linear-sdk-cli 0.2.4 → 0.3.1

package/skills/linear-sdk-cli/references/initiative-update.md

@@ -6,7 +6,7 @@ Group alias: `iu`
 
 _Generated from `linear commands --json`. `linear initiative-update --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear initiative-update`
 

package/skills/linear-sdk-cli/references/initiative.md

@@ -6,7 +6,7 @@ Group alias: `init`
 
 _Generated from `linear commands --json`. `linear initiative --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear initiative`
 

package/skills/linear-sdk-cli/references/issue.md

@@ -6,7 +6,7 @@ Group alias: `i`
 
 _Generated from `linear commands --json`. `linear issue --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear issue`
 

package/skills/linear-sdk-cli/references/label.md

@@ -6,7 +6,7 @@ Group alias: `lb`
 
 _Generated from `linear commands --json`. `linear label --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear label`
 

package/skills/linear-sdk-cli/references/milestone.md

@@ -6,7 +6,7 @@ Group alias: `m`
 
 _Generated from `linear commands --json`. `linear milestone --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear milestone`
 

package/skills/linear-sdk-cli/references/notification.md

@@ -6,7 +6,7 @@ Group alias: `notif`
 
 _Generated from `linear commands --json`. `linear notification --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear notification`
 

package/skills/linear-sdk-cli/references/open.md

@@ -4,7 +4,7 @@
 
 _Generated from `linear commands --json`. `linear open --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear open`
 

package/skills/linear-sdk-cli/references/organization.md

@@ -6,7 +6,7 @@ Group alias: `org`
 
 _Generated from `linear commands --json`. `linear organization --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear organization`
 

package/skills/linear-sdk-cli/references/project-update.md

@@ -6,7 +6,7 @@ Group alias: `pu`
 
 _Generated from `linear commands --json`. `linear project-update --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear project-update`
 

package/skills/linear-sdk-cli/references/project.md

@@ -6,7 +6,7 @@ Group alias: `p`
 
 _Generated from `linear commands --json`. `linear project --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear project`
 

package/skills/linear-sdk-cli/references/roadmap.md

@@ -6,7 +6,7 @@ Group alias: `rm`
 
 _Generated from `linear commands --json`. `linear roadmap --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear roadmap`
 

package/skills/linear-sdk-cli/references/schema.md

@@ -4,7 +4,7 @@
 
 _Generated from `linear commands --json`. `linear schema --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear schema`
 

package/skills/linear-sdk-cli/references/state.md

@@ -6,7 +6,7 @@ Group alias: `st`
 
 _Generated from `linear commands --json`. `linear state --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear state`
 

package/skills/linear-sdk-cli/references/team.md

@@ -6,7 +6,7 @@ Group alias: `t`
 
 _Generated from `linear commands --json`. `linear team --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear team`
 

package/skills/linear-sdk-cli/references/user.md

@@ -6,7 +6,7 @@ Group alias: `u`
 
 _Generated from `linear commands --json`. `linear user --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear user`
 

package/skills/linear-sdk-cli/references/webhook.md

@@ -6,7 +6,7 @@ Group alias: `wh`
 
 _Generated from `linear commands --json`. `linear webhook --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear webhook`
 

package/skills/linear-sdk-cli/references/whoami.md

@@ -4,7 +4,7 @@
 
 _Generated from `linear commands --json`. `linear whoami --help` (or `<subcommand> --help`) is authoritative._
 
-Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
+Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, `-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, `-t/--team <key>`, `-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), and `--debug`. Only command-specific options are listed below.
 
