vikunja-mcp-ng 0.4.0

package/dist/utils/error-handler.js

@@ -0,0 +1,336 @@
+"use strict";
+/**
+ * Simplified Error Handling using Zod + Security Patterns
+ *
+ * Replaces 461 lines of custom error handling with concise,
+ * secure patterns using Zod validation and minimal sanitization.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ErrorSchema = exports.handleFetchError = exports.createInternalError = exports.createValidationError = exports.wrapAuthError = exports.createAuthRequiredError = exports.wrapToolError = exports.transformApiError = exports.wrapIfRestOrigin = exports.handleStatusCodeError = void 0;
+exports.isMCPError = isMCPError;
+exports.hasStatusCode = hasStatusCode;
+const zod_1 = require("zod");
+const errors_1 = require("../types/errors");
+/**
+ * Shared prefix for every `MCPError` thrown by `vikunjaRestRequest`/
+ * `vikunjaRestMultipartRequest` (`src/utils/vikunja-rest.ts`) — kept as a
+ * local constant (rather than importing `isRestOriginError` from that
+ * module) so this file doesn't require every test that `jest.mock()`s
+ * `vikunja-rest` wholesale to also stub a new export. Must be kept in sync
+ * with `REST_ERROR_MESSAGE_PREFIX` in `vikunja-rest.ts` if that ever changes.
+ */
+const REST_ERROR_MESSAGE_PREFIX = 'Vikunja REST request failed (';
+/**
+ * Security-sensitive patterns that should be sanitized from error messages
+ * Minimal set of patterns for essential security while maintaining usability
+ */
+const SECURITY_PATTERNS = [
+    // File paths and system paths
+    /\/[a-zA-Z0-9_\-/.]+\.(json|js|ts|yml|yaml|conf|config|env|key|pem|p12|jks)/g,
+    /[A-Z]:\\[a-zA-Z0-9_\-\\]+\.(json|js|ts|yml|yaml|conf|config|env|key|pem|p12|jks)/g,
+    // Database connection strings
+    /mysql:\/\/[^@\s]+@[^/\s]+\/[a-zA-Z0-9_-]+/g,
+    /postgresql:\/\/[^@\s]+@[^/\s]+\/[a-zA-Z0-9_-]+/g,
+    /mongodb:\/\/[^@\s]+/g,
+    // Network details
+    /\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g,
+    /Bearer\s+[a-zA-Z0-9-_.]+/g,
+    /tk_[a-zA-Z0-9]{32,}/g,
+    // Stack traces
+    /at\s+[a-zA-Z_$][a-zA-Z0-9_$]*\s*\([^)]*\)/g,
+    /:\d+:\d+\)/g,
+];
+/**
+ * Type-safe error handler that preserves security while reducing complexity
+ */
+class SecureErrorHandler {
+    /**
+     * Sanitize error message by detecting and replacing ONLY security-sensitive information
+     * Preserves original error messages when they don't contain sensitive data
+     */
+    sanitize(message) {
+        if (typeof message !== 'string') {
+            return 'Unknown error';
+        }
+        const lowerMessage = message.toLowerCase();
+        // Only sanitize if we detect specific security-sensitive patterns
+        // Stack traces and internal file references (highest priority - most sensitive)
+        if (lowerMessage.includes(' at ') ||
+            lowerMessage.includes('.js:') ||
+            lowerMessage.includes('parseconfig') ||
+            lowerMessage.includes('loadconfig') ||
+            lowerMessage.includes('index.js:') ||
+            lowerMessage.includes('json.parse') ||
+            lowerMessage.includes('position 42') // Common JSON parse error pattern
+        ) {
+            return 'Internal system error';
+        }
+        // Database schema and connection details (table names, hosts, passwords)
+        if (lowerMessage.includes('er_no_such_table') ||
+            lowerMessage.includes('table \'') ||
+            lowerMessage.includes('mysql://') ||
+            lowerMessage.includes('postgresql://') ||
+            lowerMessage.includes('mongodb://') ||
+            lowerMessage.includes('schema') ||
+            lowerMessage.includes('column ')) {
+            return 'Database access error';
+        }
+        // Authentication tokens and mechanisms (JWT details, crypto keys)
+        if (lowerMessage.includes('jwt validation failed') ||
+            lowerMessage.includes('signature verification') ||
+            lowerMessage.includes('/etc/keys/') ||
+            lowerMessage.includes('jwt-public.pem') ||
+            lowerMessage.includes('tk_') ||
+            lowerMessage.includes('bearer ')) {
+            return 'Authentication error';
+        }
+        // Network details with IP addresses and ports (preserve general network errors)
+        if (/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/.test(message) || // IP addresses
+            lowerMessage.includes(':54321') ||
+            lowerMessage.includes(':443') ||
+            lowerMessage.includes('192.168.') ||
+            lowerMessage.includes('api.vikunja')) {
+            return 'Network connection error';
+        }
+        // API endpoints and internal structures (preserve general API errors)
+        if (lowerMessage.includes('/api/v1/') ||
+            lowerMessage.includes('projects/123/tasks') ||
+            lowerMessage.includes('status=completed&limit=50')) {
+            return 'API access error';
+        }
+        // File paths and system details (absolute paths, file extensions with content)
+        if (/\b\/[a-zA-Z0-9_\-/.]+\.[a-zA-Z]/.test(message) || // Unix paths with files
+            /\b[A-Z]:\\[a-zA-Z0-9_\\\-/.]+\.[a-zA-Z]/.test(message) || // Windows paths
+            lowerMessage.includes('permission denied') ||
+            lowerMessage.includes('no such file') ||
+            lowerMessage.includes('secrets.json') ||
+            lowerMessage.includes('config.js') ||
+            lowerMessage.includes('index.js')) {
+            return 'File system access error';
+        }
+        // Check for other security patterns
+        const hasSensitiveInfo = SECURITY_PATTERNS.some(pattern => pattern.test(message));
+        if (hasSensitiveInfo) {
+            return 'System error occurred';
+        }
+        // If no security patterns detected, return original message
+        return message;
+    }
+    /**
+     * Restore the conventional "Failed to <operation>: <message>" wrapping on
+     * an MCPError that originated from the direct-REST layer
+     * (`vikunjaRestRequest`, which throws `MCPError` itself now that
+     * node-vikunja is gone — see PR #73), while preserving the original
+     * `code`/`details` (including `.details.statusCode`) so callers can still
+     * branch on the underlying failure type (e.g. `NOT_FOUND`).
