@todoist/sdk 0.0.1 → 18.0.0

package/dist/esm/clients/task-client.js

@@ -0,0 +1,264 @@
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+import { v4 as uuidv4 } from 'uuid';
+import { ENDPOINT_REST_TASKS, ENDPOINT_REST_TASKS_COMPLETED, ENDPOINT_REST_TASKS_COMPLETED_BY_COMPLETION_DATE, ENDPOINT_REST_TASKS_COMPLETED_BY_DUE_DATE, ENDPOINT_REST_TASKS_COMPLETED_SEARCH, ENDPOINT_REST_TASKS_FILTER, ENDPOINT_REST_TASK_CLOSE, ENDPOINT_REST_TASK_MOVE, ENDPOINT_REST_TASK_REOPEN, ENDPOINT_SYNC_QUICK_ADD, } from '../consts/endpoints.js';
+import { isSuccess, request } from '../transport/http-client.js';
+import { performSyncRequest } from '../transport/sync-request.js';
+import { TodoistRequestError } from '../types/index.js';
+import { generatePath, spreadIfDefined } from '../utils/request-helpers.js';
+import { processTaskContent } from '../utils/uncompletable-helpers.js';
+import { IdSchema, validateTask, validateTaskArray } from '../utils/validators.js';
+import { BaseClient } from './base-client.js';
+const MAX_COMMAND_COUNT = 100;
+/**
+ * Internal sub-client handling all task-domain endpoints.
+ *
+ * Instantiated by `TodoistApi`; every public task method on `TodoistApi`
+ * delegates here. See `todoist-api.ts` for the user-facing JSDoc.
+ */
+export class TaskClient extends BaseClient {
+    async getTask(id) {
+        IdSchema.parse(id);
+        const response = await request({
+            httpMethod: 'GET',
+            baseUri: this.syncApiBase,
+            relativePath: generatePath(ENDPOINT_REST_TASKS, id),
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+        });
+        return validateTask(response.data);
+    }
+    async getTasks(args = {}) {
+        const { data: { results, nextCursor }, } = await request({
+            httpMethod: 'GET',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_REST_TASKS,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: Object.assign(Object.assign({}, args), spreadIfDefined(args.ids, (ids) => ({ ids: ids.join(',') }))),
+        });
+        return {
+            results: validateTaskArray(results),
+            nextCursor,
+        };
+    }
+    async getTasksByFilter(args) {
+        const { data: { results, nextCursor }, } = await request({
+            httpMethod: 'GET',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_REST_TASKS_FILTER,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: args,
+        });
+        return {
+            results: validateTaskArray(results),
+            nextCursor,
+        };
+    }
+    async getCompletedTasksByCompletionDate(args) {
+        const { data: { items, nextCursor }, } = await request({
+            httpMethod: 'GET',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_REST_TASKS_COMPLETED_BY_COMPLETION_DATE,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: args,
+        });
+        return {
+            items: validateTaskArray(items),
+            nextCursor,
+        };
+    }
+    async getCompletedTasksByDueDate(args) {
+        const { data: { items, nextCursor }, } = await request({
+            httpMethod: 'GET',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_REST_TASKS_COMPLETED_BY_DUE_DATE,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: args,
+        });
+        return {
+            items: validateTaskArray(items),
+            nextCursor,
+        };
+    }
+    async searchCompletedTasks(args) {
+        const { data: { items, nextCursor }, } = await request({
+            httpMethod: 'GET',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_REST_TASKS_COMPLETED_SEARCH,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: args,
+        });
+        return {
+            items: validateTaskArray(items),
+            nextCursor,
+        };
+    }
+    async getAllCompletedTasks(args = {}) {
+        const { since, until } = args, rest = __rest(args, ["since", "until"]);
+        const { data } = await request({
+            httpMethod: 'GET',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_REST_TASKS_COMPLETED,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: Object.assign(Object.assign(Object.assign({}, rest), (since ? { since: since.toISOString() } : {})), (until ? { until: until.toISOString() } : {})),
+        });
+        return {
+            projects: data.projects,
+            sections: data.sections,
+            items: validateTaskArray(data.items),
+        };
+    }
+    async addTask(args, requestId) {
+        // Process content based on isUncompletable flag
+        const processedArgs = Object.assign(Object.assign({}, args), { content: processTaskContent(args.content, args.isUncompletable) });
+        const response = await request({
+            httpMethod: 'POST',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_REST_TASKS,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: processedArgs,
+            requestId: requestId,
+        });
+        return validateTask(response.data);
+    }
+    async quickAddTask(args) {
+        // Process text based on isUncompletable flag
+        const processedArgs = Object.assign(Object.assign({}, args), { text: processTaskContent(args.text, args.isUncompletable) });
+        const response = await request({
+            httpMethod: 'POST',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_SYNC_QUICK_ADD,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: processedArgs,
+        });
+        return validateTask(response.data);
+    }
+    async updateTask(id, args, requestId) {
+        IdSchema.parse(id);
+        // Translate SDK alias for due-date clearing to Todoist's accepted payload value.
