@hasna/todos 0.12.2 → 0.13.0

package/dist/mcp.js

@@ -41,7 +41,7 @@ var __require = import.meta.require;
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.12.2",
+  version: "0.13.0",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/registry.js

@@ -11823,7 +11823,7 @@ var init_tasks = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.12.2",
+  version: "0.13.0",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/release-provenance.json

@@ -1,9 +1,9 @@
 {
   "packageName": "@hasna/todos",
-  "packageVersion": "0.12.2",
+  "packageVersion": "0.13.0",
   "repository": "https://github.com/hasna/todos.git",
-  "gitCommit": "6271f2144e08ad291b34c6d38d46a3cdadb14647",
-  "gitTree": "9f02f36bf7e73db36e738655b28841cf16fa5f6e",
-  "sourceTreeSha256": "520a72ea1d578387cf7403547f2deba823df0105214b6f404227e5f7c244f63f",
-  "generatedAt": "2026-07-24T21:29:56.000Z"
+  "gitCommit": "f1e13ecb6f374dacff6905a78e7dbd60a92883bb",
+  "gitTree": "e6d133cf8c25a83c7085b7edf52cb8a7e7745fdb",
+  "sourceTreeSha256": "fa93e1e4b62bdd70bd753daf4e86b47ec2aa92a1e6a6f091a2924c30649391f4",
+  "generatedAt": "2026-07-25T17:29:55.000Z"
 }

package/dist/server/auth-posture.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Auth posture for the Todos HTTP server — resolved ONCE at startup.
+ *
+ * Historically `checkAuth` failed OPEN: when neither `TODOS_API_KEY` nor a
+ * generated key existed it returned "authorized" for every request, which made
+ * `/mcp` and all of `/api/*` an anonymous read/write plane on any deployment
+ * that bound a non-loopback host (e.g. `HOST=0.0.0.0` behind a public ALB).
+ *
+ * The unconfigured case now DENIES. `resolveAuthPosture` is the single decision
+ * point; it is pure so the matrix can be unit-tested without a live server.
+ *
+ * Postures:
+ *  - `enforce`             — a credential source exists; every data route requires it.
+ *  - `local-plane-disabled`— hosted server (a cloud DSN is configured, so the
+ *                            self-authenticating `/v1` plane works) with NO local
+ *                            credential: the local-only planes (`/api/*`, `/mcp`)
+ *                            are not served at all. `/v1` + probes keep working,
+ *                            so this never takes a hosted deployment down.
+ *  - `anonymous-loopback`  — explicitly opted in AND bound to loopback. Anonymous
+ *                            requests are additionally required to come from a
+ *                            loopback peer. This is the documented local-dev /
+ *                            dashboard path, never reachable off-box.
+ *
+ * Anything else throws `AuthNotConfiguredError`: refusing to start beats
+ * starting wide open.
+ */
+/** Env var that configures the static server credential for `/api/*` + `/mcp`. */
+export declare const AUTH_ENV_VAR = "TODOS_API_KEY";
+/** Env var that opts a loopback-bound server into the anonymous local plane. */
+export declare const ALLOW_ANONYMOUS_ENV_VAR = "TODOS_ALLOW_ANONYMOUS";
+export type AuthPostureMode = "enforce" | "local-plane-disabled" | "anonymous-loopback";
+export interface AuthPosture {
+    mode: AuthPostureMode;
+    /** Human-readable reason, logged once at startup. */
+    reason: string;
+}
+export declare class AuthNotConfiguredError extends Error {
+    static readonly code = "AUTH_NOT_CONFIGURED";
+    readonly code = "AUTH_NOT_CONFIGURED";
+    constructor(message: string);
+}
+/** True when `host` is a loopback bind address (i.e. unreachable from off-box). */
+export declare function isLoopbackHost(host: string | undefined | null): boolean;
+/**
+ * True when a peer address is loopback. Covers IPv4 127/8, IPv6 ::1 and the
+ * IPv4-mapped form Bun reports on dual-stack sockets (`::ffff:127.0.0.1`).
+ */
+export declare function isLoopbackAddress(address: string | undefined | null): boolean;
+/** Truthy-flag parsing for the anonymous opt-in env var. */
+export declare function isAnonymousOptInEnv(env?: NodeJS.ProcessEnv): boolean;
+export interface AuthPostureInput {
+    /** Static credential from `--api-key` / `TODOS_API_KEY`. */
+    apiKey: string | null;
+    /** Whether the local `api_keys` table holds at least one active key. */
+    hasGeneratedKeys: boolean;
+    /** Bind host passed to `Bun.serve`. */
+    host: string | undefined;
+    /** Explicit opt-in to the anonymous loopback plane (flag or env). */
+    allowAnonymous: boolean;
+    /**
+     * Whether this process serves the hosted, self-authenticating `/v1` plane
+     * (a cloud DSN is configured). Defaults to the live env.
+     */
+    hosted?: boolean;
+}
+/** Actionable, credential-free startup error text. */
+export declare function authNotConfiguredMessage(host: string | undefined): string;
+/**
+ * Resolve the startup auth posture, or throw `AuthNotConfiguredError` when the
+ * only remaining option would be to serve data anonymously off-box.
+ */
+export declare function resolveAuthPosture(input: AuthPostureInput): AuthPosture;
+/** One-line startup log describing the resolved posture. */
+export declare function describeAuthPosture(posture: AuthPosture): string;
+//# sourceMappingURL=auth-posture.d.ts.map

