vikunja-mcp-ng 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Jeremy Green
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,123 @@
+# Vikunja MCP Server
+
+**Give your AI assistant real hands on your Vikunja instance** — create and triage tasks, manage projects and Kanban boards, assign teammates, and more, through natural conversation.
+
+[![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![node: 20+](https://img.shields.io/badge/node-20%2B-brightgreen.svg)](package.json)
+[![MCP](https://img.shields.io/badge/MCP-server-purple.svg)](https://modelcontextprotocol.io)
+
+> 👋 **Why this fork exists:** we rely on this project and noticed the [upstream repo](https://github.com/democratize-technology/vikunja-mcp) had gone quiet, with a growing backlog of open PRs and issues. So we've taken over active maintenance here — triaging and resolving most of that backlog (tracked in [this issue](https://github.com/netadvanced/vikunja-mcp-ng/issues/19)). Full credit to the original authors for the foundation. If they'd like to pick it back up, we'll gladly hand the reins back — or work together.
+
+---
+
+## What this gives your AI assistant
+
+This server exposes Vikunja as **27 tools** (a session tool, 22 available by default or by auth type, and 4 sensitive ones that are off until an operator opts in), each covering one entity (tasks, projects, labels, teams…) with a consistent `subcommand` pattern — not a 1:1 REST proxy, but composite operations built for how an AI actually works: resolve a username instead of demanding a user ID, verify that tricky writes actually stuck instead of trusting a 200, and explicit confirmation gates on destructive operations. Your assistant reasons in natural language; the server turns that into correct Vikunja API calls and reports partial failures honestly instead of pretending success.
+
+## See it in action
+
+> **You:** "Move 'Fix login redirect bug' to In Review and show me the board."
+
+```typescript
+vikunja_tasks({ subcommand: "set-bucket", id: 342, bucketId: 43 })
+```
+
+`projectId`/`viewId` auto-resolve from the task — no need to know which view is the Kanban one. The task card slides from *Backlog* into *In Review* on the Kanban board, instantly visible to anyone else looking at the board.
+
+More end-to-end scenarios — daily triage, team sharing, project planning, staying informed, bulk imports, admin ops — each paired with the exact tool call and the resulting Vikunja UI state, live in [`docs/samples/`](docs/samples/).
+
+## Quick Start
+
+### From source
+
+```bash
+git clone https://github.com/netadvanced/vikunja-mcp-ng.git
+cd vikunja-mcp-ng
+npm ci
+npm run build
+```
+
+```json
+{
+  "mcpServers": {
+    "vikunja": {
+      "command": "node",
+      "args": ["/path/to/vikunja-mcp/dist/index.js"],
+      "env": {
+        "VIKUNJA_URL": "https://your-vikunja-instance.com/api/v1",
+        "VIKUNJA_API_TOKEN": "your-api-token"
+      }
+    }
+  }
+}
+```
+
+### Docker
+
+There's no published image yet — build it locally:
+
+```bash
+git clone https://github.com/netadvanced/vikunja-mcp-ng.git
+cd vikunja-mcp-ng
+docker build -t ghcr.io/netadvanced/vikunja-mcp-ng:latest .
+```
+
+```json
+{
+  "mcpServers": {
+    "vikunja": {
+      "command": "docker",
+      "args": [
+        "run", "-i", "--rm",
+        "-e", "VIKUNJA_URL",
+        "-e", "VIKUNJA_API_TOKEN",
+        "ghcr.io/netadvanced/vikunja-mcp-ng:latest"
+      ],
+      "env": {
+        "VIKUNJA_URL": "https://your-vikunja-instance.com/api/v1",
+        "VIKUNJA_API_TOKEN": "your-api-token"
+      }
+    }
+  }
+}
+```
+
+Using Docker Desktop's MCP Toolkit instead of a bare `docker run`? See [docs/DOCKER-DESKTOP-MCP.md](docs/DOCKER-DESKTOP-MCP.md) for the tested, step-by-step path.
+
+Full install options, JWT vs. API-token auth, module gating, and every environment variable live in the [Configuration guide](docs/CONFIGURATION.md).
