vikunja-mcp-ng 0.4.0

package/dist/tools/admin.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Instance Admin Tool
+ *
+ * Covers the Vikunja OpenAPI spec's `/admin/*` operations: instance overview,
+ * every-project listing + owner reassignment, and instance-wide user
+ * management (list/create/delete, admin-flag toggle, status change).
+ *
+ * Reserved behind TWO gates, both of which must allow the call (module
+ * config can only narrow auth, never expand it — see
+ * src/tools/index.ts):
+ * 1. The deny-by-default `admin` module config key (see
+ *    src/config/types.ts DANGEROUS_MODULE_KEYS) — an operator must
+ *    explicitly opt in before this tool is even registered.
+ * 2. JWT-only auth gating, matching the existing `users`/`export` precedent
+ *    (src/tools/index.ts) — API-token sessions never see this tool
+ *    registered, regardless of the `admin` config value.
+ *
+ * `delete-user` additionally requires an explicit `confirm: true` argument
+ * (see docs/ENDPOINT-PLAYBOOK.md §7 honesty-in-descriptions convention) —
+ * account deletion is irreversible in 'now' mode and cannot be undone by
+ * this tool.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { AuthManager } from '../auth/AuthManager';
+import type { VikunjaClientFactory } from '../client/VikunjaClientFactory';
+/** `shared.AdminUser` per the OpenAPI spec. */
+export interface AdminUser {
+    id?: number;
+    username?: string;
+    email?: string;
+    name?: string;
+    is_admin?: boolean;
+    status?: number;
+    auth_provider?: string;
+    issuer?: string;
+    subject?: string;
+    bot_owner_id?: number;
+    created?: string;
+    updated?: string;
+}
+/** `models.Overview` per the OpenAPI spec. */
+export interface AdminOverview {
+    users?: number;
+    projects?: number;
+    tasks?: number;
+    teams?: number;
+    shares?: unknown;
+    license?: unknown;
+}
+export declare function registerAdminTool(server: McpServer, authManager: AuthManager, _clientFactory?: VikunjaClientFactory): void;
+//# sourceMappingURL=admin.d.ts.map

package/dist/tools/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/tools/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAQ3E,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACxB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAcD,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,SAAS,EACjB,WAAW,EAAE,WAAW,EACxB,cAAc,CAAC,EAAE,oBAAoB,GACpC,IAAI,CAoSN"}

package/dist/tools/admin.js

@@ -0,0 +1,207 @@
+"use strict";
+/**
+ * Instance Admin Tool
+ *
+ * Covers the Vikunja OpenAPI spec's `/admin/*` operations: instance overview,
+ * every-project listing + owner reassignment, and instance-wide user
+ * management (list/create/delete, admin-flag toggle, status change).
+ *
+ * Reserved behind TWO gates, both of which must allow the call (module
+ * config can only narrow auth, never expand it — see
+ * src/tools/index.ts):
+ * 1. The deny-by-default `admin` module config key (see
+ *    src/config/types.ts DANGEROUS_MODULE_KEYS) — an operator must
+ *    explicitly opt in before this tool is even registered.
+ * 2. JWT-only auth gating, matching the existing `users`/`export` precedent
+ *    (src/tools/index.ts) — API-token sessions never see this tool
+ *    registered, regardless of the `admin` config value.
+ *
+ * `delete-user` additionally requires an explicit `confirm: true` argument
+ * (see docs/ENDPOINT-PLAYBOOK.md §7 honesty-in-descriptions convention) —
+ * account deletion is irreversible in 'now' mode and cannot be undone by
+ * this tool.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAdminTool = registerAdminTool;
+const zod_1 = require("zod");
+const types_1 = require("../types");
+const logger_1 = require("../utils/logger");
+const validation_1 = require("../utils/validation");
+const response_factory_1 = require("../utils/response-factory");
+const vikunja_rest_1 = require("../utils/vikunja-rest");
+const read_only_1 = require("../utils/read-only");
+// user.Status enum per the OpenAPI spec (x-enum-varnames):
+// 0 StatusActive, 1 StatusEmailConfirmationRequired, 2 StatusDisabled, 3 StatusAccountLocked.
+// The MCP interface accepts readable string literals and converts to the
+// numeric wire value, matching the repeatMode/repeatAfter convention
+// documented in docs/API_NOTES.md.
