@urateam/cli 0.1.41 → 0.1.42

package/dist/__tests__/env-file.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=env-file.test.d.ts.map

package/dist/__tests__/env-file.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/env-file.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/env-file.test.js

@@ -0,0 +1,89 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, rmSync, readFileSync, writeFileSync, existsSync, } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { upsertEnvFile, readEnvFile } from "../lib/env-file.js";
+describe("upsertEnvFile", () => {
+    let tmp;
+    let path;
+    beforeEach(() => {
+        tmp = mkdtempSync(join(tmpdir(), "ura-env-"));
+        path = join(tmp, ".env");
+    });
+    afterEach(() => {
+        rmSync(tmp, { recursive: true, force: true });
+    });
+    it("creates the file when it does not exist", () => {
+        upsertEnvFile(path, { LINEAR_API_KEY: "lin_oauth_abc" });
+        const raw = readFileSync(path, "utf8");
+        expect(raw).toContain("LINEAR_API_KEY=lin_oauth_abc");
+    });
+    it("merges into an existing file preserving unrelated keys", () => {
+        writeFileSync(path, [
+            "ANTHROPIC_API_KEY=sk-ant-xyz",
+            "DASHBOARD_USER=admin",
+            "LINEAR_API_KEY=lin_api_old",
+            "",
+        ].join("\n"));
+        upsertEnvFile(path, { LINEAR_API_KEY: "lin_oauth_new" });
+        const raw = readFileSync(path, "utf8");
+        expect(raw).toContain("ANTHROPIC_API_KEY=sk-ant-xyz");
+        expect(raw).toContain("DASHBOARD_USER=admin");
+        expect(raw).toContain("LINEAR_API_KEY=lin_oauth_new");
+        expect(raw).not.toContain("lin_api_old");
+    });
+    it("preserves comments and blank lines around modified keys", () => {
+        writeFileSync(path, [
+            "# Linear",
+            "",
+            "LINEAR_API_KEY=lin_api_old",
+            "# Anthropic",
+            "ANTHROPIC_API_KEY=sk-ant-xyz",
+            "",
+        ].join("\n"));
+        upsertEnvFile(path, { LINEAR_API_KEY: "lin_oauth_new" });
+        const raw = readFileSync(path, "utf8");
+        expect(raw).toMatch(/^# Linear/m);
+        expect(raw).toMatch(/^# Anthropic/m);
+    });
+    it("appends new keys at the end when not already present", () => {
+        writeFileSync(path, "ANTHROPIC_API_KEY=sk-ant-xyz\n");
+        upsertEnvFile(path, { LINEAR_API_KEY: "lin_oauth_new" });
+        const lines = readFileSync(path, "utf8").split("\n");
+        const idx = lines.findIndex((l) => l.startsWith("LINEAR_API_KEY="));
+        const anthropicIdx = lines.findIndex((l) => l.startsWith("ANTHROPIC_API_KEY="));
+        expect(idx).toBeGreaterThan(anthropicIdx);
+    });
+    it("can upsert multiple keys in one call", () => {
+        upsertEnvFile(path, {
+            LINEAR_API_KEY: "lin_oauth_new",
+            LINEAR_WORKSPACE_ID: "ws_abc",
+        });
+        const raw = readFileSync(path, "utf8");
+        expect(raw).toContain("LINEAR_API_KEY=lin_oauth_new");
+        expect(raw).toContain("LINEAR_WORKSPACE_ID=ws_abc");
+    });
+    it("leaves no .env.tmp behind after a successful upsert", () => {
+        upsertEnvFile(path, { LINEAR_API_KEY: "lin_oauth_new" });
+        expect(existsSync(`${path}.tmp`)).toBe(false);
+    });
+});
+describe("readEnvFile", () => {
+    let tmp;
+    let path;
+    beforeEach(() => {
+        tmp = mkdtempSync(join(tmpdir(), "ura-env-"));
+        path = join(tmp, ".env");
+    });
+    afterEach(() => {
+        rmSync(tmp, { recursive: true, force: true });
+    });
+    it("returns an empty object when the file is absent", () => {
+        expect(readEnvFile(path)).toEqual({});
+    });
+    it("parses KEY=value lines, ignoring comments and blanks", () => {
+        writeFileSync(path, ["# comment", "", "FOO=bar", "BAZ=qux quux"].join("\n"));
+        expect(readEnvFile(path)).toEqual({ FOO: "bar", BAZ: "qux quux" });
+    });
+});
+//# sourceMappingURL=env-file.test.js.map

package/dist/__tests__/env-file.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.test.js","sourceRoot":"","sources":["../../src/__tests__/env-file.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EACL,WAAW,EACX,MAAM,EACN,YAAY,EACZ,aAAa,EACb,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEhE,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,IAAI,GAAW,CAAC;IAChB,IAAI,IAAY,CAAC;IACjB,UAAU,CAAC,GAAG,EAAE;QACd,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9C,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,aAAa,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,aAAa,CACX,IAAI,EACJ;YACE,8BAA8B;YAC9B,sBAAsB;YACtB,4BAA4B;YAC5B,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,aAAa,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,aAAa,CACX,IAAI,EACJ;YACE,UAAU;YACV,EAAE;YACF,4BAA4B;YAC5B,aAAa;YACb,8BAA8B;YAC9B,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;QACF,aAAa,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,aAAa,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;QACtD,aAAa,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CACzC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CACnC,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,aAAa,CAAC,IAAI,EAAE;YAClB,cAAc,EAAE,eAAe;YAC/B,mBAAmB,EAAE,QAAQ;SAC9B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,aAAa,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,IAAI,GAAW,CAAC;IAChB,IAAI,IAAY,CAAC;IACjB,UAAU,CAAC,GAAG,EAAE;QACd,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9C,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,aAAa,CACX,IAAI,EACJ,CAAC,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACxD,CAAC;QACF,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/linear-oauth.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=linear-oauth.test.d.ts.map

package/dist/__tests__/linear-oauth.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-oauth.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/linear-oauth.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/linear-oauth.test.js

