@hasna/todos 0.15.32 → 0.15.34

package/dist/cli/index.js

@@ -2123,7 +2123,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.32",
+    version: "0.15.34",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -2197,9 +2197,7 @@ var init_package = __esm(() => {
       "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
       "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
       "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-      "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
-      "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
-      "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+      "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
       "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
       prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
       postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"
@@ -5657,40 +5655,38 @@ var init_page_validation = __esm(() => {
 
 // src/cli/cloud-router.ts
 import { resolveStorageClient } from "@hasna/contracts/client/storage";
-import { normalizeStorageMode } from "@hasna/contracts/mode";
 import { randomUUID } from "crypto";
 import { resolve as resolvePath } from "path";
-function cleanMode(value) {
-  const normalized = value?.trim().toLowerCase();
-  return normalized || null;
+function assertNoLegacyStorageMode(env = process.env) {
+  for (const key of LEGACY_STORAGE_MODE_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`REMOTE_STORAGE_MODE_REMOVED: ${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `The client uses the on-box SQLite store, or the HTTP API selected by ` + `HASNA_TODOS_API_URL + HASNA_TODOS_API_KEY. ` + `On the server, set HASNA_TODOS_DATABASE_URL to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
 }
 function resolveTodosCliStorageMode(env = process.env) {
-  for (const source of ["HASNA_TODOS_STORAGE_MODE", "TODOS_STORAGE_MODE"]) {
-    if (env[source] !== undefined && env[source].trim() === "") {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source} must not be blank; local SQLite fallback is disabled for invalid routing state`);
-    }
+  assertNoLegacyStorageMode(env);
+  const urlValue = env.HASNA_TODOS_API_URL?.trim();
+  const keyValue = env.HASNA_TODOS_API_KEY?.trim();
+  if (urlValue && keyValue) {
+    return {
+      mode: "http",
+      transport: "http",
+      selected: true,
+      source: "HASNA_TODOS_API_URL+HASNA_TODOS_API_KEY"
+    };
   }
-  const canonical = cleanMode(env.HASNA_TODOS_STORAGE_MODE);
-  const fallback = cleanMode(env.TODOS_STORAGE_MODE);
-  for (const [source, value] of [
-    ["HASNA_TODOS_STORAGE_MODE", canonical],
-    ["TODOS_STORAGE_MODE", fallback]
-  ]) {
-    if (value && !(value in TRANSPORT_TOKENS)) {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source}=${value} must be sqlite (local file) or http (hosted /v1 authority); ` + "legacy values local and remote are accepted; " + "local SQLite fallback is disabled for invalid routing state");
-    }
+  if (urlValue) {
+    throw new Error("REMOTE_API_KEY_MISSING: remote Todos storage requires HASNA_TODOS_API_KEY; local SQLite fallback is disabled");
   }
-  const canonicalTransport = canonical ? TRANSPORT_TOKENS[canonical] : null;
-  const fallbackTransport = fallback ? TRANSPORT_TOKENS[fallback] : null;
-  if (canonicalTransport && fallbackTransport && canonicalTransport !== fallbackTransport) {
-    throw new Error(`REMOTE_STORAGE_MODE_CONFLICT: HASNA_TODOS_STORAGE_MODE=${canonical} conflicts with ` + `TODOS_STORAGE_MODE=${fallback}; local SQLite fallback is disabled`);
+  if (keyValue) {
+    throw new Error("REMOTE_API_URL_MISSING: remote Todos storage requires HASNA_TODOS_API_URL; local SQLite fallback is disabled");
   }
-  const transport = canonicalTransport ?? fallbackTransport ?? "sqlite";
   return {
-    mode: transport,
-    transport,
-    selected: transport === "http",
-    source: canonical ? "HASNA_TODOS_STORAGE_MODE" : fallback ? "TODOS_STORAGE_MODE" : "default"
+    mode: "sqlite",
+    transport: "sqlite",
+    selected: false,
+    source: "default"
   };
 }
 function requestedTransport(env) {
@@ -5734,7 +5730,7 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     return {
       selected: true,
       ok: false,