+const USER_STATUS_MAP = {
+    active: 0,
+    'email-confirmation-required': 1,
+    disabled: 2,
+    'account-locked': 3,
+};
+function registerAdminTool(server, authManager, _clientFactory) {
+    server.tool('vikunja_admin', (0, read_only_1.withReadOnlyNote)('vikunja_admin', "Instance-admin operations: overview, list every project, reassign a project's owner, list/create/delete users, and toggle a user's admin flag or status. Reserved/deny-by-default: only registered when the 'admin' module config key is explicitly enabled AND the session is JWT-authenticated (API-token sessions never see this tool, regardless of config). 'delete-user' is irreversible in 'now' mode and requires an explicit confirm: true argument."), {
+        subcommand: zod_1.z.enum([
+            'overview',
+            'list-projects',
+            'set-project-owner',
+            'list-users',
+            'create-user',
+            'delete-user',
+            'set-user-admin',
+            'set-user-status',
+        ]),
+        // list-projects / list-users pagination + search
+        page: zod_1.z.number().int().positive().optional(),
+        perPage: zod_1.z.number().int().positive().max(100).optional(),
+        search: zod_1.z.string().optional(),
+        // set-project-owner
+        projectId: zod_1.z.number().int().positive().optional(),
+        ownerId: zod_1.z.number().int().positive().optional(),
+        // create-user
+        username: zod_1.z.string().min(3).max(250).optional(),
+        email: zod_1.z.string().email().max(250).optional(),
+        password: zod_1.z.string().min(8).max(72).optional(),
+        name: zod_1.z.string().optional(),
+        language: zod_1.z.string().optional(),
+        isAdmin: zod_1.z.boolean().optional(),
+        skipEmailConfirm: zod_1.z.boolean().optional(),
+        // delete-user / set-user-admin / set-user-status
+        userId: zod_1.z.number().int().positive().optional(),
+        mode: zod_1.z.enum(['now', 'scheduled']).optional(),
+        confirm: zod_1.z
+            .boolean()
+            .optional()
+            .describe('Must be true to perform delete-user — this operation is irreversible in "now" mode.'),
+        status: zod_1.z
+            .enum(['active', 'email-confirmation-required', 'disabled', 'account-locked'])
+            .optional(),
+    }, (0, read_only_1.getToolAnnotations)('vikunja_admin'), async (args) => {
+        if (!authManager.isAuthenticated()) {
+            throw new types_1.MCPError(types_1.ErrorCode.AUTH_REQUIRED, 'Authentication required. Please use vikunja_auth.connect first.');
+        }
+        if (authManager.getAuthType() !== 'jwt') {
+            throw new types_1.MCPError(types_1.ErrorCode.PERMISSION_DENIED, 'Admin operations require JWT authentication. Please reconnect using vikunja_auth.connect with JWT authentication.');
+        }
+        const subcommand = args.subcommand;
+        (0, read_only_1.assertWriteAllowed)('vikunja_admin', subcommand);
+        logger_1.logger.debug('Admin tool called', { subcommand });
+        try {
+            switch (subcommand) {
+                case 'overview': {
+                    const overview = await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'GET', '/admin/overview');
+                    logger_1.logger.info('Retrieved admin overview');
+                    const aorpResult = (0, response_factory_1.createAorpResponse)('overview', 'Retrieved instance admin overview', { overview }, { success: true });
+                    return { content: [{ type: 'text', text: aorpResult.content }] };
+                }
+                case 'list-projects': {
+                    const query = new URLSearchParams();
+                    if (args.page !== undefined)
+                        query.set('page', String(args.page));
+                    if (args.perPage !== undefined)
+                        query.set('per_page', String(args.perPage));
+                    if (args.search !== undefined)
+                        query.set('s', args.search);
+                    const qs = query.toString();
+                    const projects = (await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'GET', `/admin/projects${qs ? `?${qs}` : ''}`)) ?? [];
+                    logger_1.logger.info('Listed all instance projects (admin)', { count: projects.length });
+                    const aorpResult = (0, response_factory_1.createAorpResponse)('list-projects', `Retrieved ${projects.length} projects instance-wide`, { allProjects: projects }, { success: true, metadata: { count: projects.length } });
+                    return { content: [{ type: 'text', text: aorpResult.content }] };
+                }
+                case 'set-project-owner': {
+                    const projectId = (0, validation_1.validateAndConvertId)(args.projectId, 'projectId');
+                    const ownerId = (0, validation_1.validateAndConvertId)(args.ownerId, 'ownerId');
+                    const project = await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'PATCH', `/admin/projects/${projectId}/owner`, { owner_id: ownerId });
+                    logger_1.logger.info('Reassigned project owner (admin)', { projectId, ownerId });
+                    const aorpResult = (0, response_factory_1.createAorpResponse)('set-project-owner', `Project ${projectId} owner reassigned to user ${ownerId}`, { project }, { success: true });
+                    return { content: [{ type: 'text', text: aorpResult.content }] };
+                }
+                case 'list-users': {
+                    const query = new URLSearchParams();
+                    if (args.search !== undefined)
+                        query.set('s', args.search);
+                    if (args.page !== undefined)
