@xurenxiang1219/pingcode-mcp 0.3.1

package/dist/auth/store.js

@@ -0,0 +1,55 @@
+import { randomUUID } from "node:crypto";
+export class EncryptedOAuthStore {
+    rawStore;
+    cipher;
+    constructor(rawStore, cipher) {
+        this.rawStore = rawStore;
+        this.cipher = cipher;
+    }
+    async get(key) {
+        const value = await this.rawStore.get(key);
+        return value === undefined ? undefined : this.decode(value);
+    }
+    async set(key, value, ttlSeconds) {
+        await this.rawStore.set(key, this.encode(value), ttlSeconds);
+    }
+    async consume(key) {
+        const value = await this.rawStore.consume(key);
+        return value === undefined ? undefined : this.decode(value);
+    }
+    delete(key) {
+        return this.rawStore.delete(key);
+    }
+    async withLock(key, action) {
+        const lockKey = `lock:${key}`;
+        const lockValue = randomUUID();
+        for (let attempt = 0; attempt < 50; attempt += 1) {
+            if (await this.rawStore.setIfAbsent(lockKey, lockValue, 130)) {
+                try {
+                    return await action();
+                }
+                finally {
+                    await this.rawStore.compareAndDelete(lockKey, lockValue);
+                }
+            }
+            await delay(100);
+        }
+        throw new Error("等待 OAuth Token 更新鎖逾時");
+    }
+    ping() {
+        return this.rawStore.ping();
+    }
+    close() {
+        return this.rawStore.close();
+    }
+    encode(value) {
+        return this.cipher.encrypt(JSON.stringify(value));
+    }
+    decode(value) {
+        return JSON.parse(this.cipher.decrypt(value));
+    }
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=store.js.map

package/dist/auth/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAwBzC,MAAM,OAAO,mBAAmB;IAEX;IACA;IAFnB,YACmB,QAAuB,EACvB,MAAmB;QADnB,aAAQ,GAAR,QAAQ,CAAe;QACvB,WAAM,GAAN,MAAM,CAAa;IACnC,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,UAAkB;QACvD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,GAAW,EAAE,MAAwB;QACrD,MAAM,OAAO,GAAG,QAAQ,GAAG,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC;oBACH,OAAO,MAAM,MAAM,EAAE,CAAC;gBACxB,CAAC;wBAAS,CAAC;oBACT,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAEO,MAAM,CAAC,KAAc;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,MAAM,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAY,CAAC;IAC3D,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/auth/token-cipher.d.ts

@@ -0,0 +1,7 @@
+export declare class TokenCipher {
+    private readonly key;
+    constructor(encodedKey: string);
+    encrypt(plaintext: string): string;
+    decrypt(value: string): string;
+}
+//# sourceMappingURL=token-cipher.d.ts.map

package/dist/auth/token-cipher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cipher.d.ts","sourceRoot":"","sources":["../../src/auth/token-cipher.ts"],"names":[],"mappings":"AAIA,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;gBAEjB,UAAU,EAAE,MAAM;IAO9B,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAQlC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;CAiB/B"}

package/dist/auth/token-cipher.js

@@ -0,0 +1,36 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+const VERSION = "v1";
+export class TokenCipher {
+    key;
+    constructor(encodedKey) {
+        this.key = Buffer.from(encodedKey, "base64");
+        if (this.key.length !== 32) {
+            throw new Error("MCP_OAUTH_ENCRYPTION_KEY 必須是 Base64 編碼的 32-byte 金鑰");
+        }
+    }
+    encrypt(plaintext) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+        const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return [VERSION, iv.toString("base64url"), tag.toString("base64url"), ciphertext.toString("base64url")].join(".");
+    }
+    decrypt(value) {
+        const [version, encodedIv, encodedTag, encodedCiphertext] = value.split(".");
+        if (version !== VERSION || !encodedIv || !encodedTag || encodedCiphertext === undefined) {
+            throw new Error("OAuth 儲存資料格式無效");
+        }
+        try {
+            const decipher = createDecipheriv("aes-256-gcm", this.key, Buffer.from(encodedIv, "base64url"));
+            decipher.setAuthTag(Buffer.from(encodedTag, "base64url"));
+            return Buffer.concat([
+                decipher.update(Buffer.from(encodedCiphertext, "base64url")),
+                decipher.final(),
+            ]).toString("utf8");
+        }
+        catch (error) {
+            throw new Error("無法解密 OAuth 儲存資料", { cause: error });
+        }
+    }
+}
+//# sourceMappingURL=token-cipher.js.map

package/dist/auth/token-cipher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-cipher.js","sourceRoot":"","sources":["../../src/auth/token-cipher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE5E,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB,MAAM,OAAO,WAAW;IACL,GAAG,CAAS;IAE7B,YAAY,UAAkB;QAC5B,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpH,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7E,IAAI,OAAO,KAAK,OAAO,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YAChG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBAC5D,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF"}