-      mode: cleanMode(env.HASNA_TODOS_STORAGE_MODE) ?? cleanMode(env.TODOS_STORAGE_MODE) ?? "invalid",
+      mode: "invalid",
       api_url_configured: Boolean(env.HASNA_TODOS_API_URL?.trim()),
       api_key_configured: Boolean(env.HASNA_TODOS_API_KEY?.trim()),
       v1_base_url: null,
@@ -5780,27 +5776,12 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     local_fallback: false
   };
 }
-function serverStorageMode(normalize = normalizeStorageMode) {
-  const useCache = normalize === normalizeStorageMode;
-  if (useCache && cachedServerMode !== null)
-    return cachedServerMode;
-  for (const candidate of SERVER_MODE_CANDIDATES) {
-    try {
-      normalize(candidate);
-      if (useCache)
-        cachedServerMode = candidate;
-      return candidate;
-    } catch {}
-  }
-  throw new Error(`REMOTE_STORAGE_MODE_UNSUPPORTED: no known server storage mode is accepted by the installed ` + `@hasna/contracts (tried ${SERVER_MODE_CANDIDATES.join(", ")}); the storage-mode enum has changed. ` + `Add the new server token to SERVER_MODE_CANDIDATES in src/cli/cloud-router.ts; ` + `local SQLite fallback is disabled.`);
-}
 function requireTodosRemoteAuthorityEnv(env) {
   const status = getTodosRemoteAuthorityConfigStatus(env);
   if (!status.ok)
     throw new Error(status.issues[0]);
   return {
     ...env,
-    HASNA_TODOS_STORAGE_MODE: serverStorageMode(),
     HASNA_TODOS_API_URL: status.v1_base_url.replace(/\/v1$/, ""),
     HASNA_TODOS_API_KEY: env.HASNA_TODOS_API_KEY.trim()
   };
@@ -5876,7 +5857,7 @@ async function requiredRemoteRoute(client, route, request, recognized404Codes =
     return await request();
   } catch (error) {
     const status = error && typeof error === "object" ? error.status : undefined;
-    if (status === 404) {
+    if (status === 404 || status === 405) {
       const body = error && typeof error === "object" ? error.body : undefined;
       const code = body && typeof body === "object" && !Array.isArray(body) ? body.code : undefined;
       if (typeof code === "string" && recognized404Codes.includes(code))
@@ -5892,7 +5873,12 @@ function getTodosCloudClient(env = process.env) {
   const resolved = resolveStorageClient("todos", requireTodosRemoteAuthorityEnv(env), {
     fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" })
   });
-  return resolved.transport === "cloud-http" ? protectRemoteClient(resolved.client) : null;
+  if (resolved.transport === "cloud-http")
+    return protectRemoteClient(resolved.client);
+  const transportName = resolved.transport;
+  if (transportName === "http")
+    return protectRemoteClient(resolved.client);
+  return null;
 }
 function isCloudRouting(env = process.env) {
   return getTodosCloudClient(env) !== null;
@@ -7397,11 +7383,13 @@ async function cloudUpdateTaskList(client, id, patch) {
   return unwrapTaskList(await client.update("task-lists", id, patch));
 }
 async function cloudRenameProject(client, ref, newSlug, name) {
-  const id = await cloudResolveProjectRef(client, ref);
-  const normalizedSlug = cloudProjectSlug(newSlug);
-  if (!normalizedSlug)
-    throw new Error("Invalid slug \u2014 must be non-empty kebab-case");
-  return client.transport.post(`/projects/${encodeURIComponent(id)}/rename`, { new_slug: normalizedSlug, ...name !== undefined ? { name } : {} });
+  return requiredRemoteRoute(client, "/v1/projects/:id/rename", async () => {
+    const id = await cloudResolveProjectRef(client, ref);
+    const normalizedSlug = cloudProjectSlug(newSlug);
+    if (!normalizedSlug)
+      throw new Error("Invalid slug \u2014 must be non-empty kebab-case");
+    return client.transport.post(`/projects/${encodeURIComponent(id)}/rename`, { new_slug: normalizedSlug, ...name !== undefined ? { name } : {} });
+  });
 }
 async function cloudDeleteTaskList(client, id) {
   try {
@@ -7547,7 +7535,7 @@ async function cloudTimeline(client, options = {}) {
   const limit = options.limit ?? 50;
   return { entries: entries.slice(offset, offset + limit), total, limit, offset };
 }
-var UUID_RE, TRANSPORT_TOKENS, COMPLETION_EVIDENCE_FIELDS, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, SERVER_MODE_CANDIDATES, cachedServerMode = null, PRIORITY_RANK, listTagsCapabilityCache, PLAN_COMPLETION_PROTECTED_FIELDS, RELATION_HYDRATION_CONCURRENCY = 6;
