@hasna/todos 0.15.15 → 0.15.16

package/dist/index.js

@@ -12492,7 +12492,7 @@ var init_dispatches = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.15",
+  version: "0.15.16",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -39090,6 +39090,9 @@ init_types();
 // src/task-manifest/types.ts
 var TODOS_TASK_MANIFEST_ROUTE = "todos.task-manifest.v1";
 var TODOS_TASK_MANIFEST_SCHEMA_VERSION = 1;
+function supportsIdempotentOutboxDelivery(capability2) {
+  return capability2 !== null && typeof capability2 === "object" && capability2["idempotent_outbox_delivery"] === true;
+}
 
 class TodosTaskManifestError extends Error {
   code;
@@ -39735,10 +39738,27 @@ class SqliteTodosTaskManifestBackend {
             SELECT 1 FROM todos_task_manifest_receipts r
             WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
               AND r.tenant_id = ?
+              AND r.authority = 'todos'
+              AND r.route = 'todos.task-manifest.v1'
+              AND r.schema_version = 1
+              AND r.kind = 'apply'
           )`).run(deliveredAt, outboxId, this.tenantId);
-      if (result.changes !== 1) {
-        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
-      }
+      if (result.changes === 1)
+        return;
+      const existing = this.db.query(`SELECT o.status
+        FROM todos_task_manifest_outbox o
+        JOIN todos_task_manifest_receipts r
+          ON r.receipt_id = o.apply_receipt_id
+        WHERE r.tenant_id = ?
+          AND r.authority = 'todos'
+          AND r.route = 'todos.task-manifest.v1'
+          AND r.schema_version = 1
+          AND r.kind = 'apply'
+          AND o.id = ?
+        LIMIT 1`).get(this.tenantId, outboxId);
+      if (existing?.status === "delivered")
+        return;
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
     });
   }
   async compensate(input, receipt, compensationReceiptId, requestDigest, now4) {
@@ -40270,6 +40290,22 @@ class PostgresTodosTaskManifestBackend {
   async markOutboxDelivered(outboxId, deliveredAt) {
     await this.ensureSchema();
     await this.client.transaction(async (tx) => {
+      const owned = await tx.query(`SELECT r.operation_id
+         FROM todos_task_manifest_outbox o
+         JOIN todos_task_manifest_receipts r
+           ON r.receipt_id = o.apply_receipt_id
+         WHERE r.tenant_id = $1
+           AND r.authority = 'todos'
+           AND r.route = 'todos.task-manifest.v1'
+           AND r.schema_version = 1
+           AND r.kind = 'apply'
+           AND o.id = $2
+         LIMIT 1`, [this.tenantId, outboxId]);
+      const operationId = owned.rows[0]?.operation_id;
+      if (operationId == null) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
+      }
+      await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${this.service}\x1F${String(operationId)}`]);
       const result = await tx.query(`UPDATE todos_task_manifest_outbox
         SET status = 'delivered', delivered_at = $1, attempts = attempts + 1
         WHERE id = $2 AND status = 'pending'
@@ -40277,10 +40313,28 @@ class PostgresTodosTaskManifestBackend {
             SELECT 1 FROM todos_task_manifest_receipts r
             WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
               AND r.tenant_id = $3
+              AND r.authority = 'todos'
+              AND r.route = 'todos.task-manifest.v1'
+              AND r.schema_version = 1
+              AND r.kind = 'apply'
           )
         RETURNING id`, [deliveredAt, outboxId, this.tenantId]);
-      if (!result.rows[0])
-        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
+      if (result.rows[0])
+        return;
+      const existing = await tx.query(`SELECT o.status
+         FROM todos_task_manifest_outbox o
+         JOIN todos_task_manifest_receipts r
+           ON r.receipt_id = o.apply_receipt_id
+         WHERE r.tenant_id = $1
+           AND r.authority = 'todos'
+           AND r.route = 'todos.task-manifest.v1'
+           AND r.schema_version = 1
+           AND r.kind = 'apply'
+           AND o.id = $2
+         LIMIT 1`, [this.tenantId, outboxId]);
+      if (existing.rows[0]?.status === "delivered")
+        return;