+
+## Capabilities
+
+| Group | Tools | Covers |
+|---|---|---|
+| **Tasks** | `vikunja_tasks`, `vikunja_task_bulk`, `vikunja_task_assignees`, `vikunja_task_comments`, `vikunja_task_labels`, `vikunja_task_relations`, `vikunja_task_reminders` | CRUD, filtering, bulk ops, Kanban placement, subtasks, duplication, mark-read, comments, relations |
+| **Projects** | `vikunja_projects` | CRUD, hierarchy, views, Kanban buckets, sharing, duplication, opt-in backgrounds |
+| **Organize** | `vikunja_labels`, `vikunja_filters`, `vikunja_templates` | Labels, saved filters, reusable task templates |
+| **Collaborate** | `vikunja_teams`, `vikunja_users`\*, `vikunja_notifications`, `vikunja_subscriptions`, `vikunja_reactions` | Team membership, notifications, watch/react |
+| **Automate & move data** | `vikunja_webhooks`, `vikunja_batch_import`, `vikunja_export_project`\* | Webhooks (per-project and account-wide), CSV/JSON import, project export |
+
+\* JWT authentication only. User data export also has request/status/download tools (`vikunja_request_user_export`, `vikunja_user_export_status`, `vikunja_download_user_export`), all JWT-only. (`vikunja_webhooks`' account-wide `scope: 'user'` is JWT-only too; its default `scope: 'project'` works with either auth type.)
+
+A session tool, `vikunja_auth` (connect / status / info / refresh / disconnect), rounds out the always-on surface. Four more tools — `vikunja_tokens`, `vikunja_caldav_tokens`, `vikunja_admin`, and `vikunja_user_deletion` — exist for API-token management, CalDAV-token management, instance administration, and self account deletion. All are **disabled by default**; an operator opts in explicitly (see Configuration). `vikunja_user_deletion` is the most sensitive of the four — it can delete the connected account — so read its [Configuration guide entry](docs/CONFIGURATION.md#known-modules) before enabling it. `vikunja_projects` also has three opt-in cosmetic subcommands (project backgrounds) behind a `backgrounds` module toggle, off by default for the opposite reason: low value, not danger.
+
+Full subcommand-by-subcommand reference: [`docs/TOOLS.md`](docs/TOOLS.md).
+
+## Safety by design
+
+Every entity is a toggle you can disable in config, `vikunja_admin`/`vikunja_tokens`/`vikunja_caldav_tokens`/`vikunja_user_deletion` ship off until an operator opts in (and `vikunja_admin`/`vikunja_caldav_tokens`/`vikunja_user_deletion` additionally require an active JWT session), and a global read-only mode can reject every write/destructive subcommand while reads keep working. Full details: [Configuration guide](docs/CONFIGURATION.md#module-gating).
+
+## Links
+
+- [Sample walkthroughs](docs/samples/) — real conversations paired with the tool calls and UI results behind them
+- [Full tool reference](docs/TOOLS.md) — every tool, subcommand, and argument
+- [Configuration guide](docs/CONFIGURATION.md) — auth, secrets, module gating, rate limits
+- [Roadmap](docs/ROADMAP.md) — where the project is headed and why
+- [Contributing / endpoint playbook](docs/ENDPOINT-PLAYBOOK.md) — conventions for adding new coverage
+- [Local test stack](docs/LOCAL-TESTING.md) — disposable Vikunja+Postgres via Docker for trying this out safely
+- [Agent battle-testing harness](docs/BATTLE-TESTING.md) — spawns a real AI agent against the tool surface and grades it on correctness and ergonomics (manual, costs real money — see the doc before running)
+- [Docker Desktop MCP Toolkit how-to](docs/DOCKER-DESKTOP-MCP.md) — registering this server with `docker mcp`
+- [Releasing](docs/RELEASING.md) — versioning policy and the release checklist · [CHANGELOG](CHANGELOG.md)
+
+## License
+
+MIT — see [LICENSE](LICENSE).