+var UUID_RE, COMPLETION_EVIDENCE_FIELDS, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, LEGACY_STORAGE_MODE_KEYS, PRIORITY_RANK, listTagsCapabilityCache, PLAN_COMPLETION_PROTECTED_FIELDS, RELATION_HYDRATION_CONCURRENCY = 6;
 var init_cloud_router = __esm(() => {
   init_types();
   init_redaction();
@@ -7556,15 +7544,6 @@ var init_cloud_router = __esm(() => {
   init_adoption_validation();
   init_page_validation();
   UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  TRANSPORT_TOKENS = {
-    sqlite: "sqlite",
-    http: "http",
-    local: "sqlite",
-    remote: "http",
-    self_hosted: "http",
-    cloud: "http",
-    hybrid: "http"
-  };
   COMPLETION_EVIDENCE_FIELDS = [
     "attachment_ids",
     "files_changed",
@@ -7578,7 +7557,12 @@ var init_cloud_router = __esm(() => {
   taskCreatorCapabilityCache = new Map;
   gitRefCapabilityCache = new Map;
   remoteCommandCapabilityCache = new Map;
-  SERVER_MODE_CANDIDATES = ["postgres", "cloud", "self_hosted"];
+  LEGACY_STORAGE_MODE_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
   PRIORITY_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
   listTagsCapabilityCache = new Map;
   PLAN_COMPLETION_PROTECTED_FIELDS = [
@@ -7599,8 +7583,10 @@ var init_cloud_router = __esm(() => {
 function applyTodosCliAuthorityEnvironment(authority, env = process.env) {
   if (authority.route !== "local" || authority.selected_by !== "local-only-command")
     return;
-  env.HASNA_TODOS_STORAGE_MODE = "sqlite";
-  env.TODOS_STORAGE_MODE = "sqlite";
+  env.HASNA_TODOS_API_URL = "";
+  env.HASNA_TODOS_API_KEY = "";
+  env.TODOS_API_URL = "";
+  env.TODOS_API_KEY = "";
 }
 function isTodosCliCommandVisibleForRoute(command, route, remoteCapabilities = new Set) {
   if (route === "local")
@@ -7844,7 +7830,7 @@ function assertInvocationRoutable(invocation) {
   if (command && !owner) {
     const suggestions = nearestCommands(command);
     const didYouMean = suggestions.length > 0 ? ` Did you mean: ${suggestions.join(", ")}?` : "";
-    throw new Error(`UNKNOWN_COMMAND: \`${command}\` is not a built-in todos command on the /v1 route.${didYouMean} ` + "Run `todos --help` for the commands available here; verbs contributed by optional packages are local-only. " + "(This is not a connectivity, storage-mode or credential problem.)");
+    throw new Error(`UNKNOWN_COMMAND: \`${command}\` is not a built-in todos command on the /v1 route.${didYouMean} ` + "Run `todos --help` for the commands available here; verbs contributed by optional packages are local-only. " + "(This is not a connectivity or credential problem.)");
   }
   return owner;
 }
@@ -7861,7 +7847,20 @@ function assertRemoteCommandSupported(invocation, owner) {
   }
 }
 function initializeTodosCliAuthority(args = process.argv.slice(2), env = process.env) {
-  const mode = resolveTodosCliStorageMode(env);
+  let mode;
+  try {
+    mode = resolveTodosCliStorageMode(env);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("REMOTE_STORAGE_MODE_REMOVED"))
+      throw error;
+    const invocation2 = parseInvocation(args);
+    if (isMetadataInvocation(args, invocation2)) {
+      const status = getTodosRemoteAuthorityConfigStatus(env);
+      return { route: "remote-diagnostic", v1_base_url: status.v1_base_url };
+    }
+    throw error;
+  }
   if (!mode.selected)
     return { route: "local", v1_base_url: null };
   const invocation = parseInvocation(args);
@@ -7876,7 +7875,7 @@ function initializeTodosCliAuthority(args = process.argv.slice(2), env = process
   assertRemoteCommandSupported(invocation, owner);
   const client = getTodosCloudClient(env);
   if (!client) {
-    throw new Error("REMOTE_API_UNAVAILABLE: remote mode did not resolve an HTTP client; local SQLite fallback is disabled");
+    throw new Error("REMOTE_API_UNAVAILABLE: HTTP routing did not resolve an authenticated /v1 client; local SQLite fallback is disabled");
   }
   return { route: "remote-http", v1_base_url: client.baseUrl };
 }
@@ -12039,6 +12038,7 @@ __export(exports_config2, {
   TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
   STORAGE_TABLES: () => STORAGE_TABLES,
+  REMOVED_STORAGE_MODE_ENV_KEYS: () => REMOVED_STORAGE_MODE_ENV_KEYS,
   CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV: () => CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
@@ -12100,25 +12100,36 @@ function assertTodosRemoteStorageConfig(config) {