package/dist/config.d.ts

@@ -0,0 +1,54 @@
+export interface PingCodeCredentials {
+    clientId: string;
+    clientSecret: string;
+}
+export interface AppConfig {
+    pingcode: {
+        authMode: "enterprise" | "user_oauth";
+        apiBaseUrl: string;
+        oauthBaseUrl: string;
+        credentials: PingCodeCredentials | null;
+        requestTimeoutMs: number;
+        maxResponseBytes: number;
+        maxRetries: number;
+        retryBaseDelayMs: number;
+        retryMaxDelayMs: number;
+    };
+    server: {
+        host: string;
+        port: number;
+        allowedHosts: string[];
+        publicBaseUrl: string | null;
+    };
+    oauth: {
+        store: "memory" | "redis";
+        redisUrl: string | null;
+        encryptionKey: string | null;
+        cimdEnabled: boolean;
+        cimdAllowedHosts: string[];
+        dcrClientTtlSeconds: number;
+        accessTokenTtlSeconds: number;
+        refreshTokenTtlSeconds: number;
+    };
+    observability: {
+        metricsEnabled: boolean;
+        metricsBearerToken: string | null;
+    };
+    write: {
+        enabled: boolean;
+        confirmation: "required" | "update" | "delete" | "none";
+        approvalSecret: string | null;
+        approvalSecretEphemeral: boolean;
+        approvalTtlSeconds: number;
+        idempotencyTtlSeconds: number;
+        store: "memory" | "redis";
+        redisUrl: string | null;
+    };
+    logLevel: "debug" | "info" | "warn" | "error";
+}
+export interface LoadConfigOptions {
+    allowEphemeralWriteApprovalSecret?: boolean;
+}
+export declare function loadConfig(environment?: NodeJS.ProcessEnv, options?: LoadConfigOptions): AppConfig;
+export declare function isLoopbackHost(host: string): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAqLA,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE;QACR,QAAQ,EAAE,YAAY,GAAG,YAAY,CAAC;QACtC,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,mBAAmB,GAAG,IAAI,CAAC;QACxC,gBAAgB,EAAE,MAAM,CAAC;QACzB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;QACnB,gBAAgB,EAAE,MAAM,CAAC;QACzB,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC;IACF,KAAK,EAAE;QACL,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC;QAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,WAAW,EAAE,OAAO,CAAC;QACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,mBAAmB,EAAE,MAAM,CAAC;QAC5B,qBAAqB,EAAE,MAAM,CAAC;QAC9B,sBAAsB,EAAE,MAAM,CAAC;KAChC,CAAC;IACF,aAAa,EAAE;QACb,cAAc,EAAE,OAAO,CAAC;QACxB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC,CAAC;IACF,KAAK,EAAE;QACL,OAAO,EAAE,OAAO,CAAC;QACjB,YAAY,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC;QACxD,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,uBAAuB,EAAE,OAAO,CAAC;QACjC,kBAAkB,EAAE,MAAM,CAAC;QAC3B,qBAAqB,EAAE,MAAM,CAAC;QAC9B,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC;QAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC;IACF,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAC/C;AAED,MAAM,WAAW,iBAAiB;IAChC,iCAAiC,CAAC,EAAE,OAAO,CAAC;CAC7C;AAED,wBAAgB,UAAU,CACxB,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,OAAO,GAAE,iBAAsB,GAC9B,SAAS,CAkEX;AAyBD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD"}