+     *
+     * Many call sites re-throw `instanceof MCPError` errors unmodified so
+     * their OWN validation/internal errors (e.g. "Task ID is required") aren't
+     * silently re-wrapped. Before PR #73, a task-refresh/assignee-update REST
+     * failure was a plain `Error`, so it fell through to `handleStatusCode`
+     * and got the friendly wrapping. After PR #73, the same failure is itself
+     * an `MCPError`, so that `instanceof MCPError` guard now short-circuits it
+     * too, leaking the raw "Vikunja REST request failed (...)" string to the
+     * user. REST-origin errors are distinguished from this tool's own
+     * validation/internal `MCPError`s by the message prefix `vikunjaRestRequest`
+     * always uses (`.details.statusCode` alone isn't reliable: network-level
+     * REST failures carry `.details.transient` instead, not a statusCode);
+     * errors that aren't REST-origin pass through unchanged.
+     */
+    wrapIfRestOrigin(error, operation) {
+        if (!error.message.startsWith(REST_ERROR_MESSAGE_PREFIX)) {
+            return error;
+        }
+        const sanitized = this.sanitize(error.message);
+        return new errors_1.MCPError(error.code, `Failed to ${operation}: ${sanitized}`, error.details);
+    }
+    /**
+     * Handle status code errors (404, etc.)
+     */
+    handleStatusCode(error, operation, resourceId, customMessage) {
+        if (this.isStatusCodeError(error) && error.statusCode === 404) {
+            if (customMessage) {
+                return new errors_1.MCPError(errors_1.ErrorCode.NOT_FOUND, customMessage);
+            }
+            const resourceInfo = resourceId ? ` with ID ${resourceId}` : '';
+            const resourceType = this.extractResourceType(operation);
+            return new errors_1.MCPError(errors_1.ErrorCode.NOT_FOUND, `${resourceType.charAt(0).toUpperCase() + resourceType.slice(1)}${resourceInfo} not found`);
+        }
+        // Real Error instances and explicitly-thrown strings contribute their
+        // message to the output. Any other shape (numbers, plain objects, null,
+        // undefined, etc.) becomes "Unknown error" so that arbitrary upstream
+        // API payloads never leak into the user-visible MCP error surface. This
+        // intentionally differs from transform() (which does stringify numbers/
+        // booleans) - tests/tools/tasks-relations.test.ts and
+        // tests/utils/error-handler.test.ts both assert this stricter behavior
+        // for handleStatusCode specifically.
+        let message;
+        if (error instanceof Error) {
+            message = error.message;
+        }
+        else if (typeof error === 'string') {
+            message = error;
+        }
+        else {
+            message = 'Unknown error';
+        }
+        const sanitized = this.sanitize(message);
+        return new errors_1.MCPError(errors_1.ErrorCode.API_ERROR, `Failed to ${operation}: ${sanitized}`);
+    }
+    /**
+     * Transform any error to MCPError with security sanitization
+     */
+    transform(error, context) {
+        if (error instanceof errors_1.MCPError) {
+            return error;
+        }
+        let message;
+        if (error instanceof Error) {
+            message = error.message;
+        }
+        else if (typeof error === 'string') {
+            message = error;
+        }
+        else if (typeof error === 'number' || typeof error === 'boolean') {
+            message = String(error);
+        }
+        else {
+            // Plain objects (even those with a message property), null, undefined,
+            // symbols, and bigints all become "Unknown error" here. Extracting
+            // .message from untrusted plain objects would let arbitrary upstream
+            // payloads into user-visible MCP errors.
