@jungjaehoon/mama-os 0.53.0 → 0.57.0

package/dist/connectors/trello/query-tools.js

@@ -1,661 +0,0 @@
-"use strict";
-/**
- * Trello live query tools — the READ answer path for current-state questions.
- *
- * Ported from Kagemusha's mechanism (trello_search / trello_card_detail):
- * state questions are answered by reading the LIVE board at question time,
- * never by projecting the connector change log. The 2026-07-24 incident chain
- * (missing labels/assignees, first-sight timestamps burying enriched items,
- * per-character card collapse) was one architecture mistake surfacing three
- * ways: a log projection serving state queries. The connector log remains the
- * delta/trigger source; these tools are the truth reads, the same pattern as
- * kagemusha_* for the kagemusha DB.
- *
- * Read-only: no mutation endpoint is ever called. Card text is untrusted
- * external data — tool descriptions instruct the model to treat it as data.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveTrelloQueryAuth = resolveTrelloQueryAuth;
-exports.clearTrelloSnapshotCache = clearTrelloSnapshotCache;
-exports.getTrelloKanban = getTrelloKanban;
-exports.getTrelloBoardsOverview = getTrelloBoardsOverview;
-exports.getTrelloListCards = getTrelloListCards;
-exports.searchTrelloBoardCards = searchTrelloBoardCards;
-exports.getTrelloCardDetail = getTrelloCardDetail;
-const node_crypto_1 = require("node:crypto");
-const config_loader_js_1 = require("../config-loader.js");
-const BASE_URL = 'https://api.trello.com/1';
-const FETCH_TIMEOUT_MS = 15_000;
-/** Progressive page bounds shared by the Trello cards/search facades (Task C). */
-const RECORD_DEFAULT_LIMIT = 25;
-const RECORD_MAX_LIMIT = 50;
-const DESC_DEFAULT_LIMIT = 1000;
-const DESC_MAX_LIMIT = 4000;
-const CHECKLIST_DEFAULT_LIMIT = 10;
-const CHECKLIST_MAX_LIMIT = 25;
-const ITEM_DEFAULT_LIMIT = 20;
-const ITEM_MAX_LIMIT = 50;
-/** Loud, no-fallback auth resolution via the connector contract:
- *  config.auth.token ?? env[tokenName ?? 'TRELLO_TOKEN'], "apiKey:token". */
-function resolveTrelloQueryAuth(deps = {}) {
-    const env = deps.env ?? process.env;
-    const loaded = (0, config_loader_js_1.loadConnectorConfig)(deps.configPath);
-    if (!loaded.ok) {
-        throw new Error(`trello query tools: connector configuration unreadable (${loaded.error.code})`);
-    }
-    const trello = loaded.config['trello'];
-    if (!trello?.enabled) {
-        throw new Error('trello query tools: the trello connector is not enabled in connectors.json');
-    }
-    const rawToken = trello.auth?.token ?? env[trello.auth?.tokenName ?? 'TRELLO_TOKEN'];
-    if (!rawToken) {
-        throw new Error('trello query tools: no credentials (set the connector token, format "apiKey:token")');
-    }
-    const sep = rawToken.indexOf(':');
-    if (sep <= 0) {
-        throw new Error('trello query tools: credential format invalid, expected "apiKey:token"');
-    }
-    const boardNames = new Map();
-    for (const [key, ch] of Object.entries(trello.channels ?? {})) {
-        if (ch?.role !== 'ignore' && ch?.boardId)
-            boardNames.set(ch.boardId, ch.name ?? key);
-    }
-    return { apiKey: rawToken.slice(0, sep), token: rawToken.slice(sep + 1), boardNames };
-}
-async function trelloGet(path, params, auth, fetchFn) {
-    const search = new URLSearchParams({ ...params, key: auth.apiKey, token: auth.token });
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
-    let res;
-    try {
-        res = await fetchFn(`${BASE_URL}${path}?${search.toString()}`, { signal: controller.signal });
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-    if (!res.ok) {
-        throw new Error(`trello API ${path}: HTTP ${res.status}`);
-    }
-    return (await res.json());
-}
-function summarize(card, boardNames) {
-    return {
-        cardId: card.id,