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
     });
   }
   async compensate(input, receipt, compensationReceiptId, requestDigest, now4) {
@@ -40312,7 +40366,13 @@ class PostgresTodosTaskManifestBackend {
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Graph is not applied");
       const delivered = await tx.query(`SELECT o.id FROM todos_task_manifest_outbox o
          JOIN todos_task_manifest_receipts r ON r.receipt_id = o.apply_receipt_id
-         WHERE r.tenant_id = $1 AND o.apply_receipt_id = $2 AND o.status = 'delivered'
+         WHERE r.tenant_id = $1
+           AND r.authority = 'todos'
+           AND r.route = 'todos.task-manifest.v1'
+           AND r.schema_version = 1
+           AND r.kind = 'apply'
+           AND o.apply_receipt_id = $2
+           AND o.status = 'delivered'
          LIMIT 1`, [this.tenantId, input.receipt_id]);
       if (delivered.rows[0])
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: delivered outbox row exists");
@@ -40325,15 +40385,20 @@ class PostgresTodosTaskManifestBackend {
         },
         ...(manifest.effects ?? []).map((effect2) => ({ topic: effect2.topic, payload: effect2.payload }))
       ];
-      const outboxRows = await tx.query(`SELECT id, topic, payload, payload_digest, status, attempts, delivered_at
-        FROM todos_task_manifest_outbox
-        WHERE apply_receipt_id = $1
+      const outboxRows = await tx.query(`SELECT o.id, o.topic, o.payload, o.payload_digest, o.status, o.attempts, o.delivered_at
+        FROM todos_task_manifest_outbox o
+        WHERE o.apply_receipt_id = $1
           AND EXISTS (
             SELECT 1 FROM todos_task_manifest_receipts r
-            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+            WHERE r.receipt_id = o.apply_receipt_id
               AND r.tenant_id = $2
+              AND r.authority = 'todos'
+              AND r.route = 'todos.task-manifest.v1'
+              AND r.schema_version = 1
+              AND r.kind = 'apply'
           )
-        ORDER BY id`, [input.receipt_id, this.tenantId]);
+        ORDER BY o.id
+        FOR UPDATE OF o`, [input.receipt_id, this.tenantId]);
       if (outboxRows.rows.length !== expectedEffects.length) {
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: outbox changed since apply");
       }
@@ -40433,14 +40498,23 @@ class PostgresTodosTaskManifestBackend {
       }
       if (stored.rows.length !== managedIds.length)
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: managed graph is incomplete");
-      await tx.query(`UPDATE todos_task_manifest_outbox
+      const cancelled = await tx.query(`UPDATE todos_task_manifest_outbox
         SET status = 'cancelled'
         WHERE apply_receipt_id = $1 AND status = 'pending'
           AND EXISTS (
             SELECT 1 FROM todos_task_manifest_receipts r
             WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
               AND r.tenant_id = $2
-          )`, [input.receipt_id, this.tenantId]);
+              AND r.authority = 'todos'
+              AND r.route = 'todos.task-manifest.v1'
+              AND r.schema_version = 1
+              AND r.kind = 'apply'
+          )
+        RETURNING id`, [input.receipt_id, this.tenantId]);
+      const cancelledIds = new Set(cancelled.rows.map((row) => String(row.id)));
+      if (cancelledIds.size !== applyResult.outbox_ids.length || applyResult.outbox_ids.some((id) => !cancelledIds.has(id))) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: failed to cancel every expected outbox row");
+      }
       const typedIds = [
         ["dependencies", applyResult.graph.dependency_ids],
         ["comments", applyResult.graph.comment_ids],
@@ -40627,6 +40701,7 @@ class PackageOwnedTodosTaskManifestAuthority {
       deterministic_ids: true,
       immutable_receipts: true,
       transactional_outbox: true,
+      idempotent_outbox_delivery: true,
       exact_bounded_readback: true,
       conditional_compensation: true,
       transcript_safe: false,
@@ -62008,6 +62083,7 @@ export {
   syncWithAgents,
   syncWithAgent,
   syncKgEdges,
+  supportsIdempotentOutboxDelivery,
   supersedeDecisionRecord,
   summarizeTaskRun,
   summarizeRoadmap,