+                        query.set('page', String(args.page));
+                    if (args.perPage !== undefined)
+                        query.set('per_page', String(args.perPage));
+                    const qs = query.toString();
+                    const users = (await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'GET', `/admin/users${qs ? `?${qs}` : ''}`)) ?? [];
+                    logger_1.logger.info('Listed all instance users (admin)', { count: users.length });
+                    const aorpResult = (0, response_factory_1.createAorpResponse)('list-users', `Retrieved ${users.length} users instance-wide`, { allUsers: users }, { success: true, metadata: { count: users.length } });
+                    return { content: [{ type: 'text', text: aorpResult.content }] };
+                }
+                case 'create-user': {
+                    if (!args.username || !args.email || !args.password) {
+                        throw new types_1.MCPError(types_1.ErrorCode.VALIDATION_ERROR, 'username, email, and password are required for create-user');
+                    }
+                    const body = {
+                        username: args.username,
+                        email: args.email,
+                        password: args.password,
+                    };
+                    if (args.name !== undefined)
+                        body.name = args.name;
+                    if (args.language !== undefined)
+                        body.language = args.language;
+                    if (args.isAdmin !== undefined)
+                        body.is_admin = args.isAdmin;
+                    if (args.skipEmailConfirm !== undefined)
+                        body.skip_email_confirm = args.skipEmailConfirm;
+                    const user = await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'POST', '/admin/users', body);
+                    logger_1.logger.info('Created user (admin)', { userId: user.id, username: user.username });
+                    const aorpResult = (0, response_factory_1.createAorpResponse)('create-user', `User '${user.username ?? args.username}' created successfully`, { user }, { success: true, metadata: { count: 1 } });
+                    return { content: [{ type: 'text', text: aorpResult.content }] };
+                }
+                case 'delete-user': {
+                    const userId = (0, validation_1.validateAndConvertId)(args.userId, 'userId');
+                    if (args.confirm !== true) {
+                        throw new types_1.MCPError(types_1.ErrorCode.VALIDATION_ERROR, 'Deleting a user is irreversible (in "now" mode). Pass confirm: true to proceed.');
+                    }
+                    const query = new URLSearchParams();
+                    if (args.mode !== undefined)
+                        query.set('mode', args.mode);
+                    const qs = query.toString();
+                    await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'DELETE', `/admin/users/${userId}${qs ? `?${qs}` : ''}`);
+                    logger_1.logger.info('Deleted user (admin)', { userId, mode: args.mode ?? 'scheduled' });
+                    const aorpResult = (0, response_factory_1.createAorpResponse)('delete-user', `User ${userId} deletion ${args.mode === 'now' ? 'completed immediately' : 'scheduled (confirmation email sent)'}`, { userId, mode: args.mode ?? 'scheduled' }, { success: true });
+                    return { content: [{ type: 'text', text: aorpResult.content }] };
+                }
+                case 'set-user-admin': {
+                    const userId = (0, validation_1.validateAndConvertId)(args.userId, 'userId');
+                    if (args.isAdmin === undefined) {
+                        throw new types_1.MCPError(types_1.ErrorCode.VALIDATION_ERROR, 'isAdmin is required for set-user-admin');
+                    }
+                    const user = await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'PATCH', `/admin/users/${userId}/admin`, { is_admin: args.isAdmin });
+                    logger_1.logger.info('Set user admin flag (admin)', { userId, isAdmin: args.isAdmin });
+                    const aorpResult = (0, response_factory_1.createAorpResponse)('set-user-admin', `User ${userId} admin flag set to ${args.isAdmin}`, { user }, { success: true });
+                    return { content: [{ type: 'text', text: aorpResult.content }] };
+                }
+                case 'set-user-status': {
+                    const userId = (0, validation_1.validateAndConvertId)(args.userId, 'userId');
+                    if (!args.status) {
+                        throw new types_1.MCPError(types_1.ErrorCode.VALIDATION_ERROR, 'status is required for set-user-status (one of: active, email-confirmation-required, disabled, account-locked)');
+                    }
+                    const user = await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'PATCH', `/admin/users/${userId}/status`, { status: USER_STATUS_MAP[args.status] });
+                    logger_1.logger.info('Set user status (admin)', { userId, status: args.status });
+                    const aorpResult = (0, response_factory_1.createAorpResponse)('set-user-status', `User ${userId} status set to ${args.status}`, { user }, { success: true });
+                    return { content: [{ type: 'text', text: aorpResult.content }] };
+                }
+                default:
+                    throw new types_1.MCPError(types_1.ErrorCode.VALIDATION_ERROR, `Unknown subcommand: ${subcommand}`);
+            }
+        }
+        catch (error) {
+            logger_1.logger.error('Admin operation failed', { error, subcommand });
+            if (error instanceof types_1.MCPError) {
+                throw error;
+            }
+            if (error instanceof Error) {