+            message = 'Unknown error';
+        }
+        const sanitized = this.sanitize(message);
+        return new errors_1.MCPError(errors_1.ErrorCode.API_ERROR, `${context}: ${sanitized}`);
+    }
+    /**
+     * Wrap tool errors with consistent handling
+     */
+    wrap(error, toolName, operation, resourceId, customMessage) {
+        if (error instanceof errors_1.MCPError) {
+            return error;
+        }
+        if (this.isStatusCodeError(error)) {
+            return this.handleStatusCode(error, operation, resourceId, customMessage);
+        }
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        const sanitized = this.sanitize(message);
+        return new errors_1.MCPError(errors_1.ErrorCode.API_ERROR, `${toolName}.${operation} failed: ${sanitized}`);
+    }
+    /**
+     * Create standardized errors
+     */
+    createAuthRequired(operation) {
+        const context = operation ? ` to ${operation}` : '';
+        return new errors_1.MCPError(errors_1.ErrorCode.AUTH_REQUIRED, `Authentication required${context}. Please connect first:\n` +
+            `vikunja_auth.connect({\n` +
+            `  apiUrl: 'https://your-vikunja.com/api/v1',\n` +
+            `  apiToken: 'your-api-token'\n` +
+            `})\n\n` +
+            `Get your API token from Vikunja Settings > API Access.`);
+    }
+    createValidationError(message) {
+        return new errors_1.MCPError(errors_1.ErrorCode.VALIDATION_ERROR, message);
+    }
+    createInternalError(message, originalError) {
+        if (originalError instanceof Error) {
+            const sanitized = this.sanitize(originalError.message);
+            // Only include error details if they weren't sanitized to a generic message
+            if (sanitized !== originalError.message) {
+                // Security-sensitive content was detected and sanitized
+                return new errors_1.MCPError(errors_1.ErrorCode.INTERNAL_ERROR, message);
+            }
+            else {
+                // Safe to include the original error message
+                return new errors_1.MCPError(errors_1.ErrorCode.INTERNAL_ERROR, `${message}: ${sanitized}`);
+            }
+        }
+        return new errors_1.MCPError(errors_1.ErrorCode.INTERNAL_ERROR, message);
+    }
+    /**
+     * Handle fetch errors with authentication guidance
+     */
+    handleFetchError(error, operation) {
+        const message = error instanceof Error ? error.message : 'Unknown error';
+        const lowerMessage = message.toLowerCase();
+        // Authentication-related fetch failures
+        if (lowerMessage.includes('fetch failed') ||
+            lowerMessage.includes('econnrefused') ||
+            lowerMessage.includes('enotfound') ||
+            lowerMessage.includes('401') ||
+            lowerMessage.includes('403')) {
+            return new errors_1.MCPError(errors_1.ErrorCode.AUTH_REQUIRED, `Failed to ${operation}. Please check authentication and API access.`);
+        }
+        // Timeout errors
+        if (lowerMessage.includes('timeout')) {
+            return new errors_1.MCPError(errors_1.ErrorCode.API_ERROR, `Request timeout while trying to ${operation}. Please try again.`);
+        }
+        return this.transform(error, `Failed to ${operation}`);
+    }
+    // Helper methods
+    isStatusCodeError(error) {
+        return error !== null && typeof error === 'object' && 'statusCode' in error;
+    }
+    extractResourceType(operation) {
+        // Remove action verbs and get resource type
+        const cleaned = operation.replace(/^(get|update|delete|create|list)\s+/, '');
+        // Fallback mapping
+        if (cleaned === operation) {
+            if (operation.includes('project'))
+                return 'project';
+            if (operation.includes('task'))
+                return 'task';
+            if (operation.includes('label'))
+                return 'label';
+            if (operation.includes('share'))
+                return 'share';
+            return 'resource';
+        }
+        return cleaned || 'resource';
+    }
+}
+// Create singleton instance
+const errorHandler = new SecureErrorHandler();
+// Export simplified API
+const handleStatusCodeError = (error, operation, resourceId, customMessage) => errorHandler.handleStatusCode(error, operation, resourceId, customMessage);
+exports.handleStatusCodeError = handleStatusCodeError;
+const wrapIfRestOrigin = (error, operation) => errorHandler.wrapIfRestOrigin(error, operation);
+exports.wrapIfRestOrigin = wrapIfRestOrigin;
+const transformApiError = (error, context) => errorHandler.transform(error, context);
+exports.transformApiError = transformApiError;
+const wrapToolError = (error, toolName, operation, resourceId, customMessage) => errorHandler.wrap(error, toolName, operation, resourceId, customMessage);
+exports.wrapToolError = wrapToolError;
+const createAuthRequiredError = (operation) => errorHandler.createAuthRequired(operation);
+exports.createAuthRequiredError = createAuthRequiredError;
+const wrapAuthError = (error, operation) => {
+    if (error instanceof errors_1.MCPError) {
+        return error;
+    }
+    if (errorHandler.isStatusCodeError(error)) {
+        return errorHandler.handleStatusCode(error, operation);