+        const normalizedArgs = args.dueString === null ? Object.assign(Object.assign({}, args), { dueString: 'no date' }) : args;
+        // Process content if both content and isUncompletable are provided
+        const processedArgs = normalizedArgs.content && normalizedArgs.isUncompletable !== undefined
+            ? Object.assign(Object.assign({}, normalizedArgs), { content: processTaskContent(normalizedArgs.content, normalizedArgs.isUncompletable) }) : normalizedArgs;
+        // Remap `order` → `childOrder` so snakeCaseKeys() produces `child_order`
+        const { order } = processedArgs, argsWithoutOrder = __rest(processedArgs, ["order"]);
+        const remappedArgs = order !== undefined ? Object.assign(Object.assign({}, argsWithoutOrder), { childOrder: order }) : argsWithoutOrder;
+        const response = await request({
+            httpMethod: 'POST',
+            baseUri: this.syncApiBase,
+            relativePath: generatePath(ENDPOINT_REST_TASKS, id),
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: remappedArgs,
+            requestId: requestId,
+        });
+        return validateTask(response.data);
+    }
+    async moveTasks(ids, args, requestId) {
+        var _a;
+        if (ids.length > MAX_COMMAND_COUNT) {
+            throw new TodoistRequestError(`Maximum number of items is ${MAX_COMMAND_COUNT}`, 400);
+        }
+        const commands = ids.map((id) => ({
+            type: 'item_move',
+            uuid: uuidv4(),
+            args: Object.assign(Object.assign(Object.assign({ id }, spreadIfDefined(args.projectId, (v) => ({ projectId: v }))), spreadIfDefined(args.sectionId, (v) => ({ sectionId: v }))), spreadIfDefined(args.parentId, (v) => ({ parentId: v }))),
+        }));
+        const syncRequest = {
+            commands,
+            resourceTypes: ['items'],
+        };
+        const syncResponse = await performSyncRequest(this.syncContext, syncRequest, {
+            requestId,
+            hasSyncCommands: true,
+        });
+        if (!((_a = syncResponse.items) === null || _a === void 0 ? void 0 : _a.length)) {
+            throw new TodoistRequestError('Tasks not found', 404);
+        }
+        const syncTasks = syncResponse.items.filter((task) => ids.includes(task.id));
+        if (!syncTasks.length) {
+            throw new TodoistRequestError('Tasks not found', 404);
+        }
+        return validateTaskArray(syncTasks);
+    }
+    async moveTask(id, args, requestId) {
+        IdSchema.parse(id);
+        const response = await request({
+            httpMethod: 'POST',
+            baseUri: this.syncApiBase,
+            relativePath: generatePath(ENDPOINT_REST_TASKS, id, ENDPOINT_REST_TASK_MOVE),
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: Object.assign(Object.assign(Object.assign({}, spreadIfDefined(args.projectId, (v) => ({ project_id: v }))), spreadIfDefined(args.sectionId, (v) => ({ section_id: v }))), spreadIfDefined(args.parentId, (v) => ({ parent_id: v }))),
+            requestId: requestId,
+        });
+        return validateTask(response.data);
+    }
+    async closeTask(id, requestId) {
+        IdSchema.parse(id);
+        const response = await request({
+            httpMethod: 'POST',
+            baseUri: this.syncApiBase,
+            relativePath: generatePath(ENDPOINT_REST_TASKS, id, ENDPOINT_REST_TASK_CLOSE),
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            requestId: requestId,
+        });
+        return isSuccess(response);
+    }
+    async reopenTask(id, requestId) {
+        IdSchema.parse(id);
+        const response = await request({
+            httpMethod: 'POST',
+            baseUri: this.syncApiBase,
+            relativePath: generatePath(ENDPOINT_REST_TASKS, id, ENDPOINT_REST_TASK_REOPEN),
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            requestId: requestId,
+        });
+        return isSuccess(response);
+    }
+    async deleteTask(id, requestId) {
+        IdSchema.parse(id);
+        const response = await request({
+            httpMethod: 'DELETE',
+            baseUri: this.syncApiBase,
+            relativePath: generatePath(ENDPOINT_REST_TASKS, id),
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            requestId: requestId,
+        });
+        return isSuccess(response);
