@doist/todoist-mcp 13.11.1 → 14.0.0

package/dist/mcp-server.d.ts

@@ -1,16 +1,15 @@
+import { McpServerOptions } from '@doist/mcp-core/host';
 import { McpServer } from '@modelcontextprotocol/server';
 import { FEATURE_NAMES, Feature, FeatureName, Features } from './mcp-helpers.js';
 export declare const instructions = "\n## Todoist Task and Project Management Tools\n\nYou have access to comprehensive Todoist management tools for personal productivity and team collaboration. Use these tools to help users manage tasks, projects, sections, comments, and assignments effectively.\n\n### Core Capabilities:\n- Create, update, complete, and search tasks with rich metadata (priorities, due dates, durations, assignments)\n- Manage projects and sections with flexible organization\n- Handle comments and collaboration features\n- Bulk assignment operations for team workflows\n- Get overviews and insights about workload and progress\n\n### Choosing between tools\n\nWhat each tool does and how to fill its parameters is in the tool's own description and input schema. This section covers only what those cannot: which tool to reach for, and how tools relate to each other.\n\n**Dates**\n\n- To move a task to a different date or time use **reschedule-tasks**, never **update-tasks**. It also sets duration, for time-blocking. update-tasks replaces the whole due string, so it refuses a dueString on a recurring task unless replaceRecurrence is true.\n- Never send a task's existing projectId, sectionId or parentId back to **update-tasks** \u2014 those fields are treated as a move.\n- All dates respect the user's timezone.\n- Todoist apps only display task durations under 24 hours. A longer one (\"36h\") or a day-based one (\"3d\") is stored and reported faithfully, but the apps show the task as having no duration \u2014 only set one when the user explicitly asks for it.\n\n**Finding things**\n\n- For \"what did I complete?\", call **user-info** for the asker's user ID, then **find-activity** with objectType=\"task\", eventType=\"completed\", initiatorId, and dateFrom/dateTo. Without initiatorId the answer covers every collaborator. find-activity reports completion events, including each occurrence of a recurring task; **find-completed-tasks** lists completed tasks, which is not the same question.\n- To resolve a person's name or email to a user ID, or to answer \"who is X?\", use **find-project-collaborators** with just a searchTerm. It covers every shared project you can access plus yourself, so an empty result means they collaborate on none of them \u2014 not that they do not exist.\n- Before assigning work to someone, call **find-project-collaborators** again with the target projectId. Resolving an ID only proves they collaborate on *some* project you can see; assignment fails unless they collaborate on that one.\n- To find out whether a task hides subtasks, use **fetch-object** with includeChildren rather than a speculative **find-tasks** call.\n- Filter tasks by label **name**. Label IDs are only for **delete-object** and **update-labels**. Shared labels can be renamed but not recoloured, reordered or favourited.\n\n**Comments**\n\n- Comments notify only the people **add-comments** is handed. When a comment mentions someone, name them in `notifyUsers` \u2014 writing \"@Ana\" in the text notifies nobody. Omit `notifyUsers` to notify whoever the Todoist apps would, or pass `[\"none\"]` to stay silent.\n- Notification cannot be sent when editing a comment, only when adding one.\n\n**Deleting and archiving**\n\n- **delete-object** removes every object type; there is no per-type delete tool. Reminders use type \"reminder\", location reminders \"location_reminder\".\n- A workspace project must be archived with **project-management** before it can be deleted. A personal project can be deleted directly.\n\n**Templates**\n\n- Templates cannot be listed through this server, so only use an ID or URL the user gave you. To start a new project from one, call **add-projects** first and import into it. Imports write immediately and cannot be undone.\n\n**Project health**\n\n- Health data may be stale \u2014 check the isStale flag, and call **analyze-project-health** to refresh it before reading again.\n\n**Batches**\n\n- Prefer a batch tool over one call per item.\n- Where a batch tool returns per-item `failures` alongside successes, one failure does not undo the rest: never retry the whole batch, re-send only the items whose failure reason is fixable. **reschedule-tasks** is the exception \u2014 it has no per-item failures and throws if any task fails, so retry it as a whole.\n\nUse the **productivity-analysis** prompt for a combined productivity review \u2014 it pulls together user-info, get-productivity-stats and find-completed-tasks.\n\nAlways provide clear, actionable task titles and descriptions. Use the overview tools to give users context about their workload and project status.\n";
 /**
  * Create the MCP server.
- * @param todoistApiKey - The API key for the todoist account.
+ * @param token - The user's Todoist API token.
  * @param baseUrl - The base URL for the todoist API.
  * @param features - Features to enable for the server.
  * @returns the MCP server.
  */
-declare function getMcpServer({ todoistApiKey, baseUrl, features, }: {
-    todoistApiKey: string;
-    baseUrl?: string;
+declare function getMcpServer({ token, baseUrl, features, }: McpServerOptions & {
     features?: Features;
 }): McpServer;
 export { FEATURE_NAMES, type Feature, type FeatureName, type Features, getMcpServer };

