@todoist/sdk 0.0.1 → 18.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2020 Doist
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,45 +1,309 @@
-# @todoist/sdk
+# Todoist SDK
 
-## ⚠️ IMPORTANT NOTICE ⚠️
+The official TypeScript SDK for the Todoist REST API.
 
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
+## Installation
 
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
+Requires Node 20.18.1+.
 
-## Purpose
+```
+npm install @todoist/sdk
+```
 
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@todoist/sdk`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
+Previously published as `@doist/todoist-sdk`.
 
-## What is OIDC Trusted Publishing?
+### Usage
 
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
+An example of initializing the API client and fetching a user's tasks:
 
-## Setup Instructions
+```typescript
+import { TodoistApi } from '@todoist/sdk'
 
-To properly configure OIDC trusted publishing for this package:
+const api = new TodoistApi('YOURTOKEN')
 
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
+api.getTasks()
+    .then((tasks) => console.log(tasks))
+    .catch((error) => console.log(error))
+```
 
-## DO NOT USE THIS PACKAGE
+### Documentation
 
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
+For more detailed reference documentation, have a look at the [Todoist API v1 Documentation](https://todoist.com/api/v1/docs).
 
-## More Information
+### Migration Guide
 
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
+If you're migrating from an older version of the Todoist API (v9), please refer to the [official migration guide](https://todoist.com/api/v1/docs#tag/Migrating-from-v9) for detailed information about the changes and breaking updates.
 
----
+Key changes in v1 include:
 