package/dist/auth/AuthManager.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Authentication Manager
+ * Handles session management and token refresh for the MCP server
+ */
+import type { AuthSession } from '../types';
+export declare class AuthManager {
+    private session;
+    /**
+     * Detect authentication type based on token format
+     */
+    static detectAuthType(token: string): 'api-token' | 'jwt';
+    /**
+     * Initialize a new auth session
+     */
+    connect(apiUrl: string, apiToken: string, authType?: 'api-token' | 'jwt'): void;
+    /**
+     * Get current session
+     * @throws MCPError if not authenticated
+     */
+    getSession(): AuthSession;
+    /**
+     * Check if authenticated
+     */
+    isAuthenticated(): boolean;
+    /**
+     * Clear session
+     */
+    disconnect(): void;
+    /**
+     * Get auth status
+     */
+    getStatus(): {
+        authenticated: boolean;
+        apiUrl?: string;
+        userId?: string;
+        authType?: 'api-token' | 'jwt';
+    };
+    /**
+     * Get authentication type
+     * @throws MCPError if not authenticated
+     */
+    getAuthType(): 'api-token' | 'jwt';
+    /**
+     * Save session with auth type
+     */
+    saveSession(session: AuthSession): void;
+    /**
+     * Test-only method to set user ID
+     * @throws Error if used in production
+     */
+    setTestUserId(userId: string): void;
+    /**
+     * Test-only method to set token expiry
+     * @throws Error if used in production
+     */
+    setTestTokenExpiry(expiry: Date): void;
+    /**
+     * Validate test environment - prevents test methods from being used in production
+     * @throws Error if not in test environment
+     */
+    private validateTestEnvironment;
+}
+//# sourceMappingURL=AuthManager.d.ts.map

package/dist/auth/AuthManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthManager.d.ts","sourceRoot":"","sources":["../../src/auth/AuthManager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAI5C,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAA4B;IAE3C;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,KAAK;IAezD;;OAEG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,WAAW,GAAG,KAAK,GAAG,IAAI;IAa/E;;;OAGG;IACH,UAAU,IAAI,WAAW;IAUzB;;OAEG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACH,UAAU,IAAI,IAAI;IAIlB;;OAEG;IACH,SAAS,IAAI;QAAE,aAAa,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,KAAK,CAAA;KAAE;IAezG;;;OAGG;IACH,WAAW,IAAI,WAAW,GAAG,KAAK;IAUlC;;OAEG;IACH,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IASvC;;;OAGG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAWnC;;;OAGG;IACH,kBAAkB,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI;IAWtC;;;OAGG;IACH,OAAO,CAAC,uBAAuB;CAYhC"}

package/dist/auth/AuthManager.js

@@ -0,0 +1,137 @@
+"use strict";
+/**
+ * Authentication Manager
+ * Handles session management and token refresh for the MCP server
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthManager = void 0;
+const types_1 = require("../types");
+const logger_1 = require("../utils/logger");
+class AuthManager {
+    session = null;
+    /**
+     * Detect authentication type based on token format
+     */
+    static detectAuthType(token) {
+        // API tokens start with tk_
+        if (token.startsWith('tk_')) {
+            return 'api-token';
+        }
+        // JWTs have 3 parts separated by dots and start with eyJ (base64 for {"alg":)
+        if (token.startsWith('eyJ') && token.split('.').length === 3) {
+            return 'jwt';
+        }
+        // Default to API token for backward compatibility
+        return 'api-token';
+    }
+    /**
+     * Initialize a new auth session
+     */
+    connect(apiUrl, apiToken, authType) {
+        // Auto-detect auth type if not provided
+        const detectedAuthType = authType || AuthManager.detectAuthType(apiToken);
+        logger_1.logger.debug('AuthManager.connect - Creating session with authType: %s', detectedAuthType);
+        this.session = {
+            apiUrl,
+            apiToken,
+            authType: detectedAuthType,
+            // tokenExpiry and userId are optional
+        };
+        logger_1.logger.debug('AuthManager.connect - Session created successfully');
+    }
+    /**
+     * Get current session
+     * @throws MCPError if not authenticated
+     */
+    getSession() {
+        if (!this.session) {
