+    if (opts.allowPrivate ?? privateWebhooksAllowed())
+        return false;
+    let host;
+    try {
+        host = new URL(url).hostname;
+    }
+    catch {
+        return true; // unparseable — refuse
+    }
+    // URL.hostname keeps brackets around IPv6 literals.
+    if (host.startsWith("[") && host.endsWith("]"))
+        host = host.slice(1, -1);
+    if (isIP(host))
+        return isBlockedIp(host);
+    // Hostname: validate every resolved address (public name → internal IP is SSRF too).
+    const resolver = opts.resolve ?? ((h) => lookup(h, { all: true }));
+    let addresses;
+    try {
+        addresses = await resolver(host);
+    }
+    catch {
+        // Unresolvable host is not an SSRF target; let the fetch fail normally.
+        return false;
+    }
+    if (addresses.length === 0)
+        return false;
+    return addresses.some((entry) => isBlockedIp(entry.address));
+}
+//# sourceMappingURL=webhook-policy.js.map

package/node_modules/@pome-sh/twin-linear/dist/src/webhook-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-policy.js","sourceRoot":"","sources":["../../src/webhook-policy.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACzE,MAAM,KAAK,GAAG,GAAG,CAAC,kCAAkC,CAAC;IACrD,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC3C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1D,4EAA4E;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAyC,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,2BAA2B;IACrD,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,UAAU;IACrC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IACvC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,8CAA8C;IACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,UAAU;IAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,UAAU;IACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,gCAAgC;IACnF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yCAAyC;IAClG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;IAC/E,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;IAC9E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,EAAU;IAC/B,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;IACvE,6EAA6E;IAC7E,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC;YAAE,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IACrF,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IAC9D,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,qBAAqB;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAID;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAW,EACX,OAAuD,EAAE;IAEzD,IAAI,IAAI,CAAC,YAAY,IAAI,sBAAsB,EAAE;QAAE,OAAO,KAAK,CAAC;IAEhE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,uBAAuB;IACtC,CAAC;IACD,oDAAoD;IACpD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzE,IAAI,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IAEzC,qFAAqF;IACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3E,IAAI,SAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/node_modules/@pome-sh/twin-linear/dist/src/webhook-url.d.ts

@@ -0,0 +1,3 @@
+/** Returns an error message when the URL is not a safe webhook destination, else null. */
+export declare function webhookUrlError(url: string): string | null;
+export declare function assertWebhookUrl(url: string): string;

package/node_modules/@pome-sh/twin-linear/dist/src/webhook-url.js

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: Apache-2.0
+import { badUserInput } from "./errors.js";
+/** Returns an error message when the URL is not a safe webhook destination, else null. */
+export function webhookUrlError(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return `Invalid webhook URL: ${url}`;
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        return `Webhook URL must use http or https: ${url}`;
+    }
+    if (parsed.username || parsed.password) {
+        return `Webhook URL must not include credentials`;
+    }
+    return null;
+}
+export function assertWebhookUrl(url) {
+    const error = webhookUrlError(url);
+    if (error)
+        badUserInput(error);
+    return url;
+}
+//# sourceMappingURL=webhook-url.js.map

package/node_modules/@pome-sh/twin-linear/dist/src/webhook-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-url.js","sourceRoot":"","sources":["../../src/webhook-url.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,0FAA0F;AAC1F,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,GAAG,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,OAAO,uCAAuC,GAAG,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,OAAO,0CAA0C,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK;QAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC;AACb,CAAC"}