package/dist/server/auth-posture.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-posture.d.ts","sourceRoot":"","sources":["../../src/server/auth-posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,kFAAkF;AAClF,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAC5C,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,0BAA0B,CAAC;AAE/D,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,sBAAsB,GAAG,oBAAoB,CAAC;AAExF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,yBAAyB;IAC7C,QAAQ,CAAC,IAAI,yBAA+B;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAID,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAMvE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAY7E;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAKjF;AAED,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wEAAwE;IACxE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,uCAAuC;IACvC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,qEAAqE;IACrE,cAAc,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,sDAAsD;AACtD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAezE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,GAAG,WAAW,CAmCvE;AAED,4DAA4D;AAC5D,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAWhE"}

package/dist/server/index.js

@@ -70,7 +70,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.12.2",
+    version: "0.13.0",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -8827,6 +8827,123 @@ var init_api_keys = __esm(() => {
   init_database();
 });
 
+// src/server/auth-posture.ts
+var exports_auth_posture = {};
+__export(exports_auth_posture, {
+  resolveAuthPosture: () => resolveAuthPosture,
+  isLoopbackHost: () => isLoopbackHost,
+  isLoopbackAddress: () => isLoopbackAddress,
+  isAnonymousOptInEnv: () => isAnonymousOptInEnv,
+  describeAuthPosture: () => describeAuthPosture,
+  authNotConfiguredMessage: () => authNotConfiguredMessage,
+  AuthNotConfiguredError: () => AuthNotConfiguredError,
+  AUTH_ENV_VAR: () => AUTH_ENV_VAR,
+  ALLOW_ANONYMOUS_ENV_VAR: () => ALLOW_ANONYMOUS_ENV_VAR
+});
+function isLoopbackHost(host) {
+  if (!host)
+    return true;
+  const trimmed = host.trim().toLowerCase();
+  if (trimmed === "")
+    return true;
+  if (LOOPBACK_HOSTNAMES.has(trimmed))
+    return true;
+  return isLoopbackAddress(trimmed);
+}
+function isLoopbackAddress(address) {
+  if (!address)
+    return false;
+  let value = address.trim().toLowerCase();
+  if (value.startsWith("[") && value.endsWith("]"))
+    value = value.slice(1, -1);
+  if (value === "::1")
+    return true;
+  if (value.startsWith("::ffff:"))
+    value = value.slice("::ffff:".length);
+  if (value === "localhost")
+    return true;
+  const octets = value.split(".");
+  if (octets.length !== 4)
+    return false;
+  const parsed = octets.map((o) => /^\d{1,3}$/.test(o) ? Number.parseInt(o, 10) : Number.NaN);
+  if (parsed.some((n) => Number.isNaN(n) || n > 255))
+    return false;
+  return parsed[0] === 127;
+}
+function isAnonymousOptInEnv(env = process.env) {
+  const raw = env[ALLOW_ANONYMOUS_ENV_VAR];
+  if (!raw)
+    return false;
+  const value = raw.trim().toLowerCase();
+  return value === "1" || value === "true" || value === "yes";
+}
+function authNotConfiguredMessage(host) {
+  const bind = host && host.trim() !== "" ? host : "127.0.0.1";
+  return [
+    `todos serve: refusing to start \u2014 no API credential is configured, and this server`,
+    `would otherwise expose /api/* and /mcp (task read/write, agent registration, webhook`,
+    `creation) to every caller that can reach ${bind}:<port>.`,
+    ``,
+    `Fix ONE of the following, then restart:`,
+    `  1. Set the server credential:        export ${AUTH_ENV_VAR}=<key>   (or pass --api-key <key>)`,
+    `  2. Mint a stored key:                todos api-keys create "<caller name>"`,
+    `  3. Local dev only, loopback bind:    todos serve --allow-anonymous`,
+    `                                       (or ${ALLOW_ANONYMOUS_ENV_VAR}=1; refused unless the bind host is loopback)`,
+    ``,
+    `Never use option 3 with --host 0.0.0.0 or any other off-box bind.`
+  ].join(`
+`);
+}
+function resolveAuthPosture(input) {
+  const hosted = input.hosted ?? isCloudModeEnabled();