package/dist/config.js

@@ -0,0 +1,270 @@
+import { randomBytes } from "node:crypto";
+import { z } from "zod";
+const optionalString = z.preprocess((value) => (typeof value === "string" && value.trim() === "" ? undefined : value), z.string().trim().min(1).optional());
+const booleanString = z
+    .enum(["true", "false"])
+    .default("false")
+    .transform((value) => value === "true");
+const trueBooleanString = z
+    .enum(["true", "false"])
+    .default("true")
+    .transform((value) => value === "true");
+const optionalUrl = z.preprocess((value) => (typeof value === "string" && value.trim() === "" ? undefined : value), z.url().optional());
+const envSchema = z
+    .object({
+    PINGCODE_API_BASE_URL: z.url().default("https://open.pingcode.com"),
+    PINGCODE_OAUTH_BASE_URL: z.url().default("https://open.pingcode.com/oauth2"),
+    PINGCODE_AUTH_MODE: z.enum(["enterprise", "user_oauth"]).default("enterprise"),
+    PINGCODE_CLIENT_ID: optionalString,
+    PINGCODE_CLIENT_SECRET: optionalString,
+    PINGCODE_REQUEST_TIMEOUT_MS: z.coerce.number().int().min(1000).max(120000).default(10000),
+    PINGCODE_MAX_RESPONSE_BYTES: z.coerce
+        .number()
+        .int()
+        .min(1024)
+        .max(10 * 1024 * 1024)
+        .default(1024 * 1024),
+    PINGCODE_MAX_RETRIES: z.coerce.number().int().min(0).max(5).default(2),
+    PINGCODE_RETRY_BASE_DELAY_MS: z.coerce.number().int().min(0).max(10000).default(250),
+    PINGCODE_RETRY_MAX_DELAY_MS: z.coerce.number().int().min(0).max(30000).default(2000),
+    MCP_HOST: z.string().trim().min(1).default("127.0.0.1"),
+    MCP_PORT: z.coerce.number().int().min(1).max(65535).default(3000),
+    MCP_ALLOW_REMOTE: booleanString,
+    MCP_ALLOWED_HOSTS: optionalString,
+    MCP_PUBLIC_BASE_URL: optionalUrl,
+    MCP_OAUTH_STORE: z.enum(["memory", "redis"]).default("memory"),
+    MCP_OAUTH_REDIS_URL: optionalString,
+    MCP_OAUTH_ENCRYPTION_KEY: optionalString,
+    MCP_OAUTH_CIMD_ENABLED: trueBooleanString,
+    MCP_OAUTH_CIMD_ALLOWED_HOSTS: optionalString,
+    MCP_OAUTH_DCR_CLIENT_TTL_SECONDS: z.coerce
+        .number()
+        .int()
+        .min(24 * 60 * 60)
+        .max(2 * 365 * 24 * 60 * 60)
+        .default(365 * 24 * 60 * 60),
+    MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS: z.coerce.number().int().min(300).max(86400).default(3600),
+    MCP_OAUTH_REFRESH_TOKEN_TTL_SECONDS: z.coerce
+        .number()
+        .int()
+        .min(3600)
+        .max(90 * 24 * 60 * 60)
+        .default(30 * 24 * 60 * 60),
+    MCP_METRICS_ENABLED: booleanString,
+    MCP_METRICS_BEARER_TOKEN: optionalString,
+    PINGCODE_WRITE_APPROVAL_SECRET: optionalString,
+    PINGCODE_WRITE_CONFIRMATION: z.enum(["required", "update", "delete", "none"]).default("none"),
+    PINGCODE_WRITE_APPROVAL_TTL_SECONDS: z.coerce.number().int().min(60).max(86400).default(1800),
+    PINGCODE_WRITE_IDEMPOTENCY_TTL_SECONDS: z.coerce
+        .number()
+        .int()
+        .min(3600)
+        .max(30 * 24 * 60 * 60)
+        .default(7 * 24 * 60 * 60),
+    PINGCODE_WRITE_STORE: z.enum(["memory", "redis"]).default("memory"),
+    PINGCODE_WRITE_REDIS_URL: optionalString,
+    LOG_LEVEL: z.enum(["debug", "info", "warn", "error"]).default("info"),
+})
+    .superRefine((value, context) => {
+    const hasClientId = value.PINGCODE_CLIENT_ID !== undefined;
+    const hasClientSecret = value.PINGCODE_CLIENT_SECRET !== undefined;
+    if (hasClientId !== hasClientSecret) {
+        context.addIssue({
+            code: "custom",
+            message: "PINGCODE_CLIENT_ID 和 PINGCODE_CLIENT_SECRET 必須同時配置",
+            path: hasClientId ? ["PINGCODE_CLIENT_SECRET"] : ["PINGCODE_CLIENT_ID"],
+        });
+    }
+    if (value.PINGCODE_RETRY_MAX_DELAY_MS < value.PINGCODE_RETRY_BASE_DELAY_MS) {
+        context.addIssue({
+            code: "custom",
+            message: "PINGCODE_RETRY_MAX_DELAY_MS 不得小於 PINGCODE_RETRY_BASE_DELAY_MS",
+            path: ["PINGCODE_RETRY_MAX_DELAY_MS"],
+        });
+    }
+    if (value.MCP_METRICS_ENABLED &&
