@xurenxiang1219/pingcode-mcp 0.3.1

package/dist/transports/bearer-auth.js

@@ -0,0 +1,79 @@
+import { InsufficientScopeError, InvalidTokenError, OAuthError, ServerError, } from "@modelcontextprotocol/sdk/server/auth/errors.js";
+/**
+ * SDK 的預設 Bearer middleware 會把中文 OAuth 錯誤訊息直接放進 Header，
+ * Node.js 會因此拒絕非 Latin-1 字元。這裡保留中文 JSON 錯誤，Header 使用固定 ASCII 描述。
+ */
+export function requireSafeBearerAuth({ verifier, requiredScopes = [], resourceMetadataUrl, }) {
+    return async (request, response, next) => {
+        try {
+            const authorization = request.headers.authorization;
+            const match = authorization?.match(/^Bearer\s+(\S+)$/i);
+            const token = match?.[1];
+            if (!token) {
+                throw new InvalidTokenError("缺少或無效的 Authorization Header");
+            }
+            const authInfo = await verifier.verifyAccessToken(token);
+            if (requiredScopes.length > 0) {
+                const hasAllScopes = requiredScopes.every((scope) => authInfo.scopes.includes(scope));
+                if (!hasAllScopes) {
+                    throw new InsufficientScopeError("目前 Token 的權限範圍不足");
+                }
+            }
+            if (typeof authInfo.expiresAt !== "number" || Number.isNaN(authInfo.expiresAt)) {
+                throw new InvalidTokenError("Token 缺少有效的到期時間");
+            }
+            if (authInfo.expiresAt < Date.now() / 1000) {
+                throw new InvalidTokenError("Token 已過期");
+            }
+            request.auth = authInfo;
+            next();
+        }
+        catch (error) {
+            if (error instanceof InvalidTokenError) {
+                response.set("WWW-Authenticate", buildWwwAuthenticate(error.errorCode, requiredScopes, resourceMetadataUrl));
+                response.status(401).json(error.toResponseObject());
+                return;
+            }
+            if (error instanceof InsufficientScopeError) {
+                response.set("WWW-Authenticate", buildWwwAuthenticate(error.errorCode, requiredScopes, resourceMetadataUrl));
+                response.status(403).json(error.toResponseObject());
+                return;
+            }
+            if (error instanceof ServerError) {
+                response.status(500).json(error.toResponseObject());
+                return;
+            }
+            if (error instanceof OAuthError) {
+                response.status(400).json(error.toResponseObject());
+                return;
+            }
+            response.status(500).json(new ServerError("伺服器內部錯誤").toResponseObject());
+        }
+    };
+}
+function buildWwwAuthenticate(errorCode, requiredScopes, resourceMetadataUrl) {
+    const parts = [
+        `Bearer error="${quoteHeaderValue(errorCode)}"`,
+        `error_description="${quoteHeaderValue(headerDescription(errorCode))}"`,
+    ];
+    if (requiredScopes.length > 0) {
+        parts.push(`scope="${quoteHeaderValue(requiredScopes.join(" "))}"`);
+    }
+    if (resourceMetadataUrl) {
+        parts.push(`resource_metadata="${quoteHeaderValue(resourceMetadataUrl)}"`);
+    }
+    return parts.join(", ");
+}
+function headerDescription(errorCode) {
+    if (errorCode === "insufficient_scope") {
+        return "The request requires higher privileges";
+    }
+    return "The access token is invalid or expired";
+}
+function quoteHeaderValue(value) {
+    return value
+        .replace(/[\\"]/g, "\\$&")
+        .replace(/[\x00-\x1f\x7f]/g, "?")
+        .replace(/[^\x20-\x7e]/g, "?");
+}
+//# sourceMappingURL=bearer-auth.js.map