+  const hasCredentialSource = Boolean(input.apiKey) || input.hasGeneratedKeys;
+  if (hasCredentialSource) {
+    return {
+      mode: "enforce",
+      reason: input.apiKey ? `credential from ${AUTH_ENV_VAR}/--api-key` : "at least one active generated API key"
+    };
+  }
+  if (hosted) {
+    return {
+      mode: "local-plane-disabled",
+      reason: `hosted deployment with no ${AUTH_ENV_VAR}: /api/* and /mcp are not served`
+    };
+  }
+  if (input.allowAnonymous) {
+    if (!isLoopbackHost(input.host)) {
+      throw new AuthNotConfiguredError(`todos serve: --allow-anonymous is refused for the non-loopback bind host "${input.host}".
+` + `An anonymous /api/* + /mcp plane must never be reachable off-box.
+
+` + authNotConfiguredMessage(input.host));
+    }
+    return { mode: "anonymous-loopback", reason: "explicit --allow-anonymous on a loopback bind" };
+  }
+  throw new AuthNotConfiguredError(authNotConfiguredMessage(input.host));
+}
+function describeAuthPosture(posture) {
+  switch (posture.mode) {
+    case "enforce":
+      return `auth: ENFORCED on /api/* and /mcp (${posture.reason})`;
+    case "local-plane-disabled":
+      return `auth: /api/* and /mcp DISABLED (${posture.reason}); /v1 remains authenticated, ` + `/health /ready /version /openapi.json remain public. Set ${AUTH_ENV_VAR} to enable them.`;
+    case "anonymous-loopback":
+      return `auth: ANONYMOUS local plane on loopback only (${posture.reason}). ` + `Set ${AUTH_ENV_VAR} to require a credential.`;
+  }
+}
+var AUTH_ENV_VAR = "TODOS_API_KEY", ALLOW_ANONYMOUS_ENV_VAR = "TODOS_ALLOW_ANONYMOUS", AuthNotConfiguredError, LOOPBACK_HOSTNAMES;
+var init_auth_posture = __esm(() => {
+  init_cloud();
+  AuthNotConfiguredError = class AuthNotConfiguredError extends Error {
+    static code = "AUTH_NOT_CONFIGURED";
+    code = AuthNotConfiguredError.code;
+    constructor(message) {
+      super(message);
+      this.name = "AuthNotConfiguredError";
+    }
+  };
+  LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1", "[::1]", "ip6-localhost"]);
+});
+
 // src/db/storage-tombstones.ts
 function recordStorageTombstone(input, db) {
   const d = db ?? getDatabase();
@@ -91259,7 +91376,7 @@ async function main() {
   }
   const { startServer } = await Promise.resolve().then(() => (init_serve(), exports_serve));
   const port = resolveHttpPort();
-  await startServer(port, { open: false, host: "127.0.0.1" });
+  await startServer(port, { open: false, host: "127.0.0.1", allowAnonymous: true });
   console.error(`todos MCP HTTP mounted at http://127.0.0.1:${port}/mcp`);
 }
 var agentFocusMap, isDirectRun;
@@ -91636,6 +91753,7 @@ __export(exports_serve, {
   startServer: () => startServer,
   serveStaticFile: () => serveStaticFile,
   json: () => json,
+  checkAuth: () => checkAuth,
   SECURITY_HEADERS: () => SECURITY_HEADERS,
   MIME_TYPES: () => MIME_TYPES
 });
@@ -91670,19 +91788,32 @@ function getProvidedApiKey(req) {
     return null;
   return auth.replace(/^Bearer\s+/i, "").trim() || null;
 }
-function checkAuth(req, apiKey) {
-  const generatedKeysEnabled = hasActiveApiKeys();
-  if (!apiKey && !generatedKeysEnabled)
-    return null;
+function unauthorized() {
+  return new Response(JSON.stringify({ error: "Unauthorized" }), {
+    status: 401,
+    headers: { "Content-Type": "application/json", "WWW-Authenticate": "Bearer", ...SECURITY_HEADERS }
+  });
+}
+function localPlaneDisabled() {
+  return new Response(JSON.stringify({
+    error: "Not found",
+    code: "LOCAL_PLANE_DISABLED",
+    hint: `/api/* and /mcp are local-only planes and are disabled on this deployment. Set ${AUTH_ENV_VAR} to serve them behind an API key, or use the authenticated /v1 API.`
+  }), { status: 404, headers: { "Content-Type": "application/json", ...SECURITY_HEADERS } });
+}
+function checkAuth(req, apiKey, posture, clientIp) {
+  if (posture.mode === "local-plane-disabled")
+    return localPlaneDisabled();
+  if (posture.mode === "anonymous-loopback") {
+    if (!hasActiveApiKeys()) {
+      return isLoopbackAddress(clientIp) ? null : unauthorized();
+    }
+  }
   const provided = getProvidedApiKey(req);