+    }
+    return errorHandler.transform(error, 'Authentication error');
+};
+exports.wrapAuthError = wrapAuthError;
+const createValidationError = (message) => errorHandler.createValidationError(message);
+exports.createValidationError = createValidationError;
+const createInternalError = (message, originalError) => errorHandler.createInternalError(message, originalError);
+exports.createInternalError = createInternalError;
+const handleFetchError = (error, operation) => errorHandler.handleFetchError(error, operation);
+exports.handleFetchError = handleFetchError;
+// Type guards for better TypeScript support
+function isMCPError(error) {
+    return error instanceof errors_1.MCPError;
+}
+function hasStatusCode(error) {
+    return error !== null && typeof error === 'object' && 'statusCode' in error;
+}
+// Zod schema for error validation
+exports.ErrorSchema = zod_1.z.object({
+    message: zod_1.z.string(),
+    statusCode: zod_1.z.number().optional(),
+    code: zod_1.z.string().optional(),
+    stack: zod_1.z.string().optional(),
+});
+//# sourceMappingURL=error-handler.js.map

package/dist/utils/error-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/utils/error-handler.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAqZH,gCAEC;AAED,sCAEC;AAzZD,6BAAwB;AACxB,4CAAsD;AAEtD;;;;;;;GAOG;AACH,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AAElE;;;GAGG;AACH,MAAM,iBAAiB,GAAG;IACxB,8BAA8B;IAC9B,6EAA6E;IAC7E,mFAAmF;IAEnF,8BAA8B;IAC9B,4CAA4C;IAC5C,iDAAiD;IACjD,sBAAsB;IAEtB,kBAAkB;IAClB,yCAAyC;IACzC,2BAA2B;IAC3B,sBAAsB;IAEtB,eAAe;IACf,4CAA4C;IAC5C,aAAa;CACd,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB;IACtB;;;OAGG;IACK,QAAQ,CAAC,OAAe;QAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAE3C,kEAAkE;QAElE,gFAAgF;QAChF,IACE,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC7B,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC7B,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC;YACpC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;YACnC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;YACnC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,kCAAkC;UACvE,CAAC;YACD,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,yEAAyE;QACzE,IACE,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YACzC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;YACjC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;YACjC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC;YACtC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;YACnC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/B,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAChC,CAAC;YACD,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,kEAAkE;QAClE,IACE,YAAY,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAC9C,YAAY,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAC/C,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC;YACnC,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YACvC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC5B,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAChC,CAAC;YACD,OAAO,sBAAsB,CAAC;QAChC,CAAC;QAED,gFAAgF;QAChF,IACE,wCAAwC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,eAAe;YACzE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/B,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC7B,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;YACjC,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,EACpC,CAAC;YACD,OAAO,0BAA0B,CAAC;QACpC,CAAC;QAED,sEAAsE;QACtE,IACE,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;YACjC,YAAY,CAAC,QAAQ,CAAC,oBAAoB,CAAC;YAC3C,YAAY,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAClD,CAAC;YACD,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QAED,+EAA+E;QAC/E,IACE,iCAAiC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,wBAAwB;YAC3E,yCAAyC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,gBAAgB;YAC3E,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAC1C,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;YACrC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;YACrC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EACjC,CAAC;YACD,OAAO,0BAA0B,CAAC;QACpC,CAAC;QAED,oCAAoC;QACpC,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;QAElF,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,uBAAuB,CAAC;QACjC,CAAC;QAED,4DAA4D;QAC5D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,gBAAgB,CAAC,KAAe,EAAE,SAAiB;QACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,iBAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,SAAS,KAAK,SAAS,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACzF,CAAC;IAED;;OAEG;IACH,gBAAgB,CACd,KAAc,EACd,SAAiB,EACjB,UAA4B,EAC5B,aAAsB;QAEtB,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;YAC9D,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,IAAI,iBAAQ,CAAC,kBAAS,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAEzD,OAAO,IAAI,iBAAQ,CACjB,kBAAS,CAAC,SAAS,EACnB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,YAAY,YAAY,CAC3F,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,sDAAsD;QACtD,uEAAuE;QACvE,qCAAqC;QACrC,IAAI,OAAe,CAAC;QACpB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,eAAe,CAAC;QAC5B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