package/dist/transports/bearer-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-auth.js","sourceRoot":"","sources":["../../src/transports/bearer-auth.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,UAAU,EACV,WAAW,GACZ,MAAM,iDAAiD,CAAC;AAgBzD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,EACpC,QAAQ,EACR,cAAc,GAAG,EAAE,EACnB,mBAAmB,GACG;IACtB,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;YACpD,MAAM,KAAK,GAAG,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,iBAAiB,CAAC,6BAA6B,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtF,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;YACD,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/E,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAiB,CAAC,WAAW,CAAC,CAAC;YAC3C,CAAC;YAED,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC;YACxB,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;gBACvC,QAAQ,CAAC,GAAG,CACV,kBAAkB,EAClB,oBAAoB,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAC3E,CAAC;gBACF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;gBAC5C,QAAQ,CAAC,GAAG,CACV,kBAAkB,EAClB,oBAAoB,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAC3E,CAAC;gBACF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,IAAI,KAAK,YAAY,UAAU,EAAE,CAAC;gBAChC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,SAAiB,EACjB,cAAwB,EACxB,mBAA4B;IAE5B,MAAM,KAAK,GAAG;QACZ,iBAAiB,gBAAgB,CAAC,SAAS,CAAC,GAAG;QAC/C,sBAAsB,gBAAgB,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,GAAG;KACxE,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,UAAU,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,mBAAmB,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,sBAAsB,gBAAgB,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;QACvC,OAAO,wCAAwC,CAAC;IAClD,CAAC;IACD,OAAO,wCAAwC,CAAC;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK;SACT,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;SACzB,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAChC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC"}

package/dist/transports/http.d.ts

@@ -0,0 +1,11 @@
+import type { AppConfig } from "../config.js";
+import type { Logger } from "../logger.js";
+import { type Services } from "../services.js";
+import type { UserOAuthRuntime } from "../auth/runtime.js";
+import type { WriteRuntime } from "../write/runtime.js";
+export interface RunningHttpServer {
+    url: string;
+    close(): Promise<void>;
+}
+export declare function startHttpServer(config: AppConfig, services: Services, logger: Logger, writeRuntime: WriteRuntime, oauthRuntime?: UserOAuthRuntime): Promise<RunningHttpServer>;
+//# sourceMappingURL=http.d.ts.map

package/dist/transports/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,eAAe,CACnC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,EAC1B,YAAY,CAAC,EAAE,gBAAgB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CA6M5B"}

