vikunja-mcp-ng 0.4.0

package/dist/utils/security.js

@@ -0,0 +1,358 @@
+"use strict";
+/**
+ * Enhanced security utilities for comprehensive credential masking and sensitive data protection
+ * Prevents credential exposure in logs, monitoring systems, and error reports
+ *
+ * Security Features:
+ * - Comprehensive sensitive key detection with regex patterns
+ * - Case-insensitive matching with Unicode normalization
+ * - Credential format detection (JWT, API keys, database URIs, etc.)
+ * - Protection against encoding bypasses and Unicode attacks
+ * - Performance-optimized for large datasets
+ * - Integration with input sanitization layer for comprehensive protection
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.maskCredential = maskCredential;
+exports.maskUrl = maskUrl;
+exports.sanitizeLogData = sanitizeLogData;
+exports.createSecureLogConfig = createSecureLogConfig;
+exports.createSecureConnectionMessage = createSecureConnectionMessage;
+exports.clearSecurityCache = clearSecurityCache;
+exports.getSecurityCacheStats = getSecurityCacheStats;
+const validation_1 = require("./validation");
+// Comprehensive list of sensitive key patterns
+const SENSITIVE_KEY_PATTERNS = [
+    // Token patterns (enhanced to handle camelCase and embedded patterns)
+    /(?:^|[_-])(token|tokens|access_token|refresh_token|session_token|auth_token|bearer_token|csrf_token|xsrf_token)(?:$|[_-])/i,
+    /(?:^|[_-])(jwt|jwt_token|jwt_secret|id_token|access_key|secret_key|api_key|apikey|api_key_secret|refresh)(?:$|[_-])/i,
+    /(?:^|[_-])(session|sessionid|session_id|user_session|admin_session|phpsessid)(?:$|[_-])/i,
+    /(?:^|[_-])(bearer|authorization|auth|auth_header|x_auth_token|x_api_key)(?:$|[_-])/i,
+    // Password and credential patterns
+    /(?:^|[_-])(password|passwd|pass|pwd|credential|credentials|secret|private_key|privatekey)(?:$|[_-])/i,
+    /(?:^|[_-])(client_secret|client_id|client_key|app_secret|app_key|app_id)(?:$|[_-])/i,
+    /(?:^|[_-])(user|username|user_id|email|login|signin)(?:$|[_-])/i,
+    // Database and connection patterns
+    /(?:^|[_-])(database|db|connection|connection_string|mongo_uri|mongodb_uri|redis_url)(?:$|[_-])/i,
+    /(?:^|[_-])(host|hostname|server|endpoint|uri|url|link)(?:$|[_-])/i,
+    // OAuth and external service patterns
+    /(?:^|[_-])(oauth|oauth_token|oauth_secret|consumer_key|consumer_secret)(?:$|[_-])/i,
+    /(?:^|[_-])(github|gitlab|bitbucket|slack|discord|google|facebook|twitter)(?:$|[_-])/i,
+    // Encryption and security patterns
+    /(?:^|[_-])(encryption|encrypt|decrypt|cipher|hash|salt|pepper|nonce|iv)(?:$|[_-])/i,
+    /(?:^|[_-])(public_key|private_key|certificate|cert|ssl|tls|https)(?:$|[_-])/i,
+    // Configuration and environment patterns
+    /(?:^|[_-])(config|configuration|setting|env|environment|variable)(?:$|[_-])/i,
+    /(?:^|[_-])(secret|secrets|vault|keystore|credential_store)(?:$|[_-])/i,
+    // File and storage patterns
+    /(?:^|[_-])(file|path|directory|folder|storage|bucket|container)(?:$|[_-])/i,
+    // API and service patterns
+    /(?:^|[_-])(api|service|endpoint|webhook|callback|redirect)(?:$|[_-])/i,
+    // Enhanced patterns for camelCase and embedded sensitive keywords
+    /apiToken/i, // Direct match for apiToken
+    /jwtToken/i, // Direct match for jwtToken
+    /authKey/i, // Direct match for authKey
+    /apiKey/i, // Direct match for apiKey
+    // Contains patterns for embedded sensitive words
+    /(api|auth|token|key|secret|credential|pass|refresh)/i,
+    // Direct matches for common sensitive keys (fallbacks)
+    /^(token|key|secret|auth|credential|pass)$/i,
+    /\b(token|key|secret|auth|credential|pass)\b/i
+];
+// Regex patterns for detecting credential formats in string values
+const CREDENTIAL_FORMAT_PATTERNS = [
+    // JWT tokens (header.payload.signature with base64url encoding)
+    /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/,
+    // API key formats (adjusted for realistic test data)
+    /^tk_[a-zA-Z0-9]{8,}$/, // Vikunja token format (minimum 8 chars after tk_)
+    /^ghp_[a-zA-Z0-9]{36}$/, // GitHub personal access token
