@hasna/todos 0.12.3 → 0.13.1

package/README.md

@@ -595,10 +595,19 @@ services. Use them to keep agents from starting blocked work:
 ```bash
 todos deps <task-id> --needs <blocking-task-id>
 todos deps <task-id> --graph
+todos deps <task-id> --json            # machine-readable edges (ids + status) for this task
+todos deps --project <ref> --json      # the whole-project graph (nodes + edges + cycles) in one read
 todos blocked
 todos ready
 ```
 
+`--json` returns versioned, machine-readable shapes for schedulers:
+`todos.task_dependency_edges.v1` for a single task (`dependencies` = upstream
+prerequisites, `blocked_by` = downstream dependents) and
+`todos.project_dependency_graph.v1` for `--project` (a `nodes`/`edges`/`cycles`
+adjacency list). Both are identical in local and self-hosted mode. Human output
+and `--graph --json` are unchanged.
+
 The same workflow is available to MCP clients through
 `add_task_dependency`, `remove_task_dependency`, `get_task_dependencies`, and
 `get_blocked_tasks`. Dependency writes reject cycles, `ready` omits locked or
@@ -1421,18 +1430,37 @@ MCP calls such as `get_task`, `get_status`, `get_context`, `bootstrap`, and
 todos-serve
 ```
 
-Generate an API key before exposing the REST API to another app. Once at least one
-generated key exists, all `/api/*` requests require `x-api-key` or
-`Authorization: Bearer`.
+`/api/*` and `/mcp` are **local-only data planes and they fail closed**. The server
+refuses to start unless one of the following is true:
+
+| Configuration | Result |
+| --- | --- |
+| `TODOS_API_KEY=<key>` (or `--api-key <key>`) | `/api/*` + `/mcp` require the key |
+| at least one `todos api-keys create` key exists | `/api/*` + `/mcp` require a key |
+| `--allow-anonymous` **and** a loopback bind | anonymous, loopback peers only (local dev) |
+| a cloud `DATABASE_URL` is configured (hosted `/v1` deployment) | `/api/*` + `/mcp` are **not served**; `/v1` stays authenticated |
+| nothing of the above | **server exits non-zero** with the env var to set |
 
 ```bash
-todos api-keys create "My app"
-todos-serve --host 0.0.0.0
+todos api-keys create "My app"          # then send x-api-key / Authorization: Bearer
+TODOS_API_KEY=<key> todos-serve --host 0.0.0.0
+todos serve --allow-anonymous           # local dev only; refused for a non-loopback --host
 ```
 
+`--allow-anonymous` (or `TODOS_ALLOW_ANONYMOUS=1`) is refused for any non-loopback
+bind host, and even when enabled it only serves requests whose transport peer is
+itself loopback — so it can never publish an anonymous task read/write plane
+off-box. `todos-mcp --http` sets it implicitly because that transport is pinned to
+`127.0.0.1`; set `TODOS_API_KEY` (and send it from your MCP client) to require a
+credential there too.
+
 Pass the generated key from your app as `x-api-key` or set `TODOS_API_KEY` for
 the SDK client.
 
+Always-on / hosted deployments should use the versioned `/v1` API, which
+authenticates independently against the cloud key store. `/health`, `/ready`,
+`/version` and `/openapi.json` are the only routes that are public by design.
+
 Agent callers can trim REST responses with field selectors:
 
 ```bash

package/dist/cli/commands/config-serve-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-serve-commands.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/config-serve-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,QA63C3D"}
+{"version":3,"file":"config-serve-commands.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/config-serve-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUzC,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,OAAO,QA44C3D"}

package/dist/cli/commands/project-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-commands.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/project-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAuJzC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,QA8gCvD"}
+{"version":3,"file":"project-commands.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/project-commands.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsOzC,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,QAwkCvD"}