package/dist/transports/http.js

@@ -0,0 +1,203 @@
+import { randomUUID } from "node:crypto";
+import { createMcpExpressApp } from "@modelcontextprotocol/sdk/server/express.js";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { createOAuthMetadata, getOAuthProtectedResourceMetadataUrl, mcpAuthRouter, } from "@modelcontextprotocol/sdk/server/auth/router.js";
+import { createMcpServer } from "../mcp/create-server.js";
+import { metrics } from "../observability/metrics.js";
+import { createServices } from "../services.js";
+import { UserOAuthTokenProvider } from "../auth/pingcode-oauth-provider.js";
+import { requireSafeBearerAuth } from "./bearer-auth.js";
+import { requireMetricsBearerToken } from "./metrics-auth.js";
+export async function startHttpServer(config, services, logger, writeRuntime, oauthRuntime) {
+    const expressOptions = config.server.allowedHosts.length > 0
+        ? { host: config.server.host, allowedHosts: config.server.allowedHosts }
+        : { host: config.server.host };
+    const app = createMcpExpressApp(expressOptions);
+    app.disable("x-powered-by");
+    if (oauthRuntime) {
+        const publicBaseUrl = config.server.publicBaseUrl;
+        if (!publicBaseUrl) {
+            throw new Error("user_oauth 模式缺少 MCP_PUBLIC_BASE_URL");
+        }
+        const authRouterOptions = {
+            provider: oauthRuntime.provider,
+            issuerUrl: new URL(publicBaseUrl),
+            resourceServerUrl: oauthRuntime.provider.resourceUrl,
+            scopesSupported: oauthRuntime.provider.scopes,
+            resourceName: "PingCode MCP",
+            clientRegistrationOptions: { clientIdGeneration: false },
+        };
+        if (oauthRuntime.provider.supportsCimd) {
+            const metadata = createOAuthMetadata(authRouterOptions);
+            app.get("/.well-known/oauth-authorization-server", (_request, response) => {
+                response.setHeader("Cache-Control", "public, max-age=300");
+                response.json({
+                    ...metadata,
+                    client_id_metadata_document_supported: true,
+                });
+            });
+        }
+        app.use(mcpAuthRouter(authRouterOptions));
+        app.get("/auth/pingcode/callback", (request, response) => {
+            void oauthRuntime.provider.handlePingCodeCallback(request, response).catch((error) => {
+                logger.error("處理 PingCode OAuth 回調失敗", {
+                    errorName: error instanceof Error ? error.name : typeof error,
+                });
+                if (!response.headersSent) {
+                    response.status(500).send("PingCode OAuth 回調處理失敗");
+                }
+            });
+        });
+    }
+    app.get("/health/live", (_request, response) => {
+        response.json({ status: "ok" });
+    });
+    app.get("/health/ready", async (_request, response) => {
+        try {
+            await oauthRuntime?.ping();
+            await writeRuntime.ping();
+            const configured = oauthRuntime !== undefined || services.isConfigured();
+            response.status(configured ? 200 : 503).json({
+                status: configured ? "ready" : "not_ready",
+                pingcodeCredentialsConfigured: configured,
+                authMode: config.pingcode.authMode,
+                writeEnabled: writeRuntime.enabled,
+            });
+        }
+        catch {
+            response.status(503).json({
+                status: "not_ready",
+                pingcodeCredentialsConfigured: true,
+                authMode: config.pingcode.authMode,
+                oauthStoreReady: false,
+            });
+        }
+    });
+    if (config.observability.metricsEnabled && config.observability.metricsBearerToken) {
+        app.get("/metrics", requireMetricsBearerToken(config.observability.metricsBearerToken), (_request, response) => {
+            response.setHeader("Cache-Control", "no-store");
+            response.json(metrics.snapshot());
+        });
+    }
+    const handleMcpRequest = async (request, response) => {
+        let requestServices = services;
+        if (oauthRuntime) {
+            if (!request.auth) {
+                response.status(401).json({ error: "unauthorized" });
+                return;
+            }
+            requestServices = createServices(config, logger, new UserOAuthTokenProvider(oauthRuntime.provider, request.auth.token));
+        }
+        const mcpServer = createMcpServer(requestServices, logger, writeRuntime, {
+            writeApprovalMode: "client_confirmation",
+        });
+        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+        let closed = false;
+        const closeResources = () => {
+            if (closed) {
+                return;
+            }
+            closed = true;
+            void transport.close();
+            void mcpServer.close();
+        };
+        response.once("close", closeResources);
+        try {
+            await mcpServer.connect(transport);
+            await transport.handleRequest(request, response, request.body);
+        }
+        catch (error) {
+            logger.error("處理 MCP HTTP 請求失敗", {
+                errorName: error instanceof Error ? error.name : typeof error,
+            });
+            if (!response.headersSent) {
+                response.status(500).json({
+                    jsonrpc: "2.0",
+                    error: { code: -32603, message: "伺服器內部錯誤" },
+                    id: null,
+                });
+            }
+            closeResources();
+        }
+    };
+    app.post("/mcp", (request, response, next) => {
+        const requestId = randomUUID();
+        const startedAt = Date.now();
+        request.headers["x-request-id"] = requestId;
+        response.setHeader("X-Request-ID", requestId);
+        response.once("finish", () => {
+            const durationMs = Date.now() - startedAt;
+            metrics.recordMcpHttpResponse(response.statusCode, durationMs, request.auth !== undefined);
+            logger.info("MCP HTTP 請求完成", {
+                requestId,
+                status: response.statusCode,
+                durationMs,
+                authenticated: request.auth !== undefined,
+            });
+        });
+        next();
+    });
+    if (oauthRuntime) {
+        app.post("/mcp", requireSafeBearerAuth({
+            verifier: oauthRuntime.provider,
+            requiredScopes: [oauthRuntime.provider.scope],
+            resourceMetadataUrl: getOAuthProtectedResourceMetadataUrl(oauthRuntime.provider.resourceUrl),
+        }), handleMcpRequest);
+    }
+    else {
+        app.post("/mcp", handleMcpRequest);
+    }
+    const methodNotAllowed = (_request, response) => {
+        response.status(405).json({
+            jsonrpc: "2.0",
+            error: { code: -32000, message: "不允許使用此 HTTP 方法" },
+            id: null,
+        });
+    };
+    app.get("/mcp", methodNotAllowed);
+    app.delete("/mcp", methodNotAllowed);
+    const httpServer = await listen(app, config.server.port, config.server.host);
+    const address = httpServer.address();
+    const actualPort = typeof address === "object" && address ? address.port : config.server.port;
+    const displayHost = config.server.host === "0.0.0.0" || config.server.host === "::"
+        ? "localhost"
+        : config.server.host === "::1"
+            ? "[::1]"
+            : config.server.host;
+    const url = `http://${displayHost}:${actualPort}`;
+    logger.info("PingCode MCP HTTP Server 已啟動", {
+        host: config.server.host,
+        port: actualPort,
+        mcpEndpoint: `${url}/mcp`,
+        configured: services.isConfigured(),
+        authMode: config.pingcode.authMode,
+        metricsEnabled: config.observability.metricsEnabled,
+        writeEnabled: writeRuntime.enabled,
+    });
+    return {
+        url,
+        close: async () => {
+            try {
+                await closeHttpServer(httpServer);
+            }
+            finally {
+                await oauthRuntime?.close();
+            }
+        },
+    };
+}
+function listen(app, port, host) {
+    return new Promise((resolve, reject) => {
+        const server = app.listen(port, host, () => {
+            server.off("error", reject);
+            resolve(server);
+        });
+        server.once("error", reject);
+    });
+}
+function closeHttpServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => (error ? reject(error) : resolve()));
+    });
+}
+//# sourceMappingURL=http.js.map