,iBAAQ,CAAC,kBAAS,CAAC,SAAS,EAAE,aAAa,SAAS,KAAK,SAAS,EAAE,CAAC,CAAC;IACnF,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAc,EAAE,OAAe;QACvC,IAAI,KAAK,YAAY,iBAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAe,CAAC;QACpB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACrC,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YACnE,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,yCAAyC;YACzC,OAAO,GAAG,eAAe,CAAC;QAC5B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEzC,OAAO,IAAI,iBAAQ,CAAC,kBAAS,CAAC,SAAS,EAAE,GAAG,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC;IACvE,CAAC;IAED;;OAEG;IACH,IAAI,CACF,KAAc,EACd,QAAgB,EAChB,SAAiB,EACjB,UAA4B,EAC5B,aAAsB;QAEtB,IAAI,KAAK,YAAY,iBAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAEzC,OAAO,IAAI,iBAAQ,CACjB,kBAAS,CAAC,SAAS,EACnB,GAAG,QAAQ,IAAI,SAAS,YAAY,SAAS,EAAE,CAChD,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,SAAkB;QACnC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,iBAAQ,CACjB,kBAAS,CAAC,aAAa,EACvB,0BAA0B,OAAO,2BAA2B;YAC5D,0BAA0B;YAC1B,gDAAgD;YAChD,gCAAgC;YAChC,QAAQ;YACR,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,qBAAqB,CAAC,OAAe;QACnC,OAAO,IAAI,iBAAQ,CAAC,kBAAS,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,mBAAmB,CAAC,OAAe,EAAE,aAAuB;QAC1D,IAAI,aAAa,YAAY,KAAK,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACvD,4EAA4E;YAC5E,IAAI,SAAS,KAAK,aAAa,CAAC,OAAO,EAAE,CAAC;gBACxC,wDAAwD;gBACxD,OAAO,IAAI,iBAAQ,CAAC,kBAAS,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACN,6CAA6C;gBAC7C,OAAO,IAAI,iBAAQ,CAAC,kBAAS,CAAC,cAAc,EAAE,GAAG,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;QACD,OAAO,IAAI,iBAAQ,CAAC,kBAAS,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,KAAc,EAAE,SAAiB;QAChD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QAE3C,wCAAwC;QACxC,IACE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;YACrC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC;YACrC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC;YAClC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC5B,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC5B,CAAC;YACD,OAAO,IAAI,iBAAQ,CACjB,kBAAS,CAAC,aAAa,EACvB,aAAa,SAAS,+CAA+C,CACtE,CAAC;QACJ,CAAC;QAED,iBAAiB;QACjB,IAAI,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,iBAAQ,CACjB,kBAAS,CAAC,SAAS,EACnB,mCAAmC,SAAS,qBAAqB,CAClE,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,SAAS,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,iBAAiB;IACjB,iBAAiB,CAAC,KAAc;QAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,CAAC;IAC9E,CAAC;IAEO,mBAAmB,CAAC,SAAiB;QAC3C,4CAA4C;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,qCAAqC,EAAE,EAAE,CAAC,CAAC;QAE7E,mBAAmB;QACnB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YACpD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YAC9C,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAChD,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAChD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,OAAO,IAAI,UAAU,CAAC;IAC/B,CAAC;CACF;AAED,4BAA4B;AAC5B,MAAM,YAAY,GAAG,IAAI,kBAAkB,EAAE,CAAC;AAE9C,wBAAwB;AACjB,MAAM,qBAAqB,GAAG,CACnC,KAAc,EACd,SAAiB,EACjB,UAA4B,EAC5B,aAAsB,EACZ,EAAE,CAAC,YAAY,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAL7E,QAAA,qBAAqB,yBAKwD;AAEnF,MAAM,gBAAgB,GAAG,CAAC,KAAe,EAAE,SAAiB,EAAY,EAAE,CAC/E,YAAY,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AADrC,QAAA,gBAAgB,oBACqB;AAE3C,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAE,OAAe,EAAY,EAAE,CAC7E,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAD5B,QAAA,iBAAiB,qBACW;AAElC,MAAM,aAAa,GAAG,CAC3B,KAAc,EACd,QAAgB,EAChB,SAAiB,EACjB,UAA4B,EAC5B,aAAsB,EACZ,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAN3E,QAAA,aAAa,iBAM8D;AAEjF,MAAM,uBAAuB,GAAG,CAAC,SAAkB,EAAY,EAAE,CACtE,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;AADhC,QAAA,uBAAuB,2BACS;AAEtC,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,SAAiB,EAAY,EAAE;IAC3E,IAAI,KAAK,YAAY,iBAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,YAAY,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,YAAY,CAAC,SAAS,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;AAC/D,CAAC,CAAC;AAVW,QAAA,aAAa,iBAUxB;AAEK,MAAM,qBAAqB,GAAG,CAAC,OAAe,EAAY,EAAE,CACjE,YAAY,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AADjC,QAAA,qBAAqB,yBACY;AAEvC,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAE,aAAuB,EAAY,EAAE,CACxF,YAAY,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAD9C,QAAA,mBAAmB,uBAC2B;AAEpD,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAE,SAAiB,EAAY,EAAE,CAC9E,YAAY,CAAC,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AADrC,QAAA,gBAAgB,oBACqB;AAElD,4CAA4C;AAC5C,SAAgB,UAAU,CAAC,KAAc;IACvC,OAAO,KAAK,YAAY,iBAAQ,CAAC;AACnC,CAAC;AAED,SAAgB,aAAa,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,CAAC;AAC9E,CAAC;AAED,kCAAkC;AACrB,QAAA,WAAW,GAAG,OAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC"}

package/dist/utils/filtering/ClientSideFilteringStrategy.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Client-side filtering strategy
+ *
+ * This strategy loads all tasks from the API and then applies filtering
+ * logic on the client side. This is the traditional approach that works
+ * with all versions of Vikunja but may be less efficient for large datasets.