+    /^xoxb-[0-9]{10,}-[0-9]{10,}-[a-zA-Z0-9]{24}$/, // Slack bot token
+    /^AKIA[0-9A-Z]{16}$/, // AWS access key ID
+    /^[a-zA-Z0-9+/]{20,}={0,2}$/, // Base64 encoded keys/secrets (reduced minimum)
+    // Database connection URIs
+    /^mongodb:\/\/[^:]+:[^@]+@[^/]+/, // MongoDB URI with credentials
+    /^postgresql:\/\/[^:]+:[^@]+@[^/]+/, // PostgreSQL URI with credentials
+    /^mysql:\/\/[^:]+:[^@]+@[^/]+/, // MySQL URI with credentials
+    /^redis:\/\/:[^@]+@[^/]+/, // Redis URI with password
+    // UUID patterns (often used for session IDs or request IDs)
+    /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i,
+    // Long alphanumeric strings (likely keys or hashes) - more permissive
+    /^[a-zA-Z0-9]{32,}$/, // Changed from hex-only to alphanumeric
+    // Authorization headers
+    /^Bearer\s+[A-Za-z0-9._-]+/,
+    /^Basic\s+[A-Za-z0-9+/=]+/,
+    // Certificate PEM headers
+    /^-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----/,
+    /^-----BEGIN\s+CERTIFICATE-----/,
+    // High-entropy base64 strings (likely encoded secrets)
+    /^[A-Za-z0-9+/]{30,}={0,2}$/, // Reduced minimum for practical testing
+    // Request/Trace ID patterns
+    /^(req|trace|span|correlation)_[a-zA-Z0-9]{16,}$/
+];
+// Unicode normalization patterns to detect bypass attempts
+const UNICODE_NORMALIZATION_PATTERNS = [
+    /\u200b/, // Zero-width space
+    /\u200c/, // Zero-width non-joiner
+    /\u200d/, // Zero-width joiner
+    /\u200e/, // Left-to-right mark
+    /\u200f/, // Right-to-left mark
+    /\u2060/, // Word joiner
+    /\u180e/, // Mongolian vowel separator
+    /[\uFE00-\uFE0F]/, // Variation selectors
+];
+// Performance optimization: Cache normalized keys
+const normalizedKeyCache = new Map();
+/**
+ * Normalizes a key for security checking by:
+ * - Converting to lowercase
+ * - Removing Unicode bypass characters
+ * - Normalizing Unicode characters
+ * - Replacing common separators with underscores
+ *
+ * @param key - The key to normalize
+ * @returns Normalized key safe for comparison
+ */
+function normalizeSecurityKey(key) {
+    if (normalizedKeyCache.has(key)) {
+        return normalizedKeyCache.get(key);
+    }
+    let normalized = key.toLowerCase();
+    // Remove Unicode bypass characters
+    UNICODE_NORMALIZATION_PATTERNS.forEach(pattern => {
+        normalized = normalized.replace(pattern, '');
+    });
+    // Replace common separators with underscores for pattern matching
+    normalized = normalized.replace(/[-\s.]/g, '_');
+    // Remove multiple consecutive underscores
+    normalized = normalized.replace(/_+/g, '_');
+    // Trim leading/trailing underscores
+    normalized = normalized.replace(/^_+|_+$/g, '');
+    // Cache the result
+    normalizedKeyCache.set(key, normalized);
+    return normalized;
+}
+/**
+ * Checks if a key is sensitive using comprehensive pattern matching
+ *
+ * @param key - The key to check
+ * @returns True if the key matches any sensitive pattern
+ */
+function isSensitiveKey(key) {
+    const normalizedKey = normalizeSecurityKey(key);
+    return SENSITIVE_KEY_PATTERNS.some(pattern => {
+        // Test both original and normalized key against patterns
+        return pattern.test(key) || pattern.test(normalizedKey);
+    });
+}
+/**
+ * Checks if a string value looks like a credential based on format patterns
+ *
+ * @param value - The string value to check
+ * @returns True if the value matches credential format patterns
+ */
+function isCredentialFormat(value) {
+    // Only check strings of reasonable length (avoid false positives on short strings)
+    if (value.length < 8) {
+        return false;
+    }
+    // Check against credential format patterns
+    return CREDENTIAL_FORMAT_PATTERNS.some(pattern => pattern.test(value));
+}
+/**
+ * Enhanced credential masking that handles various formats
+ * Shows only the first 4 characters followed by ellipsis for long credentials
+ * Uses '[REDACTED]' for short credentials
+ *
+ * @param credential - The credential to mask (API token, password, etc.)