package/dist/transports/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/transports/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EACL,mBAAmB,EACnB,oCAAoC,EACpC,aAAa,GAEd,MAAM,iDAAiD,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAiB,MAAM,gBAAgB,CAAC;AAE/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAQ9D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAiB,EACjB,QAAkB,EAClB,MAAc,EACd,YAA0B,EAC1B,YAA+B;IAE/B,MAAM,cAAc,GAClB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE;QACxE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,GAAG,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAChD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;QAClD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,iBAAiB,GAAG;YACxB,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,SAAS,EAAE,IAAI,GAAG,CAAC,aAAa,CAAC;YACjC,iBAAiB,EAAE,YAAY,CAAC,QAAQ,CAAC,WAAW;YACpD,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,MAAM;YAC7C,YAAY,EAAE,cAAc;YAC5B,yBAAyB,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE;SAC7B,CAAC;QAC9B,IAAI,YAAY,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;YACxD,GAAG,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;gBACxE,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CAAC;gBAC3D,QAAQ,CAAC,IAAI,CAAC;oBACZ,GAAG,QAAQ;oBACX,qCAAqC,EAAE,IAAI;iBAC5C,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC1C,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACvD,KAAK,YAAY,CAAC,QAAQ,CAAC,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACnF,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;oBACrC,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;iBAC9D,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;oBAC1B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;QAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QACpD,IAAI,CAAC;YACH,MAAM,YAAY,EAAE,IAAI,EAAE,CAAC;YAC3B,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,YAAY,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YACzE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC3C,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;gBAC1C,6BAA6B,EAAE,UAAU;gBACzC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;gBAClC,YAAY,EAAE,YAAY,CAAC,OAAO;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxB,MAAM,EAAE,WAAW;gBACnB,6BAA6B,EAAE,IAAI;gBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;gBAClC,eAAe,EAAE,KAAK;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,aAAa,CAAC,cAAc,IAAI,MAAM,CAAC,aAAa,CAAC,kBAAkB,EAAE,CAAC;QACnF,GAAG,CAAC,GAAG,CACL,UAAU,EACV,yBAAyB,CAAC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAClE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;YACrB,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;YAChD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpC,CAAC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,EAC5B,OAAgB,EAChB,QAAkB,EAClB,EAAE;QACF,IAAI,eAAe,GAAG,QAAQ,CAAC;QAC/B,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClB,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,eAAe,GAAG,cAAc,CAC9B,MAAM,EACN,MAAM,EACN,IAAI,sBAAsB,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,eAAe,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE;YACvE,iBAAiB,EAAE,qBAAqB;SACzC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QACvF,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,cAAc,GAAG,GAAG,EAAE;YAC1B,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO;YACT,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;YACvB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,SAAS,CAAC,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE;gBAC/B,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;aAC9D,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACxB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE;oBAC3C,EAAE,EAAE,IAAI;iBACT,CAAC,CAAC;YACL,CAAC;YACD,cAAc,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC;QAC5C,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAC9C,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;YAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,OAAO,CAAC,qBAAqB,CAC3B,QAAQ,CAAC,UAAU,EACnB,UAAU,EACV,OAAO,CAAC,IAAI,KAAK,SAAS,CAC3B,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;gBAC3B,SAAS;gBACT,MAAM,EAAE,QAAQ,CAAC,UAAU;gBAC3B,UAAU;gBACV,aAAa,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS;aAC1C,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CACN,MAAM,EACN,qBAAqB,CAAC;YACpB,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,cAAc,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC7C,mBAAmB,EAAE,oCAAoC,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;SAC7F,CAAC,EACF,gBAAgB,CACjB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,QAAiB,EAAE,QAAyE,EAAE,EAAE;QACxH,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE;YAClD,EAAE,EAAE,IAAI;SACT,CAAC,CAAC;IACL,CAAC,CAAC;IACF,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAClC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAErC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IAC9F,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI;QAC7D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK;YAC5B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,UAAU,WAAW,IAAI,UAAU,EAAE,CAAC;IAClD,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;QAC1C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QACxB,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,GAAG,GAAG,MAAM;QACzB,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;QAClC,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,cAAc;QACnD,YAAY,EAAE,YAAY,CAAC,OAAO;KACnC,CAAC,CAAC;IAEH,OAAO;QACL,GAAG;QACH,KAAK,EAAE,KAAK,IAAI,EAAE;YAChB,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;YACpC,CAAC;oBAAS,CAAC;gBACT,MAAM,YAAY,EAAE,KAAK,EAAE,CAAC;YAC9B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CACb,GAA2C,EAC3C,IAAY,EACZ,IAAY;IAEZ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE;YACzC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,MAAkB;IACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/transports/metrics-auth.d.ts