@@ -0,0 +1,162 @@
+import { describe, it, expect, vi } from "vitest";
+import { runLinearOAuth } from "../lib/linear-oauth.js";
+function makeDeps(overrides = {}) {
+    return {
+        clientId: "linear-client-id",
+        clientSecret: "linear-client-secret",
+        scope: "read,write",
+        timeoutMs: 1000,
+        // 0 = bind a random free port. Tests inspect the resulting redirect_uri to
+        // discover the actual port — production callers pass a fixed port.
+        port: 0,
+        openBrowser: vi.fn(async (_url) => { }),
+        fetchTokenEndpoint: vi.fn(async (_body) => ({
+            access_token: "lin_oauth_token_123",
+            token_type: "Bearer",
+            expires_in: 31536000,
+            scope: "read,write",
+        })),
+        fetchViewer: vi.fn(async (_token) => ({
+            workspaceId: "ws_abc",
+            workspaceName: "Acme",
+        })),
+        ...overrides,
+    };
+}
+async function postCallback(port, params) {
+    const qs = new URLSearchParams(params).toString();
+    return fetch(`http://127.0.0.1:${port}/callback?${qs}`);
+}
+describe("runLinearOAuth", () => {
+    it("happy path: returns token + workspace metadata after a valid callback", async () => {
+        const deps = makeDeps();
+        let capturedPort = 0;
+        let capturedState = "";
+        deps.openBrowser = vi.fn(async (url) => {
+            const parsed = new URL(url);
+            capturedState = parsed.searchParams.get("state");
+            const redirectUri = parsed.searchParams.get("redirect_uri");
+            capturedPort = Number(new URL(redirectUri).port);
+            await postCallback(capturedPort, {
+                code: "test-code",
+                state: capturedState,
+            });
+        });
+        const result = await runLinearOAuth(deps);
+        expect(result.accessToken).toBe("lin_oauth_token_123");
+        expect(result.workspaceId).toBe("ws_abc");
+        expect(result.workspaceName).toBe("Acme");
+        expect(deps.fetchTokenEndpoint).toHaveBeenCalledWith(expect.objectContaining({
+            code: "test-code",
+            client_id: "linear-client-id",
+            client_secret: "linear-client-secret",
+            grant_type: "authorization_code",
+        }));
+    });
+    it("rejects state mismatch", async () => {
+        const deps = makeDeps();
+        deps.openBrowser = vi.fn(async (url) => {
+            const parsed = new URL(url);
+            const redirectUri = parsed.searchParams.get("redirect_uri");
+            const port = Number(new URL(redirectUri).port);
+            await postCallback(port, {
+                code: "test-code",
+                state: "ATTACKER-STATE",
+            });
+        });
+        await expect(runLinearOAuth(deps)).rejects.toThrow(/state mismatch/i);
+    });
+    it("times out when the callback never arrives", async () => {
+        const deps = makeDeps({
+            timeoutMs: 100,
+            openBrowser: vi.fn(async () => { }),
+        });
+        await expect(runLinearOAuth(deps)).rejects.toThrow(/timed out/i);
+    });
+    it("surfaces Linear API errors during token exchange", async () => {
+        const deps = makeDeps({
+            fetchTokenEndpoint: vi.fn(async () => {
+                throw new Error("400: invalid_grant");
+            }),
+        });
+        deps.openBrowser = vi.fn(async (url) => {
+            const parsed = new URL(url);
+            const state = parsed.searchParams.get("state");
+            const redirectUri = parsed.searchParams.get("redirect_uri");
+            const port = Number(new URL(redirectUri).port);
+            await postCallback(port, { code: "bad-code", state });
+        });
+        await expect(runLinearOAuth(deps)).rejects.toThrow(/invalid_grant/);
+    });
+    it("never returns the token via the openBrowser URL or the callback response body", async () => {
+        const deps = makeDeps();
+        let urlPassedToBrowser = "";
+        let callbackBody = "";
+        deps.openBrowser = vi.fn(async (url) => {
+            urlPassedToBrowser = url;
+            const parsed = new URL(url);
+            const state = parsed.searchParams.get("state");
+            const redirectUri = parsed.searchParams.get("redirect_uri");
+            const port = Number(new URL(redirectUri).port);
+            const res = await postCallback(port, { code: "test-code", state });
+            callbackBody = await res.text();
+        });
+        await runLinearOAuth(deps);
+        expect(urlPassedToBrowser).not.toContain("lin_oauth_token_123");
+        expect(callbackBody).not.toContain("lin_oauth_token_123");
+    });
+    it("still returns the token when fetchViewer fails (operator already authorized)", async () => {
+        // Critical contract: a Linear GraphQL hiccup after a successful token
+        // exchange must NOT discard the access token. The operator already
+        // clicked "Authorize"; making them redo the flow because the metadata
+        // fetch hiccuped is hostile UX. Implementation renders SUCCESS_HTML
+        // BEFORE the viewer fetch so the browser shows success regardless.
+        const deps = makeDeps({
+            fetchViewer: vi.fn(async () => {
+                throw new Error("Linear GraphQL hiccup");
+            }),
+        });
+        deps.openBrowser = vi.fn(async (url) => {
+            const parsed = new URL(url);
+            const state = parsed.searchParams.get("state");
+            const redirectUri = parsed.searchParams.get("redirect_uri");
+            const port = Number(new URL(redirectUri).port);
+            // Fire-and-forget — we don't need the response body in this test.
+            // The OAuth orchestrator's promise resolution is what we assert.
+            void postCallback(port, { code: "test-code", state }).catch(() => { });
+        });
+        const result = await runLinearOAuth(deps);
+        expect(result.accessToken).toBe("lin_oauth_token_123");
+        expect(result.workspaceId).toBe("unknown");
+        expect(result.workspaceName).toBeUndefined();
+        expect(deps.fetchViewer).toHaveBeenCalled();
+    });
+    it("authorize URL contains the matching redirect_uri (port consistency)", async () => {
+        const deps = makeDeps();
+        let urlSeen = "";
+        deps.openBrowser = vi.fn(async (url) => {
+            urlSeen = url;
+            const parsed = new URL(url);
+            const state = parsed.searchParams.get("state");
+            const redirectUri = parsed.searchParams.get("redirect_uri");
+            const port = Number(new URL(redirectUri).port);
+            await postCallback(port, { code: "test-code", state });
+        });
+        await runLinearOAuth(deps);
+        const parsed = new URL(urlSeen);
+        const redirectUri = parsed.searchParams.get("redirect_uri");
+        expect(deps.fetchTokenEndpoint).toHaveBeenCalledWith(expect.objectContaining({ redirect_uri: redirectUri }));
+    });
+    it("rejects callback without a code", async () => {
+        const deps = makeDeps();
+        deps.openBrowser = vi.fn(async (url) => {
+            const parsed = new URL(url);
+            const state = parsed.searchParams.get("state");
+            const redirectUri = parsed.searchParams.get("redirect_uri");
+            const port = Number(new URL(redirectUri).port);
+            await postCallback(port, { state });
+        });
+        await expect(runLinearOAuth(deps)).rejects.toThrow(/missing code/i);
+    });
+});
+//# sourceMappingURL=linear-oauth.test.js.map