+                throw new types_1.MCPError(types_1.ErrorCode.API_ERROR, `Admin operation failed: ${error.message}`);
+            }
+            throw new types_1.MCPError(types_1.ErrorCode.INTERNAL_ERROR, 'An unexpected error occurred during admin operation');
+        }
+    });
+}
+//# sourceMappingURL=admin.js.map

package/dist/tools/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/tools/admin.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AAmDH,8CAwSC;AAxVD,6BAAwB;AAGxB,oCAA+C;AAC/C,4CAAyC;AACzC,oDAA2D;AAC3D,gEAA+D;AAC/D,wDAA2D;AAC3D,kDAA8F;AA4B9F,2DAA2D;AAC3D,8FAA8F;AAC9F,yEAAyE;AACzE,qEAAqE;AACrE,mCAAmC;AACnC,MAAM,eAAe,GAA2B;IAC9C,MAAM,EAAE,CAAC;IACT,6BAA6B,EAAE,CAAC;IAChC,QAAQ,EAAE,CAAC;IACX,gBAAgB,EAAE,CAAC;CACpB,CAAC;AAEF,SAAgB,iBAAiB,CAC/B,MAAiB,EACjB,WAAwB,EACxB,cAAqC;IAErC,MAAM,CAAC,IAAI,CACT,eAAe,EACf,IAAA,4BAAgB,EACd,eAAe,EACf,+bAA+b,CAChc,EACD;QACE,UAAU,EAAE,OAAC,CAAC,IAAI,CAAC;YACjB,UAAU;YACV,eAAe;YACf,mBAAmB;YACnB,YAAY;YACZ,aAAa;YACb,aAAa;YACb,gBAAgB;YAChB,iBAAiB;SAClB,CAAC;QAEF,iDAAiD;QACjD,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC5C,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QACxD,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAE7B,oBAAoB;QACpB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACjD,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAE/C,cAAc;QACd,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC/C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC7C,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC9C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAExC,iDAAiD;QACjD,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAC9C,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC7C,OAAO,EAAE,OAAC;aACP,OAAO,EAAE;aACT,QAAQ,EAAE;aACV,QAAQ,CAAC,qFAAqF,CAAC;QAClG,MAAM,EAAE,OAAC;aACN,IAAI,CAAC,CAAC,QAAQ,EAAE,6BAA6B,EAAE,UAAU,EAAE,gBAAgB,CAAC,CAAC;aAC7E,QAAQ,EAAE;KACd,EACD,IAAA,8BAAkB,EAAC,eAAe,CAAC,EACnC,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,aAAa,EACvB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,iBAAiB,EAC3B,mHAAmH,CACpH,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAEnC,IAAA,8BAAkB,EAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAEhD,eAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAElD,IAAI,CAAC;YACH,QAAQ,UAAU,EAAE,CAAC;gBACnB,KAAK,UAAU,CAAC,CAAC,CAAC;oBAChB,MAAM,QAAQ,GAAG,MAAM,IAAA,iCAAkB,EACvC,WAAW,EACX,KAAK,EACL,iBAAiB,CAClB,CAAC;oBAEF,eAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;oBAExC,MAAM,UAAU,GAAG,IAAA,qCAAkB,EACnC,UAAU,EACV,mCAAmC,EACnC,EAAE,QAAQ,EAAE,EACZ,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC5E,CAAC;gBAED,KAAK,eAAe,CAAC,CAAC,CAAC;oBACrB,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;oBACpC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;wBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBAClE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;wBAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;wBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC3D,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAE5B,MAAM,QAAQ,GACZ,CAAC,MAAM,IAAA,iCAAkB,EACvB,WAAW,EACX,KAAK,EACL,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,IAAI,EAAE,CAAC;oBAEX,eAAM,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;oBAEhF,MAAM,UAAU,GAAG,IAAA,qCAAkB,EACnC,eAAe,EACf,aAAa,QAAQ,CAAC,MAAM,yBAAyB,EACrD,EAAE,WAAW,EAAE,QAAQ,EAAE,EACzB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,CACxD,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC5E,CAAC;gBAED,KAAK,mBAAmB,CAAC,CAAC,CAAC;oBACzB,MAAM,SAAS,GAAG,IAAA,iCAAoB,EAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;oBACpE,MAAM,OAAO,GAAG,IAAA,iCAAoB,EAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;oBAE9D,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAkB,EACtC,WAAW,EACX,OAAO,EACP,mBAAmB,SAAS,QAAQ,EACpC,EAAE,QAAQ,EAAE,OAAO,EAAE,CACtB,CAAC;oBAEF,eAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;oBAExE,MAAM,UAAU,GAAG,IAAA,qCAAkB,EACnC,mBAAmB,EACnB,WAAW,SAAS,6BAA6B,OAAO,EAAE,EAC1D,EAAE,OAAO,EAAE,EACX,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC5E,CAAC;gBAED,KAAK,YAAY,CAAC,CAAC,CAAC;oBAClB,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;oBACpC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;wBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC3D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;wBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBAClE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;wBAAE,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC5E,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAE5B,MAAM,KAAK,GACT,CAAC,MAAM,IAAA,iCAAkB,EACvB,WAAW,EACX,KAAK,EACL,eAAe,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,CAAC,IAAI,EAAE,CAAC;oBAEX,eAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;oBAE1E,MAAM,UAAU,GAAG,IAAA,qCAAkB,EACnC,YAAY,EACZ,aAAa,KAAK,CAAC,MAAM,sBAAsB,EAC/C,EAAE,QAAQ,EAAE,KAAK,EAAE,EACnB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CACrD,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC5E,CAAC;gBAED,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACpD,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,gBAAgB,EAC1B,4DAA4D,CAC7D,CAAC;oBACJ,CAAC;oBAED,MAAM,IAAI,GAA4B;wBACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACxB,CAAC;oBACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;wBAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;oBACnD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;wBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;oBAC/D,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;wBAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;oBAC7D,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;wBAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC;oBAEzF,MAAM,IAAI,GAAG,MAAM,IAAA,iCAAkB,EAAY,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