managed-deepagents 0.9.4-dev.9 → 0.10.0-dev.10

package/dist/channels/linear/graphql.js

@@ -0,0 +1,167 @@
+import { z } from "zod";
+import { connections } from "../../connections.js";
+import { CachedRead } from "../http/provider.js";
+import { nonblankStringSchema } from "../message-schema.js";
+import { LINEAR_TOKEN_SLUG } from "./connections.js";
+const LINEAR_GRAPHQL_URL = "https://api.linear.app/graphql";
+const LINEAR_API_TIMEOUT_MS = 10_000;
+/** The largest Linear response body read. */
+const LINEAR_RESPONSE_MAX_CHARS = 1_000_000;
+/** How long the app token read from Agent Auth is reused. */
+const TOKEN_TTL_MS = 5 * 60_000;
+/**
+ * How long the app's user is reused. It changes only when the app is
+ * installed anew, which a long-lived process should notice too.
+ */
+const APP_USER_TTL_MS = 60 * 60_000;
+/**
+ * Where GraphQL requests go: Linear's API, or under `mda dev`
+ * (`MDA_LOCAL_DEV=1`) the stand-in `MDA_LINEAR_API_URL` names, so local
+ * tests never reach Linear. A deployment always uses Linear's API.
+ */
+function graphqlUrl(env = process.env) {
+    const override = env.MDA_LINEAR_API_URL?.trim();
+    if (env.MDA_LOCAL_DEV !== "1" || !override)
+        return LINEAR_GRAPHQL_URL;
+    const url = new URL(override);
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        throw new TypeError("MDA_LINEAR_API_URL must be an http(s) URL");
+    return url.toString();
+}
+/** Linear refused a request for exceeding its rate limit. */
+export class LinearRateLimitError extends Error {
+    constructor() {
+        super("Linear rate limit exceeded");
+        this.name = "LinearRateLimitError";
+    }
+}
+/** The app's access token, read from Agent Auth at most every few minutes. */
+const appToken = new CachedRead(() => connections.resolveDeploymentSecret(LINEAR_TOKEN_SLUG), () => TOKEN_TTL_MS);
+/** Forget the cached app token; for tests. */
+export function resetLinearToken() {
+    appToken.reset();
+}
+function errorCodes(body) {
+    return (body.errors ?? []).flatMap((error) => typeof error.extensions?.code === "string" ? [error.extensions.code] : []);
+}
+/**
+ * Run a GraphQL operation as the app. `query` is a constant; everything that
+ * varies goes in `variables`. A rejected token is read again once. Returns
+ * the response's `data`, checked against `schema`.
+ */
+export async function linearRequest(query, variables, schema) {
+    const send = async () => fetch(graphqlUrl(), {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${await appToken.get()}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ query, variables }),
+        signal: AbortSignal.timeout(LINEAR_API_TIMEOUT_MS),
+    });
+    let response = await send();
+    let body = await readBody(response);
+    if (response.status === 401 ||
+        errorCodes(body).includes("AUTHENTICATION_ERROR")) {
+        appToken.reset();
+        response = await send();
+        body = await readBody(response);
+    }
+    if (errorCodes(body).includes("RATELIMITED"))
+        throw new LinearRateLimitError();
+    if (!response.ok || body.errors?.length || body.data === undefined)
+        throw new Error(`Linear refused the request (HTTP ${response.status})`);
+    const data = schema.safeParse(body.data);
+    if (!data.success)
+        throw new Error("Linear answered in an unexpected shape");
+    return data.data;
+}
+async function readBody(response) {
+    const text = await response.text();
+    if (text.length > LINEAR_RESPONSE_MAX_CHARS)
+        return {};
+    try {
+        const parsed = JSON.parse(text);
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : {};
+    }
+    catch {
+        return {};
+    }
+}
+const VIEWER_QUERY = "query MdaLinearViewer { viewer { id displayName } }";
+const viewerSchema = z.object({
+    viewer: z.object({ id: nonblankStringSchema, displayName: z.string() }),
+});
+/**
+ * The Linear user the app acts as, read at most hourly: its own comments and
+ * changes are ignored, and a comment mentioning its `displayName` starts an
+ * agent session.