+ */
+import type { TaskFilteringStrategy } from './TaskFilteringStrategy';
+import type { FilteringParams, FilteringResult } from './types';
+export declare class ClientSideFilteringStrategy implements TaskFilteringStrategy {
+    execute(params: FilteringParams): Promise<FilteringResult>;
+}
+//# sourceMappingURL=ClientSideFilteringStrategy.d.ts.map

package/dist/utils/filtering/ClientSideFilteringStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientSideFilteringStrategy.d.ts","sourceRoot":"","sources":["../../../src/utils/filtering/ClientSideFilteringStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAkC,MAAM,SAAS,CAAC;AAoFhG,qBAAa,2BAA4B,YAAW,qBAAqB;IACjE,OAAO,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;CAoEjE"}

package/dist/utils/filtering/ClientSideFilteringStrategy.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * Client-side filtering strategy
+ *
+ * This strategy loads all tasks from the API and then applies filtering
+ * logic on the client side. This is the traditional approach that works
+ * with all versions of Vikunja but may be less efficient for large datasets.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientSideFilteringStrategy = void 0;
+const vikunja_rest_1 = require("../vikunja-rest");
+const types_1 = require("../../types");
+const validation_1 = require("../../tools/tasks/validation");
+const filtering_1 = require("../../tools/tasks/filtering");
+const logger_1 = require("../logger");
+const RestCrossProjectFilteringStrategy_1 = require("./RestCrossProjectFilteringStrategy");
+/**
+ * Fetches a single project's tasks. Calls the same `GET /projects/{id}/tasks`
+ * path the legacy client's `getProjectTasks` used pre-migration — this is a
+ * literal call-site migration (legacy client -> `vikunjaRestRequest`),
+ * not an endpoint redesign, so it is preserved byte-for-byte even though
+ * `docs/vikunja-openapi.json` does not document a GET method at this path
+ * (verified via `jq '.paths["/projects/{id}/tasks"]'`) — the per-view
+ * `GET /projects/{id}/views/{view}/tasks` endpoint the spec does document is
+ * a different, wider-scoped migration (extra view-resolution round trip,
+ * different Kanban response shape per docs/API_NOTES.md) left to a future
+ * item rather than folded into this refactor.
+ */
+async function fetchProjectTasks(authManager, projectId, params) {
+    // Client-side filtering never sends `filter` server-side (that's the whole
+    // point of this strategy) — apiParams never carries one for this code
+    // path, but the query is built explicitly without it for clarity.
+    const query = (0, RestCrossProjectFilteringStrategy_1.buildTasksListQuery)(params, undefined, {});
+    const path = `/projects/${projectId}/tasks${query ? `?${query}` : ''}`;
+    const tasks = await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'GET', path);
+    return Array.isArray(tasks) ? tasks : [];
+}
+/**
+ * Loads tasks from every project the user can access.
+ *
+ * Vikunja's dedicated "all tasks" endpoint (the legacy client's `getAllTasks` ->
+ * GET /tasks/all) returns HTTP 400 "Invalid model provided" on some servers
+ * (reproduced on v2.3.0), so it cannot be relied on for cross-project listing.
+ * This aggregates GET /projects/{id}/tasks across every project instead, which
+ * is consistently available. A project that fails individually is skipped
+ * rather than failing the whole listing.
+ */
+async function loadTasksAcrossProjects(authManager, params) {
+    const projects = await (0, vikunja_rest_1.vikunjaRestRequest)(authManager, 'GET', '/projects?per_page=1000');
+    const safeProjects = Array.isArray(projects) ? projects : [];
+    const perProject = await Promise.all(safeProjects.map(async (project) => {
+        const projectId = project.id;
+        // Skip pseudo-projects (e.g. Favorites uses a negative id) to avoid duplicate tasks.
+        if (typeof projectId !== 'number' || projectId <= 0) {
+            return [];
+        }
+        try {
+            return await fetchProjectTasks(authManager, projectId, params);
+        }
+        catch (error) {
+            logger_1.logger.warn('Skipping a project that failed during all-projects task aggregation', {
+                projectId,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return [];
+        }
+    }));
+    return perProject.flat();
+}
+class ClientSideFilteringStrategy {
+    async execute(params) {
+        const { args, filterExpression, filterString, params: apiParams, authManager } = params;
+        if (!authManager) {
+            // Programmer error: FilteringContext must only select this strategy
+            // when an authManager was threaded through from the tool handler.
+            throw new types_1.MCPError(types_1.ErrorCode.INTERNAL_ERROR, 'ClientSideFilteringStrategy requires an authManager');
+        }
+        logger_1.logger.info('Using client-side filtering', {
+            filter: filterString,
+            endpoint: args.projectId && !args.allProjects
+                ? 'getProjectTasks'
+                : 'getProjectTasks (aggregated across all projects)'
+        });
+        // Load tasks without server-side filtering
+        let tasks;
+        if (args.projectId !== undefined && !args.allProjects) {
+            // Validate project ID
+            (0, validation_1.validateId)(args.projectId, 'projectId');
+            // Get tasks for specific project without filter
+            tasks = await fetchProjectTasks(authManager, args.projectId, apiParams);
+        }
+        else {
+            // Aggregate tasks across all projects (GET /tasks/all is unreliable).
+            tasks = await loadTasksAcrossProjects(authManager, apiParams);
+        }
+        logger_1.logger.info('Tasks loaded for client-side filtering', {
+            totalTasksLoaded: tasks?.length || 0,
+            filter: filterString
+        });
+        // Apply client-side filtering if we have a filter expression
+        const safeTasks = tasks || [];
+        let filteredTasks = safeTasks;
+        if (filterExpression) {
+            const originalCount = safeTasks.length;
+            // applyFilter (evaluators.ts) and this strategy both type tasks as the
+            // generated `models.Task`; the cast here bridges the two nominally-
+            // distinct aliases at this boundary.