-        name: card.name,
-        board: card.board?.name ?? (card.board?.id ? (boardNames.get(card.board.id) ?? card.board.id) : ''),
-        list: card.list?.name ?? '',
-        labels: (card.labels ?? []).map((l) => l.name).filter(Boolean),
-        assignees: (card.members ?? []).map((m) => m.fullName || m.username || '').filter(Boolean),
-        due: card.due,
-        lastActivity: card.dateLastActivity,
-    };
-}
-/** Per-process snapshot cache. A full report asks about many cards in one
- *  turn; without this every trello_search re-fetched every board serially
- *  (~10s x 15 calls in the 2026-07-24 14:03 report turn). 45s keeps a turn
- *  on one snapshot while staying far fresher than the 5-min poll cadence. */
-const SNAPSHOT_TTL_MS = 45_000;
-let snapshotCache = null;
-/** Test seam: drop the snapshot cache. */
-function clearTrelloSnapshotCache() {
-    snapshotCache = null;
-}
-/**
- * A stable identity of the CURRENT authorization: the credentials and the sorted
- * configured board allowlist (id + display name). It is a one-way hash, so tokens
- * are never exposed, yet a changed token, a removed/added board, or a renamed
- * board all mint a different value. Cache reuse and cursor continuation require
- * the SAME fingerprint, so cached cards are never re-served under new auth.
- */
-function authFingerprint(auth) {
-    const boards = [...auth.boardNames.entries()].sort((left, right) => left[0] < right[0] ? -1 : left[0] > right[0] ? 1 : 0);
-    return (0, node_crypto_1.createHash)('sha256')
-        .update(JSON.stringify([auth.apiKey, auth.token, boards]))
-        .digest('base64url')
-        .slice(0, 22);
-}
-/**
- * The current cached snapshot WITHOUT triggering a fresh fetch. Progressive
- * continuations (cards/search cursors) read the exact snapshot their first page
- * observed - even after the 45s fresh-read TTL - as long as it is still present.
- * Once the cache is replaced or cleared the continuation is rejected and the
- * caller restarts, because a page 2 drawn from a different snapshot could skip
- * or repeat cards.
- */
-function peekTrelloSnapshot() {
-    return snapshotCache;
-}
-/** Stable identity of one cached snapshot: its observation instant plus board
- *  and per-list card structure. A refresh replaces the cache wholesale and mints
- *  a new id, which is exactly what invalidates an in-flight cursor. */
-function snapshotId(snapshot) {
-    const shape = snapshot.boards.map((board) => [
-        board.boardId,
-        board.status,
-        board.lists.map((list) => [list.id, list.name, list.cards.length]),
-    ]);
-    return (0, node_crypto_1.createHash)('sha256')
-        .update(`${snapshot.at}:${JSON.stringify(shape)}`)
-        .digest('base64url')
-        .slice(0, 22);
-}
-/** Fetch all boards' open cards + member rosters IN PARALLEL, cached briefly.
- *  A single unreadable board degrades to an empty snapshot for that board only,
- *  never sinking the whole read - but it is now MARKED 'failed' instead of being
- *  indistinguishable from a board that genuinely has no open cards. A caller that
- *  reports "nothing there" from a failed read states a fact it never observed.
- *
- *  Roster resolution is optional enrichment (the poller treats it the same way):
- *  losing member names degrades naming, never card coverage. */
-async function fetchBoardSnapshots(auth, fetchFn) {
-    const authFp = authFingerprint(auth);
-    if (snapshotCache &&
-        snapshotCache.authFp === authFp &&
-        Date.now() - snapshotCache.at < SNAPSHOT_TTL_MS) {
-        // Cached snapshots keep their ORIGINAL observation time and per-board status:
-        // a degraded read must not re-serve as a fresh successful one for 45s. Reuse
-        // ALSO requires the same authorization - a token or allowlist change refetches.