@@ -0,0 +1,3 @@
+import type { RequestHandler } from "express";
+export declare function requireMetricsBearerToken(expectedToken: string): RequestHandler;
+//# sourceMappingURL=metrics-auth.d.ts.map

package/dist/transports/metrics-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics-auth.d.ts","sourceRoot":"","sources":["../../src/transports/metrics-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,GAAG,cAAc,CAiB/E"}

package/dist/transports/metrics-auth.js

@@ -0,0 +1,22 @@
+import { timingSafeEqual } from "node:crypto";
+export function requireMetricsBearerToken(expectedToken) {
+    const expected = Buffer.from(expectedToken, "utf8");
+    return (request, response, next) => {
+        const authorization = request.headers.authorization;
+        const match = authorization?.match(/^Bearer\s+(\S+)$/i);
+        const provided = match?.[1];
+        if (!provided || !secureEqual(Buffer.from(provided, "utf8"), expected)) {
+            response.setHeader("WWW-Authenticate", 'Bearer realm="pingcode-mcp-metrics"');
+            response.status(401).json({
+                error: "unauthorized",
+                message: "缺少或無效的 Metrics Bearer Token",
+            });
+            return;
+        }
+        next();
+    };
+}
+function secureEqual(left, right) {
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+//# sourceMappingURL=metrics-auth.js.map

package/dist/transports/metrics-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics-auth.js","sourceRoot":"","sources":["../../src/transports/metrics-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C,MAAM,UAAU,yBAAyB,CAAC,aAAqB;IAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAEpD,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,MAAM,KAAK,GAAG,aAAa,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;YACvE,QAAQ,CAAC,SAAS,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;YAC9E,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACxB,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,6BAA6B;aACvC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC"}

package/dist/transports/stdio.d.ts

@@ -0,0 +1,5 @@
+import type { Logger } from "../logger.js";
+import type { Services } from "../services.js";
+import type { WriteRuntime } from "../write/runtime.js";
+export declare function startStdioServer(services: Services, logger: Logger, writeRuntime: WriteRuntime): Promise<void>;
+//# sourceMappingURL=stdio.d.ts.map