package/dist/mcp-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAA;AAExD,OAAO,EACH,aAAa,EACb,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,QAAQ,EAEhB,MAAM,kBAAkB,CAAA;AAMzB,eAAO,MAAM,YAAY,qhJAyDxB,CAAA;AAgBD;;;;;;GAMG;AAEH,iBAAS,YAAY,CAAC,EAClB,aAAa,EACb,OAAO,EACP,QAAa,GAChB,EAAE;IACC,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,QAAQ,CAAA;CACtB,aA+CA;AAED,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,YAAY,EAAE,CAAA"}
+{"version":3,"file":"mcp-server.d.ts","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAA;AAExD,OAAO,EACH,aAAa,EACb,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,QAAQ,EAEhB,MAAM,kBAAkB,CAAA;AAMzB,eAAO,MAAM,YAAY,qhJAyDxB,CAAA;AAgBD;;;;;;GAMG;AAEH,iBAAS,YAAY,CAAC,EAClB,KAAK,EACL,OAAO,EACP,QAAa,GAChB,EAAE,gBAAgB,GAAG;IAClB,QAAQ,CAAC,EAAE,QAAQ,CAAA;CACtB,aA+CA;AAED,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,YAAY,EAAE,CAAA"}

package/dist/middleware/require-valid-todoist-token.d.ts

@@ -27,7 +27,8 @@ type RequireValidTodoistTokenOptions = TokenSource & {
  * Express middleware that validates the Todoist API token before MCP processing.
  *
  * Returns HTTP 401 with a spec-compliant WWW-Authenticate header if the token
- * is invalid, allowing MCP clients to trigger OAuth token refresh.
+ * is invalid, allowing MCP clients to trigger OAuth token refresh, and 403 with
+ * an `insufficient_scope` challenge if it lacks a scope the tools need.
  */
 declare function requireValidTodoistToken(options: RequireValidTodoistTokenOptions): RequestHandler;
 /**

package/dist/middleware/require-valid-todoist-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"require-valid-todoist-token.d.ts","sourceRoot":"","sources":["../../src/middleware/require-valid-todoist-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,OAAO,EAAE,cAAc,EAAY,MAAM,SAAS,CAAA;AAI9E,KAAK,iBAAiB,GAAG;IACrB,IAAI,EAAE,QAAQ,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,KAAK,kBAAkB,GAAG;IACtB,IAAI,EAAE,SAAS,CAAA;IACf,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAA;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,KAAK,WAAW,GAAG,iBAAiB,GAAG,kBAAkB,CAAA;AAEzD,KAAK,+BAA+B,GAAG,WAAW,GAAG;IACjD;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC/B,CAAA;AA8DD;;;;;GAKG;AACH,iBAAS,wBAAwB,CAAC,OAAO,EAAE,+BAA+B,GAAG,cAAc,CAwC1F;AAED;;GAEG;AACH,iBAAS,yBAAyB,IAAI,IAAI,CAEzC;AAED,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,KAAK,+BAA+B,EAAE,CAAA"}
+{"version":3,"file":"require-valid-todoist-token.d.ts","sourceRoot":"","sources":["../../src/middleware/require-valid-todoist-token.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAgB,OAAO,EAAE,cAAc,EAAY,MAAM,SAAS,CAAA;AAI9E,KAAK,iBAAiB,GAAG;IACrB,IAAI,EAAE,QAAQ,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,KAAK,kBAAkB,GAAG;IACtB,IAAI,EAAE,SAAS,CAAA;IACf,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAA;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,KAAK,WAAW,GAAG,iBAAiB,GAAG,kBAAkB,CAAA;AAEzD,KAAK,+BAA+B,GAAG,WAAW,GAAG;IACjD;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC/B,CAAA;AAiGD;;;;;;GAMG;AACH,iBAAS,wBAAwB,CAAC,OAAO,EAAE,+BAA+B,GAAG,cAAc,CAiC1F;AAED;;GAEG;AACH,iBAAS,yBAAyB,IAAI,IAAI,CAEzC;AAED,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,KAAK,+BAA+B,EAAE,CAAA"}