   if (!isTodosPostgresBackend(config))
     return;
   if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when the postgresql backend is selected`);
   }
 }
 function parseStorageBackend(value) {
   const normalized = clean(value)?.toLowerCase();
   if (!normalized)
     return "sqlite";
-  if (normalized === "sqlite" || normalized === "postgres")
-    return normalized;
-  const legacy = LEGACY_BACKEND_TOKENS[normalized];
-  if (legacy)
-    return legacy;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be sqlite or postgres (legacy values local and remote are accepted)`);
+  if (normalized === "sqlite")
+    return "sqlite";
+  if (normalized === "postgres" || normalized === "postgresql")
+    return "postgres";
+  if (["local", "remote", "cloud", "hybrid", "self_hosted"].includes(normalized)) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} selects the backend. Deployment modes no longer exist: ` + `delete the storage-mode variable and set ${TODOS_STORAGE_ENV.databaseUrl} to select the ` + `postgresql backend, or leave it unset for sqlite.`);
+  }
+  throw new Error(`Storage backend must be sqlite or postgres`);
 }
 function parseStorageMode(value) {
   return parseStorageBackend(value);
 }
 function getTodosStorageBackend(env = process.env) {
-  return parseStorageBackend(readStorageEnv(env, "mode").value);
+  for (const key of REMOVED_STORAGE_MODE_ENV_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `Set ${TODOS_STORAGE_ENV.databaseUrl} to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
+  if (!getTodosStorageDatabaseUrl(env))
+    return "sqlite";
+  if (isTodosShadowEnabled(env))
+    return "sqlite";
+  return "postgres";
 }
 function getTodosStorageMode(env = process.env) {
   return getTodosStorageBackend(env);
@@ -12192,7 +12203,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos", LEGACY_BACKEND_TOKENS;
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, REMOVED_STORAGE_MODE_ENV_KEYS, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
 var init_config2 = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -12200,7 +12211,6 @@ var init_config2 = __esm(() => {
   ];
   STORAGE_TABLES = TODOS_STORAGE_TABLES;
   TODOS_STORAGE_ENV = {
-    mode: "HASNA_TODOS_STORAGE_MODE",
     shadow: "HASNA_TODOS_SHADOW",
     databaseUrl: "HASNA_TODOS_DATABASE_URL",
     databaseSsl: "HASNA_TODOS_DATABASE_SSL",
@@ -12217,7 +12227,6 @@ var init_config2 = __esm(() => {
     syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
   };
   TODOS_STORAGE_FALLBACK_ENV = {
-    mode: "TODOS_STORAGE_MODE",
     shadow: "TODOS_SHADOW",
     databaseUrl: "TODOS_DATABASE_URL",
     databaseSsl: "TODOS_DATABASE_SSL",
@@ -12233,14 +12242,12 @@ var init_config2 = __esm(() => {
     syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
     syncDryRun: "TODOS_SYNC_DRY_RUN"
   };
-  LEGACY_BACKEND_TOKENS = {
-    local: "sqlite",
-    remote: "postgres",
-    postgresql: "postgres",
-    hybrid: "postgres",
-    self_hosted: "postgres",
-    cloud: "postgres"
-  };
+  REMOVED_STORAGE_MODE_ENV_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
 });
 
 // src/storage/shadow-outbox-schema.ts
@@ -15383,8 +15390,8 @@ var init_secret_redaction = __esm(() => {
   SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
-    { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
-    { name: "github_oauth", pattern: /\bgho_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_pat", pattern: /\bgh[p]_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_oauth", pattern: /\bgh[o]_[a-zA-Z0-9]{20,}\b/g },
     { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
     { name: "bearer_token", pattern: /\bBearer\s+[a-zA-Z0-9\-._~+/]+=*\b/gi },
     { name: "jwt", pattern: /\beyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
@@ -15396,7 +15403,7 @@ var init_secret_redaction = __esm(() => {
     /example\.com/i,
     /your-api-key-here/i,
     /sk-test/i,
-    /ghp_xxx/i
+    /gh[p]_xxx/i
   ];
   customRedactors = [];
 });
@@ -31501,7 +31508,7 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
       AS $$ SELECT unaccent('unaccent', $1) $$`,
     `CREATE OR REPLACE FUNCTION todos_try_timestamptz(text)
       RETURNS timestamptz
-      LANGUAGE plpgsql IMMUTABLE PARALLEL SAFE
+      LANGUAGE plpgsql IMMUTABLE PARALLEL UNSAFE