-        return snapshotCache;
-    }
-    const boards = await Promise.all([...auth.boardNames].map(async ([boardId, boardName]) => {
-        let lists = [];
-        let roster = new Map();
-        const status = 'ok';
-        let rosterDegraded = false;
-        try {
-            lists = await trelloGet(`/boards/${boardId}/lists`, { cards: 'open', card_fields: 'name,due,dateLastActivity,idMembers,labels' }, auth, fetchFn);
-        }
-        catch {
-            return { boardId, boardName, lists: [], roster, status: 'failed', rosterDegraded: false };
-        }
-        if (lists.some((l) => l.cards.some((c) => (c.idMembers ?? []).length > 0))) {
-            try {
-                const members = await trelloGet(`/boards/${boardId}/members`, { fields: 'fullName,username' }, auth, fetchFn);
-                roster = new Map(members.flatMap((m) => m.fullName || m.username ? [[m.id, m.fullName || m.username]] : []));
-            }
-            catch {
-                rosterDegraded = true;
-            }
-        }
-        return { boardId, boardName, lists, roster, status, rosterDegraded };
-    }));
-    snapshotCache = { at: Date.now(), authFp, boards };
-    return snapshotCache;
-}
-function snapshotCard(snap, listName, card) {
-    return {
-        cardId: card.id,
-        name: card.name,
-        board: snap.boardName,
-        list: listName,
-        labels: (card.labels ?? []).map((l) => l.name).filter(Boolean),
-        assignees: (card.idMembers ?? []).map((id) => snap.roster.get(id) ?? id),
-        due: card.due,
-        lastActivity: card.dateLastActivity,
-    };
-}
-/**
- * Full LIVE kanban snapshot across the configured boards - the primary answer tool
- * for whole-project status. ONE call replaces a search per card: every open card
- * with its list, labels (revision round / artist), and assignee names, grouped by
- * board+list.
- *
- * The result carries its own coverage because both ways this read can be partial are
- * invisible in the data itself: a board whose fetch failed yields no cards, and a
- * column longer than maxCardsPerList is silently sliced. A caller that asserts a
- * whole-situation claim must check `complete` first.
- */
-async function getTrelloKanban(input = {}, deps = {}) {
-    const maxCards = Math.max(1, Math.min(100, Math.floor(input.maxCardsPerList ?? 30)));
-    const auth = resolveTrelloQueryAuth(deps);
-    const fetchFn = deps.fetchFn ?? fetch;
-    const snapshot = await fetchBoardSnapshots(auth, fetchFn);
-    const columns = [];
-    const boards = [];
-    for (const snap of snapshot.boards) {
-        boards.push({
-            boardId: snap.boardId,
-            board: snap.boardName,
-            status: snap.status,
-            rosterDegraded: snap.rosterDegraded,
-        });
-        for (const list of snap.lists) {
-            if (list.cards.length === 0)
-                continue;
-            const cards = list.cards
-                .slice(0, maxCards)
-                .map((card) => snapshotCard(snap, list.name, card));
-            columns.push({
-                board: snap.boardName,
-                list: list.name,
-                count: list.cards.length,
-                returned: cards.length,
-                cards,
-            });
-        }
-    }
-    const truncated = columns.some((column) => column.returned < column.count);
-    return {
-        observedAt: new Date(snapshot.at).toISOString(),
-        cacheAgeMs: Math.max(0, Date.now() - snapshot.at),
-        complete: boards.length > 0 && boards.every((board) => board.status === 'ok') && !truncated,
-        truncated,
-        boards,
-        columns,
-    };
-}
-/**
- * Progressive overview: every configured board and its lists with stable ids and
- * open-card COUNTS - no card arrays. This is the entry point; a caller then reads
- * one list's cards with `getTrelloListCards`. `readVersion` names the snapshot to
- * pass back through a cards/search cursor.