package/dist/__tests__/linear-oauth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-oauth.test.js","sourceRoot":"","sources":["../../src/__tests__/linear-oauth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,cAAc,EAAwB,MAAM,wBAAwB,CAAC;AAE9E,SAAS,QAAQ,CAAC,YAAsC,EAAE;IACxD,OAAO;QACL,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,sBAAsB;QACpC,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,IAAI;QACf,2EAA2E;QAC3E,mEAAmE;QACnE,IAAI,EAAE,CAAC;QACP,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,GAAE,CAAC,CAAC;QAC9C,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YAC1C,YAAY,EAAE,qBAAqB;YACnC,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,QAAQ;YACpB,KAAK,EAAE,YAAY;SACpB,CAAC,CAAC;QACH,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACpC,WAAW,EAAE,QAAQ;YACrB,aAAa,EAAE,MAAM;SACtB,CAAC,CAAC;QACH,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,MAA8B;IACtE,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClD,OAAO,KAAK,CAAC,oBAAoB,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,aAAa,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAClD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;YAC7D,YAAY,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,YAAY,CAAC,YAAY,EAAE;gBAC/B,IAAI,EAAE,WAAW;gBACjB,KAAK,EAAE,aAAa;aACrB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,CAClD,MAAM,CAAC,gBAAgB,CAAC;YACtB,IAAI,EAAE,WAAW;YACjB,SAAS,EAAE,kBAAkB;YAC7B,aAAa,EAAE,sBAAsB;YACrC,UAAU,EAAE,oBAAoB;SACjC,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,KAAK,IAAI,EAAE;QACtC,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,YAAY,CAAC,IAAI,EAAE;gBACvB,IAAI,EAAE,WAAW;gBACjB,KAAK,EAAE,gBAAgB;aACxB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,IAAI,GAAG,QAAQ,CAAC;YACpB,SAAS,EAAE,GAAG;YACd,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;SACnC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,IAAI,GAAG,QAAQ,CAAC;YACpB,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;gBACnC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAChD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,kBAAkB,GAAG,EAAE,CAAC;QAC5B,IAAI,YAAY,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YAC7C,kBAAkB,GAAG,GAAG,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAChD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,YAAY,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAChE,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,sEAAsE;QACtE,mEAAmE;QACnE,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,IAAI,GAAG,QAAQ,CAAC;YACpB,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;gBAC5B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC3C,CAAC,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAChD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/C,kEAAkE;YAClE,iEAAiE;YACjE,KAAK,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YAC7C,OAAO,GAAG,GAAG,CAAC;YACd,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAChD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,CAClD,MAAM,CAAC,gBAAgB,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;QACxB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAChD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/oauth-state.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=oauth-state.test.d.ts.map

package/dist/__tests__/oauth-state.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/oauth-state.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/oauth-state.test.js

@@ -0,0 +1,40 @@
+import { describe, it, expect } from "vitest";
+import { signState, verifyState, newNonce } from "../lib/oauth-state.js";
+describe("OAuth state HMAC", () => {
+    it("round-trips a nonce", () => {
+        const secret = "fixed-secret-for-test";
+        const signed = signState(secret, "nonce-abc");
+        expect(verifyState(secret, signed)).toBe("nonce-abc");
+    });
+    it("rejects a tampered nonce", () => {
+        const secret = "fixed-secret-for-test";
+        const signed = signState(secret, "nonce-abc");
+        const [nonce, sig] = signed.split(".");
+        const tampered = `${nonce}-tampered.${sig}`;
+        expect(verifyState(secret, tampered)).toBeNull();
+    });
+    it("rejects a state signed with a different secret", () => {
+        const signed = signState("secret-a", "nonce-abc");
+        expect(verifyState("secret-b", signed)).toBeNull();
+    });
+    it("rejects malformed input", () => {
+        expect(verifyState("any-secret", "")).toBeNull();
+        expect(verifyState("any-secret", "no-dot")).toBeNull();
+        expect(verifyState("any-secret", "too.many.dots")).toBeNull();
+    });
+    it("rejects same-length-but-wrong sig without throwing", () => {
+        const signed = signState("secret", "nonce");
+        const [nonce] = signed.split(".");
+        const wrongButSameLen = `${nonce}.${"f".repeat(64)}`;
+        expect(() => verifyState("secret", wrongButSameLen)).not.toThrow();
+        expect(verifyState("secret", wrongButSameLen)).toBeNull();
+    });
+    it("newNonce produces unique 32-char hex values", () => {
+        const a = newNonce();
+        const b = newNonce();
+        expect(a).toMatch(/^[0-9a-f]{32}$/);
+        expect(b).toMatch(/^[0-9a-f]{32}$/);
+        expect(a).not.toBe(b);
+    });
+});
+//# sourceMappingURL=oauth-state.test.js.map

package/dist/__tests__/oauth-state.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.test.js","sourceRoot":"","sources":["../../src/__tests__/oauth-state.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAEzE,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,MAAM,GAAG,uBAAuB,CAAC;QACvC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9C,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,MAAM,GAAG,uBAAuB,CAAC;QACvC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,GAAG,KAAK,aAAa,GAAG,EAAE,CAAC;QAC5C,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACjD,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvD,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,eAAe,GAAG,GAAG,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACnE,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/self-auth-linear.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=self-auth-linear.test.d.ts.map

package/dist/__tests__/self-auth-linear.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-auth-linear.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/self-auth-linear.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/self-auth-linear.test.js

@@ -0,0 +1,92 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { mkdtempSync, rmSync, readFileSync, writeFileSync, mkdirSync, } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+// Drive the OAuth flow by hijacking `defaultBrowserOpen` to post the simulated
+// provider callback at the server the real `runLinearOAuth` opens; mock the
+// token + viewer fetches so no network is touched.
+vi.mock("../lib/linear-oauth-deps.js", async () => {
+    return {
+        defaultBrowserOpen: async (url) => {
+            const parsed = new URL(url);
+            const state = parsed.searchParams.get("state");
+            const redirectUri = parsed.searchParams.get("redirect_uri");
+            const port = Number(new URL(redirectUri).port);
+            const qs = new URLSearchParams({ code: "fake-code", state }).toString();
+            await fetch(`http://127.0.0.1:${port}/callback?${qs}`);
+        },
+        defaultFetchTokenEndpoint: async () => ({
+            access_token: "lin_oauth_TOKEN",
+            token_type: "Bearer",
+            expires_in: 31536000,
+            scope: "read,write",
+        }),
+        defaultFetchViewer: async () => ({
+            workspaceId: "ws_test",
+            workspaceName: "Test Workspace",
+        }),
+    };
+});
+const { selfAuthLinearCommand } = await import("../commands/self-auth-linear.js");
+describe("ura self-auth-linear", () => {
+    let tmp;
+    beforeEach(() => {
+        tmp = mkdtempSync(join(tmpdir(), "ura-oauth-"));
+        process.env.URATEAM_HOME = tmp;
+        mkdirSync(tmp, { recursive: true });
+        process.env.LINEAR_CLIENT_ID = "client-abc";
+        process.env.LINEAR_CLIENT_SECRET = "secret-xyz";
+    });
+    afterEach(() => {
+        delete process.env.URATEAM_HOME;
+        delete process.env.LINEAR_CLIENT_ID;
+        delete process.env.LINEAR_CLIENT_SECRET;
+        rmSync(tmp, { recursive: true, force: true });
+    });
+    it("writes LINEAR_API_KEY to ~/.urateam/.env on success", async () => {
+        await selfAuthLinearCommand.parseAsync(["--port", "0"], { from: "user" });
+        const raw = readFileSync(join(tmp, ".env"), "utf8");
+        expect(raw).toContain("LINEAR_API_KEY=lin_oauth_TOKEN");
+    });
+    it("preserves unrelated keys in an existing .env", async () => {
+        writeFileSync(join(tmp, ".env"), "ANTHROPIC_API_KEY=sk-ant-xyz\nLINEAR_API_KEY=lin_api_old\n");
+        await selfAuthLinearCommand.parseAsync(["--port", "0"], { from: "user" });
+        const raw = readFileSync(join(tmp, ".env"), "utf8");
+        expect(raw).toContain("ANTHROPIC_API_KEY=sk-ant-xyz");
+        expect(raw).toContain("LINEAR_API_KEY=lin_oauth_TOKEN");
+        expect(raw).not.toContain("lin_api_old");
+    });
+    it("never logs the token to console", async () => {
+        const spy = vi.spyOn(console, "log").mockImplementation(() => { });
+        await selfAuthLinearCommand.parseAsync(["--port", "0"], { from: "user" });
+        const out = spy.mock.calls.flat().join("\n");
+        expect(out).not.toContain("lin_oauth_TOKEN");
+        spy.mockRestore();
+    });
+    it("logs the workspace name on success (operator-friendly confirmation)", async () => {
+        const spy = vi.spyOn(console, "log").mockImplementation(() => { });
+        await selfAuthLinearCommand.parseAsync(["--port", "0"], { from: "user" });
+        const out = spy.mock.calls.flat().join("\n");
+        expect(out).toMatch(/Test Workspace/);
+        spy.mockRestore();
+    });
+    it("fails when LINEAR_CLIENT_ID is missing", async () => {
+        delete process.env.LINEAR_CLIENT_ID;
+        await expect(selfAuthLinearCommand.parseAsync([], { from: "user" })).rejects.toThrow(/LINEAR_CLIENT_ID/);
+    });
+    it("fails when LINEAR_CLIENT_SECRET is missing", async () => {
+        delete process.env.LINEAR_CLIENT_SECRET;
+        await expect(selfAuthLinearCommand.parseAsync([], { from: "user" })).rejects.toThrow(/LINEAR_CLIENT_SECRET/);
+    });
+    it("rejects an out-of-range --port", async () => {
+        await expect(selfAuthLinearCommand.parseAsync(["--port", "999999"], { from: "user" })).rejects.toThrow(/--port must be an integer between 0 and 65535/);
+        await expect(selfAuthLinearCommand.parseAsync(["--port", "not-a-number"], {
+            from: "user",
+        })).rejects.toThrow(/--port must be an integer/);
+    });
+    it("fails when URATEAM_HOME does not exist (operator forgot 'ura init')", async () => {
+        rmSync(tmp, { recursive: true, force: true });
+        await expect(selfAuthLinearCommand.parseAsync([], { from: "user" })).rejects.toThrow(/ura init/i);
+    });
+});
+//# sourceMappingURL=self-auth-linear.test.js.map