package/dist/transports/stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../src/transports/stdio.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,YAAY,GACzB,OAAO,CAAC,IAAI,CAAC,CAOf"}

package/dist/transports/stdio.js

@@ -0,0 +1,11 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { createMcpServer } from "../mcp/create-server.js";
+export async function startStdioServer(services, logger, writeRuntime) {
+    const server = createMcpServer(services, logger, writeRuntime, {
+        writeApprovalMode: "client_confirmation",
+    });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    logger.info("PingCode MCP stdio Server 已啟動", { configured: services.isConfigured() });
+}
+//# sourceMappingURL=stdio.js.map

package/dist/transports/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../src/transports/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AAEjF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI1D,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAkB,EAClB,MAAc,EACd,YAA0B;IAE1B,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE;QAC7D,iBAAiB,EAAE,qBAAqB;KACzC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACxF,CAAC"}

package/dist/uat/run-label.d.ts

@@ -0,0 +1,2 @@
+export declare function createRunLabel(now?: Date): string;
+//# sourceMappingURL=run-label.d.ts.map

package/dist/uat/run-label.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-label.d.ts","sourceRoot":"","sources":["../../src/uat/run-label.ts"],"names":[],"mappings":"AAIA,wBAAgB,cAAc,CAAC,GAAG,OAAa,GAAG,MAAM,CAOvD"}

package/dist/uat/run-label.js

@@ -0,0 +1,12 @@
+function twoDigits(value) {
+    return String(value).padStart(2, "0");
+}
+export function createRunLabel(now = new Date()) {
+    const date = [
+        now.getFullYear(),
+        twoDigits(now.getMonth() + 1),
+        twoDigits(now.getDate()),
+    ].join("");
+    return `MCP UAT ${date}-${twoDigits(now.getHours())}${twoDigits(now.getMinutes())}`;
+}
+//# sourceMappingURL=run-label.js.map

package/dist/uat/run-label.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-label.js","sourceRoot":"","sources":["../../src/uat/run-label.ts"],"names":[],"mappings":"AAAA,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;IAC7C,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,WAAW,EAAE;QACjB,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7B,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;KACzB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,OAAO,WAAW,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC;AACtF,CAAC"}

package/dist/verify.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":""}

package/dist/verify.js

@@ -0,0 +1,59 @@
+#!/usr/bin/env node
+import { loadConfig } from "./config.js";
+import { loadEnvironment } from "./environment.js";
+import { createLogger } from "./logger.js";
+import { PingCodeError } from "./pingcode/errors.js";
+import { createServices } from "./services.js";
+loadEnvironment();
+async function main() {
+    const config = loadConfig(process.env, { allowEphemeralWriteApprovalSecret: true });
+    const logger = createLogger(config.logLevel);
+    if (config.pingcode.authMode === "user_oauth") {
+        throw new Error("verify:pingcode 只支援 enterprise；user_oauth 請透過 HTTP MCP Client 登入驗證");
+    }
+    const services = createServices(config, logger);
+    if (!services.isConfigured()) {
+        throw new Error(".env 中尚未配置 PingCode 憑據");
+    }
+    const wikiSource = services.getWikiSource();
+    const spaces = await wikiSource.listSpaces({});
+    const pageReference = process.argv[2]?.trim();
+    const pageSummary = pageReference ? await verifyPage(wikiSource, pageReference) : null;
+    process.stdout.write(`${JSON.stringify({
+        status: "ok",
+        apiBaseUrl: config.pingcode.apiBaseUrl,
+        spaces: {
+            returned: spaces.values.length,
+            total: spaces.total,
+        },
+        ...(pageSummary ? { page: pageSummary } : {}),
+    }, null, 2)}\n`);
+}
+async function verifyPage(wikiSource, pageReference) {
+    const context = await wikiSource.getRequirementContext(pageReference);
+    return {
+        id: context.source.id,
+        title: context.title,
+        sourceUrl: context.source.url,
+        contentBytes: Buffer.byteLength(context.contentMarkdown, "utf8"),
+        contentHash: context.source.contentHash,
+    };
+}
+main().catch((error) => {
+    const pingCodeDetails = error instanceof PingCodeError
+        ? {
+            code: error.code,
+            status: error.options.status,
+            retryable: error.retryable,
+            ...(error.options.requestId ? { requestId: error.options.requestId } : {}),
+        }
+        : {};
+    process.stderr.write(`${JSON.stringify({
+        status: "error",
+        errorName: error instanceof Error ? error.name : typeof error,
+        errorMessage: error instanceof Error ? error.message : "未知錯誤",
+        ...pingCodeDetails,
+    })}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,eAAe,EAAE,CAAC;AAElB,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhD,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CACf;QACE,MAAM,EAAE,IAAI;QACZ,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU;QACtC,MAAM,EAAE;YACN,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;YAC9B,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB;QACD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,EACD,IAAI,EACJ,CAAC,CACF,IAAI,CACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,UAA0E,EAC1E,aAAqB;IAErB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACtE,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;QACrB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG;QAC7B,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;QAChE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW;KACxC,CAAC;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,MAAM,eAAe,GACnB,KAAK,YAAY,aAAa;QAC5B,CAAC,CAAC;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E;QACH,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,CAAC,SAAS,CAAC;QAChB,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;QAC7D,YAAY,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QAC7D,GAAG,eAAe;KACnB,CAAC,IAAI,CACP,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/write/approval.d.ts