+            throw new types_1.MCPError(types_1.ErrorCode.AUTH_REQUIRED, 'Authentication required. Please use vikunja_auth.connect first.');
+        }
+        return this.session;
+    }
+    /**
+     * Check if authenticated
+     */
+    isAuthenticated() {
+        return this.session !== null;
+    }
+    /**
+     * Clear session
+     */
+    disconnect() {
+        this.session = null;
+    }
+    /**
+     * Get auth status
+     */
+    getStatus() {
+        if (!this.session) {
+            return { authenticated: false };
+        }
+        const status = {
+            authenticated: true,
+            apiUrl: this.session.apiUrl,
+            authType: this.session.authType,
+        };
+        if (this.session.userId !== undefined) {
+            status.userId = this.session.userId;
+        }
+        return status;
+    }
+    /**
+     * Get authentication type
+     * @throws MCPError if not authenticated
+     */
+    getAuthType() {
+        if (!this.session) {
+            throw new types_1.MCPError(types_1.ErrorCode.AUTH_REQUIRED, 'Authentication required. Please use vikunja_auth.connect first.');
+        }
+        return this.session.authType;
+    }
+    /**
+     * Save session with auth type
+     */
+    saveSession(session) {
+        this.session = session;
+    }
+    // ==========================================
+    // TEST-ONLY METHODS - Protected by environment checks
+    // These methods are only available in test environments
+    // ==========================================
+    /**
+     * Test-only method to set user ID
+     * @throws Error if used in production
+     */
+    setTestUserId(userId) {
+        this.validateTestEnvironment();
+        if (!this.session) {
+            throw new types_1.MCPError(types_1.ErrorCode.AUTH_REQUIRED, 'Authentication required. Please use vikunja_auth.connect first.');
+        }
+        this.session.userId = userId;
+    }
+    /**
+     * Test-only method to set token expiry
+     * @throws Error if used in production
+     */
+    setTestTokenExpiry(expiry) {
+        this.validateTestEnvironment();
+        if (!this.session) {
+            throw new types_1.MCPError(types_1.ErrorCode.AUTH_REQUIRED, 'Authentication required. Please use vikunja_auth.connect first.');
+        }
+        this.session.tokenExpiry = expiry;
+    }
+    /**
+     * Validate test environment - prevents test methods from being used in production
+     * @throws Error if not in test environment
+     */
+    validateTestEnvironment() {
+        const nodeEnv = process.env.NODE_ENV;
+        const jestRunning = process.env.JEST_WORKER_ID !== undefined || process.env.NODE_ENV === 'test';
+        if (!jestRunning && nodeEnv !== 'test' && nodeEnv !== 'development') {
+            throw new Error('AuthManager test methods can only be used in test environments. ' +
+                'This is a security measure to prevent testing methods from being accessible in production.');
+        }
+    }
+}
+exports.AuthManager = AuthManager;
+//# sourceMappingURL=AuthManager.js.map

package/dist/auth/AuthManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthManager.js","sourceRoot":"","sources":["../../src/auth/AuthManager.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAGH,oCAA+C;AAC/C,4CAAyC;AAEzC,MAAa,WAAW;IACd,OAAO,GAAuB,IAAI,CAAC;IAE3C;;OAEG;IACH,MAAM,CAAC,cAAc,CAAC,KAAa;QACjC,4BAA4B;QAC5B,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,8EAA8E;QAC9E,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,kDAAkD;QAClD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,MAAc,EAAE,QAAgB,EAAE,QAA8B;QACtE,wCAAwC;QACxC,MAAM,gBAAgB,GAAG,QAAQ,IAAI,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC1E,eAAM,CAAC,KAAK,CAAC,0DAA0D,EAAE,gBAAgB,CAAC,CAAC;QAC3F,IAAI,CAAC,OAAO,GAAG;YACb,MAAM;YACN,QAAQ;YACR,QAAQ,EAAE,gBAAgB;YAC1B,sCAAsC;SACvC,CAAC;QACF,eAAM,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,UAAU;QACR,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,aAAa,EACvB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,SAAS;QACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,MAAM,GAAiG;YAC3G,aAAa,EAAE,IAAI;YACnB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;SAChC,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACtC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,WAAW;QACT,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,aAAa,EACvB