package/dist/__tests__/self-auth-linear.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-auth-linear.test.js","sourceRoot":"","sources":["../../src/__tests__/self-auth-linear.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EACL,WAAW,EACX,MAAM,EACN,YAAY,EACZ,aAAa,EACb,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,+EAA+E;AAC/E,4EAA4E;AAC5E,mDAAmD;AACnD,EAAE,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;IAChD,OAAO;QACL,kBAAkB,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE;YACxC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;YAChD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC,oBAAoB,IAAI,aAAa,EAAE,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,yBAAyB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YACtC,YAAY,EAAE,iBAAiB;YAC/B,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,QAAQ;YACpB,KAAK,EAAE,YAAY;SACpB,CAAC;QACF,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC/B,WAAW,EAAE,SAAS;YACtB,aAAa,EAAE,gBAAgB;SAChC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAC5C,iCAAiC,CAClC,CAAC;AAEF,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,IAAI,GAAW,CAAC;IAChB,UAAU,CAAC,GAAG,EAAE;QACd,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC;QAC/B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,gBAAgB,GAAG,YAAY,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,YAAY,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACxC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EACjB,4DAA4D,CAC7D,CAAC;QACF,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClE,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC7C,GAAG,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAClE,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,WAAW,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACpC,MAAM,MAAM,CACV,qBAAqB,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CACvD,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACxC,MAAM,MAAM,CACV,qBAAqB,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CACvD,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,MAAM,CACV,qBAAqB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CACzE,CAAC,OAAO,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;QACnE,MAAM,MAAM,CACV,qBAAqB,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE;YAC3D,IAAI,EAAE,MAAM;SACb,CAAC,CACH,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,MAAM,CACV,qBAAqB,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CACvD,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/self-auth-linear.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `ura self-auth-linear` — browser-based Linear OAuth flow.
+ *
+ * Preconditions:
+ *   1. `ura init` has been run (`$URATEAM_HOME` exists).
+ *   2. `LINEAR_CLIENT_ID` and `LINEAR_CLIENT_SECRET` are set (operator created
+ *      an OAuth app in Linear's settings — see deploy/USER_LEVEL_INSTALL.md).
+ *
+ * Behavior:
+ *   - Starts an ephemeral 127.0.0.1 HTTP server, opens the authorize URL in
+ *     the operator's browser, verifies the HMAC-signed state on callback,
+ *     exchanges the code for an access token, fetches workspace metadata.
+ *   - Writes LINEAR_API_KEY=<access_token> to $URATEAM_HOME/.env, preserving
+ *     unrelated keys.
+ *   - Emits a `linear.oauth_completed` audit event opportunistically.
+ *
+ * The access token is never logged. The success-page HTML returned to the
+ * browser contains no token.
+ */
+import { Command } from "commander";
+export declare const selfAuthLinearCommand: Command;
+//# sourceMappingURL=self-auth-linear.d.ts.map

package/dist/commands/self-auth-linear.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-auth-linear.d.ts","sourceRoot":"","sources":["../../src/commands/self-auth-linear.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwDpC,eAAO,MAAM,qBAAqB,SAwE9B,CAAC"}