+ * @returns Masked credential string or empty string if input is invalid
+ */
+function maskCredential(credential) {
+    if (!credential || typeof credential !== 'string') {
+        return '';
+    }
+    // Normalize credential by removing Unicode bypass characters
+    let normalizedCredential = credential;
+    UNICODE_NORMALIZATION_PATTERNS.forEach(pattern => {
+        normalizedCredential = normalizedCredential.replace(pattern, '');
+    });
+    if (normalizedCredential.length <= 4) {
+        return '***';
+    }
+    return `${normalizedCredential.substring(0, 4)}...`;
+}
+/**
+ * Masks sensitive information in URLs for logging
+ * Enhanced detection of sensitive path components and query parameters
+ *
+ * @param url - The URL to mask
+ * @returns Masked URL string or original if not a valid URL
+ */
+function maskUrl(url) {
+    if (!url || typeof url !== 'string') {
+        return '';
+    }
+    try {
+        const urlObj = new URL(url);
+        // Enhanced sensitive path detection
+        const sensitivePathPatterns = [
+            /\/api\/v\d+\/(token|auth|login|key|session)/i,
+            /(auth|login|logout|signin|signout|token|key|session)/i,
+            /\/oauth\/(authorize|token|callback)/i,
+            /(admin|dashboard|control)/i
+        ];
+        const pathname = urlObj.pathname.toLowerCase();
+        if (sensitivePathPatterns.some(pattern => pattern.test(pathname))) {
+            // Mask the last path component
+            urlObj.pathname = urlObj.pathname.replace(/\/[^/]*$/, '/[REDACTED]');
+        }
+        // Mask all query parameters (they may contain sensitive data)
+        if (urlObj.search) {
+            urlObj.search = '?[REDACTED]';
+        }
+        // Mask sensitive URL fragments
+        if (urlObj.hash && isSensitiveKey(urlObj.hash.substring(1))) {
+            urlObj.hash = '#[REDACTED]';
+        }
+        return urlObj.toString();
+    }
+    catch {
+        // If URL parsing fails, just mask after the first slash (original behavior)
+        const firstSlashIndex = url.indexOf('/', url.indexOf('://') + 3);
+        if (firstSlashIndex !== -1) {
+            return `${url.substring(0, firstSlashIndex)}/[REDACTED]`;
+        }
+        return url;
+    }
+}
+/**
+ * Enhanced log data sanitization with comprehensive credential masking
+ * Recursively processes nested objects and arrays with advanced pattern detection
+ *
+ * @param data - The data object to sanitize
+ * @returns Sanitized data with masked sensitive fields
+ */
+function sanitizeLogData(data) {
+    return sanitizeLogDataInternal(data, new Set());
+}
+/**
+ * Internal recursive sanitization function with cycle detection
+ *
+ * @param data - The data to sanitize
+ * @param visited - Set of visited objects to prevent infinite recursion
+ * @returns Sanitized data
+ */
+function sanitizeLogDataInternal(data, visited) {
+    // Handle primitive types
+    if (data === null || data === undefined) {
+        return data;
+    }
+    if (typeof data === 'string') {
+        // Check for credential formats in string values
+        if (isCredentialFormat(data)) {
+            return maskCredential(data);
+        }
+        // Apply input sanitization to all non-credential string values
+        // This provides comprehensive XSS and injection protection
+        try {
+            return (0, validation_1.sanitizeString)(data);
+        }
+        catch {
+            // If sanitization fails, return the original string with fallback protection
+            // This ensures we don't break logging if input contains unexpected content
+            return '[SANITIZATION_FAILED]';
+        }
+    }
+    if (typeof data === 'number' || typeof data === 'boolean') {
+        return data;
+    }
+    // Handle arrays with recursion protection
+    if (Array.isArray(data)) {
+        if (visited.has(data)) {
+            return '[Circular Reference]';
+        }
+        visited.add(data);
+        return data.map(item => sanitizeLogDataInternal(item, visited));
+    }
+    // Handle objects with recursion protection
+    if (typeof data === 'object' && data !== null) {