-**Maintained for OIDC setup purposes only**
+- Updated endpoint structure
+- New pagination system
+- Unified error response format
+- Object renames (e.g., items → tasks, notes → comments)
+- URL renames and endpoint signature changes
+
+## Custom Headers
+
+Pass `headers` to send extra headers with every API request, for example to tell the backend which client is calling:
+
+```typescript
+const api = new TodoistApi('YOURTOKEN', {
+    headers: { 'Doist-Platform': 'cli' },
+})
+```
+
+For values that change between requests, pass a function instead. The SDK calls it once per request, and a retried request reuses its result:
+
+```typescript
+import { randomUUID } from 'node:crypto'
+
+const api = new TodoistApi('YOURTOKEN', {
+    headers: () => ({ 'Doist-Platform': 'cli', 'Request-Id': randomUUID() }),
+})
+```
+
+These headers cannot replace `Authorization`, `X-Request-Id` or the multipart `Content-Type`; the SDK's own values always win. They are not sent on attachment downloads (`viewAttachment`), which redirect to a third-party CDN. The OAuth helpers (`getAuthToken`, `refreshAuthToken`, `revokeToken`, …) take their own options and do not send them.
+
+## Custom HTTP Clients
+
+The Todoist API client supports custom HTTP implementations to enable usage in environments with specific networking requirements, such as:
+
+- **Obsidian plugins** - Desktop app with strict CORS policies
+- **Browser extensions** - Custom HTTP APIs with different security models
+- **Electron apps** - Requests routed through IPC layer
+- **React Native** - Different networking stack
+- **Enterprise environments** - Proxy configuration, custom headers, or certificate handling
+
+### Basic Usage
+
+```typescript
+import { TodoistApi } from '@todoist/sdk'
+
+// Using the new options-based constructor
+const api = new TodoistApi('YOURTOKEN', {
+    baseUrl: 'https://custom-api.example.com', // optional
+    customFetch: myCustomFetch, // your custom fetch implementation
+})
+
+// Legacy constructor (deprecated but supported)
+const apiLegacy = new TodoistApi('YOURTOKEN', 'https://custom-api.example.com')
+```
+
+### Custom Fetch Interface
+
+Your custom fetch function must implement this interface:
+
+```typescript
+type CustomFetch = (
+    url: string,
+    options?: RequestInit & { timeout?: number },
+) => Promise<CustomFetchResponse>
+
+type CustomFetchResponse = {
+    ok: boolean
+    status: number
+    statusText: string
+    headers: Record<string, string>
+    text(): Promise<string>
+    json(): Promise<unknown>
+}
+```
+
+### OAuth with Custom Fetch
+
+OAuth authentication functions (`getAuthToken`, `revokeAuthToken`, `revokeToken`) support custom fetch through an options object:
+
+```typescript
+// New options-based usage
+const { accessToken } = await getAuthToken(args, {
+    baseUrl: 'https://custom-auth.example.com',
+    customFetch: myCustomFetch,
+})
+
+await revokeToken(args, {
+    customFetch: myCustomFetch,
+})
+
+// Legacy usage (deprecated)
+const { accessToken } = await getAuthToken(args, baseUrl)
+```
+
+When the authorization server issues a `refreshToken`, use `refreshAuthToken`
+to obtain a new access token once the current one expires, without sending the
+user back through the authorization flow:
+
+```typescript
+const refreshed = await refreshAuthToken({
+    clientId: 'your-client-id',
+    clientSecret: 'your-client-secret',
+    refreshToken: storedRefreshToken,
+})
+
+// The server may rotate the refresh token — persist refreshed.refreshToken
+// when present, otherwise keep using the previous one.
+```
+
+> **Note:** Refresh tokens are only issued to OAuth apps that have them enabled
+> (the default for new apps). Apps without them receive a long-lived access
+> token, so `getAuthToken` returns no `refreshToken` and there is nothing to
+> refresh. For public clients (`tokenEndpointAuthMethod: 'none'`), omit
+> `clientSecret` when calling `refreshAuthToken`.
+
+### Keeping Proxy Support and Response Decompression
+
+On Node, the SDK's default transport reads the proxy environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`) and decodes compressed response bodies. Supplying a `customFetch` replaces that transport, so a custom implementation that still wants both can borrow it with `getDefaultTransport`:
+
+```typescript
+import { type CustomFetch, getDefaultTransport, TodoistApi } from '@todoist/sdk'
+
+const customFetch: CustomFetch = async (url, options) => {
+    const transport = await getDefaultTransport()
+    // undici's `fetch` and the global one are the same call at runtime but
+    // carry different types, so settle on one signature.
+    const fetchImpl = (transport?.fetch ?? fetch) as typeof fetch
+
+    const response = await fetchImpl(url, {
+        ...options,
+        headers: {
+            ...(options?.headers as Record<string, string> | undefined),
+            'x-my-header': 'value',
+        },
+        // `dispatcher` is a Node fetch option that the DOM types don't declare.
+        dispatcher: transport?.dispatcher,
+    } as RequestInit)
+
+    // `CustomFetchResponse` wants plain-object headers, not a `Headers`.
+    const headers: Record<string, string> = {}
+    response.headers.forEach((value, key) => {
+        headers[key] = value
+    })
+
+    return {
+        ok: response.ok,