       SET DateStyle TO 'ISO, YMD'
       AS $$
       BEGIN
@@ -36349,9 +36356,14 @@ class PackageOwnedTodosProjectRegistrationAuthority {
     if (request.max_items !== 1) {
       throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_BOUNDS", "max_items must be exactly 1 for terminal receipt lookup");
     }
-    if (request.authority !== "todos" || request.authority_id !== this.capabilityValue.authority_id || request.tenant_id !== this.capabilityValue.tenant_id || request.corpus_id !== this.capabilityValue.corpus_id) {
+    if (request.authority !== "todos" || request.authority_id !== this.capabilityValue.authority_id || request.tenant_id !== this.capabilityValue.tenant_id) {
       throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CAPABILITY_MISMATCH", "receipt lookup does not match this authority capability identity");
     }
+    requireString(request.corpus_id, "corpus_id", {
+      min: 3,
+      max: 128,
+      pattern: AUTHORITY_ROUTE_PATTERN
+    });
     requireString(request.authority_route, "authority_route", {
       min: 3,
       max: 128,
@@ -36382,6 +36394,7 @@ class PackageOwnedTodosProjectRegistrationAuthority {
     }
     const receipt = await this.backend.getReceiptForLookup({
       ...authorityScope(this.capabilityValue),
+      corpus_id: request.corpus_id,
       route: request.authority_route,
       package_version: request.package_version,
       operation_id: request.operation_id,
@@ -36486,9 +36499,15 @@ class PackageOwnedTodosProjectRegistrationAuthority {
       max: 128,
       pattern: PACKAGE_VERSION_PATTERN
     });
+    requireString(sourceRequest.corpus_id, "corpus_id", {
+      min: 3,
+      max: 128,
+      pattern: AUTHORITY_ROUTE_PATTERN
+    });
     assertForwardRequest(sourceRequest, {
       ...this.capabilityValue,
-      package_version: sourceRequest.package_version
+      package_version: sourceRequest.package_version,
+      corpus_id: sourceRequest.corpus_id
     });
     const validation = await this.backend.transaction(async (transaction) => {
       const storedSource = await transaction.getReceiptById(sourceReceipt.receipt_id);
@@ -36503,7 +36522,11 @@ class PackageOwnedTodosProjectRegistrationAuthority {
       if (!receiptLineageMatches(storedSource) || !receiptLineageMatches(accepted) || storedSource.outcome === "duplicate_of_accepted" && (storedSource.duplicate_of_receipt_id !== accepted.receipt_id || storedSource.target_id !== accepted.target_id || storedSource.result_revision !== accepted.result_revision || storedSource.result_digest !== accepted.result_digest)) {
         throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ADOPTION_REJECTED", "receipt authority, operation, request, precondition, or normalized-call lineage changed");
       }
-      const binding = await transaction.getBinding(authorityScope(this.capabilityValue), sourceRequest.resource_kind, sourceRequest.target_selector);
+      const binding = await transaction.getBinding({
+        authority_id: sourceRequest.authority_id,
+        tenant_id: sourceRequest.tenant_id,
+        corpus_id: sourceRequest.corpus_id
+      }, sourceRequest.resource_kind, sourceRequest.target_selector);
       if (!binding || binding.state !== "accepted" || binding.operation_id !== sourceRequest.operation_id || binding.step_id !== sourceRequest.step_id || binding.direction !== "forward" || binding.idempotency_key !== sourceRequest.idempotency_key || binding.request_digest !== sourceRequest.request_digest || binding.precondition_digest !== sourceRequest.precondition_digest || binding.normalized_call_digest !== accepted.normalized_call_digest || binding.target_id !== accepted.target_id || binding.accepted_receipt_id !== accepted.receipt_id || binding.result_revision !== accepted.result_revision || binding.result_digest !== accepted.result_digest) {
         throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ADOPTION_REJECTED", "accepted binding does not match the exact accepted receipt and source lineage");
       }
@@ -55738,8 +55761,8 @@ async function handleV1Request(req, url, dependencies = {}) {
           }
           const created = await store.tasks.create(body2, storageContext);
           const persisted = created?.id ? await store.tasks.get(created.id, storageContext) : null;