package/dist/lib/agent-adapter-docs.d.ts

@@ -6,6 +6,16 @@ import { GOAL_COMMAND_RECIPES } from "./goal-workflow.js";
 export declare const ADAPTER_DOCS_SCHEMA_VERSION = "todos.agent_adapter_docs.v1";
 export declare const AGENT_ADAPTER_HOSTS: readonly ["codex", "claude-code", "takumi"];
 export type AgentAdapterHost = (typeof AGENT_ADAPTER_HOSTS)[number];
+/**
+ * Agents accepted by `todos mcp --register` / `--unregister`. Kept beside the
+ * adapter docs so the docs can never advertise a host the CLI rejects — the
+ * reader of a recovery field is an agent, and a recovery command that exits 1
+ * strands it. `todos mcp --register takumi` shipped in doc metadata while the
+ * CLI rejected it; the consistency test in agent-adapter-docs.test.ts pins
+ * every advertised `--register <agent>` to this list.
+ */
+export declare const MCP_REGISTRABLE_CLI_AGENTS: readonly ["claude", "codex", "gemini", "cursor", "takumi"];
+export type McpRegistrableCliAgent = (typeof MCP_REGISTRABLE_CLI_AGENTS)[number];
 export interface AdapterWorkflowStep {
     step: number;
     title: string;

package/dist/lib/agent-adapter-docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-adapter-docs.d.ts","sourceRoot":"","sources":["../../src/lib/agent-adapter-docs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAEzE,eAAO,MAAM,mBAAmB,6CAA8C,CAAC;AAC/E,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,OAAO,2BAA2B,CAAC;IACnD,IAAI,EAAE,gBAAgB,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,GAAG,EAAE;QACH,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,GAAG,EAAE,MAAM,EAAE,CAAC;KACf,CAAC;IACF,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,aAAa,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,CAAC;IACF,YAAY,EAAE;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAgCD,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,EAAE,eAAe,CA0IxE,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAM3E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAGvE;AAED,wBAAgB,oBAAoB,IAAI,eAAe,EAAE,CAExD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CA6B9C;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA6EpE;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAIrD;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,IAAI,MAAM,CAoBlD"}
+{"version":3,"file":"agent-adapter-docs.d.ts","sourceRoot":"","sources":["../../src/lib/agent-adapter-docs.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAEzE,eAAO,MAAM,mBAAmB,6CAA8C,CAAC;AAC/E,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,4DAA6D,CAAC;AACrG,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,cAAc,EAAE,OAAO,2BAA2B,CAAC;IACnD,IAAI,EAAE,gBAAgB,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,GAAG,EAAE;QACH,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;QACpB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,GAAG,EAAE,MAAM,EAAE,CAAC;KACf,CAAC;IACF,aAAa,EAAE,OAAO,oBAAoB,CAAC;IAC3C,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,aAAa,EAAE;QACb,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;KACpC,CAAC;IACF,YAAY,EAAE;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC;IACF,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAgCD,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,EAAE,eAAe,CA0IxE,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,GAAG,IAAI,CAM3E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAGvE;AAED,wBAAgB,oBAAoB,IAAI,eAAe,EAAE,CAExD;AAED,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CA6B9C;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA6EpE;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAIrD;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,IAAI,MAAM,CAoBlD"}