+    }
+}

package/dist/esm/clients/template-client.js

@@ -0,0 +1,89 @@
+import { ENDPOINT_REST_TEMPLATES_CREATE_FROM_FILE, ENDPOINT_REST_TEMPLATES_FILE, ENDPOINT_REST_TEMPLATES_IMPORT_FROM_FILE, ENDPOINT_REST_TEMPLATES_IMPORT_FROM_ID, ENDPOINT_REST_TEMPLATES_URL, } from '../consts/endpoints.js';
+import { request } from '../transport/http-client.js';
+import { uploadMultipartFile } from '../utils/multipart-upload.js';
+import { validateCommentArray, validateProjectArray, validateSectionArray, validateTaskArray, } from '../utils/validators.js';
+import { BaseClient } from './base-client.js';
+/**
+ * Internal sub-client handling all template-domain endpoints.
+ *
+ * Instantiated by `TodoistApi`; every public template method on
+ * `TodoistApi` delegates here. See `todoist-api.ts` for user-facing
+ * JSDoc.
+ */
+export class TemplateClient extends BaseClient {
+    async exportTemplateAsFile(args) {
+        const response = await request({
+            httpMethod: 'GET',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_REST_TEMPLATES_FILE,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: args,
+        });
+        return response.data;
+    }
+    async exportTemplateAsUrl(args) {
+        const { data } = await request({
+            httpMethod: 'GET',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_REST_TEMPLATES_URL,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: args,
+        });
+        return data;
+    }
+    async createProjectFromTemplate(args, requestId) {
+        const { file, fileName, name, workspaceId } = args;
+        const additionalFields = { name };
+        if (workspaceId !== undefined && workspaceId !== null) {
+            additionalFields.workspace_id = workspaceId;
+        }
+        const data = await uploadMultipartFile({
+            baseUrl: this.syncApiBase,
+            authToken: this.authToken,
+            endpoint: ENDPOINT_REST_TEMPLATES_CREATE_FROM_FILE,
+            file,
+            fileName,
+            additionalFields,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            requestId,
+        });
+        return this.validateTemplateResponse(data);
+    }
+    async importTemplateIntoProject(args, requestId) {
+        const { file, fileName, projectId } = args;
+        const data = await uploadMultipartFile({
+            baseUrl: this.syncApiBase,
+            authToken: this.authToken,
+            endpoint: ENDPOINT_REST_TEMPLATES_IMPORT_FROM_FILE,
+            file,
+            fileName,
+            additionalFields: { project_id: projectId },
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            requestId,
+        });
+        return this.validateTemplateResponse(data);
+    }
+    async importTemplateFromId(args, requestId) {
+        const { data } = await request({
+            httpMethod: 'POST',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_REST_TEMPLATES_IMPORT_FROM_ID,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: args,
+            requestId: requestId,
+        });
+        return this.validateTemplateResponse(data);
+    }
+    validateTemplateResponse(data) {
+        var _a, _b, _c, _d;
+        return Object.assign(Object.assign({}, data), { projects: validateProjectArray((_a = data.projects) !== null && _a !== void 0 ? _a : []), sections: validateSectionArray((_b = data.sections) !== null && _b !== void 0 ? _b : []), tasks: validateTaskArray((_c = data.tasks) !== null && _c !== void 0 ? _c : []), comments: validateCommentArray((_d = data.comments) !== null && _d !== void 0 ? _d : []) });
+    }
+}

package/dist/esm/clients/ui-extension-client.js

@@ -0,0 +1,110 @@
+import { ENDPOINT_REST_APPS_UI_EXTENSIONS, ENDPOINT_REST_APPS_UI_EXTENSIONS_INSTALLED, getUiExtensionEndpoint, getUiExtensionIconEndpoint, getUiExtensionsByIntegrationEndpoint, } from '../consts/endpoints.js';
+import { isSuccess, request } from '../transport/http-client.js';
+import { uploadMultipartFile } from '../utils/multipart-upload.js';
+import { IdSchema, validateUiExtension, validateUiExtensionArray } from '../utils/validators.js';
+import { BaseClient } from './base-client.js';
+/**
+ * Internal sub-client handling all UI-extension endpoints for developer
+ * applications. All endpoints require the `dev:app_console` OAuth scope.