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,OAAoB;QAC9B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,6CAA6C;IAC7C,sDAAsD;IACtD,wDAAwD;IACxD,6CAA6C;IAE7C;;;OAGG;IACH,aAAa,CAAC,MAAc;QAC1B,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,aAAa,EACvB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACH,kBAAkB,CAAC,MAAY;QAC7B,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,aAAa,EACvB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC;IACpC,CAAC;IAED;;;OAGG;IACK,uBAAuB;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QACrC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC;QAEhG,IAAI,CAAC,WAAW,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACb,kEAAkE;gBAClE,4FAA4F,CAC7F,CAAC;QACJ,CAAC;IACH,CAAC;CAEF;AA3JD,kCA2JC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Auth Module Exports - Simplified
+ * Eliminated over-engineered testing infrastructure
+ */
+export { AuthManager } from './AuthManager';
+export { Permission, PermissionManager, TOOL_PERMISSIONS, type PermissionCheckResult } from './permissions';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,MAAM,eAAe,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,14 @@
+"use strict";
+/**
+ * Auth Module Exports - Simplified
+ * Eliminated over-engineered testing infrastructure
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOOL_PERMISSIONS = exports.PermissionManager = exports.Permission = exports.AuthManager = void 0;
+var AuthManager_1 = require("./AuthManager");
+Object.defineProperty(exports, "AuthManager", { enumerable: true, get: function () { return AuthManager_1.AuthManager; } });
+var permissions_1 = require("./permissions");
+Object.defineProperty(exports, "Permission", { enumerable: true, get: function () { return permissions_1.Permission; } });
+Object.defineProperty(exports, "PermissionManager", { enumerable: true, get: function () { return permissions_1.PermissionManager; } });
+Object.defineProperty(exports, "TOOL_PERMISSIONS", { enumerable: true, get: function () { return permissions_1.TOOL_PERMISSIONS; } });
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AACpB,6CAA4G;AAAnG,yGAAA,UAAU,OAAA;AAAE,gHAAA,iBAAiB,OAAA;AAAE,+GAAA,gBAAgB,OAAA"}

package/dist/auth/permissions.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Permission System for Tool Access Control
+ * Centralizes authentication requirements and eliminates conditional tool registration
+ */
+import type { AuthSession } from '../types';
+/**
+ * Permissions required for different tool operations
+ */
+export declare enum Permission {
+    BASIC_AUTH = "basic_auth",// Basic authentication required
+    TASK_MANAGEMENT = "task_management",// Task CRUD operations
+    PROJECT_MANAGEMENT = "project_management",// Project CRUD operations
+    LABEL_MANAGEMENT = "label_management",// Label CRUD operations
+    TEAM_MANAGEMENT = "team_management",// Team CRUD operations
+    FILTER_MANAGEMENT = "filter_management",// Filter operations
+    TEMPLATE_MANAGEMENT = "template_management",// Template operations
+    WEBHOOK_MANAGEMENT = "webhook_management",// Webhook operations
+    BATCH_IMPORT = "batch_import",// Batch import operations
+    USER_MANAGEMENT = "user_management",// User operations and settings
+    DATA_EXPORT = "data_export"
+}
+/**
+ * Maps tools to their required permissions
+ */
+export declare const TOOL_PERMISSIONS: Record<string, Permission[]>;
+/**
+ * Permission validation result
+ */
+export interface PermissionCheckResult {
+    hasPermission: boolean;
+    missingPermissions: Permission[];
+    suggestedAuthType?: 'jwt';
+    errorMessage?: string;
+}
+/**
+ * Centralized permission checker
+ */
+export declare class PermissionManager {
+    /**
+     * Check if current session has required permissions for a tool
+     */
+    static checkToolPermission(session: AuthSession | null, toolName: string): PermissionCheckResult;
+    /**
+     * Check if session has specific permissions
+     */
+    static checkPermissions(session: AuthSession, requiredPermissions: Permission[]): PermissionCheckResult;
+    /**
+     * Get all available permissions for an auth type
+     */
+    static getAvailablePermissions(authType: 'api-token' | 'jwt'): Permission[];
+    /**
+     * Check if upgrading to JWT would grant the missing permissions
+     */
+    private static shouldSuggestJWT;
+    /**
+     * Generate helpful error message for permission failures