+        (!value.MCP_METRICS_BEARER_TOKEN || value.MCP_METRICS_BEARER_TOKEN.length < 32)) {
+        context.addIssue({
+            code: "custom",
+            message: "啟用 Metrics 時必須配置至少 32 字元的 MCP_METRICS_BEARER_TOKEN",
+            path: ["MCP_METRICS_BEARER_TOKEN"],
+        });
+    }
+    if (value.PINGCODE_AUTH_MODE === "enterprise" && (!hasClientId || !hasClientSecret)) {
+        context.addIssue({ code: "custom", message: "enterprise 模式使用 PingCode 寫入能力時必須配置完整應用憑據", path: ["PINGCODE_CLIENT_ID"] });
+    }
+    if (!value.PINGCODE_WRITE_APPROVAL_SECRET) {
+        context.addIssue({ code: "custom", message: "使用 PingCode 寫入能力時必須配置 PINGCODE_WRITE_APPROVAL_SECRET", path: ["PINGCODE_WRITE_APPROVAL_SECRET"] });
+    }
+    else if (!isValidEncryptionKey(value.PINGCODE_WRITE_APPROVAL_SECRET)) {
+        context.addIssue({ code: "custom", message: "PINGCODE_WRITE_APPROVAL_SECRET 必須是 Base64 編碼的 32-byte 金鑰", path: ["PINGCODE_WRITE_APPROVAL_SECRET"] });
+    }
+    if (value.PINGCODE_WRITE_STORE === "redis" && !value.PINGCODE_WRITE_REDIS_URL) {
+        context.addIssue({ code: "custom", message: "Redis 寫入控制儲存必須配置 PINGCODE_WRITE_REDIS_URL", path: ["PINGCODE_WRITE_REDIS_URL"] });
+    }
+    if (!isLoopbackHost(value.MCP_HOST) && value.PINGCODE_WRITE_STORE !== "redis") {
+        context.addIssue({ code: "custom", message: "非本機部署使用 PingCode 寫入能力時必須使用 PINGCODE_WRITE_STORE=redis", path: ["PINGCODE_WRITE_STORE"] });
+    }
+    if (!isLoopbackHost(value.MCP_HOST) && !value.MCP_ALLOW_REMOTE) {
+        context.addIssue({
+            code: "custom",
+            message: "將 MCP Server 綁定到非本機位址前，必須設定 MCP_ALLOW_REMOTE=true",
+            path: ["MCP_ALLOW_REMOTE"],
+        });
+    }
+    if (value.PINGCODE_AUTH_MODE === "user_oauth") {
+        if (!hasClientId || !hasClientSecret) {
+            context.addIssue({
+                code: "custom",
+                message: "user_oauth 模式必須配置 PINGCODE_CLIENT_ID 和 PINGCODE_CLIENT_SECRET",
+                path: ["PINGCODE_CLIENT_ID"],
+            });
+        }
+        if (!value.MCP_PUBLIC_BASE_URL) {
+            context.addIssue({
+                code: "custom",
+                message: "user_oauth 模式必須配置 MCP_PUBLIC_BASE_URL",
+                path: ["MCP_PUBLIC_BASE_URL"],
+            });
+        }
+        if (!value.MCP_OAUTH_ENCRYPTION_KEY) {
+            context.addIssue({
+                code: "custom",
+                message: "user_oauth 模式必須配置 MCP_OAUTH_ENCRYPTION_KEY",
+                path: ["MCP_OAUTH_ENCRYPTION_KEY"],
+            });
+        }
+        else if (!isValidEncryptionKey(value.MCP_OAUTH_ENCRYPTION_KEY)) {
+            context.addIssue({
+                code: "custom",
+                message: "MCP_OAUTH_ENCRYPTION_KEY 必須是 Base64 編碼的 32-byte 金鑰",
+                path: ["MCP_OAUTH_ENCRYPTION_KEY"],
+            });
+        }
+        if (value.MCP_OAUTH_STORE === "redis" && !value.MCP_OAUTH_REDIS_URL) {
+            context.addIssue({
+                code: "custom",
+                message: "Redis OAuth 儲存必須配置 MCP_OAUTH_REDIS_URL",
+                path: ["MCP_OAUTH_REDIS_URL"],
+            });
+        }
+        if (value.MCP_PUBLIC_BASE_URL) {
+            validatePublicBaseUrl(value.MCP_PUBLIC_BASE_URL, context);
+            const publicHost = new URL(value.MCP_PUBLIC_BASE_URL).hostname;
+            if (!isLoopbackHost(publicHost) && value.MCP_OAUTH_STORE !== "redis") {
+                context.addIssue({
+                    code: "custom",
+                    message: "非本機 user_oauth 部署必須使用 MCP_OAUTH_STORE=redis",
+                    path: ["MCP_OAUTH_STORE"],
+                });
+            }
+        }
+    }
+});
+export function loadConfig(environment = process.env, options = {}) {
+    const configuredApprovalSecret = environment.PINGCODE_WRITE_APPROVAL_SECRET?.trim();
+    const approvalSecretEphemeral = Boolean(options.allowEphemeralWriteApprovalSecret && !configuredApprovalSecret);
+    const effectiveEnvironment = approvalSecretEphemeral
+        ? {
+            ...environment,