package/dist/commands/self-auth-linear.js

@@ -0,0 +1,100 @@
+/**
+ * `ura self-auth-linear` — browser-based Linear OAuth flow.
+ *
+ * Preconditions:
+ *   1. `ura init` has been run (`$URATEAM_HOME` exists).
+ *   2. `LINEAR_CLIENT_ID` and `LINEAR_CLIENT_SECRET` are set (operator created
+ *      an OAuth app in Linear's settings — see deploy/USER_LEVEL_INSTALL.md).
+ *
+ * Behavior:
+ *   - Starts an ephemeral 127.0.0.1 HTTP server, opens the authorize URL in
+ *     the operator's browser, verifies the HMAC-signed state on callback,
+ *     exchanges the code for an access token, fetches workspace metadata.
+ *   - Writes LINEAR_API_KEY=<access_token> to $URATEAM_HOME/.env, preserving
+ *     unrelated keys.
+ *   - Emits a `linear.oauth_completed` audit event opportunistically.
+ *
+ * The access token is never logged. The success-page HTML returned to the
+ * browser contains no token.
+ */
+import { Command } from "commander";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { userInfo } from "node:os";
+import { createDb, logAuditEvent, linearOauthCompletedEvent, } from "@urateam/core";
+import { resolveUserLevelHome, userLevelDataDir, } from "../lib/user-level-config.js";
+import { runLinearOAuth } from "../lib/linear-oauth.js";
+import { defaultBrowserOpen, defaultFetchTokenEndpoint, defaultFetchViewer, } from "../lib/linear-oauth-deps.js";
+import { upsertEnvFile } from "../lib/env-file.js";
+const DEFAULT_TIMEOUT_MS = 5 * 60 * 1000;
+const DEFAULT_SCOPE = "read,write";
+/**
+ * Fixed default port for the callback server. Linear's OAuth flow requires
+ * the redirect URI in the authorize request to EXACTLY match the URI
+ * registered in the OAuth app settings (host + port + path), so a random
+ * port would force the operator to re-register every time. 9898 is
+ * unprivileged and unlikely to collide with common dev-server ports. The
+ * `--port` flag overrides it when 9898 is taken — but the operator then
+ * has to register the new URI in Linear.
+ */
+const DEFAULT_PORT = 9898;
+async function tryEmitAuditEvent(args) {
+    try {
+        const dbPath = join(userLevelDataDir(), "urateam.db");
+        if (!existsSync(dbPath))
+            return;
+        const db = await createDb({ connectionString: dbPath });
+        const actor = `cli:${userInfo().username ?? "unknown"}`;
+        await logAuditEvent(db, linearOauthCompletedEvent({
+            workspaceId: args.workspaceId,
+            workspaceName: args.workspaceName,
+            actor,
+        }));
+    }
+    catch {
+        // Audit failure must not break the OAuth flow.
+    }
+}
+export const selfAuthLinearCommand = new Command("self-auth-linear")
+    .description("Browser-based Linear OAuth flow; stores the token as LINEAR_API_KEY in ~/.urateam/.env")
+    .option("--timeout-ms <ms>", "How long to wait for the operator to authorize (default 5 minutes)", String(DEFAULT_TIMEOUT_MS))
+    .option("--scope <scope>", "OAuth scopes to request (comma-separated)", DEFAULT_SCOPE)
+    .option("--port <port>", "Local port for the callback server (must match the redirect URI registered in Linear)", String(DEFAULT_PORT))
+    .action(async (opts) => {
+    const home = resolveUserLevelHome();
+    if (!existsSync(home)) {
+        throw new Error(`ura self-auth-linear: ${home} does not exist. Run 'ura init' first.`);
+    }
+    const clientId = process.env.LINEAR_CLIENT_ID;
+    const clientSecret = process.env.LINEAR_CLIENT_SECRET;
+    if (!clientId) {
+        throw new Error("ura self-auth-linear: LINEAR_CLIENT_ID is not set. Create a Linear OAuth app at https://linear.app/settings/api/applications/new and set LINEAR_CLIENT_ID + LINEAR_CLIENT_SECRET in ~/.urateam/.env before running this command.");
+    }
+    if (!clientSecret) {
+        throw new Error("ura self-auth-linear: LINEAR_CLIENT_SECRET is not set. See https://linear.app/settings/api/applications and copy the client secret into ~/.urateam/.env.");
+    }
+    const port = Number(opts.port);
+    if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        throw new Error(`ura self-auth-linear: --port must be an integer between 0 and 65535 (got '${opts.port}')`);
+    }
+    console.log(`ura self-auth-linear: opening Linear in your browser (callback on http://127.0.0.1:${port}/callback)…`);
+    const result = await runLinearOAuth({
+        clientId,
+        clientSecret,
+        scope: opts.scope,
+        timeoutMs: Number(opts.timeoutMs),
+        port,
+        openBrowser: defaultBrowserOpen,
+        fetchTokenEndpoint: defaultFetchTokenEndpoint,
+        fetchViewer: defaultFetchViewer,
+    });
+    upsertEnvFile(join(home, ".env"), {
+        LINEAR_API_KEY: result.accessToken,
+    });
+    console.log(`ura self-auth-linear: authorized for workspace ${result.workspaceName ?? result.workspaceId}; token written to ${join(home, ".env")}.`);
+    await tryEmitAuditEvent({
+        workspaceId: result.workspaceId,
+        workspaceName: result.workspaceName,
+    });
+});
+//# sourceMappingURL=self-auth-linear.js.map

package/dist/commands/self-auth-linear.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-auth-linear.js","sourceRoot":"","sources":["../../src/commands/self-auth-linear.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EACL,QAAQ,EACR,aAAa,EACb,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC;;;;;;;;GAQG;AACH,MAAM,YAAY,GAAG,IAAI,CAAC;AAE1B,KAAK,UAAU,iBAAiB,CAAC,IAGhC;IACC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO;QAChC,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,EAAE,gBAAgB,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,QAAQ,EAAE,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;QACxD,MAAM,aAAa,CACjB,EAAE,EACF,yBAAyB,CAAC;YACxB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK;SACN,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;KACjE,WAAW,CACV,wFAAwF,CACzF;KACA,MAAM,CACL,mBAAmB,EACnB,oEAAoE,EACpE,MAAM,CAAC,kBAAkB,CAAC,CAC3B;KACA,MAAM,CACL,iBAAiB,EACjB,2CAA2C,EAC3C,aAAa,CACd;KACA,MAAM,CACL,eAAe,EACf,uFAAuF,EACvF,MAAM,CAAC,YAAY,CAAC,CACrB;KACA,MAAM,CAAC,KAAK,EAAE,IAAwD,EAAE,EAAE;IACzE,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,wCAAwC,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,kOAAkO,CACnO,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,0JAA0J,CAC3J,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,6EAA6E,IAAI,CAAC,IAAI,IAAI,CAC3F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,sFAAsF,IAAI,aAAa,CACxG,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,QAAQ;QACR,YAAY;QACZ,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;QACjC,IAAI;QACJ,WAAW,EAAE,kBAAkB;QAC/B,kBAAkB,EAAE,yBAAyB;QAC7C,WAAW,EAAE,kBAAkB;KAChC,CAAC,CAAC;IAEH,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE;QAChC,cAAc,EAAE,MAAM,CAAC,WAAW;KACnC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CACT,kDACE,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,WACjC,sBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAC5C,CAAC;IACF,MAAM,iBAAiB,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.js

@@ -29,6 +29,7 @@ import { initCommand } from "./commands/init.js";
 import { repoCommand } from "./commands/repo.js";
 import { uninstallCommand } from "./commands/uninstall.js";
 import { serviceCommand } from "./commands/service.js";
+import { selfAuthLinearCommand } from "./commands/self-auth-linear.js";
 const program = new Command();
 program
     .name("ura")
@@ -48,5 +49,6 @@ program.addCommand(initCommand);
 program.addCommand(repoCommand);
 program.addCommand(uninstallCommand);
 program.addCommand(serviceCommand);
+program.addCommand(selfAuthLinearCommand);
 program.parse();
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,oCAAoC;AACpC,4EAA4E;AAC5E,2EAA2E;AAC3E,mEAAmE;AACnE,6EAA6E;AAC7E,oEAAoE;AACpE,IAAI,CAAC;IACH,OAAO,CAAC,WAAW,EAAE,CAAC;AACxB,CAAC;AAAC,OAAO,GAAY,EAAE,CAAC;IACtB,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;IAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,qCAAqC,OAAO,CAAC,GAAG,EAAE,KAChD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,aAAa,CAAC;KAC1B,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAEhC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAC/B,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAC/B,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AAEnC,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,oCAAoC;AACpC,4EAA4E;AAC5E,2EAA2E;AAC3E,mEAAmE;AACnE,6EAA6E;AAC7E,oEAAoE;AACpE,IAAI,CAAC;IACH,OAAO,CAAC,WAAW,EAAE,CAAC;AACxB,CAAC;AAAC,OAAO,GAAY,EAAE,CAAC;IACtB,MAAM,IAAI,GAAI,GAA6B,EAAE,IAAI,CAAC;IAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CACV,qCAAqC,OAAO,CAAC,GAAG,EAAE,KAChD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,aAAa,CAAC;KAC1B,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;AAEhC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAC/B,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AAC/B,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACrD,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAChC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AACrC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;AACnC,OAAO,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAE1C,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/lib/env-file.d.ts