   const matchesEnvKey = Boolean(apiKey && provided && safeEqualStrings(provided, apiKey));
   const matchesGeneratedKey = Boolean(provided && verifyApiKey2(provided));
-  if (!matchesEnvKey && !matchesGeneratedKey) {
-    return new Response(JSON.stringify({ error: "Unauthorized" }), {
-      status: 401,
-      headers: { "Content-Type": "application/json", "WWW-Authenticate": "Bearer", ...SECURITY_HEADERS }
-    });
-  }
+  if (!matchesEnvKey && !matchesGeneratedKey)
+    return unauthorized();
   return null;
 }
 function resolveClientIp(req, server) {
@@ -91761,6 +91892,22 @@ async function startServer(port, options) {
   const shouldOpen = options?.open ?? true;
   const apiKey = options?.apiKey || process.env.TODOS_API_KEY || null;
   const db = getDatabase();
+  const authPosture = resolveAuthPosture({
+    apiKey,
+    hasGeneratedKeys: hasActiveApiKeys(),
+    host: options?.host,
+    allowAnonymous: options?.allowAnonymous === true || isAnonymousOptInEnv()
+  });
+  if (authPosture.mode === "anonymous-loopback") {
+    console.error(`
+\u26A0  ${describeAuthPosture(authPosture)}
+` + `   /api/* and /mcp accept UNAUTHENTICATED task read/write from any process on this
+` + `   machine. Set ${AUTH_ENV_VAR}=<key> (or run \`todos api-keys create "<name>"\`) to require a
+` + `   credential, and never combine ${ALLOW_ANONYMOUS_ENV_VAR} with an off-box bind.
+`);
+  } else {
+    console.log(describeAuthPosture(authPosture));
+  }
   try {
     const { startRuntimeShadowDrain: startRuntimeShadowDrain2 } = await Promise.resolve().then(() => (init_shadow_runtime(), exports_shadow_runtime));
     startRuntimeShadowDrain2(db);
@@ -91845,6 +91992,7 @@ Dashboard not found at: ${dashboardDir}`);
         });
       }
       const ip = resolveClientIp(req, server2);
+      const peerIp = server2.requestIP(req)?.address;
       const rl = checkRateLimit(ip);
       if (!rl.allowed) {
         return new Response(JSON.stringify({ error: "Too many requests", retry_after: rl.retryAfter }), {
@@ -91883,15 +92031,15 @@ Dashboard not found at: ${dashboardDir}`);
           return res;
       }
       if (path === "/mcp") {
-        const authError = checkAuth(req, apiKey);
+        const authError = checkAuth(req, apiKey, authPosture, peerIp);
         if (authError)
           return authError;
         const { handleMcpHttpRequest: handleMcpHttpRequest2 } = await Promise.resolve().then(() => (init_http(), exports_http));
         const { buildServer: buildServer2 } = await Promise.resolve().then(() => (init_mcp3(), exports_mcp));
         return handleMcpHttpRequest2(req, buildServer2);
       }
-      if (path.startsWith("/api/")) {
-        const authError = checkAuth(req, apiKey);
+      if (path === "/api" || path.startsWith("/api/")) {
+        const authError = checkAuth(req, apiKey, authPosture, peerIp);
         if (authError)
           return authError;
       }
@@ -92131,6 +92279,7 @@ var MIME_TYPES, SECURITY_HEADERS, rateLimitMap, RATE_LIMIT_WINDOW_MS = 60000, RA
 var init_serve = __esm(() => {
   init_database();
   init_api_keys();
+  init_auth_posture();
   init_routes();
   MIME_TYPES = {
     ".html": "text/html; charset=utf-8",
@@ -92322,10 +92471,22 @@ async function main2() {
   }
   const noOpen = process.argv.includes("--no-open") || process.env["TODOS_NO_OPEN"] === "true" || Boolean(envPort);
   const { startServer: startServer2 } = await Promise.resolve().then(() => (init_serve(), exports_serve));
-  startServer2(port, {
-    open: !noOpen,
-    host: parseStringArg("--host") || process.env.HOST,
-    apiKey: parseStringArg("--api-key")
-  });
+  try {
+    await startServer2(port, {
+      open: !noOpen,
+      host: parseStringArg("--host") || process.env.HOST,
+      apiKey: parseStringArg("--api-key"),
+      allowAnonymous: process.argv.includes("--allow-anonymous")
+    });
+  } catch (error3) {
+    const { AuthNotConfiguredError: AuthNotConfiguredError2 } = await Promise.resolve().then(() => (init_auth_posture(), exports_auth_posture));
+    if (error3 instanceof AuthNotConfiguredError2) {
+      console.error(`
+${error3.message}
+`);
+      process.exit(1);
+    }
+    throw error3;
+  }
 }
 main2();