+     */
+    private static generatePermissionErrorMessage;
+}
+//# sourceMappingURL=permissions.d.ts.map

package/dist/auth/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;GAEG;AACH,oBAAY,UAAU;IAEpB,UAAU,eAAe,CAAW,gCAAgC;IACpE,eAAe,oBAAoB,CAAE,uBAAuB;IAC5D,kBAAkB,uBAAuB,CAAE,0BAA0B;IACrE,gBAAgB,qBAAqB,CAAE,wBAAwB;IAC/D,eAAe,oBAAoB,CAAE,uBAAuB;IAC5D,iBAAiB,sBAAsB,CAAE,oBAAoB;IAC7D,mBAAmB,wBAAwB,CAAE,sBAAsB;IACnE,kBAAkB,uBAAuB,CAAE,qBAAqB;IAChE,YAAY,iBAAiB,CAAO,0BAA0B;IAG9D,eAAe,oBAAoB,CAAE,+BAA+B;IACpE,WAAW,gBAAgB;CAC5B;AAiCD;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAiBzD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,EAAE,UAAU,EAAE,CAAC;IACjC,iBAAiB,CAAC,EAAE,KAAK,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,qBAAa,iBAAiB;IAC5B;;OAEG;IACH,MAAM,CAAC,mBAAmB,CACxB,OAAO,EAAE,WAAW,GAAG,IAAI,EAC3B,QAAQ,EAAE,MAAM,GACf,qBAAqB;IAqBxB;;OAEG;IACH,MAAM,CAAC,gBAAgB,CACrB,OAAO,EAAE,WAAW,EACpB,mBAAmB,EAAE,UAAU,EAAE,GAChC,qBAAqB;IAsCxB;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,QAAQ,EAAE,WAAW,GAAG,KAAK,GAAG,UAAU,EAAE;IAI3E;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAK/B;;OAEG;IACH,OAAO,CAAC,MAAM,CAAC,8BAA8B;CAyB9C"}

package/dist/auth/permissions.js

@@ -0,0 +1,173 @@
+"use strict";
+/**
+ * Permission System for Tool Access Control
+ * Centralizes authentication requirements and eliminates conditional tool registration
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionManager = exports.TOOL_PERMISSIONS = exports.Permission = void 0;
+/**
+ * Permissions required for different tool operations
+ */
+var Permission;
+(function (Permission) {
+    // Basic permissions available with both auth types
+    Permission["BASIC_AUTH"] = "basic_auth";
+    Permission["TASK_MANAGEMENT"] = "task_management";
+    Permission["PROJECT_MANAGEMENT"] = "project_management";
+    Permission["LABEL_MANAGEMENT"] = "label_management";
+    Permission["TEAM_MANAGEMENT"] = "team_management";
+    Permission["FILTER_MANAGEMENT"] = "filter_management";
+    Permission["TEMPLATE_MANAGEMENT"] = "template_management";
+    Permission["WEBHOOK_MANAGEMENT"] = "webhook_management";
+    Permission["BATCH_IMPORT"] = "batch_import";
+    // Advanced permissions requiring JWT authentication
+    Permission["USER_MANAGEMENT"] = "user_management";
+    Permission["DATA_EXPORT"] = "data_export";
+})(Permission || (exports.Permission = Permission = {}));
+/**
+ * Maps authentication types to their available permissions
+ */
+const AUTH_TYPE_PERMISSIONS = {
+    'api-token': [
+        Permission.BASIC_AUTH,
+        Permission.TASK_MANAGEMENT,
+        Permission.PROJECT_MANAGEMENT,
+        Permission.LABEL_MANAGEMENT,
+        Permission.TEAM_MANAGEMENT,
+        Permission.FILTER_MANAGEMENT,
+        Permission.TEMPLATE_MANAGEMENT,
+        Permission.WEBHOOK_MANAGEMENT,
+        Permission.BATCH_IMPORT,
+    ],
+    'jwt': [
+        // JWT includes all API token permissions plus advanced ones
+        Permission.BASIC_AUTH,
+        Permission.TASK_MANAGEMENT,
+        Permission.PROJECT_MANAGEMENT,
+        Permission.LABEL_MANAGEMENT,
+        Permission.TEAM_MANAGEMENT,
+        Permission.FILTER_MANAGEMENT,
+        Permission.TEMPLATE_MANAGEMENT,
+        Permission.WEBHOOK_MANAGEMENT,
+        Permission.BATCH_IMPORT,
+        Permission.USER_MANAGEMENT,
+        Permission.DATA_EXPORT,
+    ],
+};
+/**
+ * Maps tools to their required permissions
+ */
+exports.TOOL_PERMISSIONS = {
+    // Always available (only requires basic auth)
+    'vikunja_auth': [Permission.BASIC_AUTH],
+    'vikunja_tasks': [Permission.BASIC_AUTH, Permission.TASK_MANAGEMENT],
+    'vikunja_projects': [Permission.BASIC_AUTH, Permission.PROJECT_MANAGEMENT],
+    'vikunja_labels': [Permission.BASIC_AUTH, Permission.LABEL_MANAGEMENT],
+    'vikunja_teams': [Permission.BASIC_AUTH, Permission.TEAM_MANAGEMENT],
+    'vikunja_filters': [Permission.BASIC_AUTH, Permission.FILTER_MANAGEMENT],
+    'vikunja_templates': [Permission.BASIC_AUTH, Permission.TEMPLATE_MANAGEMENT],
+    'vikunja_webhooks': [Permission.BASIC_AUTH, Permission.WEBHOOK_MANAGEMENT],
+    'vikunja_batch_import': [Permission.BASIC_AUTH, Permission.BATCH_IMPORT],
+    // JWT-only tools
+    'vikunja_users': [Permission.BASIC_AUTH, Permission.USER_MANAGEMENT],
+    'vikunja_export_project': [Permission.BASIC_AUTH, Permission.DATA_EXPORT],
+    'vikunja_request_user_export': [Permission.BASIC_AUTH, Permission.DATA_EXPORT],