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+        text: () => response.text(),
+        json: () => response.json(),
+        arrayBuffer: () => response.arrayBuffer(),
+    }
+}
+
+const api = new TodoistApi('YOURTOKEN', { customFetch })
+```
+
+`getDefaultTransport` returns the dispatcher and the `fetch` it must be used with as a single value, and both halves have to be used together. The dispatcher decompresses the response body itself, so pairing it with a `fetch` from a different undici build — including the runtime's global `fetch` on Node 26 — decodes the body twice and the request fails mid-stream with `terminated`. A `fetch` of `undefined` means the global `fetch` is the correct partner; the whole value is `undefined` outside Node, where no dispatcher applies.
+
+### Important Notes
+
+- All existing transforms (snake_case ↔ camelCase) work automatically with custom fetch
+- Retry logic and error handling are preserved
+- File uploads work with custom fetch implementations
+- File upload bodies are a `Blob`, or a `ReadableStream` when uploading from a stream — a custom fetch must pass them through unchanged
+- Timeout parameter is optional and up to your custom implementation
+
+## Filter Queries
+
+Use `escapeFilterToken` for user-provided search text, handling validation and trimming in your code. Pass complete filter queries directly to `getTasksByFilter`.
+
+```typescript
+await api.getTasksByFilter({
+    query: `search: ${escapeFilterToken(searchText)}`,
+})
+```
+
+## Development and Testing
+
+Instead of having an example app in the repository to assist development and testing, we have included [ts-node](https://github.com/TypeStrong/ts-node) as a dev dependency. This allows us to have a scratch file locally that can import and utilize the API while developing or reviewing pull requests without having to manage a separate app project.
+
+- `npm install`
+- Add a file named `scratch.ts` in the `src` folder.
+- Configure your IDE to run the scratch file with `ts-node` (instructions for [VSCode](https://medium.com/@dupski/debug-typescript-in-vs-code-without-compiling-using-ts-node-9d1f4f9a94a), [WebStorm](https://www.jetbrains.com/help/webstorm/running-and-debugging-typescript.html#ws_ts_run_debug_server_side_ts_node)), or you can optionally run ts-node in a terminal using instructions [here](https://github.com/TypeStrong/ts-node) (`npx ts-node ./src/scratch.ts` should be enough).
+- Import and call the relevant modules and run the scratch file.
+
+Example scratch.ts file:
+
+```
+/* eslint-disable no-console */
+import { TodoistApi } from './todoist-api'
+
+const token = 'YOURTOKEN'
+const api = new TodoistApi(token)
+
+api.getProjects()
+    .then((projects) => {
+        console.log(projects)
+    })
+    .catch((error) => console.error(error))
+```
+
+### Local API Requests With .env
+
+For live API verification, you can run raw requests with a local token:
+
+1. Copy `.env.example` to `.env`.
+2. Set `TODOIST_API_TOKEN` in `.env`.
+3. Run requests with `npm run api:request -- ...`.
+4. Optional: set `TODOIST_API_BASE_URL` in `.env` (defaults to `https://api.todoist.com`).
+
+Examples:
+
+```bash
+npm run api:request -- --path /api/v1/tasks
+npm run api:request -- --method POST --path /api/v1/tasks --body '{"content":"API smoke test"}'
+npm run api:request -- --method POST --path /api/v1/tasks/123 --body '{"due_string":"no date"}'
+npm run api:request -- --path /api/v1/tasks --query '{"project_id":"123","limit":10}'
+```
+
+To see all options:
+
+```bash
+npm run api:request -- --help
+```
+
+## Releases
+
+This project uses [Release Please](https://github.com/googleapis/release-please) to automate releases. Releases are created automatically based on [Conventional Commits](https://www.conventionalcommits.org/).
+
+### For Contributors
+
+When making changes, use conventional commit messages:
+
+- `feat:` - New features (triggers a minor version bump)
+- `fix:` - Bug fixes (triggers a patch version bump)
+- `feat!:` or `BREAKING CHANGE:` - Breaking changes (triggers a major version bump)
+- `chore:`, `docs:`, `refactor:`, `perf:` - Other changes (included in changelog)
+
+Example:
+
+```
+feat: add support for recurring tasks
+fix: resolve issue with date parsing
+feat!: remove deprecated getTask method
+```
+
+### For Maintainers
+
+The release process is fully automated:
+
+1. **Automatic PR Creation**: When commits are merged to `main`, Release Please automatically creates or updates a release PR with:
+    - Updated version in `package.json`
+    - Updated `CHANGELOG.md`
+    - Aggregated changes since the last release
+
+2. **Review and Merge**: Review the release PR to ensure the version bump and changelog are correct, then merge it.
+
+3. **Automatic Release**: Upon merging the release PR:
+    - A GitHub release is automatically created with the new version tag
+    - The `publish.yml` workflow is triggered by the tag
+    - The package is automatically published to NPM
+
+Users of the API client can then update to the new version in their `package.json`.
+
+### Feedback
+
+Any feedback, such as bugs, questions, comments, etc. can be reported as _Issues_ in this repository, and will be handled by us in Todoist.
+
+### Contributions
+
+We would also love contributions in the form of _Pull requests_ in this repository.