+            PINGCODE_WRITE_APPROVAL_SECRET: randomBytes(32).toString("base64"),
+        }
+        : environment;
+    const parsed = envSchema.parse(effectiveEnvironment);
+    const credentials = parsed.PINGCODE_CLIENT_ID && parsed.PINGCODE_CLIENT_SECRET
+        ? {
+            clientId: parsed.PINGCODE_CLIENT_ID,
+            clientSecret: parsed.PINGCODE_CLIENT_SECRET,
+        }
+        : null;
+    return {
+        pingcode: {
+            authMode: parsed.PINGCODE_AUTH_MODE,
+            apiBaseUrl: stripTrailingSlash(parsed.PINGCODE_API_BASE_URL),
+            oauthBaseUrl: stripTrailingSlash(parsed.PINGCODE_OAUTH_BASE_URL),
+            credentials,
+            requestTimeoutMs: parsed.PINGCODE_REQUEST_TIMEOUT_MS,
+            maxResponseBytes: parsed.PINGCODE_MAX_RESPONSE_BYTES,
+            maxRetries: parsed.PINGCODE_MAX_RETRIES,
+            retryBaseDelayMs: parsed.PINGCODE_RETRY_BASE_DELAY_MS,
+            retryMaxDelayMs: parsed.PINGCODE_RETRY_MAX_DELAY_MS,
+        },
+        server: {
+            host: parsed.MCP_HOST,
+            port: parsed.MCP_PORT,
+            allowedHosts: parseCsv(parsed.MCP_ALLOWED_HOSTS),
+            publicBaseUrl: parsed.MCP_PUBLIC_BASE_URL
+                ? stripTrailingSlash(parsed.MCP_PUBLIC_BASE_URL)
+                : null,
+        },
+        oauth: {
+            store: parsed.MCP_OAUTH_STORE,
+            redisUrl: parsed.MCP_OAUTH_REDIS_URL ?? null,
+            encryptionKey: parsed.MCP_OAUTH_ENCRYPTION_KEY ?? null,
+            cimdEnabled: parsed.MCP_OAUTH_CIMD_ENABLED,
+            cimdAllowedHosts: parseCsv(parsed.MCP_OAUTH_CIMD_ALLOWED_HOSTS).map((host) => host.toLowerCase()),
+            dcrClientTtlSeconds: parsed.MCP_OAUTH_DCR_CLIENT_TTL_SECONDS,
+            accessTokenTtlSeconds: parsed.MCP_OAUTH_ACCESS_TOKEN_TTL_SECONDS,
+            refreshTokenTtlSeconds: parsed.MCP_OAUTH_REFRESH_TOKEN_TTL_SECONDS,
+        },
+        observability: {
+            metricsEnabled: parsed.MCP_METRICS_ENABLED,
+            metricsBearerToken: parsed.MCP_METRICS_BEARER_TOKEN ?? null,
+        },
+        write: {
+            enabled: true,
+            confirmation: parsed.PINGCODE_WRITE_CONFIRMATION,
+            approvalSecret: parsed.PINGCODE_WRITE_APPROVAL_SECRET ?? null,
+            approvalSecretEphemeral,
+            approvalTtlSeconds: parsed.PINGCODE_WRITE_APPROVAL_TTL_SECONDS,
+            idempotencyTtlSeconds: parsed.PINGCODE_WRITE_IDEMPOTENCY_TTL_SECONDS,
+            store: parsed.PINGCODE_WRITE_STORE,
+            redisUrl: parsed.PINGCODE_WRITE_REDIS_URL ?? null,
+        },
+        logLevel: parsed.LOG_LEVEL,
+    };
+}
+function parseCsv(value) {
+    if (!value) {
+        return [];
+    }
+    return value
+        .split(",")
+        .map((item) => item.trim())
+        .filter(Boolean);
+}
+function stripTrailingSlash(value) {
+    return value.replace(/\/+$/, "");
+}
+function isLoopbackUrl(value) {
+    try {
+        return isLoopbackHost(new URL(value).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+export function isLoopbackHost(host) {
+    return host === "127.0.0.1" || host === "localhost" || host === "::1" || host === "[::1]";
+}
+function validatePublicBaseUrl(value, context) {
+    const url = new URL(value);
+    if (url.pathname !== "/" || url.search || url.hash) {
+        context.addIssue({
+            code: "custom",
+            message: "MCP_PUBLIC_BASE_URL 只能包含協議、主機和連接埠，不得包含路徑、查詢或片段",
+            path: ["MCP_PUBLIC_BASE_URL"],
+        });
+    }
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHost(url.hostname))) {
+        context.addIssue({
+            code: "custom",
+            message: "MCP_PUBLIC_BASE_URL 在非本機環境必須使用 HTTPS",
+            path: ["MCP_PUBLIC_BASE_URL"],
+        });
+    }
+}
+function isValidEncryptionKey(value) {