+ */
+const appUser = new CachedRead(async () => (await linearRequest(VIEWER_QUERY, {}, viewerSchema)).viewer, () => APP_USER_TTL_MS);
+export function linearAppUser() {
+    return appUser.get();
+}
+/** Forget the cached app user; for tests. */
+export function resetLinearAppUser() {
+    appUser.reset();
+}
+const COMMENT_CREATE_MUTATION = `mutation MdaLinearCommentCreate($input: CommentCreateInput!) {
+  commentCreate(input: $input) { success comment { id url } }
+}`;
+const commentCreateSchema = z.object({
+    commentCreate: z.object({
+        success: z.literal(true),
+        comment: z.object({ id: nonblankStringSchema, url: z.string().nullish() }),
+    }),
+});
+/**
+ * Comment on an issue as the app, threaded under `parentId` when given.
+ * Returns the comment's id and URL.
+ */
+export async function createLinearComment(input) {
+    const { comment } = (await linearRequest(COMMENT_CREATE_MUTATION, { input }, commentCreateSchema)).commentCreate;
+    return { id: comment.id, ...(comment.url && { url: comment.url }) };
+}
+const COMMENT_SESSION_QUERY = `query MdaLinearCommentSession($id: String!) {
+  comment(id: $id) { agentSession { id } }
+}`;
+const commentSessionSchema = z.object({
+    comment: z
+        .object({ agentSession: z.object({ id: nonblankStringSchema }).nullable() })
+        .nullable(),
+});
+/** Whether a comment belongs to an agent session's thread. */
+export async function commentInAgentSession(commentId) {
+    const { comment } = await linearRequest(COMMENT_SESSION_QUERY, { id: commentId }, commentSessionSchema);
+    return Boolean(comment?.agentSession);
+}
+const ACTIVITY_CREATE_MUTATION = `mutation MdaLinearActivityCreate($input: AgentActivityCreateInput!) {
+  agentActivityCreate(input: $input) { success agentActivity { id } }
+}`;
+const activityCreateSchema = z.object({
+    agentActivityCreate: z.object({
+        success: z.literal(true),
+        agentActivity: z.object({ id: nonblankStringSchema }),
+    }),
+});
+/**
+ * Post an activity to an agent session as the app. An `ephemeral` thought is
+ * replaced by the next activity.
+ */
+export async function createLinearActivity(input) {
+    const { agentActivity } = (await linearRequest(ACTIVITY_CREATE_MUTATION, { input }, activityCreateSchema)).agentActivityCreate;
+    return { id: agentActivity.id };
+}
+const SESSION_UPDATE_MUTATION = `mutation MdaLinearSessionUpdate($id: String!, $input: AgentSessionUpdateInput!) {
+  agentSessionUpdate(id: $id, input: $input) { success }
+}`;
+const sessionUpdateSchema = z.object({
+    agentSessionUpdate: z.object({ success: z.literal(true) }),
+});
+/** Link an agent session to a page about it, such as its Studio thread. */
+export async function addLinearSessionUrl(agentSessionId, link) {
+    await linearRequest(SESSION_UPDATE_MUTATION, { id: agentSessionId, input: { addedExternalUrls: [link] } }, sessionUpdateSchema);
+}
+//# sourceMappingURL=graphql.js.map

package/dist/channels/linear/graphql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphql.js","sourceRoot":"","sources":["../../../src/channels/linear/graphql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,MAAM,kBAAkB,GAAG,gCAAgC,CAAC;AAC5D,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,6CAA6C;AAC7C,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAC5C,6DAA6D;AAC7D,MAAM,YAAY,GAAG,CAAC,GAAG,MAAM,CAAC;AAChC;;;GAGG;AACH,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AAEpC;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG;IACnC,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,IAAI,CAAC,QAAQ;QAAE,OAAO,kBAAkB,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACvD,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,6DAA6D;AAC7D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C;QACE,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,QAAQ,GAAG,IAAI,UAAU,CAC7B,GAAG,EAAE,CAAC,WAAW,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,EAC5D,GAAG,EAAE,CAAC,YAAY,CACnB,CAAC;AAEF,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB;IAC9B,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC;AAKD,SAAS,UAAU,CAAC,IAAqB;IACvC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3C,OAAO,KAAK,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAC1E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAa,EACb,SAAkC,EAClC,MAAoB;IAEpB,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CACtB,KAAK,CAAC,UAAU,EAAE,EAAE;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE;YAC/C,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC1C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;KACnD,CAAC,CAAC;IACL,IAAI,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpC,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EACjD,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QACxB,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC1C,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAChE,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,IAAI,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,EAAE,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YACnE,CAAC,CAAE,MAA0B;YAC7B,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,qDAAqD,CAAC;AAC3E,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACxE,CAAC,CAAC;AAKH;;;;GAIG;AACH,MAAM,OAAO,GAAG,IAAI,UAAU,CAC5B,KAAK,IAA4B,EAAE,CACjC,CAAC,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,EAC9D,GAAG,EAAE,CAAC,eAAe,CACtB,CAAC;AAEF,MAAM,UAAU,aAAa;IAC3B,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;AACvB,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,uBAAuB,GAAG;;EAE9B,CAAC;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;KAC3E,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAIzC;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,CAClB,MAAM,aAAa,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,EAAE,mBAAmB,CAAC,CAC7E,CAAC,aAAa,CAAC;IAChB,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,MAAM,qBAAqB,GAAG;;EAE5B,CAAC;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,CAAC;SACP,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;SAC3E,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB;IAEjB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,aAAa,CACrC,qBAAqB,EACrB,EAAE,EAAE,EAAE,SAAS,EAAE,EACjB,oBAAoB,CACrB,CAAC;IACF,OAAO,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACxC,CAAC;AAQD,MAAM,wBAAwB,GAAG;;EAE/B,CAAC;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC;QAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACxB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC;KACtD,CAAC;CACH,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAI1C;IACC,MAAM,EAAE,aAAa,EAAE,GAAG,CACxB,MAAM,aAAa,CACjB,wBAAwB,EACxB,EAAE,KAAK,EAAE,EACT,oBAAoB,CACrB,CACF,CAAC,mBAAmB,CAAC;IACtB,OAAO,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,uBAAuB,GAAG;;EAE9B,CAAC;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,cAAsB,EACtB,IAAoC;IAEpC,MAAM,aAAa,CACjB,uBAAuB,EACvB,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAC5D,mBAAmB,CACpB,CAAC;AACJ,CAAC"}

package/dist/channels/linear/index.d.ts

@@ -0,0 +1,9 @@
+import { type HttpChannel } from "../http/index.js";
+import type { LinearChannelOptions } from "./types.js";
+export type { LinearAppOptions, LinearChannelOptions, LinearChannelThread, LinearEvent, LinearEventCallback, LinearEventKey, LinearEventResult, LinearPayloadFor, } from "./types.js";
+export { LinearRateLimitError } from "./graphql.js";
+/** Adapt verified Linear webhooks into HTTP channel messages or skips. */
+export declare function linearChannel(options?: LinearChannelOptions): HttpChannel;
+/** Forget the cached webhook secret; for tests. */
+export declare function resetLinearWebhookSecret(): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/channels/linear/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/channels/linear/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,WAAW,EAOjB,MAAM,kBAAkB,CAAC;AAkC1B,OAAO,KAAK,EAEV,oBAAoB,EAKrB,MAAM,YAAY,CAAC;AAGpB,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AA2BpD,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,WAAW,CA+D7E;AA+CD,mDAAmD;AACnD,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C"}