package/dist/esm/authentication.js

@@ -0,0 +1,307 @@
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { v4 as uuid } from 'uuid';
+import { getAuthBaseUri, getSyncBaseUri, ENDPOINT_AUTHORIZATION, ENDPOINT_GET_TOKEN, ENDPOINT_REVOKE, ENDPOINT_REGISTER, ENDPOINT_REST_ACCESS_TOKENS_MIGRATE, } from './consts/endpoints.js';
+import { request, isSuccess } from './transport/http-client.js';
+import { TodoistRequestError } from './types/index.js';
+/** Available OAuth2 permission scopes. */
+export const PERMISSIONS = [
+    'task:add',
+    'data:read',
+    'data:read_write',
+    'data:delete',
+    'project:delete',
+    'backups:read',
+    'billing:read',
+    'billing:read_write',
+    'dev:app_console',
+];
+/** Supported token endpoint authentication methods for dynamic client registration. */
+export const TOKEN_ENDPOINT_AUTH_METHODS = [
+    'client_secret_post',
+    'client_secret_basic',
+    'none',
+];
+/**
+ * Creates a Basic Authentication header value from client credentials.
+ * @param clientId - The OAuth client ID
+ * @param clientSecret - The OAuth client secret
+ * @returns The Basic Auth header value (without the 'Basic ' prefix)
+ */
+function createBasicAuthHeader(clientId, clientSecret) {
+    const credentials = `${clientId}:${clientSecret}`;
+    return Buffer.from(credentials).toString('base64');
+}
+/**
+ * Generates a random state parameter for OAuth2 authorization.
+ * The state parameter helps prevent CSRF attacks.
+ *
+ * @example
+ * ```typescript
+ * const state = getAuthStateParameter()
+ * // Store state in session
+ * const authUrl = getAuthorizationUrl(clientId, ['data:read'], state)
+ * ```
+ *
+ * @returns A random UUID v4 string
+ */
+export function getAuthStateParameter() {
+    return uuid();
+}
+/**
+ * Generates the authorization URL for the OAuth2 flow.
+ *
+ * The `clientId` can be either a traditional client ID string (e.g. from
+ * {@link registerClient}) or an HTTPS URL pointing to a client metadata document,
+ * as defined in {@link https://drafts.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/ RFC draft-ietf-oauth-client-id-metadata-document}.
+ *
+ * @example
+ * ```typescript
+ * const url = getAuthorizationUrl({
+ *   clientId: 'your-client-id',
+ *   permissions: ['data:read', 'task:add'],
+ *   state,
+ * })
+ * // Redirect user to url
+ * ```
+ *
+ * @returns The full authorization URL to redirect users to
+ * @see https://developer.todoist.com/api/v1/#tag/Authorization/OAuth
+ */
+export function getAuthorizationUrl({ clientId, permissions, state, baseUrl, }) {
+    if (!(permissions === null || permissions === void 0 ? void 0 : permissions.length)) {
+        throw new Error('At least one scope value should be passed for permissions.');
+    }
+    const scope = permissions.join(',');
+    return `${getAuthBaseUri(baseUrl)}${ENDPOINT_AUTHORIZATION}?client_id=${encodeURIComponent(clientId)}&scope=${scope}&state=${state}`;
+}
+/**
+ * Exchanges an authorization code for an access token.
+ *
+ * @example
+ * ```typescript
+ * const { accessToken } = await getAuthToken({
+ *   clientId: 'your-client-id',
+ *   clientSecret: 'your-client-secret',
+ *   code: authCode
+ * })
+ * ```
+ *
+ * @returns The access token response
+ * @throws {@link TodoistRequestError} If the token exchange fails
+ */
+/**
+ * Posts a payload to the OAuth token endpoint and returns the token response,
+ * mapping any failure to a {@link TodoistRequestError} with `errorMessage`.
+ * Shared by {@link getAuthToken} and {@link refreshAuthToken}.
+ */
+async function requestAuthToken(payload, errorMessage, options) {
+    var _a;
+    try {
+        const response = await request({
+            httpMethod: 'POST',
+            baseUri: getAuthBaseUri(options === null || options === void 0 ? void 0 : options.baseUrl),
+            relativePath: ENDPOINT_GET_TOKEN,
+            apiToken: undefined,
+            payload,
+            customFetch: options === null || options === void 0 ? void 0 : options.customFetch,