package/dist/require-valid-todoist-token-B0G0XLuO.js

@@ -0,0 +1,79 @@
+import { validateBearerToken as _ } from "@doist/mcp-core/host";
+import { $ as k, a0 as v } from "./mcp-server-DY_eceeG.js";
+const w = "https://api.todoist.com", y = (e, t) => _({
+  // Resolved the way the SDK resolves its own requests against a custom base URL. An empty
+  // base (`TODOIST_BASE_URL=`) means the default, as it does for the SDK client.
+  url: new URL("/api/v1/user", t || w),
+  token: e,
+  headers: v({ label: "auth:validate-token" }),
+  fetch: k
+}), g = 3e5, m = 12e4, f = 1e4, r = /* @__PURE__ */ new Map();
+function E(e, t) {
+  return t ? `${e}::${t}` : e;
+}
+function C() {
+  const e = Date.now();
+  for (const [t, n] of r)
+    e >= n.expiresAt && r.delete(t);
+}
+function D(e) {
+  const t = r.get(e);
+  if (t && Date.now() < t.expiresAt)
+    return t.result;
+  t && r.delete(e);
+}
+function L(e, t, n) {
+  r.size >= f && C(), r.size >= f && r.clear(), r.set(e, { result: t, expiresAt: Date.now() + n });
+}
+function T(e, t) {
+  const n = [
+    ...t ? [`error="${t}"`] : [],
+    ...e ? [`resource_metadata="${e}"`] : []
+  ];
+  return n.length > 0 ? `Bearer ${n.join(", ")}` : "Bearer";
+}
+function h(e, t) {
+  e.status(401).set("WWW-Authenticate", T(t)).json({
+    error: "invalid_token",
+    error_description: "Todoist API token is invalid or expired"
+  });
+}
+function U(e, t) {
+  e.status(403).set(
+    "WWW-Authenticate",
+    T(t, "insufficient_scope")
+  ).json({
+    error: "insufficient_scope",
+    error_description: "Todoist API token does not have the required scopes"
+  });
+}
+function l(e, t, n, i) {
+  e === "valid" ? n() : e === "forbidden" ? U(t, i) : h(t, i);
+}
+function M(e) {
+  const t = e.type === "static" ? g : m, n = e.cacheTtlMs ?? t, { resourceMetadataUrl: i } = e;
+  return async (p, o, s) => {
+    const a = e.type === "static" ? e.apiKey : e.getApiKey(p);
+    if (!a) {
+      h(o, i);
+      return;
+    }
+    const d = E(a, e.baseUrl), u = D(d);
+    if (u !== void 0) {
+      l(u, o, s, i);
+      return;
+    }
+    let c;
+    try {
+      c = await y(a, e.baseUrl);
+    } catch (A) {
+      console.warn("[Token validation] Transient error, proceeding:", A), s();
+      return;
+    }
+    L(d, c, n), l(c, o, s, i);
+  };
+}
+export {
+  M as r,
+  y as v
+};

package/dist/usage-tracking.d.ts

@@ -22,6 +22,11 @@ export declare function buildUsageTrackingHeaders({ label, platform, sessionId,
 export declare function resetDefaultDispatcherForTests(): Promise<void>;
 export declare function setDispatcherModuleLoaderForTests(loader: () => Promise<DispatcherModule>): void;
 export declare function resetDispatcherModuleLoaderForTests(): void;
+/**
+ * Sends a request the way the SDK sends its own: through its default dispatcher, which honours
+ * `HTTP_PROXY`, `HTTPS_PROXY` and `NO_PROXY`, with the `fetch` paired to it.
+ */
+export declare function fetchThroughSdkTransport(url: string | URL, init: RequestInit): Promise<Response>;
 export declare function createTrackedFetch(baseFetch?: typeof fetch, tracking?: UsageTrackingConfig): CustomFetch;
 export declare function createTodoistClient(apiKey: string, { baseUrl, tracking, }?: {
     baseUrl?: string;