- */
-async function getTrelloBoardsOverview(deps = {}) {
-    const auth = resolveTrelloQueryAuth(deps);
-    const fetchFn = deps.fetchFn ?? fetch;
-    const snapshot = await fetchBoardSnapshots(auth, fetchFn);
-    const boards = snapshot.boards.map((snap) => ({
-        boardId: snap.boardId,
-        board: snap.boardName,
-        status: snap.status,
-        rosterDegraded: snap.rosterDegraded,
-        lists: snap.lists.map((list) => ({
-            listId: list.id,
-            list: list.name,
-            count: list.cards.length,
-        })),
-    }));
-    return {
-        boards,
-        observedAt: new Date(snapshot.at).toISOString(),
-        cacheAgeMs: Math.max(0, Date.now() - snapshot.at),
-        readVersion: snapshotId(snapshot),
-        complete: boards.length > 0 && boards.every((board) => board.status === 'ok'),
-    };
-}
-function encodeRecordCursor(payload) {
-    return Buffer.from(JSON.stringify(payload), 'utf8').toString('base64url');
-}
-/** Resolve the snapshot a page reads AND the CURRENT authorization. Authorization
- *  is re-resolved on EVERY page (P1: PR #262): a disabled connector or unreadable
- *  config throws here before any cached field is returned. A cursor pins the EXACT
- *  cached snapshot and rejects if it is gone, replaced, or fetched under a
- *  different authorization; a first page fetches (refreshing on TTL or auth). */
-async function resolvePageSnapshot(cursor, scope, deps) {
-    const auth = resolveTrelloQueryAuth(deps);
-    const fetchFn = deps.fetchFn ?? fetch;
-    if (cursor) {
-        const snapshot = peekTrelloSnapshot();
-        if (!snapshot) {
-            throw new Error('trello cursor snapshot is no longer cached; restart the read from the overview.');
-        }
-        // Authorization is re-checked against the cache: a changed token or a changed
-        // board allowlist rejects the continuation rather than filtering old cards.
-        if (snapshot.authFp !== authFingerprint(auth)) {
-            throw new Error('trello authorization changed since this cursor was issued; restart the read from the overview.');
-        }
-        const id = snapshotId(snapshot);
-        if (id !== cursor.snapshotId || cursor.scope !== scope) {
-            throw new Error('trello cursor belongs to a replaced snapshot or a different scope; restart the read.');
-        }
-        return { snapshot, id, auth };
-    }
-    const snapshot = await fetchBoardSnapshots(auth, fetchFn);
-    return { snapshot, id: snapshotId(snapshot), auth };
-}
-function decodeRecordCursor(raw) {
-    if (raw === undefined)
-        return null;
-    if (typeof raw !== 'string' || raw.length === 0 || raw.length > 2048) {
-        throw new Error('trello cursor is malformed; restart the read.');
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(Buffer.from(raw, 'base64url').toString('utf8'));
-    }
-    catch {
-        throw new Error('trello cursor is malformed; restart the read.');
-    }
-    if (!parsed ||
-        typeof parsed !== 'object' ||
-        parsed.v !== 1 ||
-        typeof parsed.snapshotId !== 'string' ||
-        typeof parsed.scope !== 'string' ||
-        !Number.isSafeInteger(parsed.offset) ||
-        parsed.offset < 0) {
-        throw new Error('trello cursor is malformed; restart the read.');
-    }
-    return parsed;
-}
-function boundedRecordLimit(value) {
-    if (value === undefined)
-        return RECORD_DEFAULT_LIMIT;
-    if (!Number.isInteger(value) || value < 1 || value > RECORD_MAX_LIMIT) {
-        throw new Error(`limit must be an integer from 1 to ${RECORD_MAX_LIMIT}.`);
-    }
-    return value;
-}
-/**
- * One bounded page of a single list's open cards, drawn from the cached snapshot.
- * Every card in the list is reachable by walking `nextCursor` - past the old
- * 100-card kanban ceiling. The cursor is pinned to the snapshot and (boardId,
- * listId); a replaced/expired snapshot is rejected with restart guidance.
- */
-async function getTrelloListCards(input, deps = {}) {
-    const boardId = (input.boardId ?? '').trim();
-    const listId = (input.listId ?? '').trim();
-    if (!boardId || !listId) {
-        throw new Error('trello cards view requires boardId and listId from the overview.');
-    }
-    const scope = `cards:${boardId}:${listId}`;
-    const cursor = decodeRecordCursor(input.cursor);
-    const limit = boundedRecordLimit(input.limit);
-    const { snapshot, id, auth } = await resolvePageSnapshot(cursor, scope, deps);
-    // Authorize against the CURRENT allowlist before touching the snapshot: never
-    // disclose a board's cards from an old snapshot just because it was cached.