+        });
+        if (response.status !== 200 || !((_a = response.data) === null || _a === void 0 ? void 0 : _a.accessToken)) {
+            throw new TodoistRequestError(errorMessage, response.status, response.data);
+        }
+        return response.data;
+    }
+    catch (error) {
+        // Re-throw with custom message for authentication failures
+        const err = error;
+        throw new TodoistRequestError(errorMessage, err.httpStatusCode, err.responseData);
+    }
+}
+export async function getAuthToken(args, options) {
+    if (typeof options === 'string') {
+        throw new TypeError('Passing baseUrl as a string is no longer supported. Use an options object instead: getAuthToken(args, { baseUrl })');
+    }
+    return requestAuthToken(Object.assign({}, args), 'Authentication token exchange failed.', options);
+}
+/**
+ * Exchanges a refresh token for a new access token using the OAuth2
+ * `refresh_token` grant.
+ *
+ * Only relevant for OAuth apps that have refresh tokens enabled (the default for
+ * new apps). Apps without them never receive a `refreshToken` from
+ * {@link getAuthToken}, so they have nothing to pass here — their access tokens
+ * are long-lived instead.
+ *
+ * Omit `clientSecret` for public clients registered with
+ * `tokenEndpointAuthMethod: 'none'`.
+ *
+ * @example
+ * ```typescript
+ * const { accessToken, refreshToken } = await refreshAuthToken({
+ *   clientId: 'your-client-id',
+ *   clientSecret: 'your-client-secret',
+ *   refreshToken: storedRefreshToken,
+ * })
+ * ```
+ *
+ * @returns The refreshed token. The server rotates the refresh token, so the
+ * response carries a new `refreshToken` — persist it in place of the old one.
+ * @throws {@link TodoistRequestError} If the refresh fails
+ */
+export async function refreshAuthToken(args, options) {
+    const payload = {
+        clientId: args.clientId,
+        refreshToken: args.refreshToken,
+        grantType: 'refresh_token',
+    };
+    if (args.clientSecret !== undefined) {
+        payload.clientSecret = args.clientSecret;
+    }
+    return requestAuthToken(payload, 'Authentication token refresh failed.', options);
+}
+/**
+ * Revokes a token using the RFC 7009 OAuth 2.0 Token Revocation standard.
+ *
+ * This function uses HTTP Basic Authentication with client credentials and follows
+ * the RFC 7009 specification for token revocation.
+ *
+ * @example
+ * ```typescript
+ * await revokeToken({
+ *   clientId: 'your-client-id',
+ *   clientSecret: 'your-client-secret',
+ *   token: 'access-token-to-revoke'
+ * })
+ * ```
+ *
+ * @returns True if revocation was successful
+ * @see https://datatracker.ietf.org/doc/html/rfc7009
+ * @see https://developer.todoist.com/api/v1/#tag/Authorization
+ */
+export async function revokeToken(args, options) {
+    if (typeof options === 'string') {
+        throw new TypeError('Passing baseUrl as a string is no longer supported. Use an options object instead: revokeToken(args, { baseUrl })');
+    }
+    const baseUrl = options === null || options === void 0 ? void 0 : options.baseUrl;
+    const customFetch = options === null || options === void 0 ? void 0 : options.customFetch;
+    const { clientId, clientSecret, token } = args;
+    // Create Basic Auth header as per RFC 7009
+    const basicAuth = createBasicAuthHeader(clientId, clientSecret);
+    const customHeaders = {
+        Authorization: `Basic ${basicAuth}`,
+    };
+    // Request body only contains the token and optional token_type_hint
+    const requestBody = {
+        token,
+        token_type_hint: 'access_token',
+    };
+    const response = await request({
+        httpMethod: 'POST',
+        baseUri: getSyncBaseUri(baseUrl),
+        relativePath: ENDPOINT_REVOKE,
+        apiToken: undefined,
+        payload: requestBody,
+        requestId: undefined,
+        hasSyncCommands: false,
+        customHeaders: customHeaders,
+        customFetch,