package/dist/channels/linear/index.js

@@ -0,0 +1,477 @@
+import { z } from "zod";
+import { channelThreadId, httpChannel, } from "../http/index.js";
+import { channelName, checkEventKeys, definedFields, eventSnapshot, handledEventKeys, readDeploymentSecret, resetDeploymentSecrets, resolveEndpoints, runEventHandler, settleEvents, verifyHmacSha256, } from "../http/provider.js";
+import { interruptedNotice, studioUrl } from "../http/studio.js";
+import { requireTextContent } from "../runtime.js";
+import { logger } from "../../runtime/log.js";
+import { validateChannelIconPath } from "../../runtime/channel-icon.js";
+import { linearAppConnectionSlug } from "./connections.js";
+import { addLinearSessionUrl, commentInAgentSession, createLinearActivity, createLinearComment, linearAppUser, } from "./graphql.js";
+import { SUPPORTED_EVENT_KEYS, linearEventSchema, linearReceiptSchema, } from "./schema.js";
+export { LinearRateLimitError } from "./graphql.js";
+const EVENT_KEYS = new Set(SUPPORTED_EVENT_KEYS);
+const SESSION_KEYS = new Set([
+    "AgentSessionEvent.created",
+    "AgentSessionEvent.prompted",
+]);
+const APP_OPTION_KEYS = new Set([
+    "name",
+    "description",
+    "icon",
+    "teams",
+]);
+/** Whether a delivery's `type.action` is an event key the channel supports. */
+function isLinearEventKey(key) {
+    return EVENT_KEYS.has(key);
+}
+/** The part of a delivery's body the replay check reads. */
+const timestampSchema = z.looseObject({ webhookTimestamp: z.number() });
+/** Adapt verified Linear webhooks into HTTP channel messages or skips. */
+export function linearChannel(options = {}) {
+    const handlers = resolveEndpoints("Linear", options.onEvent);
+    checkEventKeys("Linear", handlers, EVENT_KEYS);
+    // A misspelled option would silently widen what starts runs.
+    const unknown = Object.keys(options.app ?? {}).filter((key) => !APP_OPTION_KEYS.has(key));
+    if (unknown.length)
+        throw new TypeError(`unknown Linear app option ${unknown.join(", ")}; use ${[...APP_OPTION_KEYS].join(", ")}`);
+    if (options.app)
+        validateAppDisplay(options.app);
+    const teams = options.app?.teams?.map((team) => team.trim().toLowerCase());
+    if (teams?.length === 0 || teams?.some((team) => !team))
+        throw new TypeError("Linear app.teams must list team keys; omit it to allow every team");
+    const filters = {
+        teams,
+        ignoreBots: options.ignoreBots ?? true,
+        sessions: options.sessions ?? true,
+    };
+    const channel = httpChannel({
+        provider: "linear",
+        ...(options.multitaskStrategy && {
+            multitaskStrategy: options.multitaskStrategy,
+        }),
+        providerConfig: {
+            // Deploy subscribes the app's webhook to the handled events.
+            events: handledEvents(handlers, filters.sessions),
+            ...(options.app && {
+                app: definedFields({
+                    name: options.app.name?.trim(),
+                    description: options.app.description?.trim(),
+                    icon: options.app.icon &&
+                        validateChannelIconPath(options.app.icon, "Linear app.icon"),
+                    teams: options.app.teams && [...options.app.teams],
+                }),
+            }),
+        },
+        verify: verifyLinearRequest,
+        parse: (context) => parseLinearRequest(context, handlers, channelName(channel), filters),
+        input: (message, rawEvent) => handlerInput(handlers, rawEvent, {
+            id: message.threadId,
+            channel: { name: channelName(channel) },
+        }),
+        post: postReply,
+        onReceived: acknowledgeSession,
+        onError: reportError,
+        onSettled: settleEvents(notifySettled, options.onSettled, linearEvent, () => channelName(channel)),
+    });
+    // Served at /channels/{name}/icon; deploy points the app's icon at it.