+    'vikunja_download_user_export': [Permission.BASIC_AUTH, Permission.DATA_EXPORT],
+};
+/**
+ * Centralized permission checker
+ */
+class PermissionManager {
+    /**
+     * Check if current session has required permissions for a tool
+     */
+    static checkToolPermission(session, toolName) {
+        // Handle no authentication
+        if (!session) {
+            const requiredPermissions = exports.TOOL_PERMISSIONS[toolName] || [Permission.BASIC_AUTH];
+            return {
+                hasPermission: false,
+                missingPermissions: requiredPermissions,
+                errorMessage: 'Authentication required. Please use vikunja_auth.connect first.',
+            };
+        }
+        // Get required permissions for the tool
+        const requiredPermissions = exports.TOOL_PERMISSIONS[toolName];
+        if (!requiredPermissions) {
+            // Unknown tool - allow by default but require basic auth
+            return this.checkPermissions(session, [Permission.BASIC_AUTH]);
+        }
+        return this.checkPermissions(session, requiredPermissions);
+    }
+    /**
+     * Check if session has specific permissions
+     */
+    static checkPermissions(session, requiredPermissions) {
+        const availablePermissions = AUTH_TYPE_PERMISSIONS[session.authType];
+        const missingPermissions = [];
+        // Handle case where auth type is not recognized
+        if (!availablePermissions) {
+            return {
+                hasPermission: false,
+                missingPermissions: requiredPermissions,
+                errorMessage: `Unknown authentication type: ${session.authType}`,
+            };
+        }
+        // Check each required permission
+        for (const permission of requiredPermissions) {
+            if (!availablePermissions.includes(permission)) {
+                missingPermissions.push(permission);
+            }
+        }
+        if (missingPermissions.length === 0) {
+            return { hasPermission: true, missingPermissions: [] };
+        }
+        // Generate helpful error message and suggestions
+        const errorMessage = this.generatePermissionErrorMessage(session.authType, missingPermissions);
+        const suggestedAuthType = this.shouldSuggestJWT(missingPermissions) ? 'jwt' : undefined;
+        const result = {
+            hasPermission: false,
+            missingPermissions,
+            errorMessage,
+            ...(suggestedAuthType !== undefined && { suggestedAuthType }),
+        };
+        return result;
+    }
+    /**
+     * Get all available permissions for an auth type
+     */
+    static getAvailablePermissions(authType) {
+        return [...AUTH_TYPE_PERMISSIONS[authType]];
+    }
+    /**
+     * Check if upgrading to JWT would grant the missing permissions
+     */
+    static shouldSuggestJWT(missingPermissions) {
+        const jwtOnlyPermissions = [Permission.USER_MANAGEMENT, Permission.DATA_EXPORT];
+        return missingPermissions.some(permission => jwtOnlyPermissions.includes(permission));
+    }
+    /**
+     * Generate helpful error message for permission failures
+     */
+    static generatePermissionErrorMessage(currentAuthType, missingPermissions) {
+        const jwtOnlyPermissions = [Permission.USER_MANAGEMENT, Permission.DATA_EXPORT];
+        const needsJWT = missingPermissions.some(permission => jwtOnlyPermissions.includes(permission));
+        if (needsJWT && currentAuthType === 'api-token') {
+            const operationNames = missingPermissions
+                .filter(p => jwtOnlyPermissions.includes(p))
+                .map(p => {
+                switch (p) {
+                    case Permission.USER_MANAGEMENT: return 'user operations';
+                    case Permission.DATA_EXPORT: return 'export operations';
+                    default: return p.replace('_', ' ');
+                }
+            })
+                .join(' and ');
+            return `${operationNames} require JWT authentication. Please reconnect using vikunja_auth.connect with JWT authentication.`;
+        }
+        // Generic permission error (shouldn't happen in current implementation)
+        return `Insufficient permissions. Missing: ${missingPermissions.join(', ')}`;
+    }
+}
+exports.PermissionManager = PermissionManager;
+//# sourceMappingURL=permissions.js.map

