feat(issues): add the ref-backed claims package

.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.sha }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  test:
+    name: Test and lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Test
+        run: pnpm --filter @mento-protocol/issues test
+
+      - name: Trunk Code Quality
+        uses: trunk-io/trunk-action@e1234e67a86010d61ddac8d8ebf4b783e2ffd2fa # v2.0.0

.github/workflows/publish.yml

@@ -0,0 +1,70 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - "@mento-protocol/issues@*"
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    name: Publish @mento-protocol/issues
+    if: startsWith(github.ref, 'refs/tags/@mento-protocol/issues@')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22.14.0
+          registry-url: https://registry.npmjs.org
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Setup npm for trusted publishing
+        run: |
+          npm install --global npm@11.5.1
+          npm --version
+
+      - name: Validate tag version
+        run: |
+          tag_version="${GITHUB_REF_NAME#@mento-protocol/issues@}"
+          package_version="$(node -p "require('./packages/issues/package.json').version")"
+          if [ "$tag_version" != "$package_version" ]; then
+            echo "Tag version $tag_version does not match package version $package_version"
+            exit 1
+          fi
+
+      - name: Test
+        run: pnpm --filter @mento-protocol/issues test
+
+      # Published from the package directory. `npm publish --workspace` reads
+      # workspaces from the root package.json `workspaces` field, which this
+      # repository does not have — the workspaces live in pnpm-workspace.yaml —
+      # so npm answers "No workspaces found" and every tag push fails here.
+      - name: Publish package
+        working-directory: packages/issues
+        run: |
+          package_version="$(node -p "require('./package.json').version")"
+          if npm view "@mento-protocol/issues@${package_version}" version >/dev/null 2>&1; then
+            echo "::notice::@mento-protocol/issues@${package_version} already published; skipping"
+            exit 0
+          fi
+          npm publish

.trunk/configs/.markdownlint.yaml

@@ -0,0 +1,2 @@
+# Prettier friendly markdownlint config (all formatting rules disabled)
+extends: markdownlint/style/prettier

.trunk/configs/.yamllint.yaml

@@ -0,0 +1,7 @@
+rules:
+  quoted-strings:
+    required: only-when-needed
+    extra-allowed: ["{|}"]
+  key-duplicates: {}
+  octal-values:
+    forbid-implicit-octal: true

.trunk/trunk.yaml

@@ -0,0 +1,62 @@
+# This file controls the behavior of Trunk: https://docs.trunk.io/cli
+# To learn more about the format of this file, see https://docs.trunk.io/reference/trunk-yaml
+version: 0.1
+cli:
+  version: 1.25.0
+
+# Trunk provides extensibility via plugins. (https://docs.trunk.io/plugins)
+plugins:
+  sources:
+    - id: trunk
+      ref: v1.7.3
+      uri: https://github.com/trunk-io/plugins
+
+# Many linters and tools depend on runtimes - configure them here. (https://docs.trunk.io/runtimes)
+runtimes:
+  enabled:
+    - go@1.21.0 # Required for various Go-based security and linting tools
+    - node@22.16.0 # Node.js runtime for ESLint, Prettier, and other JS tools
+    - python@3.10.8 # Python runtime for security scanners and other tools
+
+# This is the section where you manage your linters. (https://docs.trunk.io/check/configuration)
+lint:
+  # Global ignore patterns for better performance and relevance
+  ignore:
+    - linters: [ALL]
+      paths:
+        - "**/node_modules/**" # Skip all dependency directories
+        - "**/dist/**" # Skip build/distribution directories
+        - "**/build/**" # Skip build directories
+
+  # All enabled linters - organized by category for clarity
+  enabled:
+    # === CONFIGURATION & DOCUMENTATION ===
+    - yamllint@1.37.1 # YAML configuration file linting
+    - markdownlint@0.46.0 # Markdown documentation linting
+    - markdown-link-check@3.14.2 # Validates that markdown links are not broken
+
+    # === SHELL SCRIPTING ===
+    - shellcheck@0.11.0 # Shell script linting (catches common bash/sh errors)
+    - shfmt@3.6.0 # Shell script formatting
+
+    # === SECURITY SCANNING ===
+    - gitleaks@8.28.0 # Detects secrets in git history and commits
+    - trufflehog@3.90.8 # Advanced secret detection with high accuracy
+    - osv-scanner@2.2.3 # Vulnerability scanning for dependencies
+
+    # === GITHUB ACTIONS ===
+    - actionlint@1.7.8 # GitHub Actions workflow linting
+
+    # === CODE QUALITY & ORGANIZATION ===
+    - prettier@3.7.4 # Code formatting
+    - git-diff-check # Validates git diffs for common issues
+    - sort-package-json@3.5.0 # Automatically sorts package.json files
+    - dustilock@1.2.0 # Dependency integrity checking
+
+# Git hooks and automated actions
+actions:
+  enabled:
+    - trunk-fmt-pre-commit # Auto-format files when committing
+    - commitlint # Validate commit messages follow conventional format
+    - trunk-announce # Show announcements for new features
+    - trunk-upgrade-available # Notify when Trunk updates are available

commitlint.config.mjs

@@ -0,0 +1,3 @@
+export default {
+  extends: ["@commitlint/config-conventional"],
+};

package.json

@@ -0,0 +1,18 @@
+{
+  "name": "agents",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "format": "trunk fmt",
+    "lint": "trunk check --all",
+    "test": "pnpm -r test"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "^19.8.1",
+    "@commitlint/config-conventional": "^19.8.1"
+  },
+  "packageManager": "pnpm@10.34.5",
+  "engines": {
+    "node": "^22.12.0 || >=24.0.0"
+  }
+}

packages/issues/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mento Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.