+    const icon = options.app?.icon;
+    return icon === undefined
+        ? channel
+        : Object.assign(channel, {
+            icon: validateChannelIconPath(icon, "Linear app.icon"),
+        });
+}
+/** The events deploy subscribes the app's webhook to. */
+function handledEvents(handlers, sessions) {
+    return [
+        ...new Set([
+            ...handledEventKeys(handlers),
+            ...(sessions ? SESSION_KEYS : []),
+        ]),
+    ].sort();
+}
+/** Check how the app looks against Linear's rules, before deploy sends it. */
+function validateAppDisplay({ name, description, icon }) {
+    if (name !== undefined) {
+        const trimmed = name.trim();
+        if (trimmed.length < 2 ||
+            trimmed.length > 80 ||
+            /linear|https?:\/\//i.test(trimmed))
+            throw new TypeError('Linear app.name must be 2-80 characters, without "Linear" or a URL');
+    }
+    if (description !== undefined &&
+        (!description.trim() || description.trim().length > 1000))
+        throw new TypeError("Linear app.description must be 1-1000 characters");
+    if (icon !== undefined)
+        validateChannelIconPath(icon, "Linear app.icon");
+}
+/**
+ * The app's webhook signing secret: `LINEAR_WEBHOOK_SECRET` when set,
+ * otherwise the agent secret stored at
+ * `mda/linear-app/{deployment}/webhook-secret`. Only a missing connection
+ * reads as `undefined`; credential store failures propagate.
+ */
+function linearWebhookSecret() {
+    return readDeploymentSecret("LINEAR_WEBHOOK_SECRET", (deploymentId) => linearAppConnectionSlug(deploymentId, "webhook-secret"), "Linear webhook secret");
+}
+/** Forget the cached webhook secret; for tests. */
+export function resetLinearWebhookSecret() {
+    resetDeploymentSecrets();
+}
+/**
+ * How far a delivery's `webhookTimestamp` may be from now. Linear recommends
+ * rejecting older payloads, so a captured delivery can't be replayed.
+ */
+const WEBHOOK_TOLERANCE_MS = 60_000;
+async function verifyLinearRequest({ request, rawBody, }) {
+    // Reject unsigned deliveries before reading the secret from Agent Auth.
+    const signature = request.headers.get("linear-signature") ?? "";
+    if (!/^[0-9a-f]{64}$/i.test(signature))
+        return false;
+    const secret = await linearWebhookSecret();
+    if (!secret)
+        return false;
+    if (!verifyHmacSha256(secret, rawBody, signature))
+        return false;
+    return isFresh(rawBody);
+}
+/** Whether a signed delivery was sent within the replay window. */
+function isFresh(rawBody) {
+    let body;
+    try {
+        body = JSON.parse(new TextDecoder().decode(rawBody));
+    }
+    catch {
+        // Signed, but not JSON: no timestamp to trust, so the delivery is refused.
+        return false;
+    }
+    const parsed = timestampSchema.safeParse(body);
+    return (parsed.success &&
+        Math.abs(Date.now() - parsed.data.webhookTimestamp) <= WEBHOOK_TOLERANCE_MS);
+}
+/**
+ * Whether another app or an integration made the change. The delivery's actor
+ * says who acted. An issue's or comment's `botActor` is the bot that created
+ * it, so it names the actor only when the event is its creation.
+ */
+function byBot(event) {
+    if (event.actor?.type !== undefined &&
+        event.actor.type.toLowerCase() !== "user")
+        return true;
+    if (event.key === "Issue.update")
+        return false;
+    const { botActor } = event.payload.data;
+    return botActor !== undefined && botActor !== null;
+}
+async function parseLinearRequest({ request }, handlers, channelName, filters) {
+    const receipt = linearReceiptSchema.parse({
+        deliveryId: request.headers.get("linear-delivery"),
+        payload: await request.json(),
+    });
+    const { deliveryId, payload } = receipt;
+    const key = `${payload.type}.${payload.action}`;
+    logger.info(`linear receipt ${JSON.stringify({
+        event: logger.logIdentifier(key),
+        deliveryId: logger.logIdentifier(deliveryId),
+    })}`);
+    // Linear expects a 200 for every delivery it should not retry.