+ *
+ * Instantiated by `TodoistApi`; every public UI-extension method on
+ * `TodoistApi` delegates here. See `todoist-api.ts` for user-facing JSDoc.
+ */
+export class UiExtensionClient extends BaseClient {
+    async getUiExtension(uiExtensionId, requestId) {
+        IdSchema.parse(uiExtensionId);
+        const response = await request({
+            httpMethod: 'GET',
+            baseUri: this.apiRootBase,
+            relativePath: getUiExtensionEndpoint(uiExtensionId),
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            requestId: requestId,
+        });
+        return validateUiExtension(response.data);
+    }
+    async getInstalledUiExtensions(requestId) {
+        const response = await request({
+            httpMethod: 'GET',
+            baseUri: this.apiRootBase,
+            relativePath: ENDPOINT_REST_APPS_UI_EXTENSIONS_INSTALLED,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            requestId: requestId,
+        });
+        return validateUiExtensionArray(response.data);
+    }
+    async getUiExtensionsForApp(appId, requestId) {
+        IdSchema.parse(appId);
+        const response = await request({
+            httpMethod: 'GET',
+            baseUri: this.apiRootBase,
+            relativePath: getUiExtensionsByIntegrationEndpoint(appId),
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            requestId: requestId,
+        });
+        return validateUiExtensionArray(response.data);
+    }
+    async addUiExtension(args, requestId) {
+        const response = await request({
+            httpMethod: 'POST',
+            baseUri: this.apiRootBase,
+            relativePath: ENDPOINT_REST_APPS_UI_EXTENSIONS,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: args,
+            requestId: requestId,
+        });
+        return validateUiExtension(response.data);
+    }
+    async updateUiExtension(uiExtensionId, args, requestId) {
+        IdSchema.parse(uiExtensionId);
+        const response = await request({
+            httpMethod: 'PATCH',
+            baseUri: this.apiRootBase,
+            relativePath: getUiExtensionEndpoint(uiExtensionId),
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: args,
+            requestId: requestId,
+        });
+        return validateUiExtension(response.data);
+    }
+    async deleteUiExtension(uiExtensionId, requestId) {
+        IdSchema.parse(uiExtensionId);
+        const response = await request({
+            httpMethod: 'DELETE',
+            baseUri: this.apiRootBase,
+            relativePath: getUiExtensionEndpoint(uiExtensionId),
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            requestId: requestId,
+        });
+        return isSuccess(response);
+    }
+    async uploadUiExtensionIcon(args, requestId) {
+        var _a;
+        if (Buffer.isBuffer(args.file) && args.file.length === 0) {
+            throw new Error('Cannot upload empty image file');
+        }
+        const data = await uploadMultipartFile({
+            baseUrl: this.apiRootBase,
+            authToken: this.authToken,
+            endpoint: getUiExtensionIconEndpoint(args.uiExtensionId),
+            file: args.file,
+            fileName: args.fileName,
+            additionalFields: { file_name: (_a = args.fileName) !== null && _a !== void 0 ? _a : '' },
+            requestId: requestId,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+        });
+        return validateUiExtension(data);
+    }
+}

package/dist/esm/clients/upload-client.js

@@ -0,0 +1,153 @@
+import { ENDPOINT_REST_UPLOADS } from '../consts/endpoints.js';
+import { isSuccess, request } from '../transport/http-client.js';
+import { wrapAsFileResponse } from '../utils/file-response.js';
+import { uploadMultipartFile } from '../utils/multipart-upload.js';
+import { validateAttachment } from '../utils/validators.js';
+import { BaseClient } from './base-client.js';
+/**
+ * First-party origin that serves attachment downloads behind Bearer auth.