+    return /^[A-Za-z0-9+/_-]+={0,2}$/.test(value) && Buffer.from(value, "base64").length === 32;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,cAAc,GAAG,CAAC,CAAC,UAAU,CACjC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EACjF,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CACpC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC;KACpB,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvB,OAAO,CAAC,OAAO,CAAC;KAChB,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;AAE1C,MAAM,iBAAiB,GAAG,CAAC;KACxB,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACvB,OAAO,CAAC,MAAM,CAAC;KACf,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;AAE1C,MAAM,WAAW,GAAG,CAAC,CAAC,UAAU,CAC9B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EACjF,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CACnB,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,qBAAqB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,2BAA2B,CAAC;IACnE,uBAAuB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,kCAAkC,CAAC;IAC5E,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC9E,kBAAkB,EAAE,cAAc;IAClC,sBAAsB,EAAE,cAAc;IACtC,2BAA2B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACzF,2BAA2B,EAAE,CAAC,CAAC,MAAM;SAClC,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;SACrB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IACvB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,4BAA4B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACpF,2BAA2B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACpF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACjE,gBAAgB,EAAE,aAAa;IAC/B,iBAAiB,EAAE,cAAc;IACjC,mBAAmB,EAAE,WAAW;IAChC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9D,mBAAmB,EAAE,cAAc;IACnC,wBAAwB,EAAE,cAAc;IACxC,sBAAsB,EAAE,iBAAiB;IACzC,4BAA4B,EAAE,cAAc;IAC5C,gCAAgC,EAAE,CAAC,CAAC,MAAM;SACvC,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SAC3B,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC9B,kCAAkC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7F,mCAAmC,EAAE,CAAC,CAAC,MAAM;SAC1C,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACtB,OAAO,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC7B,mBAAmB,EAAE,aAAa;IAClC,wBAAwB,EAAE,cAAc;IACxC,8BAA8B,EAAE,cAAc;IAC9C,2BAA2B,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7F,mCAAmC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7F,sCAAsC,EAAE,CAAC,CAAC,MAAM;SAC7C,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,IAAI,CAAC;SACT,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;SACtB,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IAC5B,oBAAoB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACnE,wBAAwB,EAAE,cAAc;IACxC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACtE,CAAC;KACD,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,MAAM,WAAW,GAAG,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAC;IAC3D,MAAM,eAAe,GAAG,KAAK,CAAC,sBAAsB,KAAK,SAAS,CAAC;IAEnE,IAAI,WAAW,KAAK,eAAe,EAAE,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,oDAAoD;YAC7D,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,2BAA2B,GAAG,KAAK,CAAC,4BAA4B,EAAE,CAAC;QAC3E,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,+DAA+D;YACxE,IAAI,EAAE,CAAC,6BAA6B,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,IACE,KAAK,CAAC,mBAAmB;QACzB,CAAC,CAAC,KAAK,CAAC,wBAAwB,IAAI,KAAK,CAAC,wBAAwB,CAAC,MAAM,GAAG,EAAE,CAAC,EAC/E,CAAC;QACD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,oDAAoD;YAC7D,IAAI,EAAE,CAAC,0BAA0B,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,kBAAkB,KAAK,YAAY,IAAI,CAAC,CAAC,WAAW,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QACpF,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0CAA0C,EAAE,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,8BAA8B,EAAE,CAAC;QAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,sDAAsD,EAAE,IAAI,EAAE,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAC;IAClJ,CAAC;SAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAE,CAAC;QACvE,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,0DAA0D,EAAE,IAAI,EAAE,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAC;IACtJ,CAAC;IACD,IAAI,KAAK,CAAC,oBAAoB,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC;QAC9E,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,oBAAoB,KAAK,OAAO,EAAE,CAAC;