+    const response = Response.json({ status: "received" }, { status: 200 });
+    if (key === "OAuthApp.revoked") {
+        logger.warn("Linear app access was revoked; reinstall it with mda deploy");
+        return { type: "ignore", response };
+    }
+    // Events nothing handles stop here, before run creation. Sessions have a
+    // default handler while they are on.
+    const handled = isLinearEventKey(key) &&
+        ((filters.sessions && SESSION_KEYS.has(key)) ||
+            (Object.hasOwn(handlers, key) && handlers[key] !== undefined));
+    if (!handled)
+        return { type: "ignore", response };
+    const event = linearEventSchema.parse({ key, deliveryId, payload });
+    // Issues of teams the channel is not limited to start nothing.
+    if (filters.teams &&
+        !(event.team && filters.teams.includes(event.team.key.toLowerCase()))) {
+        logger.info(`linear event ignored: ${event.team ? "its team is not in app.teams" : "it names no team"} ${JSON.stringify({
+            event: logger.logIdentifier(key),
+            deliveryId: logger.logIdentifier(deliveryId),
+        })}`);
+        return { type: "ignore", response };
+    }
+    if (!("sessionId" in event) && (await ignored(event, filters)))
+        return { type: "ignore", response };
+    // Preserve the original event even if a callback modifies its argument.
+    const snapshot = eventSnapshot(event, "Linear");
+    // One thread per agent session, so a Stop ends only its own session's
+    // work. Other events share one thread per issue, so the agent keeps the
+    // conversation.
+    const conversation = `${event.organizationId}/${event.issueId}`;
+    const message = {
+        threadId: channelThreadId(channelName, "sessionId" in event
+            ? `${conversation}/session/${event.sessionId}`
+            : conversation),
+        userId: "mda:channel",
+        target: linearTarget(event),
+        deliveryKey: deliveryId,
+    };
+    // Stop in a session cancels the session's run.
+    if (event.key === "AgentSessionEvent.prompted" &&
+        event.payload.agentActivity.signal === "stop")
+        return {
+            type: "cancel",
+            message: {
+                userId: message.userId,
+                threadId: message.threadId,
+                target: message.target,
+            },
+            rawEvent: snapshot,
+            response,
+        };
+    // What the run starts with, or how the event answers an interrupt, is
+    // decided once MDA knows whether the thread waits on one.
+    return { type: "message", message, rawEvent: snapshot, response };
+}
+/**
+ * Whether a webhook event starts nothing: another app's change, the app's own
+ * activity, or a comment an agent session already delivers.
+ */
+async function ignored(event, filters) {
+    if (filters.ignoreBots && byBot(event))
+        return true;
+    // Linear reports the app's comments as its user's, not as a bot's.
+    const appUser = await linearAppUser();
+    if (event.actor?.id === appUser.id)
+        return true;
+    if (event.key !== "Comment.create")
+        return false;
+    const comment = event.payload.data;
+    if ((comment.user?.id ?? comment.userId) === appUser.id)
+        return true;
+    if (!filters.sessions)
+        return false;
+    const delivered = await sessionComment(comment, appUser);
+    if (delivered)
+        logger.info(`linear comment left to its agent session: ${delivered} ${JSON.stringify({
+            event: logger.logIdentifier(event.key),
+            deliveryId: logger.logIdentifier(event.deliveryId),
+        })}`);
+    return delivered !== undefined;
+}
+/**
+ * Why a comment is part of an agent session, which delivers it as a session
+ * event too: one that mentions the app opens a session, and a reply in a
+ * session's thread prompts it. Only a reply without a mention asks Linear.