+ * It redirects to the CDN; on the cross-origin hop the runtime drops the
+ * Authorization header, so the token never reaches the CDN.
+ */
+const AUTHENTICATED_ATTACHMENT_HOST = 'files.todoist.com';
+/**
+ * CDN origins that serve attachments via pre-signed URLs. These are
+ * third-party infrastructure and must never receive the auth token.
+ */
+const CDN_ATTACHMENT_HOSTS = new Set(['todoist.b-cdn.net', 'd1ysz50cxb9zwl.cloudfront.net']);
+const MAX_ATTACHMENT_REDIRECTS = 5;
+/**
+ * Builds the request headers for an attachment fetch, attaching the Bearer
+ * token only when the URL is on the first-party authenticated host.
+ */
+function buildAttachmentAuthHeaders(url, authToken) {
+    return new URL(url).hostname === AUTHENTICATED_ATTACHMENT_HOST
+        ? { Authorization: `Bearer ${authToken}` }
+        : {};
+}
+/**
+ * Fetches an attachment through a caller-supplied `customFetch` while
+ * guaranteeing the auth token is never sent across origins.
+ *
+ * A `customFetch` is an arbitrary implementation that may not honour the Fetch
+ * standard's rule of stripping `Authorization` on cross-origin redirects (older
+ * `node-fetch`, for example, does not). Because `files.todoist.com` redirects
+ * downloads to the CDN, a naive implementation could forward the token there.
+ * We therefore drive redirects with `redirect: 'manual'` and follow them
+ * ourselves, dropping the auth header whenever the origin changes.
+ *
+ * Implementations that hide the redirect behind an opaque response (status `0`,
+ * e.g. undici and browsers) can't be followed manually; for those we re-issue
+ * with normal redirect following and rely on the Fetch standard's cross-origin
+ * auth stripping, which those runtimes implement.
+ */
+async function customFetchFollowingRedirects(customFetch, startUrl, authToken) {
+    let currentUrl = startUrl;
+    let headers = buildAttachmentAuthHeaders(currentUrl, authToken);
+    for (let redirects = 0; redirects < MAX_ATTACHMENT_REDIRECTS; redirects++) {
+        const response = await customFetch(currentUrl, {
+            method: 'GET',
+            headers,
+            redirect: 'manual',
+        });
+        const location = response.headers['location'];
+        const isReadableRedirect = response.status >= 300 && response.status < 400 && Boolean(location);
+        if (!isReadableRedirect) {
+            // Opaque redirect (the impl hid the Location, e.g. undici): re-issue
+            // with normal following and trust the runtime to strip auth cross-origin.
+            if (response.status === 0) {
+                return customFetch(currentUrl, { method: 'GET', headers });
+            }
+            return response;
+        }
+        const nextUrl = new URL(location, currentUrl);
+        if (nextUrl.origin !== new URL(currentUrl).origin) {
+            headers = {};
+        }
+        currentUrl = nextUrl.toString();
+    }
+    throw new Error('Too many redirects while fetching attachment');
+}
+/**
+ * Internal sub-client handling upload + attachment endpoints
+ * (file upload, upload delete, attachment view).
+ *
+ * Instantiated by `TodoistApi`; every public upload method on
+ * `TodoistApi` delegates here. See `todoist-api.ts` for user-facing
+ * JSDoc.