@@ -0,0 +1,35 @@
+import { z } from "zod";
+export declare const writeResourceTypes: readonly ["task", "test_case", "ship_product", "ship_idea", "project", "test_library", "member_role", "relation", "ship_suite"];
+export type WriteResourceType = (typeof writeResourceTypes)[number];
+export declare function isWriteResourceType(value: string | undefined): value is WriteResourceType;
+declare const approvalPayloadSchema: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    approvalContextId: z.ZodString;
+    sessionBinding: z.ZodString;
+    evidenceHash: z.ZodString;
+    requestHash: z.ZodString;
+    resourceType: z.ZodEnum<{
+        task: "task";
+        test_case: "test_case";
+        ship_product: "ship_product";
+        ship_idea: "ship_idea";
+        project: "project";
+        test_library: "test_library";
+        member_role: "member_role";
+        relation: "relation";
+        ship_suite: "ship_suite";
+    }>;
+    approvedBy: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export type ApprovalPayload = z.infer<typeof approvalPayloadSchema>;
+export declare function createApprovalToken(payload: ApprovalPayload, secret: string): string;
+export declare function verifyApprovalToken(token: string, secret: string, expected: {
+    approvalContextId: string;
+    sessionBinding: string;
+    evidenceHash: string;
+    requestHash: string;
+    resourceType: WriteResourceType;
+}, now?: () => Date): ApprovalPayload;
+export {};
+//# sourceMappingURL=approval.d.ts.map

package/dist/write/approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.d.ts","sourceRoot":"","sources":["../../src/write/approval.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,kBAAkB,iIAUrB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,IAAI,iBAAiB,CAEzF;AAED,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;iBASzB,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAKpF;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE;IACR,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,iBAAiB,CAAC;CACjC,EACD,GAAG,GAAE,MAAM,IAAuB,GACjC,eAAe,CAmCjB"}