-    if (!auth.boardNames.has(boardId)) {
-        throw new Error(`trello board '${boardId}' is not configured/authorized.`);
-    }
-    const board = snapshot.boards.find((b) => b.boardId === boardId);
-    if (!board) {
-        throw new Error(`trello board '${boardId}' is not configured/authorized.`);
-    }
-    const observedAt = new Date(snapshot.at).toISOString();
-    const cacheAgeMs = Math.max(0, Date.now() - snapshot.at);
-    const coverage = { status: board.status, rosterDegraded: board.rosterDegraded };
-    if (board.status === 'failed') {
-        // A failed board read contributed NO cards; absence here is not an empty list.
-        // The display name is unknown (the read failed), so only the id echoes back.
-        return {
-            boardId,
-            listId,
-            board: board.boardName,
-            list: '',
-            cards: [],
-            total: 0,
-            returned: 0,
-            nextCursor: null,
-            observedAt,
-            cacheAgeMs,
-            readVersion: id,
-            coverage,
-        };
-    }
-    // Bind by the REAL Trello list id, never by display name: two lists on one board
-    // can share a name, and a name lookup would collapse them onto the first match.
-    const list = board.lists.find((entry) => entry.id === listId);
-    if (!list) {
-        throw new Error(`trello list '${listId}' is not present on board '${boardId}'.`);
-    }
-    const offset = cursor?.offset ?? 0;
-    if (offset > list.cards.length) {
-        throw new Error('trello cursor is past the end of the list; restart the read.');
-    }
-    const slice = list.cards
-        .slice(offset, offset + limit)
-        .map((card) => snapshotCard(board, list.name, card));
-    const nextOffset = offset + slice.length;
-    return {
-        boardId,
-        listId,
-        board: board.boardName,
-        list: list.name,
-        cards: slice,
-        total: list.cards.length,
-        returned: slice.length,
-        nextCursor: nextOffset < list.cards.length
-            ? encodeRecordCursor({ v: 1, snapshotId: id, scope, offset: nextOffset })
-            : null,
-        observedAt,
-        cacheAgeMs,
-        readVersion: id,
-        coverage,
-    };
-}
-/**
- * Progressive search over the cached board snapshot with local substring match -
- * an HONEST full match total and stable paging, not the old 20-result cap. A
- * failed board keeps `complete:false` so a missing match is never read as absent.
- * Local substring scan is deliberate: Trello's /search tokenizes on word
- * boundaries and misses CJK substrings and underscore compounds (e.g.
- * 'エルデリーゼ', 'ex_1055003'), which is most of this board vocabulary.
- */
-async function searchTrelloBoardCards(input, deps = {}) {
-    const query = (input.query ?? '').trim();
-    if (!query) {
-        throw new Error('trello_search requires a non-empty query');
-    }
-    const scope = `search:${query.toLowerCase()}`;
-    const cursor = decodeRecordCursor(input.cursor);
-    const limit = boundedRecordLimit(input.limit);
-    const { snapshot, id } = await resolvePageSnapshot(cursor, scope, deps);
-    const needle = query.toLowerCase();
-    const matches = [];
-    for (const board of snapshot.boards) {
-        for (const list of board.lists) {
-            for (const card of list.cards) {
-                if (card.name.toLowerCase().includes(needle)) {
-                    matches.push(snapshotCard(board, list.name, card));
-                }
-            }
-        }
-    }
-    const offset = cursor?.offset ?? 0;
-    if (offset > matches.length) {
-        throw new Error('trello cursor is past the end of the matches; restart the read.');
-    }
-    const slice = matches.slice(offset, offset + limit);
-    const nextOffset = offset + slice.length;
-    const boards = snapshot.boards.map((snap) => ({
-        boardId: snap.boardId,
-        board: snap.boardName,
-        status: snap.status,
-        rosterDegraded: snap.rosterDegraded,
-    }));
-    return {
-        query,
-        cards: slice,
-        total: matches.length,
-        returned: slice.length,
-        nextCursor: nextOffset < matches.length
-            ? encodeRecordCursor({ v: 1, snapshotId: id, scope, offset: nextOffset })
-            : null,
-        observedAt: new Date(snapshot.at).toISOString(),
-        cacheAgeMs: Math.max(0, Date.now() - snapshot.at),
-        readVersion: id,
-        coverage: {
-            boards,
-            complete: boards.length > 0 && boards.every((board) => board.status === 'ok'),
-        },
-    };
-}
-/** One raw card fetch, gated by the SAME board allowlist list/search obey. Returns
- *  null-free fields only after the returned board.id is a configured board. */
-async function fetchAuthorizedCard(cardId, auth, fetchFn) {
-    const card = await trelloGet(`/cards/${cardId}`, {
-        fields: 'name,desc,due,dateLastActivity,labels',
-        members: 'true',
-        member_fields: 'fullName,username',
-        list: 'true',
-        board: 'true',
-        checklists: 'all',
-        checkItem_fields: 'name,state',
-    }, auth, fetchFn);
-    // Authorization BEFORE any field is returned: an empty configured set grants no
-    // board, and a token-accessible card outside the configured boards is refused
-    // generically - no title, board, or contents leak through an unconfigured card.