package/dist/mcp/index.js

@@ -21041,10 +21041,72 @@ async function requireTagsFilterCapability(client) {
     throw new Error(`REMOTE_TAGS_FILTER_UNSUPPORTED: configured Todos authority ${authority} does not advertise the tags ` + "query param on GET /v1/tasks; deploy the current @hasna/todos /v1 server to filter by tag; " + "no unfiltered task read was issued");
   }
 }
-async function requestCloudTaskPage(client, filter) {
+function parseCloudTaskTotal(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw))
+    return;
+  const total = raw.total;
+  return typeof total === "number" && Number.isSafeInteger(total) && total >= 0 ? total : undefined;
+}
+async function requestRawCloudTaskPage(client, filter) {
   const res = await requiredRemoteRoute(client, "/v1/tasks", () => client.list("tasks", { query: toListQuery(filter) }));
   const envelope = res.raw;
-  return Array.isArray(envelope?.tasks) ? envelope.tasks : res.items;
+  return {
+    tasks: Array.isArray(envelope?.tasks) ? envelope.tasks : res.items,
+    total: parseCloudTaskTotal(res.raw)
+  };
+}
+function cloudTaskListFilterError(code, taskListId, detail) {
+  return new Error(`${code}: hosted authority returned rows outside requested task_list_id ${taskListId}; ${detail}; refusing an incomplete exact-list result`);
+}
+async function requestCloudTaskPage(client, filter) {
+  const firstPage = await requestRawCloudTaskPage(client, filter);
+  const tasks = firstPage.tasks;
+  if (filter.task_list_id === undefined)
+    return tasks;
+  const taskListId = filter.task_list_id;
+  if (tasks.every((task) => task.task_list_id === taskListId))
+    return tasks;
+  const scanLimit = filter.limit;
+  const startOffset = filter.offset ?? 0;
+  if (startOffset !== 0 || scanLimit === undefined || !Number.isSafeInteger(scanLimit) || scanLimit <= 0 || firstPage.total === undefined) {
+    throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, "the response does not provide complete bounded total/offset pagination evidence");
+  }
+  const total = firstPage.total;
+  if (total > scanLimit) {
+    throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_INCOMPLETE", taskListId, `reported total ${total} exceeds bounded scan limit ${scanLimit}`);
+  }
+  if (tasks.length > total) {
+    throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, `the first page contains ${tasks.length} rows but reports total ${total}`);
+  }
+  const seenTaskIds = new Set;
+  for (const task of tasks) {
+    if (seenTaskIds.has(task.id)) {
+      throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, `the first page repeats task id ${task.id}`);
+    }
+    seenTaskIds.add(task.id);
+  }
+  while (tasks.length < total) {
+    const remaining = total - tasks.length;
+    const page = await requestRawCloudTaskPage(client, {
+      ...filter,
+      offset: tasks.length,
+      limit: Math.min(scanLimit - tasks.length, remaining)
+    });
+    if (page.total !== total) {
+      throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, `pagination total changed from ${total} to ${String(page.total)}`);
+    }
+    if (page.tasks.length === 0 || tasks.length + page.tasks.length > total) {
+      throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, "pagination did not make bounded progress toward the reported total");
+    }
+    for (const task of page.tasks) {
+      if (seenTaskIds.has(task.id)) {
+        throw cloudTaskListFilterError("REMOTE_TASK_LIST_FILTER_UNSUPPORTED", taskListId, `pagination repeats task id ${task.id}`);
+      }
+      seenTaskIds.add(task.id);
+    }
+    tasks.push(...page.tasks);
+  }
+  return tasks.filter((task) => task.task_list_id === taskListId);
 }
 async function cloudListTasks(client, filter = {}) {
   if (filter.tags?.length)
@@ -21083,12 +21145,10 @@ async function cloudGetTask(client, id) {
 }
 async function cloudCreateTask(client, input) {
   const expectedParentId = typeof input["parent_id"] === "string" ? input["parent_id"] : null;
-  const created = unwrapTask(await requiredRemoteRoute(client, "/v1/tasks", () => expectedParentId === null ? client.create("tasks", input) : client.create("tasks", input, { retry: false }), ["PARENT_TASK_NOT_FOUND"]));
+  const created = unwrapTask(await requiredRemoteRoute(client, "/v1/tasks", () => client.create("tasks", input, { retry: false }), ["PARENT_TASK_NOT_FOUND"]));
   if (!created || typeof created.id !== "string" || !created.id.trim()) {
     throw new Error(`REMOTE_API_INCOMPATIBLE: configured Todos authority ${remoteAuthorityBase(client)} returned a task create ` + "response without a stored task id; no success row or local SQLite fallback is permitted");
   }
-  if (expectedParentId === null)
-    return created;
   const persisted = await cloudGetTask(client, created.id);
   if (!persisted || persisted.id !== created.id || (persisted.parent_id ?? null) !== expectedParentId) {
     throw new Error(`TASK_CREATE_PERSISTENCE_UNVERIFIED: configured Todos authority ${remoteAuthorityBase(client)} accepted ` + `POST /v1/tasks but authoritative GET /v1/tasks/${encodeURIComponent(created.id)} did not return the same ` + "stored task id and parent_id; no success row or local SQLite fallback is permitted");
@@ -35415,7 +35475,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.15",
+    version: "0.15.16",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -51606,6 +51666,22 @@ class PostgresTodosTaskManifestBackend {
   async markOutboxDelivered(outboxId, deliveredAt) {
     await this.ensureSchema();
     await this.client.transaction(async (tx) => {
+      const owned = await tx.query(`SELECT r.operation_id
+         FROM todos_task_manifest_outbox o
+         JOIN todos_task_manifest_receipts r
+           ON r.receipt_id = o.apply_receipt_id
+         WHERE r.tenant_id = $1
+           AND r.authority = 'todos'
+           AND r.route = 'todos.task-manifest.v1'