;oBAE5F,eAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAElF,MAAM,UAAU,GAAG,IAAA,qCAAkB,EACnC,aAAa,EACb,SAAS,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,wBAAwB,EAC/D,EAAE,IAAI,EAAE,EACR,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAC1C,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC5E,CAAC;gBAED,KAAK,aAAa,CAAC,CAAC,CAAC;oBACnB,MAAM,MAAM,GAAG,IAAA,iCAAoB,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAE3D,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;wBAC1B,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,gBAAgB,EAC1B,iFAAiF,CAClF,CAAC;oBACJ,CAAC;oBAED,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;oBACpC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;wBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAE5B,MAAM,IAAA,iCAAkB,EAAC,WAAW,EAAE,QAAQ,EAAE,gBAAgB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAE/F,eAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;oBAEhF,MAAM,UAAU,GAAG,IAAA,qCAAkB,EACnC,aAAa,EACb,QAAQ,MAAM,aAAa,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,qCAAqC,EAAE,EAClH,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,EAC1C,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC5E,CAAC;gBAED,KAAK,gBAAgB,CAAC,CAAC,CAAC;oBACtB,MAAM,MAAM,GAAG,IAAA,iCAAoB,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAC3D,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;wBAC/B,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,gBAAgB,EAC1B,wCAAwC,CACzC,CAAC;oBACJ,CAAC;oBAED,MAAM,IAAI,GAAG,MAAM,IAAA,iCAAkB,EACnC,WAAW,EACX,OAAO,EACP,gBAAgB,MAAM,QAAQ,EAC9B,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,CAC3B,CAAC;oBAEF,eAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;oBAE9E,MAAM,UAAU,GAAG,IAAA,qCAAkB,EACnC,gBAAgB,EAChB,QAAQ,MAAM,sBAAsB,IAAI,CAAC,OAAO,EAAE,EAClD,EAAE,IAAI,EAAE,EACR,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC5E,CAAC;gBAED,KAAK,iBAAiB,CAAC,CAAC,CAAC;oBACvB,MAAM,MAAM,GAAG,IAAA,iCAAoB,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAC3D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;wBACjB,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,gBAAgB,EAC1B,gHAAgH,CACjH,CAAC;oBACJ,CAAC;oBAED,MAAM,IAAI,GAAG,MAAM,IAAA,iCAAkB,EACnC,WAAW,EACX,OAAO,EACP,gBAAgB,MAAM,SAAS,EAC/B,EAAE,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CACzC,CAAC;oBAEF,eAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;oBAExE,MAAM,UAAU,GAAG,IAAA,qCAAkB,EACnC,iBAAiB,EACjB,QAAQ,MAAM,kBAAkB,IAAI,CAAC,MAAM,EAAE,EAC7C,EAAE,IAAI,EAAE,EACR,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;oBACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC5E,CAAC;gBAED;oBACE,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,gBAAgB,EAC1B,uBAAuB,UAAoB,EAAE,CAC9C,CAAC;YACN,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;YAE9D,IAAI,KAAK,YAAY,gBAAQ,EAAE,CAAC;gBAC9B,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,MAAM,IAAI,gBAAQ,CAAC,iBAAS,CAAC,SAAS,EAAE,2BAA2B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,IAAI,gBAAQ,CAAC,iBAAS,CAAC,cAAc,EAAE,qDAAqD,CAAC,CAAC;QACtG,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tools/auth.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Authentication Tool
+ * Handles authentication operations for Vikunja
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { AuthManager } from '../auth/AuthManager';
+import type { VikunjaClientFactory } from '../client/VikunjaClientFactory';
+export declare function registerAuthTool(server: McpServer, authManager: AuthManager, _clientFactory?: VikunjaClientFactory): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/tools/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/tools/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AA2F3E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAqLzH"}

package/dist/tools/auth.js

@@ -0,0 +1,175 @@
+"use strict";
+/**
+ * Authentication Tool
+ * Handles authentication operations for Vikunja
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAuthTool = registerAuthTool;
+const zod_1 = require("zod");
+const errors_1 = require("../types/errors");
+const client_1 = require("../client");
+const logger_1 = require("../utils/logger");
+const direct_middleware_1 = require("../middleware/direct-middleware");
+const security_1 = require("../utils/security");
+const error_handler_1 = require("../utils/error-handler");
+const response_factory_1 = require("../utils/response-factory");
+const simple_response_1 = require("../utils/simple-response");
+const vikunja_rest_1 = require("../utils/vikunja-rest");
+const read_only_1 = require("../utils/read-only");
+/**
+ * Verifies a freshly-connected session actually works, per the audit finding
+ * that 'connect' previously never contacted the server (bad URL/token only
+ * surfaced on the first real tool call — see docs/API-COVERAGE.md, "Auth,
+ * API tokens, and service/meta info", MEDIUM severity).
+ *
+ * Two round trips, in order:
+ * 1. `GET /info` — documented as requiring no authentication, so a failure
+ *    here means the URL itself is unreachable/wrong (DNS, connection
+ *    refused, wrong path, non-Vikunja server), independent of credentials.
+ *    Also returns the server version, surfaced in the connect response.
+ * 2. A cheap authenticated call to validate the credential itself. JWTs are
+ *    verified against `GET /user`; API tokens (`tk_*`) cannot use `/user`
+ *    (per docs/VIKUNJA_API_ISSUES.md #2, user-scoped endpoints reject `tk_`
+ *    tokens even when valid) so `GET /projects` with `per_page=1` is used
+ *    instead — a minimal authenticated call that both token types accept.
+ *
+ * On failure of either step, the caller's freshly-created session is rolled
+ * back (`authManager.disconnect()`) so a failed 'connect' does not leave a
+ * broken session behind, and a clear, actionable MCPError is thrown.