package/dist/auth/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAIH;;GAEG;AACH,IAAY,UAeX;AAfD,WAAY,UAAU;IACpB,mDAAmD;IACnD,uCAAyB,CAAA;IACzB,iDAAmC,CAAA;IACnC,uDAAyC,CAAA;IACzC,mDAAqC,CAAA;IACrC,iDAAmC,CAAA;IACnC,qDAAuC,CAAA;IACvC,yDAA2C,CAAA;IAC3C,uDAAyC,CAAA;IACzC,2CAA6B,CAAA;IAE7B,oDAAoD;IACpD,iDAAmC,CAAA;IACnC,yCAA2B,CAAA;AAC7B,CAAC,EAfW,UAAU,0BAAV,UAAU,QAerB;AAED;;GAEG;AACH,MAAM,qBAAqB,GAA8C;IACvE,WAAW,EAAE;QACX,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,kBAAkB;QAC7B,UAAU,CAAC,gBAAgB;QAC3B,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,iBAAiB;QAC5B,UAAU,CAAC,mBAAmB;QAC9B,UAAU,CAAC,kBAAkB;QAC7B,UAAU,CAAC,YAAY;KACxB;IACD,KAAK,EAAE;QACL,4DAA4D;QAC5D,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,kBAAkB;QAC7B,UAAU,CAAC,gBAAgB;QAC3B,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,iBAAiB;QAC5B,UAAU,CAAC,mBAAmB;QAC9B,UAAU,CAAC,kBAAkB;QAC7B,UAAU,CAAC,YAAY;QACvB,UAAU,CAAC,eAAe;QAC1B,UAAU,CAAC,WAAW;KACvB;CACF,CAAC;AAEF;;GAEG;AACU,QAAA,gBAAgB,GAAiC;IAC5D,8CAA8C;IAC9C,cAAc,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;IACvC,eAAe,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,eAAe,CAAC;IACpE,kBAAkB,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC;IAC1E,gBAAgB,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,gBAAgB,CAAC;IACtE,eAAe,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,eAAe,CAAC;IACpE,iBAAiB,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,iBAAiB,CAAC;IACxE,mBAAmB,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,mBAAmB,CAAC;IAC5E,kBAAkB,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC;IAC1E,sBAAsB,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,YAAY,CAAC;IAExE,iBAAiB;IACjB,eAAe,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,eAAe,CAAC;IACpE,wBAAwB,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,WAAW,CAAC;IACzE,6BAA6B,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,WAAW,CAAC;IAC9E,8BAA8B,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC,WAAW,CAAC;CAChF,CAAC;AAYF;;GAEG;AACH,MAAa,iBAAiB;IAC5B;;OAEG;IACH,MAAM,CAAC,mBAAmB,CACxB,OAA2B,EAC3B,QAAgB;QAEhB,2BAA2B;QAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,mBAAmB,GAAG,wBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YAClF,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,kBAAkB,EAAE,mBAAmB;gBACvC,YAAY,EAAE,iEAAiE;aAChF,CAAC;QACJ,CAAC;QAED,wCAAwC;QACxC,MAAM,mBAAmB,GAAG,wBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,yDAAyD;YACzD,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,gBAAgB,CACrB,OAAoB,EACpB,mBAAiC;QAEjC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,kBAAkB,GAAiB,EAAE,CAAC;QAE5C,gDAAgD;QAChD,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,OAAO;gBACL,aAAa,EAAE,KAAK;gBACpB,kBAAkB,EAAE,mBAAmB;gBACvC,YAAY,EAAE,gCAAgC,OAAO,CAAC,QAAQ,EAAE;aACjE,CAAC;QACJ,CAAC;QAED,iCAAiC;QACjC,KAAK,MAAM,UAAU,IAAI,mBAAmB,EAAE,CAAC;YAC7C,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/C,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAED,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;QACzD,CAAC;QAED,iDAAiD;QACjD,MAAM,YAAY,GAAG,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC/F,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAExF,MAAM,MAAM,GAA0B;YACpC,aAAa,EAAE,KAAK;YACpB,kBAAkB;YAClB,YAAY;YACZ,GAAG,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC;SAC9D,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,uBAAuB,CAAC,QAA6B;QAC1D,OAAO,CAAC,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,gBAAgB,CAAC,kBAAgC;QAC9D,MAAM,kBAAkB,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAChF,OAAO,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACxF,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,8BAA8B,CAC3C,eAAoC,EACpC,kBAAgC;QAEhC,MAAM,kBAAkB,GAAG,CAAC,UAAU,CAAC,eAAe,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QAChF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QAEhG,IAAI,QAAQ,IAAI,eAAe,KAAK,WAAW,EAAE,CAAC;YAChD,MAAM,cAAc,GAAG,kBAAkB;iBACtC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;iBAC3C,GAAG,CAAC,CAAC,CAAC,EAAE;gBACP,QAAQ,CAAC,EAAE,CAAC;oBACV,KAAK,UAAU,CAAC,eAAe,CAAC,CAAC,OAAO,iBAAiB,CAAC;oBAC1D,KAAK,UAAU,CAAC,WAAW,CAAC,CAAC,OAAO,mBAAmB,CAAC;oBACxD,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC,CAAC;iBACD,IAAI,CAAC,OAAO,CAAC,CAAC;YAEjB,OAAO,GAAG,cAAc,mGAAmG,CAAC;QAC9H,CAAC;QAED,wEAAwE;QACxE,OAAO,sCAAsC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC/E,CAAC;CACF;AAnHD,8CAmHC"}