+           AND r.schema_version = 1
+           AND r.kind = 'apply'
+           AND o.id = $2
+         LIMIT 1`, [this.tenantId, outboxId]);
+      const operationId = owned.rows[0]?.operation_id;
+      if (operationId == null) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
+      }
+      await tx.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [`${this.service}\x1F${String(operationId)}`]);
       const result = await tx.query(`UPDATE todos_task_manifest_outbox
         SET status = 'delivered', delivered_at = $1, attempts = attempts + 1
         WHERE id = $2 AND status = 'pending'
@@ -51613,10 +51689,28 @@ class PostgresTodosTaskManifestBackend {
             SELECT 1 FROM todos_task_manifest_receipts r
             WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
               AND r.tenant_id = $3
+              AND r.authority = 'todos'
+              AND r.route = 'todos.task-manifest.v1'
+              AND r.schema_version = 1
+              AND r.kind = 'apply'
           )
         RETURNING id`, [deliveredAt, outboxId, this.tenantId]);
-      if (!result.rows[0])
-        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
+      if (result.rows[0])
+        return;
+      const existing = await tx.query(`SELECT o.status
+         FROM todos_task_manifest_outbox o
+         JOIN todos_task_manifest_receipts r
+           ON r.receipt_id = o.apply_receipt_id
+         WHERE r.tenant_id = $1
+           AND r.authority = 'todos'
+           AND r.route = 'todos.task-manifest.v1'
+           AND r.schema_version = 1
+           AND r.kind = 'apply'
+           AND o.id = $2
+         LIMIT 1`, [this.tenantId, outboxId]);
+      if (existing.rows[0]?.status === "delivered")
+        return;
+      throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_GRAPH_CONFLICT", `Pending outbox row not found: ${outboxId}`);
     });
   }
   async compensate(input, receipt, compensationReceiptId, requestDigest, now4) {
@@ -51648,7 +51742,13 @@ class PostgresTodosTaskManifestBackend {
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Graph is not applied");
       const delivered = await tx.query(`SELECT o.id FROM todos_task_manifest_outbox o
          JOIN todos_task_manifest_receipts r ON r.receipt_id = o.apply_receipt_id
-         WHERE r.tenant_id = $1 AND o.apply_receipt_id = $2 AND o.status = 'delivered'
+         WHERE r.tenant_id = $1
+           AND r.authority = 'todos'
+           AND r.route = 'todos.task-manifest.v1'
+           AND r.schema_version = 1
+           AND r.kind = 'apply'
+           AND o.apply_receipt_id = $2
+           AND o.status = 'delivered'
          LIMIT 1`, [this.tenantId, input.receipt_id]);
       if (delivered.rows[0])
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: delivered outbox row exists");
@@ -51661,15 +51761,20 @@ class PostgresTodosTaskManifestBackend {
         },
         ...(manifest.effects ?? []).map((effect2) => ({ topic: effect2.topic, payload: effect2.payload }))
       ];
-      const outboxRows = await tx.query(`SELECT id, topic, payload, payload_digest, status, attempts, delivered_at
-        FROM todos_task_manifest_outbox
-        WHERE apply_receipt_id = $1
+      const outboxRows = await tx.query(`SELECT o.id, o.topic, o.payload, o.payload_digest, o.status, o.attempts, o.delivered_at
+        FROM todos_task_manifest_outbox o
+        WHERE o.apply_receipt_id = $1
           AND EXISTS (
             SELECT 1 FROM todos_task_manifest_receipts r
-            WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
+            WHERE r.receipt_id = o.apply_receipt_id
               AND r.tenant_id = $2
+              AND r.authority = 'todos'
+              AND r.route = 'todos.task-manifest.v1'
+              AND r.schema_version = 1
+              AND r.kind = 'apply'
           )
-        ORDER BY id`, [input.receipt_id, this.tenantId]);
+        ORDER BY o.id
+        FOR UPDATE OF o`, [input.receipt_id, this.tenantId]);
       if (outboxRows.rows.length !== expectedEffects.length) {
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: outbox changed since apply");
       }
@@ -51769,14 +51874,23 @@ class PostgresTodosTaskManifestBackend {
       }
       if (stored.rows.length !== managedIds.length)
         throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: managed graph is incomplete");
-      await tx.query(`UPDATE todos_task_manifest_outbox
+      const cancelled = await tx.query(`UPDATE todos_task_manifest_outbox
         SET status = 'cancelled'
         WHERE apply_receipt_id = $1 AND status = 'pending'
           AND EXISTS (
             SELECT 1 FROM todos_task_manifest_receipts r
             WHERE r.receipt_id = todos_task_manifest_outbox.apply_receipt_id
               AND r.tenant_id = $2
-          )`, [input.receipt_id, this.tenantId]);
+              AND r.authority = 'todos'
+              AND r.route = 'todos.task-manifest.v1'
+              AND r.schema_version = 1
+              AND r.kind = 'apply'
+          )
+        RETURNING id`, [input.receipt_id, this.tenantId]);
+      const cancelledIds = new Set(cancelled.rows.map((row) => String(row.id)));
+      if (cancelledIds.size !== applyResult.outbox_ids.length || applyResult.outbox_ids.some((id) => !cancelledIds.has(id))) {
+        throw new TodosTaskManifestError("TODOS_TASK_MANIFEST_COMPENSATION_REFUSED", "Compensation refused: failed to cancel every expected outbox row");
+      }
       const typedIds = [
         ["dependencies", applyResult.graph.dependency_ids],
         ["comments", applyResult.graph.comment_ids],
@@ -51959,6 +52073,7 @@ class PackageOwnedTodosTaskManifestAuthority {
       deterministic_ids: true,
       immutable_receipts: true,
       transactional_outbox: true,
+      idempotent_outbox_delivery: true,
       exact_bounded_readback: true,
       conditional_compensation: true,
       transcript_safe: false,