package/dist/server/serve.d.ts

@@ -3,9 +3,21 @@
  * Serves the Vite-built React/shadcn dashboard from dashboard/dist/.
  * Provides REST API endpoints for task management.
  */
+import { type AuthPosture } from "./auth-posture.js";
 import type { Task } from "../types/index.js";
 export declare const MIME_TYPES: Record<string, string>;
 export declare const SECURITY_HEADERS: Record<string, string>;
+/**
+ * Check API key auth for a data route — returns a Response if the request must
+ * be refused, null if it may proceed.
+ *
+ * FAILS CLOSED. There is deliberately no "no key configured, skip auth" branch:
+ * the unconfigured case is resolved at startup by `resolveAuthPosture`, which
+ * either refuses to start or disables these routes entirely. A request is only
+ * ever served anonymously under the explicit `anonymous-loopback` posture, and
+ * then only when the peer address is itself loopback.
+ */
+export declare function checkAuth(req: Request, apiKey: string | null, posture: AuthPosture, clientIp?: string): Response | null;
 export declare function json(data: unknown, status?: number, headers?: HeadersInit): Response;
 export declare function serveStaticFile(filePath: string): Response | null;
 export declare function taskToSummary(task: Task, fields?: string[]): {
@@ -33,9 +45,17 @@ export declare function taskToSummary(task: Task, fields?: string[]): {
 } | {
     [k: string]: {} | null;
 };
-export declare function startServer(port: number, options?: {
+export interface StartServerOptions {
     open?: boolean;
     host?: string;
     apiKey?: string;
-}): Promise<void>;
+    /**
+     * Explicitly opt into serving `/api/*` + `/mcp` anonymously. Honored ONLY when
+     * no credential is configured AND the bind host is loopback; otherwise the
+     * server refuses to start. `todos-mcp --http` sets this because that transport
+     * is loopback-pinned by contract.
+     */
+    allowAnonymous?: boolean;
+}
+export declare function startServer(port: number, options?: StartServerOptions): Promise<void>;
 //# sourceMappingURL=serve.d.ts.map

package/dist/server/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/server/serve.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AA+B9C,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAW7C,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAMnD,CAAC;AAwEF,wBAAgB,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CASjF;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAYjE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;EA0B1D;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsf3H"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/server/serve.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AA+B9C,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAW7C,CAAC;AAEF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAMnD,CAAC;AAiCF;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CACvB,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,OAAO,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,GAAG,IAAI,CAsBjB;AA6CD,wBAAgB,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,SAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CASjF;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAYjE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;EA0B1D;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+gB3F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/todos",
-  "version": "0.12.2",
+  "version": "0.13.0",
   "description": "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   "type": "module",
   "main": "dist/index.js",