-    const boardId = card.board?.id;
-    if (auth.boardNames.size === 0 || !boardId || !auth.boardNames.has(boardId)) {
-        throw new Error('trello card is not available in an authorized board');
-    }
-    return card;
-}
-/** Stable version of the authorized fetched card content; survives sectioned
- *  reads and changes if the live card's text/checklists/items change. */
-function cardContentVersion(card) {
-    const shape = {
-        name: card.name,
-        desc: card.desc ?? '',
-        due: card.due ?? null,
-        labels: (card.labels ?? []).map((l) => l.name),
-        checklists: (card.checklists ?? []).map((cl) => ({
-            id: cl.id ?? null,
-            name: cl.name,
-            items: (cl.checkItems ?? []).map((it) => ({ name: it.name, state: it.state })),
-        })),
-    };
-    return (0, node_crypto_1.createHash)('sha256').update(JSON.stringify(shape)).digest('base64url').slice(0, 22);
-}
-/** A section continuation (offset > 0) must echo the readVersion; a changed card is rejected. */
-function assertCardVersion(supplied, current, offset) {
-    if (offset > 0 && supplied === undefined) {
-        throw new Error('trello_card continuation (offset > 0) requires the readVersion from the previous section read; restart from offset 0.');
-    }
-    if (supplied !== undefined && supplied !== current) {
-        throw new Error('trello_card content changed since this readVersion was issued; restart the read from offset 0.');
-    }
-}
-function nonNegInt(value, field) {
-    if (value === undefined)
-        return 0;
-    if (!Number.isInteger(value) || value < 0) {
-        throw new Error(`trello_card ${field} must be a non-negative integer.`);
-    }
-    return value;
-}
-function boundedInt(value, field, fallback, max) {
-    if (value === undefined)
-        return fallback;
-    if (!Number.isInteger(value) || value < 1 || value > max) {
-        throw new Error(`trello_card ${field} must be an integer from 1 to ${max}.`);
-    }
-    return value;
-}
-/**
- * The ONE deterministic key a checklist is addressed by, used identically when
- * `checklists` emits headers and when `checklist_items` resolves them. A real
- * Trello id (present) is used as-is; an ABSENT id falls back to an `idx:<n>`
- * namespace keyed by the checklist's absolute position, which can never be
- * confused with a Trello hex id - so every returned header id resolves back to
- * its own items instead of an undefined-id lookup that could never match.
- */
-function checklistKey(checklist, index) {
-    return checklist.id ?? `idx:${index}`;
-}
-/**
- * Sectioned card detail. `summary` (default) is metadata plus description length
- * and checklist/item counts; `description` pages the text by Unicode CODE POINTS
- * (offset/limit); `checklists` pages whole checklist headers by RECORD; and
- * `checklist_items` pages whole item records of one checklist. Every long tail is
- * reachable through the returned continuation - nothing is silently sliced. The
- * board allowlist is enforced before ANY field is returned; list/search/detail
- * all agree on the same configured boards.