package/dist/mcp.js

@@ -41,7 +41,7 @@ var __require = import.meta.require;
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.15",
+  version: "0.15.16",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/project-registration.js

@@ -12382,7 +12382,7 @@ import { createHash as createHash5 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.15",
+  version: "0.15.16",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/registry.js

@@ -12379,7 +12379,7 @@ var init_tasks = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.15",
+  version: "0.15.16",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",

package/dist/release-provenance.json

@@ -1,9 +1,9 @@
 {
   "packageName": "@hasna/todos",
-  "packageVersion": "0.15.15",
+  "packageVersion": "0.15.16",
   "repository": "https://github.com/hasna/todos.git",
-  "gitCommit": "3c9e40955ed30592a313258561b6cc76b928080e",
-  "gitTree": "372cf75a8993b31e328a995694c2f7a4c49fc63c",
-  "sourceTreeSha256": "95cf4fe5ee9dff0b651b37d4a499b714112a0b1a2f13a7eb326d5b79d1a3d77b",
-  "generatedAt": "2026-08-08T18:01:52.000Z"
+  "gitCommit": "084685de11895e9c0bbed1ed49111034be5f7abf",
+  "gitTree": "abbe0059ad26a5e3d912791a29be4ddf41a5806a",
+  "sourceTreeSha256": "b78b8353a1695771896c48af0113c731345a9a15545b984f2778b69cec96eda9",
+  "generatedAt": "2026-08-09T02:43:36.000Z"
 }