+            filteredTasks = (0, filtering_1.applyFilter)(safeTasks, filterExpression);
+            logger_1.logger.debug('Applied client-side filter', {
+                originalCount,
+                filteredCount: filteredTasks?.length || 0,
+                filter: filterString,
+            });
+        }
+        return {
+            tasks: filteredTasks || [],
+            metadata: {
+                serverSideFilteringUsed: false,
+                serverSideFilteringAttempted: false,
+                clientSideFiltering: Boolean(filterExpression),
+                filteringNote: filterExpression
+                    ? 'Client-side filtering applied'
+                    : 'No filter applied; tasks returned as loaded'
+            }
+        };
+    }
+}
+exports.ClientSideFilteringStrategy = ClientSideFilteringStrategy;
+//# sourceMappingURL=ClientSideFilteringStrategy.js.map

package/dist/utils/filtering/ClientSideFilteringStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientSideFilteringStrategy.js","sourceRoot":"","sources":["../../../src/utils/filtering/ClientSideFilteringStrategy.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAKH,kDAAqD;AACrD,uCAAkD;AAClD,6DAA0D;AAC1D,2DAA0D;AAC1D,sCAAmC;AACnC,2FAA0E;AAQ1E;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,iBAAiB,CAC9B,WAAwB,EACxB,SAAiB,EACjB,MAAyB;IAEzB,2EAA2E;IAC3E,sEAAsE;IACtE,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAA,uDAAmB,EAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,aAAa,SAAS,SAAS,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACvE,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAkB,EAAgB,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAChF,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,uBAAuB,CACpC,WAAwB,EACxB,MAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,IAAA,iCAAkB,EACvC,WAAW,EACX,KAAK,EACL,yBAAyB,CAC1B,CAAC;IACF,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7D,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAA0B,EAAE;QACzD,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,CAAC;QAC7B,qFAAqF;QACrF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,iBAAiB,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,IAAI,CAAC,qEAAqE,EAAE;gBACjF,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAa,2BAA2B;IACtC,KAAK,CAAC,OAAO,CAAC,MAAuB;QACnC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;QAExF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,oEAAoE;YACpE,kEAAkE;YAClE,MAAM,IAAI,gBAAQ,CAChB,iBAAS,CAAC,cAAc,EACxB,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,eAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;YACzC,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW;gBAC3C,CAAC,CAAC,iBAAiB;gBACnB,CAAC,CAAC,kDAAkD;SACvD,CAAC,CAAC;QAEH,2CAA2C;QAC3C,IAAI,KAAK,CAAC;QACV,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtD,sBAAsB;YACtB,IAAA,uBAAU,EAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACxC,gDAAgD;YAChD,KAAK,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,KAAK,GAAG,MAAM,uBAAuB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAChE,CAAC;QAED,eAAM,CAAC,IAAI,CAAC,wCAAwC,EAAE;YACpD,gBAAgB,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC;YACpC,MAAM,EAAE,YAAY;SACrB,CAAC,CAAC;QAEH,6DAA6D;QAC7D,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,aAAa,GAAG,SAAS,CAAC;QAE9B,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC;YACvC,uEAAuE;YACvE,oEAAoE;YACpE,qCAAqC;YACrC,aAAa,GAAG,IAAA,uBAAW,EACzB,SAAyD,EACzD,gBAAgB,CACW,CAAC;YAC9B,eAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACzC,aAAa;gBACb,aAAa,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;gBACzC,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,KAAK,EAAE,aAAa,IAAI,EAAE;YAC1B,QAAQ,EAAE;gBACR,uBAAuB,EAAE,KAAK;gBAC9B,4BAA4B,EAAE,KAAK;gBACnC,mBAAmB,EAAE,OAAO,CAAC,gBAAgB,CAAC;gBAC9C,aAAa,EAAE,gBAAgB;oBAC7B,CAAC,CAAC,+BAA+B;oBACjC,CAAC,CAAC,6CAA6C;aAClD;SACF,CAAC;IACJ,CAAC;CACF;AArED,kEAqEC"}

package/dist/utils/filtering/FilteringContext.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Filtering context for strategy selection and execution
+ *
+ * This class encapsulates the logic for selecting the appropriate filtering
+ * strategy based on configuration. HybridFilteringStrategy attempts
+ * server-side filtering and transparently falls back to client-side
+ * filtering on any server error, so it is safe to use whenever a filter
+ * is present.
+ */
+import type { FilteringParams, FilteringResult, StrategyConfig } from './types';
+export declare class FilteringContext {
+    private strategy;
+    constructor(config: StrategyConfig);
+    /**
+     * Execute filtering using the selected strategy
+     */
+    execute(params: FilteringParams): Promise<FilteringResult>;
+    /**
+     * Select the appropriate filtering strategy based on configuration.
+     *
+     * - enableServerSide -> HybridFilteringStrategy (server-side attempt with
+     *   automatic client-side fallback on any server error).
+     * - otherwise -> ClientSideFilteringStrategy.
+     *
+     * Server-side filtering used to be gated behind NODE_ENV=production or the
+     * VIKUNJA_ENABLE_SERVER_SIDE_FILTERING env var. That gate only ever disabled
+     * a self-healing path: with it off, every filtered list fetched a raw page
+     * and filtered it in memory, so `done`/`filter` were applied *after*
+     * pagination and matching tasks were scattered unpredictably across pages.
+     *
+     * - crossProject -> RestCrossProjectFilteringStrategy (direct REST GET
+     *   /tasks, one call, falling back to per-project aggregation on
+     *   failure) takes priority over `enableServerSide`: it is strictly
+     *   better than the N+1 aggregation whether or not a filter is present.