- */
-async function getTrelloCardDetail(input, deps = {}) {
-    const cardId = (input.cardId ?? '').trim();
-    if (!cardId || !/^[A-Za-z0-9]+$/.test(cardId)) {
-        throw new Error('trello_card requires a cardId (from trello_search results)');
-    }
-    const section = input.section ?? 'summary';
-    if (!['summary', 'description', 'checklists', 'checklist_items'].includes(section)) {
-        throw new Error('trello_card section must be one of summary|description|checklists|checklist_items.');
-    }
-    const auth = resolveTrelloQueryAuth(deps);
-    const fetchFn = deps.fetchFn ?? fetch;
-    // Authorize (board allowlist) BEFORE any field is disclosed, THEN version.
-    const card = await fetchAuthorizedCard(cardId, auth, fetchFn);
-    const readVersion = cardContentVersion(card);
-    const checklists = card.checklists ?? [];
-    if (section === 'summary') {
-        const base = summarize(card, auth.boardNames);
-        return {
-            cardId,
-            section: 'summary',
-            name: base.name,
-            board: base.board,
-            list: base.list,
-            labels: base.labels,
-            assignees: base.assignees,
-            due: base.due,
-            lastActivity: base.lastActivity,
-            descriptionLength: Array.from(card.desc ?? '').length,
-            checklistCount: checklists.length,
-            itemCount: checklists.reduce((sum, cl) => sum + (cl.checkItems?.length ?? 0), 0),
-            readVersion,
-        };
-    }
-    if (section === 'description') {
-        const points = Array.from(card.desc ?? '');
-        const offset = nonNegInt(input.offset, 'offset');
-        assertCardVersion(input.readVersion, readVersion, offset);
-        const limit = boundedInt(input.limit, 'limit', DESC_DEFAULT_LIMIT, DESC_MAX_LIMIT);
-        const start = Math.min(offset, points.length);
-        const slice = points.slice(start, start + limit);
-        const end = start + slice.length;
-        const nextOffset = end < points.length ? end : null;
-        return {
-            cardId,
-            section: 'description',
-            content: slice.join(''),
-            offset,
-            limit,
-            total: points.length,
-            nextOffset,
-            complete: nextOffset === null,
-            readVersion,
-        };
-    }
-    if (section === 'checklists') {
-        const offset = nonNegInt(input.offset, 'offset');
-        assertCardVersion(input.readVersion, readVersion, offset);
-        const limit = boundedInt(input.limit, 'limit', CHECKLIST_DEFAULT_LIMIT, CHECKLIST_MAX_LIMIT);
-        const slice = checklists.slice(offset, offset + limit).map((cl, index) => ({
-            id: checklistKey(cl, offset + index),
-            name: cl.name,
-            itemCount: cl.checkItems?.length ?? 0,
-            completeCount: (cl.checkItems ?? []).filter((it) => it.state === 'complete').length,
-        }));
-        const nextOffset = offset + slice.length < checklists.length ? offset + slice.length : null;
-        return {
-            cardId,
-            section: 'checklists',
-            checklists: slice,
-            offset,
-            limit,
-            total: checklists.length,
-            nextOffset,
-            readVersion,
-        };
-    }
-    // checklist_items
-    const checklistId = (input.checklistId ?? '').trim();
-    if (!checklistId) {
-        throw new Error('trello_card section checklist_items requires checklistId.');
-    }
-    // Resolve by the SAME deterministic key the headers emit, so an absent-id
-    // checklist (addressed as idx:<n>) reaches its items too.
-    const checklist = checklists.find((cl, index) => checklistKey(cl, index) === checklistId);
-    if (!checklist) {
-        throw new Error(`trello_card unknown checklistId '${checklistId}' on this card.`);
-    }
-    const items = checklist.checkItems ?? [];
-    const offset = nonNegInt(input.offset, 'offset');
-    assertCardVersion(input.readVersion, readVersion, offset);
-    const limit = boundedInt(input.limit, 'limit', ITEM_DEFAULT_LIMIT, ITEM_MAX_LIMIT);
-    const slice = items
-        .slice(offset, offset + limit)
-        .map((it) => ({ name: it.name, complete: it.state === 'complete' }));
-    const nextOffset = offset + slice.length < items.length ? offset + slice.length : null;
-    return {
-        cardId,
-        section: 'checklist_items',
-        checklistId,
-        items: slice,
-        offset,
-        limit,
-        total: items.length,
-        nextOffset,
-        readVersion,
-    };
-}
-//# sourceMappingURL=query-tools.js.map