+        if (visited.has(data)) {
+            return '[Circular Reference]';
+        }
+        visited.add(data);
+        const sanitized = {};
+        for (const [key, value] of Object.entries(data)) {
+            // Check if key is sensitive using enhanced detection
+            if (isSensitiveKey(key)) {
+                if (typeof value === 'string') {
+                    // For string sensitive values, use format detection
+                    if (isCredentialFormat(value)) {
+                        sanitized[key] = maskCredential(value);
+                    }
+                    else if (value.length > 50) {
+                        // Long strings in sensitive keys are likely credentials
+                        sanitized[key] = maskCredential(value);
+                    }
+                    else {
+                        sanitized[key] = '[REDACTED]';
+                    }
+                }
+                else {
+                    // Non-string sensitive values
+                    sanitized[key] = '[REDACTED]';
+                }
+            }
+            else {
+                // Recursively sanitize non-sensitive values
+                sanitized[key] = sanitizeLogDataInternal(value, visited);
+            }
+        }
+        return sanitized;
+    }
+    // Handle any other types (functions, symbols, etc.)
+    return '[Unsupported Type]';
+}
+/**
+ * Creates a secure configuration object for logging
+ * Masks sensitive environment variables and configuration values
+ *
+ * @param config - Configuration object to sanitize
+ * @returns Sanitized configuration for safe logging
+ */
+function createSecureLogConfig(config) {
+    return sanitizeLogData(config);
+}
+/**
+ * Generates a safe connection status message with masked credentials
+ * Enhanced with comprehensive URL and token masking
+ *
+ * @param url - Connection URL
+ * @param token - API token or credential
+ * @param authType - Type of authentication being used
+ * @returns Safe status message for logging
+ */
+function createSecureConnectionMessage(url, token, authType) {
+    const maskedUrl = maskUrl(url);
+    const maskedToken = maskCredential(token);
+    if (authType) {
+        return `Connecting to ${maskedUrl} with ${authType} token ${maskedToken}`;
+    }
+    return `Connecting to ${maskedUrl} with token ${maskedToken}`;
+}
+/**
+ * Performance utility to clear the normalized key cache
+ * Useful for testing or memory management in long-running processes
+ */
+function clearSecurityCache() {
+    normalizedKeyCache.clear();
+}
+/**
+ * Gets cache statistics for performance monitoring
+ *
+ * @returns Object containing cache size and performance metrics
+ */
+function getSecurityCacheStats() {
+    return {
+        size: normalizedKeyCache.size,
+        maxSize: 10000 // Configurable maximum cache size
+    };
+}
+//# sourceMappingURL=security.js.map

package/dist/utils/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/utils/security.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAsLH,wCAgBC;AASD,0BAyCC;AASD,0CAEC;AA2FD,sDAEC;AAWD,sEAaC;AAMD,gDAEC;AAOD,sDAKC;AA1YD,6CAA8C;AAE9C,+CAA+C;AAC/C,MAAM,sBAAsB,GAAG;IAC7B,sEAAsE;IACtE,4HAA4H;IAC5H,sHAAsH;IACtH,0FAA0F;IAC1F,qFAAqF;IAErF,mCAAmC;IACnC,sGAAsG;IACtG,qFAAqF;IACrF,iEAAiE;IAEjE,mCAAmC;IACnC,iGAAiG;IACjG,mEAAmE;IAEnE,sCAAsC;IACtC,oFAAoF;IACpF,sFAAsF;IAEtF,mCAAmC;IACnC,oFAAoF;IACpF,8EAA8E;IAE9E,yCAAyC;IACzC,8EAA8E;IAC9E,uEAAuE;IAEvE,4BAA4B;IAC5B,4EAA4E;IAE5E,2BAA2B;IAC3B,uEAAuE;IAEvE,kEAAkE;IAClE,WAAW,EAAE,4BAA4B;IACzC,WAAW,EAAE,4BAA4B;IACzC,UAAU,EAAG,2BAA2B;IACxC,SAAS,EAAG,0BAA0B;IAEtC,iDAAiD;IACjD,sDAAsD;IAEtD,uDAAuD;IACvD,4CAA4C;IAC5C,8CAA8C;CAC/C,CAAC;AAEF,mEAAmE;AACnE,MAAM,0BAA0B,GAAG;IACjC,gEAAgE;IAChE,kDAAkD;IAElD,qDAAqD;IACrD,sBAAsB,EAAE,mDAAmD;IAC3E,uBAAuB,EAAE,+BAA+B;IACxD,8CAA8C,EAAE,kBAAkB;IAClE,oBAAoB,EAAE,oBAAoB;IAC1C,4BAA4B,EAAE,gDAAgD;IAE9E,2BAA2B;IAC3B,gCAAgC,EAAE,+BAA+B;IACjE,mCAAmC,EAAE,kCAAkC;IACvE,8BAA8B,EAAE,6BAA6B;IAC7D,yBAAyB,EAAE,0BAA0B;IAErD,4DAA4D;IAC5D,4EAA4E;IAE5E,sEAAsE;IACtE,oBAAoB,EAAE,wCAAwC;IAE9D,wBAAwB;IACxB,2BAA2B;IAC3B,0BAA0B;IAE1B,0