+     * - enableServerSide (single-project) -> HybridFilteringStrategy.
+     * - otherwise -> ClientSideFilteringStrategy.
+     */
+    private getStrategy;
+}
+//# sourceMappingURL=FilteringContext.d.ts.map

package/dist/utils/filtering/FilteringContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FilteringContext.d.ts","sourceRoot":"","sources":["../../../src/utils/filtering/FilteringContext.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAKhF,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAwB;gBAE5B,MAAM,EAAE,cAAc;IAIlC;;OAEG;IACG,OAAO,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAIhE;;;;;;;;;;;;;;;;;;;OAmBG;IACH,OAAO,CAAC,WAAW;CAWpB"}

package/dist/utils/filtering/FilteringContext.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Filtering context for strategy selection and execution
+ *
+ * This class encapsulates the logic for selecting the appropriate filtering
+ * strategy based on configuration. HybridFilteringStrategy attempts
+ * server-side filtering and transparently falls back to client-side
+ * filtering on any server error, so it is safe to use whenever a filter
+ * is present.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FilteringContext = void 0;
+const ClientSideFilteringStrategy_1 = require("./ClientSideFilteringStrategy");
+const HybridFilteringStrategy_1 = require("./HybridFilteringStrategy");
+const RestCrossProjectFilteringStrategy_1 = require("./RestCrossProjectFilteringStrategy");
+class FilteringContext {
+    strategy;
+    constructor(config) {
+        this.strategy = this.getStrategy(config);
+    }
+    /**
+     * Execute filtering using the selected strategy
+     */
+    async execute(params) {
+        return this.strategy.execute(params);
+    }
+    /**
+     * Select the appropriate filtering strategy based on configuration.
+     *
+     * - enableServerSide -> HybridFilteringStrategy (server-side attempt with
+     *   automatic client-side fallback on any server error).
+     * - otherwise -> ClientSideFilteringStrategy.
+     *
+     * Server-side filtering used to be gated behind NODE_ENV=production or the
+     * VIKUNJA_ENABLE_SERVER_SIDE_FILTERING env var. That gate only ever disabled
+     * a self-healing path: with it off, every filtered list fetched a raw page
+     * and filtered it in memory, so `done`/`filter` were applied *after*
+     * pagination and matching tasks were scattered unpredictably across pages.
+     *
+     * - crossProject -> RestCrossProjectFilteringStrategy (direct REST GET
+     *   /tasks, one call, falling back to per-project aggregation on
+     *   failure) takes priority over `enableServerSide`: it is strictly
+     *   better than the N+1 aggregation whether or not a filter is present.
+     * - enableServerSide (single-project) -> HybridFilteringStrategy.
+     * - otherwise -> ClientSideFilteringStrategy.
+     */
+    getStrategy(config) {
+        if (config.crossProject) {
+            return new RestCrossProjectFilteringStrategy_1.RestCrossProjectFilteringStrategy();
+        }
+        if (config.enableServerSide) {
+            return new HybridFilteringStrategy_1.HybridFilteringStrategy();
+        }
+        return new ClientSideFilteringStrategy_1.ClientSideFilteringStrategy();
+    }
+}
+exports.FilteringContext = FilteringContext;
+//# sourceMappingURL=FilteringContext.js.map

package/dist/utils/filtering/FilteringContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FilteringContext.js","sourceRoot":"","sources":["../../../src/utils/filtering/FilteringContext.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAIH,+EAA4E;AAC5E,uEAAoE;AACpE,2FAAwF;AAExF,MAAa,gBAAgB;IACnB,QAAQ,CAAwB;IAExC,YAAY,MAAsB;QAChC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,MAAuB;QACnC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACK,WAAW,CAAC,MAAsB;QACxC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,OAAO,IAAI,qEAAiC,EAAE,CAAC;QACjD,CAAC;QAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,OAAO,IAAI,iDAAuB,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,IAAI,yDAA2B,EAAE,CAAC;IAC3C,CAAC;CACF;AA7CD,4CA6CC"}

package/dist/utils/filtering/HybridFilteringStrategy.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Hybrid filtering strategy
+ *
+ * This strategy attempts server-side filtering first, and falls back to
+ * client-side filtering if server-side fails. This provides the best of
+ * both worlds: efficiency when possible, reliability always.
+ */
+import type { TaskFilteringStrategy } from './TaskFilteringStrategy';
+import type { FilteringParams, FilteringResult } from './types';
+export declare class HybridFilteringStrategy implements TaskFilteringStrategy {
+    private serverSideStrategy;
+    private clientSideStrategy;
+    execute(params: FilteringParams): Promise<FilteringResult>;
+}
+//# sourceMappingURL=HybridFilteringStrategy.d.ts.map

package/dist/utils/filtering/HybridFilteringStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HybridFilteringStrategy.d.ts","sourceRoot":"","sources":["../../../src/utils/filtering/HybridFilteringStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAKhE,qBAAa,uBAAwB,YAAW,qBAAqB;IACnE,OAAO,CAAC,kBAAkB,CAAqC;IAC/D,OAAO,CAAC,kBAAkB,CAAqC;IAEzD,OAAO,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;CA2CjE"}