QAC9E,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uDAAuD,EAAE,IAAI,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACzI,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC/D,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,mDAAmD;YAC5D,IAAI,EAAE,CAAC,kBAAkB,CAAC;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,kBAAkB,KAAK,YAAY,EAAE,CAAC;QAC9C,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,+DAA+D;gBACxE,IAAI,EAAE,CAAC,oBAAoB,CAAC;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC/B,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,uCAAuC;gBAChD,IAAI,EAAE,CAAC,qBAAqB,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,wBAAwB,EAAE,CAAC;YACpC,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,4CAA4C;gBACrD,IAAI,EAAE,CAAC,0BAA0B,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACjE,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,oDAAoD;gBAC7D,IAAI,EAAE,CAAC,0BAA0B,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;YACpE,OAAO,CAAC,QAAQ,CAAC;gBACf,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,wCAAwC;gBACjD,IAAI,EAAE,CAAC,qBAAqB,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,mBAAmB,EAAE,CAAC;YAC9B,qBAAqB,CAAC,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC;YAC/D,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,eAAe,KAAK,OAAO,EAAE,CAAC;gBACrE,OAAO,CAAC,QAAQ,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,6CAA6C;oBACtD,IAAI,EAAE,CAAC,iBAAiB,CAAC;iBAC1B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAwDL,MAAM,UAAU,UAAU,CACxB,cAAiC,OAAO,CAAC,GAAG,EAC5C,UAA6B,EAAE;IAE/B,MAAM,wBAAwB,GAAG,WAAW,CAAC,8BAA8B,EAAE,IAAI,EAAE,CAAC;IACpF,MAAM,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,iCAAiC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAChH,MAAM,oBAAoB,GAAG,uBAAuB;QAClD,CAAC,CAAC;YACE,GAAG,WAAW;YACd,8BAA8B,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACnE;QACH,CAAC,CAAC,WAAW,CAAC;IAChB,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACrD,MAAM,WAAW,GACf,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,sBAAsB;QACxD,CAAC,CAAC;YACE,QAAQ,EAAE,MAAM,CAAC,kBAAkB;YACnC,YAAY,EAAE,MAAM,CAAC,sBAAsB;SAC5C;QACH,CAAC,CAAC,IAAI,CAAC;IAEX,OAAO;QACL,QAAQ,EAAE;YACR,QAAQ,EAAE,MAAM,CAAC,kBAAkB;YACnC,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,qBAAqB,CAAC;YAC5D,YAAY,EAAE,kBAAkB,CAAC,MAAM,CAAC,uBAAuB,CAAC;YAChE,WAAW;YACX,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;YACpD,gBAAgB,EAAE,MAAM,CAAC,2BAA2B;YACpD,UAAU,EAAE,MAAM,CAAC,oBAAoB;YACvC,gBAAgB,EAAE,MAAM,CAAC,4BAA4B;YACrD,eAAe,EAAE,MAAM,CAAC,2BAA2B;SACpD;QACD,MAAM,EAAE;YACN,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,IAAI,EAAE,MAAM,CAAC,QAAQ;YACrB,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAChD,aAAa,EAAE,MAAM,CAAC,mBAAmB;gBACvC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,mBAAmB,CAAC;gBAChD,CAAC,CAAC,IAAI;SACT;QACD,KAAK,EAAE;YACL,KAAK,EAAE,MAAM,CAAC,eAAe;YAC7B,QAAQ,EAAE,MAAM,CAAC,mBAAmB,IAAI,IAAI;YAC5C,aAAa,EAAE,MAAM,CAAC,wBAAwB,IAAI,IAAI;YACtD,WAAW,EAAE,MAAM,CAAC,sBAAsB;YAC1C,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3E,IAAI,CAAC,WAAW,EAAE,CACnB;YACD,mBAAmB,EAAE,MAAM,CAAC,gCAAgC;YAC5D,qBAAqB,EAAE,MAAM,CAAC,kCAAkC;YAChE,sBAAsB,EAAE,MAAM,CAAC,mCAAmC;SACnE;QACD,aAAa,EAAE;YACb,cAAc,EAAE,MAAM,CAAC,mBAAmB;YAC1C,kBAAkB,EAAE,MAAM,CAAC,wBAAwB,IAAI,IAAI;SAC5D;QACD,KAAK,EAAE;YACL,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,MAAM,CAAC,2BAA2B;YAChD,cAAc,EAAE,MAAM,CAAC,8BAA8B,IAAI,IAAI;YAC7D,uBAAuB;YACvB,kBAAkB,EAAE,MAAM,CAAC,mCAAmC;YAC9D,qBAAqB,EAAE,MAAM,CAAC,sCAAsC;YACpE,KAAK,EAAE,MAAM,CAAC,oBAAoB;YAClC,QAAQ,EAAE,MAAM,CAAC,wBAAwB,IAAI,IAAI;SAClD;QACD,QAAQ,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;AAC5F,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAa,EACb,OAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gDAAgD;YACzD,IAAI,EAAE,CAAC,qBAAqB,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC7F,OAAO,CAAC,QAAQ,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,sCAAsC;YAC/C,IAAI,EAAE,CAAC,qBAAqB,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC;AAC9F,CAAC"}

