LinearTokenService (linear/token-service.ts)

* `LinearTokenService` — the CP's custody of a connected workspace's OAuth grant (docs/designs/linear-integration.md §4.4, §9.2). Linear access tokens expire in ~24 h and refresh ROTATES the refresh token, so a rotating credential needs exactly one durable writer. That is this se

// Source: https://github.com/agentconnect-md/agentconnect | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * `LinearTokenService` — the CP's custody of a connected workspace's OAuth grant
 * (docs/designs/linear-integration.md §4.4, §9.2).
 *
 * Linear access tokens expire in ~24 h and refresh ROTATES the refresh token, so a rotating
 * credential needs exactly one durable writer. That is this service, over Postgres, and it is why
 * the daemon never holds the client secret or the refresh token — it gets a ≤24 h access token in
 * its spec and re-requests over `linearcred` (§7.3, its own change).
 *
 * TWO PROPERTIES the design names, both load-bearing:
 *
 *  - SINGLE-FLIGHT

... (truncated -- full source via MCP)