+ */
+async function sessionComment(comment, appUser) {
+    if (mentionsApp(comment.body, appUser.displayName))
+        return "it mentions the app, which opens a session";
+    if (comment.parentId && (await commentInAgentSession(comment.parentId)))
+        return "it replies in a session's thread";
+    return undefined;
+}
+function mentionsApp(body, displayName) {
+    if (!displayName)
+        return false;
+    const name = displayName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(^|[^\\w@])@${name}(?![\\w-])`, "i").test(body);
+}
+/** Where replies go: the issue, and the comment thread or session that asked. */
+function linearTarget(event) {
+    const target = {
+        organizationId: event.organizationId,
+        issueId: event.issueId,
+    };
+    if ("sessionId" in event) {
+        const identifier = event.payload.agentSession.issue?.identifier;
+        return {
+            ...target,
+            ...(identifier && { identifier }),
+            sessionId: event.sessionId,
+        };
+    }
+    if (event.key === "Comment.create") {
+        const { data } = event.payload;
+        return {
+            ...target,
+            ...(data.issue?.identifier && { identifier: data.issue.identifier }),
+            // Replies go into the comment's thread; Linear threads one level deep.
+            commentId: data.parentId ?? data.id,
+        };
+    }
+    return { ...target, identifier: event.payload.data.identifier };
+}
+const ERROR_MESSAGE = "Something went wrong while working on this.";
+/** What the event's handler starts a run with; `undefined` when it skips or fails. */
+async function handlerInput(handlers, rawEvent, thread) {
+    const event = linearEvent(rawEvent);
+    if (!event)
+        return undefined;
+    const outcome = Object.hasOwn(handlers, event.key) && handlers[event.key] !== undefined
+        ? await runEventHandler("Linear", event, () => callHandler(handlers, event.key, event, thread))
+        : sessionInput(event);
+    if (outcome.type === "input")
+        return outcome.input;
+    // A session that gets no run would wait for an answer that never comes,
+    // whether it just opened or this is a follow-up in it. A handler that threw
+    // failed; one that returned nothing declined.
+    if ("sessionId" in event)
+        await say(event.sessionId, outcome.type === "failed"
+            ? { type: "error", body: ERROR_MESSAGE }
+            : { type: "response", body: "I'm not set up to work on this request." });
+    return undefined;
+}
+/** What a session event starts a run with when no handler decides. */
+function sessionInput(event) {
+    let input;
+    if (event.key === "AgentSessionEvent.created") {
+        const { promptContext, agentSession } = event.payload;
+        input =
+            promptContext?.trim() ||
+                agentSession.comment?.body?.trim() ||
+                agentSession.issue?.title?.trim() ||
+                undefined;
+    }
+    else if (event.key === "AgentSessionEvent.prompted")
+        input = event.payload.agentActivity.content.body?.trim() || undefined;
+    return input ? { type: "input", input } : { type: "skipped" };
+}
+/** Call the handler of the event's key, typed by the key. */
+function callHandler(handlers, key, event, thread) {
+    return handlers[key]?.(event, thread);
+}
+/**
+ * The parsed event a delivery carries, checked against the schema again: the
+ * HTTP layer hands over a copy, which handlers may change.
+ */
+function linearEvent(rawEvent) {
+    // The schema reads `key`, `deliveryId` and `payload`, and derives the rest.
+    const parsed = linearEventSchema.safeParse(rawEvent);
+    return parsed.success ? parsed.data : undefined;
+}
+/** Say something in a session; a failure is logged, never thrown. */
+async function say(sessionId, content, extra = {}) {
+    try {
+        await createLinearActivity({
+            agentSessionId: sessionId,
+            content,
+            ...extra,
+        });
+    }
+    catch (error) {
+        logger.error(`linear session activity failed (${logger.safeErrorLabel(error)})`);
+    }
+}
+/**
+ * Post the agent's reply: as the session's response when a session asked,
+ * otherwise as a comment in the thread of the comment that started the run.