BAA0B;IAC1B,6CAA6C;IAC7C,gCAAgC;IAEhC,uDAAuD;IACvD,4BAA4B,EAAE,wCAAwC;IAEtE,4BAA4B;IAC5B,iDAAiD;CAClD,CAAC;AAEF,2DAA2D;AAC3D,MAAM,8BAA8B,GAAG;IACrC,QAAQ,EAAE,mBAAmB;IAC7B,QAAQ,EAAE,wBAAwB;IAClC,QAAQ,EAAE,oBAAoB;IAC9B,QAAQ,EAAE,qBAAqB;IAC/B,QAAQ,EAAE,qBAAqB;IAC/B,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,4BAA4B;IACtC,iBAAiB,EAAE,sBAAsB;CAC1C,CAAC;AAEF,kDAAkD;AAClD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAErD;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,GAAW;IACvC,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAW,CAAC;IAC/C,CAAC;IAED,IAAI,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAEnC,mCAAmC;IACnC,8BAA8B,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/C,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAEhD,0CAA0C;IAC1C,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE5C,oCAAoC;IACpC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAEhD,mBAAmB;IACnB,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACxC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAEhD,OAAO,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;QAC3C,yDAAyD;QACzD,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,mFAAmF;IACnF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2CAA2C;IAC3C,OAAO,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,cAAc,CAAC,UAAqC;IAClE,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,6DAA6D;IAC7D,IAAI,oBAAoB,GAAG,UAAU,CAAC;IACtC,8BAA8B,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/C,oBAAoB,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,IAAI,oBAAoB,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,OAAO,CAAC,GAA8B;IACpD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAE5B,oCAAoC;QACpC,MAAM,qBAAqB,GAAG;YAC5B,8CAA8C;YAC9C,uDAAuD;YACvD,sCAAsC;YACtC,4BAA4B;SAC7B,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAClE,+BAA+B;YAC/B,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QACvE,CAAC;QAED,8DAA8D;QAC9D,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,CAAC,MAAM,GAAG,aAAa,CAAC;QAChC,CAAC;QAED,+BAA+B;QAC/B,IAAI,MAAM,CAAC,IAAI,IAAI,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,GAAG,aAAa,CAAC;QAC9B,CAAC;QAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,MAAM,eAAe,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACjE,IAAI,eAAe,KAAK,CAAC,CAAC,EAAE,CAAC;YAC3B,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,aAAa,CAAC;QAC3D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,eAAe,CAAC,IAAa;IAC3C,OAAO,uBAAuB,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,IAAa,EAAE,OAAwB;IACtE,yBAAyB;IACzB,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,gDAAgD;QAChD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,+DAA+D;QAC/D,2DAA2D;QAC3D,IAAI,CAAC;YACH,OAAO,IAAA,2BAAc,EAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,6EAA6E;YAC7E,2EAA2E;YAC3E,OAAO,uBAAuB,CAAC;QACjC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,SAAS,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,sBAAsB,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,2CAA2C;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,sBAAsB,CAAC;QAChC,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAElB,MAAM,SAAS,GAA4B,EAAE,CAAC;QAE9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,qDAAqD;YACrD,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC9B,oDAAoD;oBACpD,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9B,SAAS,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;oBACzC,CAAC;yBAAM,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;wBAC7B,wDAAwD;wBACxD,SAAS,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;oBACzC,CAAC;yBAAM,CAAC;wBACN,SAAS,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;oBAChC,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,8BAA8B;oBAC9B,SAAS,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;gBAChC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,4CAA4C;gBAC5C,SAAS,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,oDAAoD;IACpD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,MAA+B;IACnE,OAAO,eAAe,CAAC,MAAM,CAA4B,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,6BAA6B,CAC3C,GAAuB,EACvB,KAAyB,EACzB,QAAiB;IAEjB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAE1C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,iBAAiB,SAAS,SAAS,QAAQ,UAAU,WAAW,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO,iBAAiB,SAAS,eAAe,WAAW,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAgB,kBAAkB;IAChC,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB;IACnC,OAAO;QACL,IAAI,EAAE,kBAAkB,CAAC,IAAI;QAC7B,OAAO,EAAE,KAAK,CAAC,kCAAkC;KAClD,CAAC;AACJ,CAAC"}