package/dist/write/approval.js

@@ -0,0 +1,66 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+import { PingCodeError } from "../pingcode/errors.js";
+export const writeResourceTypes = [
+    "task",
+    "test_case",
+    "ship_product",
+    "ship_idea",
+    "project",
+    "test_library",
+    "member_role",
+    "relation",
+    "ship_suite",
+];
+export function isWriteResourceType(value) {
+    return value !== undefined && writeResourceTypes.includes(value);
+}
+const approvalPayloadSchema = z.object({
+    version: z.literal(2),
+    approvalContextId: z.string().uuid(),
+    sessionBinding: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+    evidenceHash: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+    requestHash: z.string().regex(/^sha256:[0-9a-f]{64}$/),
+    resourceType: z.enum(writeResourceTypes),
+    approvedBy: z.string().trim().min(1).max(200),
+    expiresAt: z.string().datetime(),
+});
+export function createApprovalToken(payload, secret) {
+    const encodedPayload = Buffer.from(JSON.stringify(approvalPayloadSchema.parse(payload))).toString("base64url");
+    return `${encodedPayload}.${sign(encodedPayload, secret)}`;
+}
+export function verifyApprovalToken(token, secret, expected, now = () => new Date()) {
+    const [encodedPayload, encodedSignature, extra] = token.split(".");
+    if (!encodedPayload || !encodedSignature || extra !== undefined) {
+        throw approvalError();
+    }
+    const expectedSignature = Buffer.from(sign(encodedPayload, secret));
+    const actualSignature = Buffer.from(encodedSignature);
+    if (expectedSignature.length !== actualSignature.length ||
+        !timingSafeEqual(expectedSignature, actualSignature)) {
+        throw approvalError();
+    }
+    let payload;
+    try {
+        payload = approvalPayloadSchema.parse(JSON.parse(Buffer.from(encodedPayload, "base64url").toString("utf8")));
+    }
+    catch {
+        throw approvalError();
+    }
+    if (payload.requestHash !== expected.requestHash ||
+        payload.resourceType !== expected.resourceType ||
+        payload.approvalContextId !== expected.approvalContextId ||
+        payload.sessionBinding !== expected.sessionBinding ||
+        payload.evidenceHash !== expected.evidenceHash ||
+        Date.parse(payload.expiresAt) <= now().getTime()) {
+        throw approvalError();
+    }
+    return payload;
+}
+function sign(payload, secret) {
+    return createHmac("sha256", Buffer.from(secret, "base64")).update(payload).digest("base64url");
+}
+function approvalError() {
+    return new PingCodeError("寫入 Approval 無效、已過期或不適用於此 Preview", "APPROVAL_INVALID");
+}
+//# sourceMappingURL=approval.js.map

package/dist/write/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../src/write/approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM;IACN,WAAW;IACX,cAAc;IACd,WAAW;IACX,SAAS;IACT,cAAc;IACd,aAAa;IACb,UAAU;IACV,YAAY;CACJ,CAAC;AAIX,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,OAAO,KAAK,KAAK,SAAS,IAAK,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACzD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACvD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACtD,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAIH,MAAM,UAAU,mBAAmB,CAAC,OAAwB,EAAE,MAAc;IAC1E,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAC/F,WAAW,CACZ,CAAC;IACF,OAAO,GAAG,cAAc,IAAI,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAa,EACb,MAAc,EACd,QAMC,EACD,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;IAElC,MAAM,CAAC,cAAc,EAAE,gBAAgB,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnE,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAChE,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IACpE,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACtD,IACE,iBAAiB,CAAC,MAAM,KAAK,eAAe,CAAC,MAAM;QACnD,CAAC,eAAe,CAAC,iBAAiB,EAAE,eAAe,CAAC,EACpD,CAAC;QACD,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IAED,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,qBAAqB,CAAC,KAAK,CACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CACjF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IAED,IACE,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAC5C,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;QAC9C,OAAO,CAAC,iBAAiB,KAAK,QAAQ,CAAC,iBAAiB;QACxD,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAClD,OAAO,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY;QAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,EAChD,CAAC;QACD,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,IAAI,CAAC,OAAe,EAAE,MAAc;IAC3C,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,IAAI,aAAa,CAAC,kCAAkC,EAAE,kBAAkB,CAAC,CAAC;AACnF,CAAC"}

package/dist/write/plan.d.ts

@@ -0,0 +1,2 @@
+export declare function requestHash(value: unknown): string;
+//# sourceMappingURL=plan.d.ts.map

package/dist/write/plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.d.ts","sourceRoot":"","sources":["../../src/write/plan.ts"],"names":[],"mappings":"AAEA,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAElD"}

package/dist/write/plan.js

@@ -0,0 +1,17 @@
+import { createHash } from "node:crypto";
+export function requestHash(value) {
+    return `sha256:${createHash("sha256").update(stableJson(value), "utf8").digest("hex")}`;
+}
+function stableJson(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(stableJson).join(",")}]`;
+    }
+    if (value && typeof value === "object") {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, nested]) => `${JSON.stringify(key)}:${stableJson(nested)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+//# sourceMappingURL=plan.js.map

package/dist/write/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../src/write/plan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAChD,CAAC;IACD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aACxD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;aACtE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC"}