+ */
+export class UploadClient extends BaseClient {
+    async uploadFile(args, requestId) {
+        const additionalFields = {};
+        if (args.projectId) {
+            additionalFields.project_id = args.projectId;
+        }
+        const data = await uploadMultipartFile({
+            baseUrl: this.syncApiBase,
+            authToken: this.authToken,
+            endpoint: ENDPOINT_REST_UPLOADS,
+            file: args.file,
+            fileName: args.fileName,
+            additionalFields: additionalFields,
+            requestId: requestId,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+        });
+        return validateAttachment(data);
+    }
+    async deleteUpload(args, requestId) {
+        const response = await request({
+            httpMethod: 'DELETE',
+            baseUri: this.syncApiBase,
+            relativePath: ENDPOINT_REST_UPLOADS,
+            apiToken: this.authToken,
+            customFetch: this.customFetch,
+            customHeaders: this.customHeaders,
+            payload: args,
+            requestId: requestId,
+        });
+        return isSuccess(response);
+    }
+    async viewAttachment(commentOrUrl) {
+        var _a;
+        let fileUrl;
+        if (typeof commentOrUrl === 'string') {
+            fileUrl = commentOrUrl;
+        }
+        else {
+            if (!((_a = commentOrUrl.fileAttachment) === null || _a === void 0 ? void 0 : _a.fileUrl)) {
+                throw new Error('Comment does not have a file attachment');
+            }
+            fileUrl = commentOrUrl.fileAttachment.fileUrl;
+        }
+        // Only allow known attachment origins, and only attach the auth token to the
+        // first-party authenticated host. This prevents the token leaking to other
+        // todoist.com hosts (e.g. api.todoist.com) or to third-party CDN infrastructure.
+        const urlHostname = new URL(fileUrl).hostname;
+        const isAuthenticatedHost = urlHostname === AUTHENTICATED_ATTACHMENT_HOST;
+        if (!isAuthenticatedHost && !CDN_ATTACHMENT_HOSTS.has(urlHostname)) {
+            throw new Error('Attachment URLs must be on a known Todoist attachment host');
+        }
+        if (this.customFetch) {
+            // customFetch may not strip auth on cross-origin redirects, so we
+            // follow the files.todoist.com -> CDN hop ourselves to avoid leaking
+            // the token. See customFetchFollowingRedirects for details.
+            const response = await customFetchFollowingRedirects(this.customFetch, fileUrl, this.authToken);
+            if (!response.ok) {
+                throw new Error(`Failed to fetch attachment: ${response.status} ${response.statusText}`);
+            }
+            return wrapAsFileResponse(response, 'viewAttachment');
+        }
+        // Built-in fetch (undici) strips Authorization on cross-origin redirects
+        // per the Fetch standard, so the files.todoist.com -> CDN hop is safe here.
+        const fetchOptions = {
+            method: 'GET',
+            headers: isAuthenticatedHost ? { Authorization: `Bearer ${this.authToken}` } : {},
+        };
+        const response = await fetch(fileUrl, fetchOptions);
+        if (!response.ok) {
+            throw new Error(`Failed to fetch attachment: ${response.status} ${response.statusText}`);
+        }
+        return wrapAsFileResponse(response, 'viewAttachment');
+    }
+}

package/dist/esm/clients/view-options-client.js

@@ -0,0 +1,21 @@
+import { performSyncRequest } from '../transport/sync-request.js';
+import { createCommand } from '../utils/sync-helpers.js';
+import { isActiveViewOption } from '../utils/view-options.js';
+import { BaseClient } from './base-client.js';
+/** Internal sub-client for saved view-option reads and writes. */
+export class ViewOptionsClient extends BaseClient {
+    async getViewOptions() {
+        var _a;
+        const response = await performSyncRequest(this.syncContext, {
+            resourceTypes: ['view_options'],
+            syncToken: '*',
+        });
+        return ((_a = response.viewOptions) !== null && _a !== void 0 ? _a : []).filter(isActiveViewOption);
+    }
+    async setViewOptions(args, requestId) {
+        await performSyncRequest(this.syncContext, { commands: [createCommand('view_options_set', args)] }, { requestId, hasSyncCommands: true });
+    }
+    async deleteViewOptions(args, requestId) {
+        await performSyncRequest(this.syncContext, { commands: [createCommand('view_options_delete', args)] }, { requestId, hasSyncCommands: true });
+    }
+}