package/dist/utils/simple-response.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Simple Response Formatter
+ * Replaces the over-engineered 2,925-line AORP system with direct, clean responses
+ */
+import type { ResponseMetadata } from '../types/responses';
+import type { Task, Project, Label, User } from '../types/vikunja';
+/**
+ * Common data structures that can be passed to response formatters
+ */
+export interface ResponseData {
+    /** Array of items with common identifiers */
+    items?: Array<{
+        id?: number | string;
+        title?: string;
+        name?: string;
+        [key: string]: unknown;
+    }>;
+    /** Tasks collection */
+    tasks?: Task[];
+    /** Projects collection */
+    projects?: Project[];
+    /** Labels collection */
+    labels?: Label[];
+    /** Users collection */
+    users?: User[];
+    /** Generic key-value data */
+    [key: string]: unknown;
+}
+/**
+ * Individual data item that can be formatted for display
+ */
+export interface DataItem {
+    id?: number | string;
+    title?: string;
+    name?: string;
+    [key: string]: unknown;
+}
+/**
+ * Simple response structure - replaces complex AORP system
+ */
+export interface SimpleResponse {
+    /** Response content */
+    content: string;
+    /** Response metadata */
+    metadata?: ResponseMetadata;
+}
+/**
+ * Create a simple success response
+ * Replaces complex AORP factory with direct formatting
+ */
+export declare function createSuccessResponse(operation: string, message: string, data?: ResponseData, metadata?: ResponseMetadata): SimpleResponse;
+/**
+ * Create a simple error response
+ * Replaces complex AORP error handling with direct formatting
+ */
+export declare function createErrorResponse(operation: string, message: string, errorCode?: string, metadata?: ResponseMetadata): SimpleResponse;
+/**
+ * Format success message in clean markdown
+ * Replaces complex AORP markdown formatting
+ */
+export declare function formatSuccessMessage(operation: string, message: string, data?: ResponseData, metadata?: Record<string, unknown>): string;
+/**
+ * Format error message in clean markdown
+ * Replaces complex AORP error formatting
+ */
+export declare function formatErrorMessage(operation: string, message: string, errorCode: string, metadata?: ResponseMetadata): string;
+/**
+ * Format response as MCP content array
+ * Direct replacement for AORP formatting
+ */
+export declare function formatMcpResponse(response: SimpleResponse): Array<{
+    type: 'text';
+    text: string;
+}>;
+//# sourceMappingURL=simple-response.d.ts.map

package/dist/utils/simple-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simple-response.d.ts","sourceRoot":"","sources":["../../src/utils/simple-response.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC,CAAC;IACH,uBAAuB;IACvB,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;IACf,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,wBAAwB;IACxB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB,uBAAuB;IACvB,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;IACf,6BAA6B;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,YAAY,EACnB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,cAAc,CAYhB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,MAAwB,EACnC,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,cAAc,CAgBhB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,YAAY,EACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,MAAM,CA+CR;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,MAAM,CAiCR;AAyMD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,cAAc,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAKjG"}