@@ -0,0 +1,3 @@
+export declare function readEnvFile(path: string): Record<string, string>;
+export declare function upsertEnvFile(path: string, updates: Record<string, string>): void;
+//# sourceMappingURL=env-file.d.ts.map

package/dist/lib/env-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.d.ts","sourceRoot":"","sources":["../../src/lib/env-file.ts"],"names":[],"mappings":"AAiBA,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAahE;AAED,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,IAAI,CA2CN"}

package/dist/lib/env-file.js

@@ -0,0 +1,69 @@
+/**
+ * Minimal `.env` read / upsert preserving unrelated keys, comments, and blank
+ * lines. We don't need the full `dotenv` spec — just replace-or-append.
+ *
+ * `upsertEnvFile` writes atomically by writing a sibling `<path>.tmp` first
+ * and then renaming. Same-FS rename is atomic on POSIX and on Windows in
+ * Node 22, which is the only target.
+ */
+import { readFileSync, writeFileSync, renameSync, existsSync, mkdirSync, } from "node:fs";
+import { dirname } from "node:path";
+export function readEnvFile(path) {
+    if (!existsSync(path))
+        return {};
+    const out = {};
+    for (const raw of readFileSync(path, "utf8").split("\n")) {
+        const line = raw.trim();
+        if (!line || line.startsWith("#"))
+            continue;
+        const eq = line.indexOf("=");
+        if (eq < 1)
+            continue;
+        const key = line.slice(0, eq).trim();
+        const value = line.slice(eq + 1).trim();
+        out[key] = value;
+    }
+    return out;
+}
+export function upsertEnvFile(path, updates) {
+    mkdirSync(dirname(path), { recursive: true });
+    const updateKeys = new Set(Object.keys(updates));
+    const seen = new Set();
+    let lines = [];
+    if (existsSync(path)) {
+        lines = readFileSync(path, "utf8").split("\n");
+    }
+    const out = [];
+    for (const raw of lines) {
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith("#")) {
+            out.push(raw);
+            continue;
+        }
+        const eq = trimmed.indexOf("=");
+        if (eq < 1) {
+            out.push(raw);
+            continue;
+        }
+        const key = trimmed.slice(0, eq).trim();
+        if (updateKeys.has(key)) {
+            out.push(`${key}=${updates[key]}`);
+            seen.add(key);
+        }
+        else {
+            out.push(raw);
+        }
+    }
+    while (out.length > 0 && out[out.length - 1] === "")
+        out.pop();
+    for (const key of updateKeys) {
+        if (!seen.has(key)) {
+            out.push(`${key}=${updates[key]}`);
+        }
+    }
+    out.push("");
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, out.join("\n"));
+    renameSync(tmp, path);
+}
+//# sourceMappingURL=env-file.js.map

package/dist/lib/env-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.js","sourceRoot":"","sources":["../../src/lib/env-file.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,YAAY,EACZ,aAAa,EACb,UAAU,EACV,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,OAA+B;IAE/B,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,IAAI,KAAK,GAAa,EAAE,CAAC;IACzB,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IAE/D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEb,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/lib/linear-oauth-deps.d.ts

@@ -0,0 +1,14 @@
+import type { LinearTokenResponse } from "./linear-oauth.js";
+export declare function defaultBrowserOpen(url: string): Promise<void>;
+export declare function defaultFetchTokenEndpoint(body: {
+    code: string;
+    client_id: string;
+    client_secret: string;
+    redirect_uri: string;
+    grant_type: "authorization_code";
+}): Promise<LinearTokenResponse>;
+export declare function defaultFetchViewer(accessToken: string): Promise<{
+    workspaceId: string;
+    workspaceName?: string;
+}>;
+//# sourceMappingURL=linear-oauth-deps.d.ts.map

package/dist/lib/linear-oauth-deps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-oauth-deps.d.ts","sourceRoot":"","sources":["../../src/lib/linear-oauth-deps.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAI7D,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CASnE;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,oBAAoB,CAAC;CAClC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAa/B;AAED,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqB1D"}

package/dist/lib/linear-oauth-deps.js

@@ -0,0 +1,54 @@
+/**
+ * Default real-world implementations of the LinearOAuthDeps callbacks.
+ * Split into its own module so tests can mock the entire shim without
+ * pulling in node:child_process and friends.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileP = promisify(execFile);
+export async function defaultBrowserOpen(url) {
+    // macOS: `open`, Linux: `xdg-open`. If neither resolves, print the URL.
+    const cmd = process.platform === "darwin" ? "open" : "xdg-open";
+    try {
+        await execFileP(cmd, [url]);
+    }
+    catch {
+        console.log("Open this URL in your browser:");
+        console.log(`  ${url}`);
+    }
+}
+export async function defaultFetchTokenEndpoint(body) {
+    const params = new URLSearchParams();
+    for (const [k, v] of Object.entries(body))
+        params.set(k, v);
+    const res = await fetch("https://api.linear.app/oauth/token", {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: params.toString(),
+    });
+    if (!res.ok) {
+        const errText = await res.text().catch(() => res.statusText);
+        throw new Error(`${res.status}: ${errText.slice(0, 200)}`);
+    }
+    return (await res.json());
+}
+export async function defaultFetchViewer(accessToken) {
+    const query = "query { organization { id name } }";
+    const res = await fetch("https://api.linear.app/graphql", {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${accessToken}`,
+        },
+        body: JSON.stringify({ query }),
+    });
+    if (!res.ok) {
+        throw new Error(`Failed to fetch workspace metadata: ${res.status} ${res.statusText}`);
+    }
+    const json = (await res.json());
+    const org = json?.data?.organization;
+    if (!org?.id)
+        throw new Error("Linear returned no organization id");
+    return { workspaceId: org.id, workspaceName: org.name };
+}
+//# sourceMappingURL=linear-oauth-deps.js.map

package/dist/lib/linear-oauth-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-oauth-deps.js","sourceRoot":"","sources":["../../src/lib/linear-oauth-deps.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,wEAAwE;IACxE,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAM/C;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oCAAoC,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB;IAEnB,MAAM,KAAK,GAAG,oCAAoC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,WAAW,EAAE;SACvC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,uCAAuC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACpE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC"}