+ */
+async function verifyConnection(authManager, apiUrl, authType) {
+    let info;
+    try {
+        info = await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'GET', '/info');
+    }
+    catch (error) {
+        authManager.disconnect();
+        throw new errors_1.MCPError(errors_1.ErrorCode.AUTH_REQUIRED, `Could not reach a Vikunja server at ${apiUrl}: ${error instanceof Error ? error.message : String(error)}. Check the URL (it should point at the API, e.g. .../api/v1) and network connectivity.`);
+    }
+    try {
+        if (authType === 'jwt') {
+            await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'GET', '/user');
+        }
+        else {
+            await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'GET', '/projects?per_page=1');
+        }
+    }
+    catch (error) {
+        authManager.disconnect();
+        throw new errors_1.MCPError(errors_1.ErrorCode.AUTH_REQUIRED, `Vikunja server at ${apiUrl} was reachable, but the provided ${authType === 'jwt' ? 'JWT' : 'API'} token was rejected: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return typeof info.version === 'string' ? info.version : undefined;
+}
+function registerAuthTool(server, authManager, _clientFactory) {
+    server.tool('vikunja_auth', (0, read_only_1.withReadOnlyNote)('vikunja_auth', 'Manage authentication with Vikunja API (connect, status, refresh, disconnect, info)'), {
+        subcommand: zod_1.z.enum(['connect', 'status', 'refresh', 'disconnect', 'info']),
+        apiUrl: zod_1.z.string().url().optional(),
+        apiToken: zod_1.z.string().optional(),
+    }, (0, read_only_1.getToolAnnotations)('vikunja_auth'), (0, direct_middleware_1.applyRateLimiting)('vikunja_auth', async (args) => {
+        try {
+            (0, read_only_1.assertWriteAllowed)('vikunja_auth', args.subcommand);
+            switch (args.subcommand) {
+                case 'connect': {
+                    if (!args.apiUrl || !args.apiToken) {
+                        throw new errors_1.MCPError(errors_1.ErrorCode.VALIDATION_ERROR, 'apiUrl and apiToken are required for connect');
+                    }
+                    const secureMessage = (0, security_1.createSecureConnectionMessage)(args.apiUrl, args.apiToken);
+                    logger_1.logger.debug('Auth connect attempt: %s', secureMessage);
+                    // Check if already authenticated
+                    const currentStatus = authManager.getStatus();
+                    if (currentStatus.authenticated && currentStatus.apiUrl === args.apiUrl) {
+                        const response = (0, response_factory_1.createStandardResponse)('auth-connect', 'Already connected to Vikunja', { authenticated: true }, { apiUrl: args.apiUrl });
+                        return {
+                            content: (0, simple_response_1.formatMcpResponse)(response),
+                        };
+                    }
+                    // Auto-detect auth type will be handled by AuthManager
+                    logger_1.logger.info('Attempting to connect to Vikunja');
+                    authManager.connect(args.apiUrl, args.apiToken);
+                    const detectedAuthType = authManager.getAuthType();
+                    logger_1.logger.info('Successfully connected to Vikunja - authType: %s', detectedAuthType);
+                    // Verify the connection actually works before reporting success —
+                    // see verifyConnection()'s doc comment for why this is a
+                    // two-step round trip (unauthenticated /info, then a cheap
+                    // authenticated call). Throws (and rolls back the session) on
+                    // failure.
+                    const serverVersion = await verifyConnection(authManager, args.apiUrl, detectedAuthType);
+                    const response = (0, response_factory_1.createStandardResponse)('auth-connect', 'Successfully connected to Vikunja', { authenticated: true }, {
+                        apiUrl: args.apiUrl,
+                        authType: authManager.getAuthType(),
+                        ...(serverVersion !== undefined ? { serverVersion } : {}),
+                    });
+                    return {
+                        content: (0, simple_response_1.formatMcpResponse)(response),
+                    };
+                }
+                case 'status': {
+                    const status = authManager.getStatus();
+                    const response = (0, response_factory_1.createStandardResponse)('auth-status', status.authenticated ? 'Authentication status retrieved' : 'Not authenticated', status, status.authenticated ? { apiUrl: status.apiUrl } : undefined);
+                    return {
+                        content: (0, simple_response_1.formatMcpResponse)(response),
+                    };
+                }
+                case 'refresh': {
+                    // authManager.getAuthType() throws AUTH_REQUIRED when there is
+                    // no active session, which wrapAuthError below turns into a
+                    // clear "not authenticated" error.
+                    const authType = authManager.getAuthType();
+                    if (authType === 'jwt') {
+                        // Vikunja JWTs are short-lived (unlike API tokens) and the
+                        // spec documents POST /user/token/refresh to renew one. That
+                        // endpoint exchanges a refresh-token cookie set at login for
+                        // a new JWT -- but this server authenticates every request
+                        // with a single static Bearer token supplied via
+                        // vikunja_auth.connect and never establishes a cookie-based
+                        // session, so it has no refresh-token cookie to send. The
+                        // endpoint is therefore not usable from this server: calling
+                        // it would just fail with 401 "invalid or expired refresh
+                        // token". Report that accurately instead of attempting (and
+                        // silently failing) the call or claiming refresh isn't
+                        // needed.