+ * A post that starts a new thread, such as a scheduled one, comments on the
+ * issue itself.
+ */
+async function postReply(input) {
+    const { target, newThread, ...message } = input;
+    if (!isLinearTarget(target))
+        throw new TypeError("invalid Linear target");
+    const body = requireTextContent(message);
+    if (target.sessionId && !newThread)
+        return createLinearActivity({
+            agentSessionId: target.sessionId,
+            content: { type: "response", body },
+        });
+    return createLinearComment({
+        issueId: target.issueId,
+        body,
+        ...(target.commentId && !newThread && { parentId: target.commentId }),
+    });
+}
+/**
+ * Linear marks a session unresponsive without an activity within seconds, even
+ * while the run waits behind another one: acknowledge it at once, and link a
+ * new session to its thread in Studio.
+ */
+async function acknowledgeSession(target, delivery) {
+    if (!isLinearTarget(target) || !target.sessionId)
+        return;
+    await say(target.sessionId, { type: "thought", body: "Working on it." }, {
+        ephemeral: true,
+    });
+    const url = studioUrl(delivery);
+    if (!url ||
+        linearEvent(delivery.rawEvent)?.key !== "AgentSessionEvent.created")
+        return;
+    try {
+        await addLinearSessionUrl(target.sessionId, {
+            label: "LangSmith Studio",
+            url,
+        });
+    }
+    catch (error) {
+        logger.error(`linear session link failed (${logger.safeErrorLabel(error)})`);
+    }
+}
+/**
+ * What the conversation hears once a delivery settles, besides the run's own
+ * answer and `reportError`: where to make a pending decision, or, after
+ * Stop, the final word Linear waits for.
+ */
+async function notifySettled(target, delivery) {
+    const { type } = delivery.outcome;
+    if (type === "interrupted" || type === "waiting")
+        await notifyInterrupted(target, delivery, type);
+    else if (type === "stopped")
+        await confirmStopped(target);
+}
+/** After Stop, Linear waits for a final word from the agent. */
+async function confirmStopped(target) {
+    if (!isLinearTarget(target) || !target.sessionId)
+        return;
+    await say(target.sessionId, { type: "response", body: "Stopped." });
+}
+/** Tell the session or the issue that the run failed. */
+async function reportError(_error, target) {
+    if (!isLinearTarget(target))
+        return;
+    if (target.sessionId) {
+        await createLinearActivity({
+            agentSessionId: target.sessionId,
+            content: { type: "error", body: ERROR_MESSAGE },
+        });
+        return;
+    }
+    await createLinearComment({
+        issueId: target.issueId,
+        body: ERROR_MESSAGE,
+        ...(target.commentId && { parentId: target.commentId }),
+    });
+}
+/**
+ * The conversation waits on a decision, made in LangSmith Studio: say so with
+ * a link. In a session it asks for input, so the session waits rather than
+ * ends: once the decision is made, the resumed run's answer is the session's
+ * response. Otherwise it is a comment.
+ */
+async function notifyInterrupted(target, delivery, outcome) {
+    if (!isLinearTarget(target))
+        return;
+    const body = interruptedNotice(outcome, delivery, "ask again");
+    if (target.sessionId) {
+        await createLinearActivity({
+            agentSessionId: target.sessionId,
+            content: { type: "elicitation", body },
+        });
+        return;
+    }
+    await createLinearComment({
+        issueId: target.issueId,
+        body,
+        ...(target.commentId && { parentId: target.commentId }),
+    });
+}
+function isLinearTarget(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const { organizationId, issueId, identifier, commentId, sessionId } = value;
+    const nonblank = (field) => typeof field === "string" && field.trim().length > 0;
+    return (nonblank(organizationId) &&
+        nonblank(issueId) &&
+        [identifier, commentId, sessionId].every((field) => field === undefined || nonblank(field)));
+}
+//# sourceMappingURL=index.js.map