package/dist/lib/linear-oauth.d.ts

@@ -0,0 +1,46 @@
+export interface LinearOAuthDeps {
+    clientId: string;
+    clientSecret: string;
+    scope: string;
+    /** Total time to wait for the operator to authorize, in milliseconds. */
+    timeoutMs: number;
+    /**
+     * Port to bind the local callback server to. Fixed because Linear requires
+     * the redirect URI registered in the OAuth app settings to match the URI
+     * sent in the authorize request EXACTLY (host + port + path), so a
+     * random port would force the operator to re-register every time.
+     * Pass `0` to bind a random free port (test-only — production code must
+     * pass a stable value).
+     */
+    port: number;
+    /** Opens the authorize URL in the operator's browser. Pure-test override. */
+    openBrowser: (url: string) => Promise<void>;
+    /** Exchanges the code for an access token. */
+    fetchTokenEndpoint: (body: {
+        code: string;
+        client_id: string;
+        client_secret: string;
+        redirect_uri: string;
+        grant_type: "authorization_code";
+    }) => Promise<LinearTokenResponse>;
+    /** Fetches workspace metadata for the audit event. */
+    fetchViewer: (accessToken: string) => Promise<{
+        workspaceId: string;
+        workspaceName?: string;
+    }>;
+}
+export interface LinearTokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    scope: string;
+}
+export interface LinearOAuthResult {
+    accessToken: string;
+    workspaceId: string;
+    workspaceName?: string;
+    scope: string;
+    expiresInSeconds: number;
+}
+export declare function runLinearOAuth(deps: LinearOAuthDeps): Promise<LinearOAuthResult>;
+//# sourceMappingURL=linear-oauth.d.ts.map

package/dist/lib/linear-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-oauth.d.ts","sourceRoot":"","sources":["../../src/lib/linear-oauth.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,8CAA8C;IAC9C,kBAAkB,EAAE,CAAC,IAAI,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,oBAAoB,CAAC;KAClC,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC,sDAAsD;IACtD,WAAW,EAAE,CACX,WAAW,EAAE,MAAM,KAChB,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAkBD,wBAAsB,cAAc,CAClC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,iBAAiB,CAAC,CA6J5B"}

package/dist/lib/linear-oauth.js

@@ -0,0 +1,154 @@
+/**
+ * Linear OAuth 2.0 authorization-code flow, runnable headlessly with
+ * dependency-injected browser-open and HTTP transport for tests.
+ *
+ * High-level:
+ *   1. Bind an ephemeral 127.0.0.1 server (random free port).
+ *   2. Redirect the operator's browser to Linear with the loopback callback.
+ *   3. Verify the HMAC-signed state on the callback.
+ *   4. Exchange the code for an access token.
+ *   5. Look up workspace metadata (for the audit event).
+ *   6. Shut the server down.
+ *
+ * Token handling: the access token never crosses console.log, never lands
+ * in the success-page HTML, and never appears in the audit event payload.
+ */
+import { createServer } from "node:http";
+import { randomBytes } from "node:crypto";
+import { newNonce, signState, verifyState } from "./oauth-state.js";
+const SUCCESS_HTML = `<!doctype html>
+<html><head><meta charset="utf-8"><title>urateam OAuth</title></head>
+<body style="font-family: -apple-system, sans-serif; max-width: 520px; margin: 80px auto; line-height: 1.5;">
+<h1>Authorized</h1>
+<p>You can close this tab. Return to your terminal to continue.</p>
+</body></html>`;
+const ERROR_HTML = (msg) => `<!doctype html>
+<html><head><meta charset="utf-8"><title>urateam OAuth</title></head>
+<body style="font-family: -apple-system, sans-serif; max-width: 520px; margin: 80px auto; line-height: 1.5;">
+<h1>Authorization failed</h1>
+<p>${msg}</p>
+</body></html>`;
+const AUTHORIZE_URL = "https://linear.app/oauth/authorize";
+export async function runLinearOAuth(deps) {
+    const stateSecret = randomBytes(32).toString("hex");
+    const nonce = newNonce();
+    const state = signState(stateSecret, nonce);
+    return await new Promise((resolve, reject) => {
+        let resolved = false;
+        let server = null;
+        const timeout = setTimeout(() => {
+            if (resolved)
+                return;
+            resolved = true;
+            server?.close();
+            reject(new Error(`ura self-auth-linear: timed out waiting for the OAuth callback (${deps.timeoutMs}ms)`));
+        }, deps.timeoutMs);
+        const finalize = (ok, err, e) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timeout);
+            server?.close();
+            if (e && err)
+                err(e);
+            else
+                ok();
+        };
+        server = createServer(async (req, res) => {
+            try {
+                const url = new URL(req.url ?? "/", `http://127.0.0.1`);
+                if (url.pathname !== "/callback") {
+                    res.writeHead(404).end();
+                    return;
+                }
+                const code = url.searchParams.get("code");
+                const incomingState = url.searchParams.get("state") ?? "";
+                const verified = verifyState(stateSecret, incomingState);
+                if (!verified || verified !== nonce) {
+                    res.writeHead(400, { "content-type": "text/html" });
+                    res.end(ERROR_HTML("State mismatch — possible CSRF; abort."));
+                    finalize(() => { }, (e) => reject(e), new Error("ura self-auth-linear: state mismatch — aborting"));
+                    return;
+                }
+                if (!code) {
+                    res.writeHead(400, { "content-type": "text/html" });
+                    res.end(ERROR_HTML("Missing 'code' parameter from Linear."));
+                    finalize(() => { }, (e) => reject(e), new Error("ura self-auth-linear: missing code in callback"));
+                    return;
+                }
+                const port = server.address().port;
+                const redirectUri = `http://127.0.0.1:${port}/callback`;
+                const token = await deps.fetchTokenEndpoint({
+                    code,
+                    client_id: deps.clientId,
+                    client_secret: deps.clientSecret,
+                    redirect_uri: redirectUri,
+                    grant_type: "authorization_code",
+                });
+                // Render the success page IMMEDIATELY after token exchange succeeds.
+                // The operator's view of "Authorized" must not depend on the
+                // subsequent viewer fetch, which is only used for the audit event's
+                // display name. If `fetchViewer` fails (Linear GraphQL hiccup), we
+                // still resolve with the token — falling back to an "unknown"
+                // workspace placeholder.
+                res.writeHead(200, { "content-type": "text/html" });
+                res.end(SUCCESS_HTML);
+                let viewer;
+                try {
+                    viewer = await deps.fetchViewer(token.access_token);
+                }
+                catch {
+                    viewer = { workspaceId: "unknown", workspaceName: undefined };
+                }
+                if (!resolved) {
+                    resolved = true;
+                    clearTimeout(timeout);
+                    server?.close();
+                    resolve({
+                        accessToken: token.access_token,
+                        workspaceId: viewer.workspaceId,
+                        workspaceName: viewer.workspaceName,
+                        scope: token.scope,
+                        expiresInSeconds: token.expires_in,
+                    });
+                }
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                try {
+                    res.writeHead(500, { "content-type": "text/html" });
+                    res.end(ERROR_HTML("Token exchange failed; check the terminal."));
+                }
+                catch {
+                    // response may already be sent
+                }
+                finalize(() => { }, (e) => reject(e), new Error(`ura self-auth-linear: ${message}`));
+            }
+        });
+        server.on("error", (err) => {
+            if (err.code === "EADDRINUSE") {
+                finalize(() => { }, (e) => reject(e), new Error(`ura self-auth-linear: port ${deps.port} is already in use. ` +
+                    `Pass --port <other-port> and register the matching redirect URI in your Linear OAuth app.`));
+                return;
+            }
+            finalize(() => { }, (e) => reject(e), err instanceof Error ? err : new Error(String(err)));
+        });
+        server.listen(deps.port, "127.0.0.1", async () => {
+            try {
+                const port = server.address().port;
+                const redirectUri = `http://127.0.0.1:${port}/callback`;
+                const authUrl = new URL(AUTHORIZE_URL);
+                authUrl.searchParams.set("client_id", deps.clientId);
+                authUrl.searchParams.set("redirect_uri", redirectUri);
+                authUrl.searchParams.set("response_type", "code");
+                authUrl.searchParams.set("scope", deps.scope);
+                authUrl.searchParams.set("state", state);
+                await deps.openBrowser(authUrl.toString());
+            }
+            catch (err) {
+                finalize(() => { }, (e) => reject(e), err instanceof Error ? err : new Error(String(err)));
+            }
+        });
+    });
+}
+//# sourceMappingURL=linear-oauth.js.map