+                        const response = (0, response_factory_1.createStandardResponse)('auth-refresh', 'JWT tokens expire and this server cannot refresh them automatically. Vikunja\'s POST /user/token/refresh endpoint requires a refresh-token cookie issued at login, but this server authenticates with a static Bearer token and holds no such cookie. When your JWT expires, obtain a new one (e.g. by logging in to Vikunja again) and call vikunja_auth connect with the new token.', { refreshed: false, authType: 'jwt', tokenExpires: true }, {
+                            reason: 'JWT refresh requires a refresh-token cookie this static-Bearer-token server does not have',
+                        });
+                        return {
+                            content: (0, simple_response_1.formatMcpResponse)(response),
+                        };
+                    }
+                    // API tokens (tk_*) are documented as long-lived and have no
+                    // refresh mechanism in the API, so this message remains accurate.
+                    const response = (0, response_factory_1.createStandardResponse)('auth-refresh', 'Token refresh not required for API tokens (tk_*) - they are long-lived and do not expire.', { refreshed: false, authType: 'api-token', tokenExpires: false }, { reason: 'API tokens do not expire' });
+                    return {
+                        content: (0, simple_response_1.formatMcpResponse)(response),
+                    };
+                }
+                case 'disconnect': {
+                    authManager.disconnect();
+                    await (0, client_1.clearGlobalClientFactory)();
+                    const response = (0, response_factory_1.createStandardResponse)('auth-disconnect', 'Successfully disconnected from Vikunja', { authenticated: false }, { previouslyConnected: true });
+                    return {
+                        content: (0, simple_response_1.formatMcpResponse)(response),
+                    };
+                }
+                case 'info': {
+                    // GET /info needs no auth server-side, but this subcommand
+                    // still requires an active session (like 'refresh') so it has a
+                    // server URL to ask.
+                    if (!authManager.isAuthenticated()) {
+                        throw new errors_1.MCPError(errors_1.ErrorCode.AUTH_REQUIRED, 'Authentication required. Please use vikunja_auth.connect first.');
+                    }
+                    const info = await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'GET', '/info');
+                    const response = (0, response_factory_1.createStandardResponse)('auth-info', 'Vikunja server info retrieved successfully', { info }, typeof info.version === 'string' ? { serverVersion: info.version } : undefined);
+                    return {
+                        content: (0, simple_response_1.formatMcpResponse)(response),
+                    };
+                }
+                default:
+                    throw new errors_1.MCPError(errors_1.ErrorCode.VALIDATION_ERROR, `Unknown subcommand: ${args.subcommand}`);
+            }
+        }
+        catch (error) {
+            throw (0, error_handler_1.wrapAuthError)(error, args.subcommand);
+        }
+    }));
+}
+//# sourceMappingURL=auth.js.map

package/dist/tools/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/tools/auth.ts"],"names":[],"mappings":";AAAA;;;GAGG;;AAgGH,4CAqLC;AAlRD,6BAAwB;AAGxB,4CAAsD;AACtD,sCAAqD;AACrD,4CAAyC;AACzC,uEAAoE;AACpE,gDAAkE;AAClE,0DAAuD;AACvD,gEAAmE;AACnE,8DAA6D;AAC7D,wDAA2D;AAC3D,kDAA8F;AAqB9F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,KAAK,UAAU,gBAAgB,CAC7B,WAAwB,EACxB,MAAc,EACd,QAA6B;IAE7B,IAAI,IAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAA,iCAAkB,EAAsB,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAQ,CAChB,kBAAS,CAAC,aAAa,EACvB,uCAAuC,MAAM,KAC3C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,MAAM,IAAA,iCAAkB,EAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,iCAAkB,EAAC,WAAW,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,UAAU,EAAE,CAAC;QACzB,MAAM,IAAI,iBAAQ,CAChB,kBAAS,CAAC,aAAa,EACvB,qBAAqB,MAAM,oCACzB,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAC/B,wBACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,SAAgB,gBAAgB,CAAC,MAAiB,EAAE,WAAwB,EAAE,cAAqC;IACjH,MAAM,CAAC,IAAI,CACT,cAAc,EACd,IAAA,4BAAgB,EACd,cAAc,EACd,qFAAqF,CACtF,EACD;QACE,UAAU,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACnC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAChC,EACD,IAAA,8BAAkB,EAAC,cAAc,CAAC,EAClC,IAAA,qCAAiB,EAAC,cAAc,EAAE,KAAK,EAAE,IAAc,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,IAAA,8BAAkB,EAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACpD,QAAQ,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxB,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACnC,MAAM,IAAI,iBAAQ,CAChB,kBAAS,CAAC,gBAAgB,EAC1B,8CAA8C,CAC/C,CAAC;oBACJ,CAAC;oBAED,MAAM,aAAa,GAAG,IAAA,wCAA6B,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAChF,eAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC;oBAExD,iCAAiC;oBACjC,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;oBAC9C,IAAI,aAAa,CAAC,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;wBACxE,MAAM,QAAQ,GAAG,IAAA,yCAAsB,EACrC,cAAc,EACd,8BAA8B,EAC9B,EAAE,aAAa,EAAE,IAAI,EAAE,EACvB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CACxB,CAAC;wBACF,OAAO;4BACL,OAAO,EAAE,IAAA,mCAAiB,EAAC,QAAQ,CAAC;yBACrC,CAAC;oBACJ,CAAC;oBAED,uDAAuD;oBACvD,eAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;oBAChD,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAChD,MAAM,gBAAgB,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;oBACnD,eAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE,gBAAgB,CAAC,CAAC;oBAElF,kEAAkE;oBAClE,yDAAyD;oBACzD,2DAA2D;oBAC3D,8DAA8D;oBAC9D,WAAW;oBACX,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;oBAEzF,MAAM,QAAQ,GAAG,IAAA,yCAAsB,EACrC,cAAc,EACd,mCAAmC,EACnC,EAAE,aAAa,EAAE,IAAI,EAAE,EACvB;wBACE,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE;wBACnC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC1D,CACF,CAAC;oBACF,OAAO;wBACL,OAAO,EAAE,IAAA,mCAAiB,EAAC,QAAQ,CAAC;qBACrC,CAAC;gBACJ,CAAC;gBAED,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACd,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,CAAC;oBACvC,MAAM,QAAQ,GAAG,IAAA,yCAAsB,EACrC,aAAa,EACb,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,mBAAmB,EAC9E,MAAM,EACN,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAC7D,CAAC;oBACF,OAAO;wBACL,OAAO,EAAE,IAAA,mCAAiB,EAAC,QAAQ,CAAC;qBACrC,CAAC;gBACJ,CAAC;gBAED,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,+DAA+D;oBAC/D,4DAA4D;oBAC5D,mCAAmC;oBACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;oBAE3C,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;wBACvB,2DAA2D;wBAC3D,6DAA6D;wBAC7D,6DAA6D;wBAC7D,2DAA2D;wBAC3D,iDAAiD;wBACjD,4DAA4D;wBAC5D,0DAA0D;wBAC1D,6DAA6D;wBAC7D,0DAA0D;wBAC1D,4DAA4D;wBAC5D,uDAAuD;wBACvD,UAAU;wBACV,MAAM,QAAQ,GAAG,IAAA,yCAAsB,EACrC,cAAc,EACd,uXAAuX,EACvX,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,EACzD;4BACE,MAAM,EACJ,2FAA2F;yBAC9F,CACF,CAAC;wBACF,OAAO;4BACL,OAAO,EAAE,IAAA,mCAAiB,EAAC,QAAQ,CAAC;yBACrC,CAAC;oBACJ,CAAC;oBAED,6DAA6D;oBAC7D,kEAAkE;oBAClE,MAAM,QAAQ,GAAG,IAAA,yCAAsB,EACrC,cAAc,EACd,2FAA2F,EAC3F,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,EAChE,EAAE,MAAM,EAAE,0BAA0B,EAAE,CACvC,CAAC;oBACF,OAAO;wBACL,OAAO,EAAE,IAAA,mCAAiB,EAAC,QAAQ,CAAC;qBACrC,CAAC;gBACJ,CAAC;gBAED,KAAK,YAAY,CAAC,CAAC,CAAC;oBAClB,WAAW,CAAC,UAAU,EAAE,CAAC;oBACzB,MAAM,IAAA,iCAAwB,GAAE,CAAC;oBACjC,MAAM,QAAQ,GAAG,IAAA,yCAAsB,EACrC,iBAAiB,EACjB,wCAAwC,EACxC,EAAE,aAAa,EAAE,KAAK,EAAE,EACxB,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,CAAC;oBACF,OAAO;wBACL,OAAO,EAAE,IAAA,mCAAiB,EAAC,QAAQ,CAAC;qBACrC,CAAC;gBACJ,CAAC;gBAED,KAAK,MAAM,CAAC,CAAC,CAAC;oBACZ,2DAA2D;oBAC3D,gEAAgE;oBAChE,qBAAqB;oBACrB,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,CAAC;wBACnC,MAAM,IAAI,iBAAQ,CAChB,kBAAS,CAAC,aAAa,EACvB,iEAAiE,CAClE,CAAC;oBACJ,CAAC;oBACD,MAAM,IAAI,GAAG,MAAM,IAAA,iCAAkB,EACnC,WAAW,EACX,KAAK,EACL,OAAO,CACR,CAAC;oBAEF,MAAM,QAAQ,GAAG,IAAA,yCAAsB,EACrC,WAAW,EACX,4CAA4C,EAC5C,EAAE,IAAI,EAAE,EACR,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAC/E,CAAC;oBACF,OAAO;wBACL,OAAO,EAAE,IAAA,mCAAiB,EAAC,QAAQ,CAAC;qBACrC,CAAC;gBACJ,CAAC;gBAED;oBACE,MAAM,IAAI,iBAAQ,CAChB,kBAAS,CAAC,gBAAgB,EAC1B,uBAAuB,IAAI,CAAC,UAAoB,EAAE,CACnD,CAAC;YACN,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAA,6BAAa,EAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/tools/batch-import.d.ts

@@ -0,0 +1,5 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { AuthManager } from '../auth/AuthManager';
+import type { VikunjaClientFactory } from '../client/VikunjaClientFactory';
+export declare function registerBatchImportTool(server: McpServer, authManager: AuthManager, _clientFactory?: VikunjaClientFactory): void;
+//# sourceMappingURL=batch-import.d.ts.map

package/dist/tools/batch-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-import.d.ts","sourceRoot":"","sources":["../../src/tools/batch-import.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAgB3E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,EAAE,oBAAoB,GAAG,IAAI,CA2KhI"}