package/dist/domain/content-hash.d.ts

@@ -0,0 +1,5 @@
+import * as z from "zod/v4";
+/** MCP content hashes are canonicalized before they enter a Preview/Commit plan. */
+export declare function normalizeContentHash(value: string): string;
+export declare const contentHashSchema: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+//# sourceMappingURL=content-hash.d.ts.map

package/dist/domain/content-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.d.ts","sourceRoot":"","sources":["../../src/domain/content-hash.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAI5B,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO1D;AAED,eAAO,MAAM,iBAAiB,wDAII,CAAC"}

package/dist/domain/content-hash.js

@@ -0,0 +1,17 @@
+import * as z from "zod/v4";
+const CONTENT_HASH_PATTERN = /^(?:sha256:|sha256-)?([0-9a-f]{64})$/i;
+/** MCP content hashes are canonicalized before they enter a Preview/Commit plan. */
+export function normalizeContentHash(value) {
+    const normalized = value.trim();
+    const match = CONTENT_HASH_PATTERN.exec(normalized);
+    if (!match) {
+        throw new Error("content hash 必須是 sha256:<64 位十六进制字符>");
+    }
+    return `sha256:${match[1].toLowerCase()}`;
+}
+export const contentHashSchema = z
+    .string()
+    .trim()
+    .regex(CONTENT_HASH_PATTERN, "content hash 必须是 sha256:<64 位十六进制字符>")
+    .transform(normalizeContentHash);
+//# sourceMappingURL=content-hash.js.map

package/dist/domain/content-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.js","sourceRoot":"","sources":["../../src/domain/content-hash.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,oBAAoB,GAAG,uCAAuC,CAAC;AAErE,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,oBAAoB,EAAE,sCAAsC,CAAC;KACnE,SAAS,CAAC,oBAAoB,CAAC,CAAC"}

package/dist/domain/requirement-context.d.ts

@@ -0,0 +1,29 @@
+export interface RequirementContext {
+    source: {
+        type: "wiki";
+        id: string;
+        shortId: string | null;
+        url: string;
+        apiUrl: string;
+        spaceId: string;
+        spaceName: string;
+        updatedAt: number | null;
+        retrievedAt: string;
+        contentHash: string;
+    };
+    title: string;
+    contentFormat: "markdown";
+    contentMarkdown: string;
+    parent: {
+        id: string;
+        title: string;
+        url: string | null;
+    } | null;
+    tags: Array<{
+        id: string;
+        name: string;
+    }>;
+    attachments: [];
+    relatedLinks: [];
+}
+//# sourceMappingURL=requirement-context.d.ts.map

package/dist/domain/requirement-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requirement-context.d.ts","sourceRoot":"","sources":["../../src/domain/requirement-context.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;QACX,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,UAAU,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE;QACN,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;KACpB,GAAG,IAAI,CAAC;IACT,IAAI,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1C,WAAW,EAAE,EAAE,CAAC;IAChB,YAAY,EAAE,EAAE,CAAC;CAClB"}

package/dist/domain/requirement-context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=requirement-context.js.map

package/dist/domain/requirement-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requirement-context.js","sourceRoot":"","sources":["../../src/domain/requirement-context.ts"],"names":[],"mappings":""}

package/dist/domain/test-case-context.d.ts

@@ -0,0 +1,56 @@
+export interface TestCaseContext {
+    source: {
+        type: "test_case";
+        id: string;
+        identifier: string;
+        shortId: string | null;
+        url: string;
+        apiUrl: string;
+        libraryId: string;
+        libraryIdentifier: string;
+        libraryName: string;
+        updatedAt: number | null;
+        retrievedAt: string;
+        contentHash: string;
+    };
+    title: string;
+    description: string | null;
+    precondition: string | null;
+    level: string | null;
+    testType: string | null;
+    importantLevel: TestCaseNamedValue | null;
+    suite: (TestCaseNamedValue & {
+        paths: string | null;
+    }) | null;
+    state: (TestCaseNamedValue & {
+        type: string | null;
+    }) | null;
+    type: TestCaseNamedValue | null;
+    maintenance: {
+        id: string;
+        name: string | null;
+        displayName: string | null;
+    } | null;
+    properties: Record<string, unknown>;
+    relationsAvailable: boolean;
+    relationErrorCode: string | null;
+    relationIds: string[];
+    relatedWorkItemIds: string[];
+    relations: Array<{
+        id: string;
+        targetType: string;
+        targetId: string | null;
+    }>;
+    steps: Array<{
+        stepId: string | null;
+        description: string;
+        expectedValue: string | null;
+        isGroup: boolean;
+        groupId: string | null;
+    }>;
+}
+export interface TestCaseNamedValue {
+    id: string;
+    name: string;
+}
+//# sourceMappingURL=test-case-context.d.ts.map

package/dist/domain/test-case-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-case-context.d.ts","sourceRoot":"","sources":["../../src/domain/test-case-context.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE;QACN,IAAI,EAAE,WAAW,CAAC;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC1C,KAAK,EAAE,CAAC,kBAAkB,GAAG;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC9D,KAAK,EAAE,CAAC,kBAAkB,GAAG;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAC7D,IAAI,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE;QACX,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;KAC5B,GAAG,IAAI,CAAC;IACT,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,SAAS,EAAE,KAAK,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC,CAAC;IACH,KAAK,EAAE,KAAK,CAAC;QACX,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,OAAO,EAAE,OAAO,CAAC;QACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd"}

package/dist/domain/test-case-context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=test-case-context.js.map

package/dist/domain/test-case-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-case-context.js","sourceRoot":"","sources":["../../src/domain/test-case-context.ts"],"names":[],"mappings":""}