package/dist/lib/linear-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linear-oauth.js","sourceRoot":"","sources":["../../src/lib/linear-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAgDpE,MAAM,YAAY,GAAG;;;;;eAKN,CAAC;AAEhB,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC;;;;KAI/B,GAAG;eACO,CAAC;AAEhB,MAAM,aAAa,GAAG,oCAAoC,CAAC;AAE3D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAqB;IAErB,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAE5C,OAAO,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC9D,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,EAAE,KAAK,EAAE,CAAC;YAChB,MAAM,CACJ,IAAI,KAAK,CACP,mEAAmE,IAAI,CAAC,SAAS,KAAK,CACvF,CACF,CAAC;QACJ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,MAAM,QAAQ,GAAG,CACf,EAAc,EACd,GAAwB,EACxB,CAAS,EACH,EAAE;YACR,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,EAAE,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,GAAG;gBAAE,GAAG,CAAC,CAAC,CAAC,CAAC;;gBAChB,EAAE,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACjC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;oBACzB,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;gBACzD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;oBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,wCAAwC,CAAC,CAAC,CAAC;oBAC9D,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAC7D,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,uCAAuC,CAAC,CAAC,CAAC;oBAC7D,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAC5D,CAAC;oBACF,OAAO;gBACT,CAAC;gBAED,MAAM,IAAI,GAAI,MAAO,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;gBAC1D,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;gBAExD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC;oBAC1C,IAAI;oBACJ,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,aAAa,EAAE,IAAI,CAAC,YAAY;oBAChC,YAAY,EAAE,WAAW;oBACzB,UAAU,EAAE,oBAAoB;iBACjC,CAAC,CAAC;gBAEH,qEAAqE;gBACrE,6DAA6D;gBAC7D,oEAAoE;gBACpE,mEAAmE;gBACnE,8DAA8D;gBAC9D,yBAAyB;gBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAEtB,IAAI,MAAuD,CAAC;gBAC5D,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;gBAChE,CAAC;gBAED,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,QAAQ,GAAG,IAAI,CAAC;oBAChB,YAAY,CAAC,OAAO,CAAC,CAAC;oBACtB,MAAM,EAAE,KAAK,EAAE,CAAC;oBAChB,OAAO,CAAC;wBACN,WAAW,EAAE,KAAK,CAAC,YAAY;wBAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;wBAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;wBACnC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,gBAAgB,EAAE,KAAK,CAAC,UAAU;qBACnC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,IAAI,CAAC;oBACH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,4CAA4C,CAAC,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,+BAA+B;gBACjC,CAAC;gBACD,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,IAAI,KAAK,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAC9C,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;YAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC9B,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,IAAI,KAAK,CACP,8BAA8B,IAAI,CAAC,IAAI,sBAAsB;oBAC3D,2FAA2F,CAC9F,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YACD,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;YAC/C,IAAI,CAAC;gBACH,MAAM,IAAI,GAAI,MAAO,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;gBAC1D,MAAM,WAAW,GAAG,oBAAoB,IAAI,WAAW,CAAC;gBACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;gBACvC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACrD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;gBACtD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBAClD,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC9C,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACzC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CACN,GAAG,EAAE,GAAE,CAAC,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAChB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACpD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/oauth-state.d.ts

@@ -0,0 +1,9 @@
+export declare function newNonce(): string;
+export declare function signState(secret: string, nonce: string): string;
+/**
+ * Returns the verified nonce when `state` is valid; `null` otherwise.
+ * Constant-time signature comparison so attacker timing observations don't
+ * leak the expected signature byte-by-byte.
+ */
+export declare function verifyState(secret: string, state: string): string | null;
+//# sourceMappingURL=oauth-state.d.ts.map

package/dist/lib/oauth-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.d.ts","sourceRoot":"","sources":["../../src/lib/oauth-state.ts"],"names":[],"mappings":"AAUA,wBAAgB,QAAQ,IAAI,MAAM,CAEjC;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAexE"}

package/dist/lib/oauth-state.js

@@ -0,0 +1,43 @@
+/**
+ * HMAC-signed OAuth `state` parameter helpers.
+ *
+ * The OAuth provider echoes `state` back on the callback; verifying the HMAC
+ * before trusting the callback's `code` defends against open-redirect / CSRF
+ * attacks. Format: `<nonce>.<hmac-sha256-hex>`. The secret is per-invocation
+ * and never persisted — sign + verify happen in the same process.
+ */
+import { createHmac, timingSafeEqual, randomBytes } from "node:crypto";
+export function newNonce() {
+    return randomBytes(16).toString("hex");
+}
+export function signState(secret, nonce) {
+    const sig = createHmac("sha256", secret).update(nonce).digest("hex");
+    return `${nonce}.${sig}`;
+}
+/**
+ * Returns the verified nonce when `state` is valid; `null` otherwise.
+ * Constant-time signature comparison so attacker timing observations don't
+ * leak the expected signature byte-by-byte.
+ */
+export function verifyState(secret, state) {
+    if (!state)
+        return null;
+    const parts = state.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [nonce, providedSig] = parts;
+    if (!nonce || !providedSig)
+        return null;
+    const expectedSig = createHmac("sha256", secret).update(nonce).digest("hex");
+    const a = Buffer.from(providedSig, "hex");
+    const b = Buffer.from(expectedSig, "hex");
+    if (a.length !== b.length)
+        return null;
+    try {
+        return timingSafeEqual(a, b) ? nonce : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=oauth-state.js.map

package/dist/lib/oauth-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-state.js","sourceRoot":"","sources":["../../src/lib/oauth-state.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,UAAU,QAAQ;IACtB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,KAAa;IACrD,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,KAAa;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@urateam/cli",
-  "version": "0.1.41",
+  "version": "0.1.42",
   "license": "BUSL-1.1",
   "type": "module",
   "main": "dist/index.js",
@@ -23,8 +23,8 @@
     "commander": "^13.1.0",
     "postgres": "^3.4.0",
     "zod": "^4.3.6",
-    "@urateam/core": "0.1.39",
-    "@urateam/dashboard": "0.1.39"
+    "@urateam/core": "0.1.40",
+    "@urateam/dashboard": "0.1.40"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.0",