 ### `linear whoami`
 

package/skills/linear-sdk-cli/scripts/generate-docs.ts

@@ -66,6 +66,7 @@ const GLOBAL_OPTIONS = new Map([
   ["-j, --json", "output machine-readable JSON"],
   ["--no-ansi", "disable colored output"],
   ["--api-key <key>", "Linear API key (overrides env/config)"],
+  ["--access-token <token>", "Linear OAuth access token (overrides env/config)"],
   ["--workspace <slug>", "select workspace credential profile"],
   ["-t, --team <key>", "default team key (e.g. TES)"],
   ["-n, --limit <n>", "max results (positive integer; 0 = all)"],
@@ -229,7 +230,8 @@ function buildReference(group: string, commands: CliCommand[]): string {
   lines.push("");
   lines.push(
     "Every command also accepts the global flags `-j/--json`, `--no-input`, `-y/--yes`, " +
-      "`-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `-t/--team <key>`, " +
+      "`-q/--quiet`, `--workspace <slug>`, `--api-key <key>`, `--access-token <token>`, " +
+      "`-t/--team <key>`, " +
       "`-n/--limit <n>`, `--all`, `-f/--fields <a,b,c>`, `--no-ansi` (alias `--no-color`), " +
       "and `--debug`. " +
       "Only command-specific options are listed below.",

package/src/client.ts

@@ -3,21 +3,76 @@
  */
 
 import { LinearClient } from "@linear/sdk";
-import type { ResolvedConfig } from "./config.js";
+import { rotateOAuthCredential, type ResolvedConfig } from "./config.js";
+import { OAuthUserTokenProvider } from "./oauth.js";
 import { authError, normalizeError, CliError } from "./lib/errors.js";
 
 export function createClient(config: ResolvedConfig): LinearClient {
+  if (config.oauthCredential) {
+    return createRefreshingOAuthClient(config);
+  }
+  if (config.accessToken) {
+    return new LinearClient({ accessToken: config.accessToken });
+  }
   if (!config.apiKey) {
     // Surface the precise credential-selection error (ambiguous / unstored
     // workspace) only now, when a client is actually required.
     throw (
       config.apiKeyError ??
-      authError("No API key found. Set LINEAR_API_KEY, pass --api-key, or run `linear auth login`.")
+      authError(
+        "No Linear credential found. Set LINEAR_ACCESS_TOKEN or LINEAR_API_KEY, pass --access-token or --api-key, or run `linear auth login`.",
+      )
     );
   }
   return new LinearClient({ apiKey: config.apiKey });
 }
 
+function isAuthenticationFailure(err: unknown): boolean {
+  const value = err as Record<string, any> | undefined;
+  const status = value?.status ?? value?.response?.status ?? value?.raw?.response?.status;
+  if (status === 401) return true;
+  const errors = value?.response?.errors ?? value?.errors ?? value?.raw?.response?.errors;
+  return (
+    Array.isArray(errors) &&
+    errors.some((item) => {
+      const type = `${item?.extensions?.type ?? ""} ${item?.extensions?.code ?? ""}`;
+      const message = `${item?.message ?? ""}`;
+      return (
+        /^(?:authentication(?:error)?|unauthorized|invalidtoken|invalid_token)$/i.test(
+          type.trim(),
+        ) ||
+        /authentication (?:failed|required)|unauthori[sz]ed|invalid (?:access )?token|token (?:expired|invalid)/i.test(
+          message,
+        )
+      );
+    })
+  );
+}
+
+/** SDK client whose request boundary refreshes stored PKCE credentials before expiry and once on 401. */
+function createRefreshingOAuthClient(config: ResolvedConfig): LinearClient {
+  const credential = config.oauthCredential!;
+  const provider = new OAuthUserTokenProvider({
+    credential,
+    persist: (previous, next) => rotateOAuthCredential(credential.workspace.urlKey, previous, next),
+  });
+  const client = new LinearClient({ accessToken: credential.accessToken });
+  const original = client.client.request.bind(client.client);
+  client.client.request = async (document, variables, requestHeaders) => {
+    const accessToken = await provider.getAccessToken();
+    client.client.setHeader("Authorization", `Bearer ${accessToken}`);
+    try {
+      return await original(document, variables, requestHeaders);
+    } catch (err) {
+      if (!isAuthenticationFailure(err)) throw err;
+      const replacement = await provider.getAccessToken({ forceRefresh: true });
+      client.client.setHeader("Authorization", `Bearer ${replacement}`);
+      return original(document, variables, requestHeaders);
+    }
+  };
+  return client;
+}
+
 /**
  * The longest single wait `withRetry` will honour. Linear's request quota
  * resets hourly, so a `Retry-After` can be in the thousands of seconds; a CLI