package/dist/usage-tracking.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"usage-tracking.d.ts","sourceRoot":"","sources":["../src/usage-tracking.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,WAAW,EAA4B,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAK3F,QAAA,MAAM,mBAAmB,QAAsB,CAAA;AAI/C,KAAK,mBAAmB,GAAG;IACvB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,KAAK,gBAAgB,GAAG;IACpB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACvB,CAAA;AAED,KAAK,gBAAgB,GAAG;IACpB,mBAAmB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAA;CACnE,CAAA;AAcD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE5E;AAED,wBAAgB,yBAAyB,CAAC,EACtC,KAAK,EACL,QAAgB,EAChB,SAAwB,GAC3B,GAAE;IACC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CAChB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW9B;AAkGD,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,IAAI,CAAC,CAcpE;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAE/F;AAED,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D;AAmCD,wBAAgB,kBAAkB,CAC9B,SAAS,GAAE,OAAO,KAAwB,EAC1C,QAAQ,GAAE,mBAAwB,GACnC,WAAW,CA+Bb;AAED,wBAAgB,mBAAmB,CAC/B,MAAM,EAAE,MAAM,EACd,EACI,OAAO,EACP,QAAQ,GACX,GAAE;IACC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC5B,GACP,UAAU,CAUZ;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAA"}
+{"version":3,"file":"usage-tracking.d.ts","sourceRoot":"","sources":["../src/usage-tracking.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,WAAW,EAA4B,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAK3F,QAAA,MAAM,mBAAmB,QAAsB,CAAA;AAI/C,KAAK,mBAAmB,GAAG;IACvB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,KAAK,gBAAgB,GAAG;IACpB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACvB,CAAA;AAED,KAAK,gBAAgB,GAAG;IACpB,mBAAmB,EAAE,MAAM,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAA;CACnE,CAAA;AAcD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,2BAA2B,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE5E;AAED,wBAAgB,yBAAyB,CAAC,EACtC,KAAK,EACL,QAAgB,EAChB,SAAwB,GAC3B,GAAE;IACC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;CAChB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW9B;AAkGD,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,IAAI,CAAC,CAcpE;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAE/F;AAED,wBAAgB,mCAAmC,IAAI,IAAI,CAE1D;AAuBD;;;GAGG;AACH,wBAAsB,wBAAwB,CAC1C,GAAG,EAAE,MAAM,GAAG,GAAG,EACjB,IAAI,EAAE,WAAW,GAClB,OAAO,CAAC,QAAQ,CAAC,CAInB;AAcD,wBAAgB,kBAAkB,CAC9B,SAAS,GAAE,OAAO,KAAwB,EAC1C,QAAQ,GAAE,mBAAwB,GACnC,WAAW,CA+Bb;AAED,wBAAgB,mBAAmB,CAC/B,MAAM,EAAE,MAAM,EACd,EACI,OAAO,EACP,QAAQ,GACX,GAAE;IACC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CAC5B,GACP,UAAU,CAUZ;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAA"}

package/dist/utils/validate-todoist-token.d.ts

@@ -1,9 +1,17 @@
+import { ValidateToken } from '@doist/mcp-core/host';
 /**
- * Validates a Todoist API token by making a lightweight API call.
+ * Validates a Todoist API token with a status-only call to the user endpoint.
  *
- * @returns `true` if the token is valid, `false` if it's an auth error (401/403).
- * @throws On transient errors (network failures, 5xx) so the caller can decide.
+ * Resolves `'valid'`, `'invalid'` (401) or `'forbidden'` (403), so a host can answer a token that
+ * lacks a scope with an RFC 6750 `insufficient_scope` challenge rather than a blanket 401. The
+ * body is never parsed, so a change to the user object can't turn a valid token into an error.
+ *
+ * The request goes out through the SDK's transport, so it honours the same proxy settings as
+ * every tool call, and carries the usage-tracking headers as `auth:validate-token`.
+ *
+ * @throws {TokenValidationError} (from `@doist/mcp-core/host`) for any other status, such as a
+ * 5xx, carrying it as `httpStatusCode`. Network and timeout errors propagate unchanged.
  */
-declare function validateTodoistToken(apiKey: string, baseUrl?: string): Promise<boolean>;
+declare const validateTodoistToken: ValidateToken;
 export { validateTodoistToken };
 //# sourceMappingURL=validate-todoist-token.d.ts.map