+    });
+    return isSuccess(response);
+}
+/**
+ * Migrates a personal API token to an OAuth access token.
+ *
+ * This allows applications to transition users from personal API tokens
+ * to proper OAuth tokens without requiring the user to go through the
+ * full OAuth authorization flow.
+ *
+ * @example
+ * ```typescript
+ * const { accessToken } = await migratePersonalToken({
+ *   clientId: 'your-client-id',
+ *   clientSecret: 'your-client-secret',
+ *   personalToken: 'user-personal-token',
+ *   scope: 'data:read_write,data:delete'
+ * })
+ * ```
+ *
+ * @returns The new OAuth token response
+ * @throws {@link TodoistRequestError} If the migration fails
+ */
+export async function migratePersonalToken(args, options) {
+    var _a;
+    const baseUrl = options === null || options === void 0 ? void 0 : options.baseUrl;
+    const customFetch = options === null || options === void 0 ? void 0 : options.customFetch;
+    try {
+        const response = await request({
+            httpMethod: 'POST',
+            baseUri: getSyncBaseUri(baseUrl),
+            relativePath: ENDPOINT_REST_ACCESS_TOKENS_MIGRATE,
+            apiToken: undefined,
+            payload: Object.assign(Object.assign({}, args), { scope: args.scope.join(',') }),
+            customFetch,
+        });
+        if (response.status !== 200 || !((_a = response.data) === null || _a === void 0 ? void 0 : _a.accessToken)) {
+            throw new TodoistRequestError('Personal token migration failed.', response.status, response.data);
+        }
+        return response.data;
+    }
+    catch (error) {
+        const err = error;
+        throw new TodoistRequestError('Personal token migration failed.', err.httpStatusCode, err.responseData);
+    }
+}
+/**
+ * Registers a new OAuth client via Dynamic Client Registration (RFC 7591).
+ *
+ * @example
+ * ```typescript
+ * const client = await registerClient({
+ *   redirectUris: ['https://example.com/callback'],
+ *   clientName: 'My App',
+ *   scope: ['data:read_write', 'task:add'],
+ * })
+ * // Use client.clientId and client.clientSecret for OAuth flows
+ * ```
+ *
+ * @returns The registered client details
+ * @throws {@link TodoistRequestError} If the registration fails
+ * @see {@link https://datatracker.ietf.org/doc/html/rfc7591 RFC 7591}
+ */
+export async function registerClient(args, options) {
+    var _a, _b;
+    const baseUrl = options === null || options === void 0 ? void 0 : options.baseUrl;
+    const customFetch = options === null || options === void 0 ? void 0 : options.customFetch;
+    try {
+        const response = await request({
+            httpMethod: 'POST',
+            baseUri: getAuthBaseUri(baseUrl),
+            relativePath: ENDPOINT_REGISTER,
+            apiToken: undefined,
+            payload: Object.assign(Object.assign({}, args), { scope: (_a = args.scope) === null || _a === void 0 ? void 0 : _a.join(' ') }),
+            customFetch,
+        });
+        if (!isSuccess(response) || !((_b = response.data) === null || _b === void 0 ? void 0 : _b.clientId)) {
+            throw new TodoistRequestError('Dynamic client registration failed.', response.status, response.data);
+        }
+        const _c = response.data, { clientIdIssuedAt, clientSecretExpiresAt, scope } = _c, rest = __rest(_c, ["clientIdIssuedAt", "clientSecretExpiresAt", "scope"]);
+        return Object.assign(Object.assign({}, rest), { scope: scope ? scope.split(' ') : undefined, clientIdIssuedAt: clientIdIssuedAt !== undefined ? new Date(clientIdIssuedAt * 1000) : undefined, clientSecretExpiresAt: clientSecretExpiresAt === undefined
+                ? undefined
+                : clientSecretExpiresAt === 0
+                    ? null
+                    : new Date(clientSecretExpiresAt * 1000) });
+    }
+    catch (error) {
+        const err = error;
+        throw new TodoistRequestError('Dynamic client registration failed.', err.httpStatusCode, err.responseData);
+    }
+}