package/dist/utils/validate-todoist-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-todoist-token.d.ts","sourceRoot":"","sources":["../../src/utils/validate-todoist-token.ts"],"names":[],"mappings":"AAuBA;;;;;GAKG;AACH,iBAAe,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAYtF;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAA"}
+{"version":3,"file":"validate-todoist-token.d.ts","sourceRoot":"","sources":["../../src/utils/validate-todoist-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAuB,MAAM,sBAAsB,CAAA;AAO9E;;;;;;;;;;;;GAYG;AACH,QAAA,MAAM,oBAAoB,EAAE,aAQtB,CAAA;AAEN,OAAO,EAAE,oBAAoB,EAAE,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@doist/todoist-mcp",
-    "version": "13.11.1",
+    "version": "14.0.0",
     "type": "module",
     "main": "./dist/index.js",
     "types": "./dist/index.d.ts",
@@ -67,7 +67,7 @@
         "prepare": "lefthook install --reset-hooks-path"
     },
     "dependencies": {
-        "@doist/mcp-core": "0.1.1",
+        "@doist/mcp-core": "0.3.0",
         "@doist/todoist-sdk": "16.0.0",
         "@modelcontextprotocol/ext-apps": "2.0.4",
         "date-fns": "4.1.0",

package/dist/require-valid-todoist-token-BOCa8T4B.js

@@ -1,72 +0,0 @@
-import { $ as A, a0 as v, a1 as T } from "./mcp-server-BhPX7dvL.js";
-const y = /* @__PURE__ */ new Set([401, 403]);
-function C(e) {
-  const t = T(e);
-  if (t !== void 0)
-    return t;
-  if (e !== null && typeof e == "object" && "response" in e)
-    return T(e.response);
-}
-async function _(e, t) {
-  const r = A(e, { baseUrl: t });
-  try {
-    return await v("auth:validate-token", () => r.getUser()), !0;
-  } catch (a) {
-    const i = C(a);
-    if (i !== void 0 && y.has(i))
-      return !1;
-    throw a;
-  }
-}
-const p = 3e5, w = 12e4, h = 1e4, n = /* @__PURE__ */ new Map();
-function k(e, t) {
-  return t ? `${e}::${t}` : e;
-}
-function E() {
-  const e = Date.now();
-  for (const [t, r] of n)
-    e >= r.expiresAt && n.delete(t);
-}
-function S(e) {
-  const t = n.get(e);
-  if (t && Date.now() < t.expiresAt)
-    return t.valid;
-  t && n.delete(e);
-}
-function g(e, t, r) {
-  n.size >= h && E(), n.size >= h && n.clear(), n.set(e, { valid: t, expiresAt: Date.now() + r });
-}
-function x(e) {
-  return e ? `Bearer resource_metadata="${e}"` : "Bearer";
-}
-function d(e, t) {
-  e.status(401).set("WWW-Authenticate", x(t)).json({
-    error: "invalid_token",
-    error_description: "Todoist API token is invalid or expired"
-  });
-}
-function M(e) {
-  const t = e.type === "static" ? p : w, r = e.cacheTtlMs ?? t, { resourceMetadataUrl: a } = e;
-  return async (i, s, c) => {
-    const u = e.type === "static" ? e.apiKey : e.getApiKey(i);
-    if (!u) {
-      d(s, a);
-      return;
-    }
-    const f = k(u, e.baseUrl), l = S(f);
-    if (l !== void 0) {
-      l ? c() : d(s, a);
-      return;
-    }
-    try {
-      const o = await _(u, e.baseUrl);
-      g(f, o, r), o ? c() : d(s, a);
-    } catch (o) {
-      console.warn("[Token validation] Transient error, proceeding:", o), c();
-    }
-  };
-}
-export {
-  M as r,
-  _ as v
-};