-          if (!persisted || persisted.id !== created.id || (persisted.parent_id ?? null) !== (body2.parent_id ?? null) || (persisted.plan_id ?? null) !== (body2.plan_id ?? null)) {
-            return error(500, "TASK_CREATE_PERSISTENCE_UNVERIFIED: task create was acknowledged but authoritative readback did not return the same stored task id, parent_id, and plan_id", { code: "TASK_CREATE_PERSISTENCE_UNVERIFIED" });
+          if (!persisted || persisted.id !== created.id || (persisted.parent_id ?? null) !== (body2.parent_id ?? null) || (persisted.plan_id ?? null) !== (body2.plan_id ?? null) || body2.created_by !== undefined && persisted.created_by !== body2.created_by) {
+            return error(500, "TASK_CREATE_PERSISTENCE_UNVERIFIED: task create was acknowledged but authoritative readback did not return the same stored task id, parent_id, plan_id, and explicit created_by", { code: "TASK_CREATE_PERSISTENCE_UNVERIFIED" });
           }
           return json5({ task: persisted }, 201);
         }
@@ -82428,7 +82451,7 @@ No task claimed (nothing available).`));
         verdict_exit_code: verdict2.verdict,
         fail_on_findings: verdict2.fail_on_findings,
         dry_run: true,
-        mode: "remote-http",
+        mode: "http",
         authority: { v1_base_url: cloud.baseUrl, local_fallback: false },
         routes: {
           stats: true,
@@ -82650,7 +82673,7 @@ Findings`));
       checks.push({ name: "Version", ok: true, message: `v${getPackageVersion3()} \xB7 remote HTTP client` });
       const ok = checks.every((check) => check.ok);
       if (opts.json || globalOpts.json) {
-        console.log(JSON.stringify({ ok, mode: "remote-http", checks }));
+        console.log(JSON.stringify({ ok, mode: "http", checks }));
       } else {
         console.log(chalk9.bold(`todos health
 `));
@@ -93376,7 +93399,7 @@ function getNativeStorageStatus(env = process.env) {
   const remoteEnabled = isTodosPostgresBackend(config);
   const remoteFieldsConfigured = Boolean(config.database || config.objectStorage);
   if (!remoteEnabled && remoteFieldsConfigured) {
-    warnings.push(`the sqlite backend (${TODOS_STORAGE_ENV.mode}) ignores configured remote storage fields`);
+    warnings.push(`the sqlite backend ignores configured remote storage fields`);
   }
   if (remoteEnabled && !config.objectStorage) {
     warnings.push(`${TODOS_STORAGE_ENV.s3Bucket} is not configured, so artifact sync will stay local`);
@@ -93469,7 +93492,7 @@ function storageEnvStatus(env) {
 function fallbackConfig(env) {
   let mode;
   try {
-    mode = parseStorageBackend(clean2(env[TODOS_STORAGE_ENV.mode]));
+    mode = getTodosStorageBackend(env);
   } catch {
     mode = "sqlite";
   }

package/dist/cli/stage-a.d.ts

@@ -18,7 +18,9 @@ export type TodosCliCommandOwner = "diagnostic" | "remote-http" | "local-only";
  * mutating the caller's environment. The executable applies an admitted local
  * redaction decision before importing command modules so any later
  * `getTodosCloudClient()` call cannot reconstruct hosted routing from the
- * ambient selector.
+ * ambient API pair. The retired storage-mode variables are never written here —
+ * they are banned (owner directive 2026-08-15), and the HTTP selector is
+ * HASNA_TODOS_API_URL + HASNA_TODOS_API_KEY, which the redaction blanks.
  */
 export declare function applyTodosCliAuthorityEnvironment(authority: TodosCliAuthorityInitialization, env?: Env): void;
 export declare const TODOS_CLI_COMMAND_ALIASES: {

package/dist/cli/stage-a.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stage-a.d.ts","sourceRoot":"","sources":["../../src/cli/stage-a.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,WAAW,CAAC;AAC1C,OAAO,EAIL,KAAK,4BAA4B,EAClC,MAAM,mBAAmB,CAAC;AAE3B,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,MAAM,MAAM,+BAA+B,GACvC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,oBAAoB,CAAA;CAAE,GACzE;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1D;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,aAAa,GAAG,YAAY,CAAC;AAE/E;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,+BAA+B,EAC1C,GAAG,GAAE,GAAwB,GAC5B,IAAI,CAIN;AAyBD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;CA8BgB,CAAC;AAkFvD,wBAAgB,kCAAkC,IAAI,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,EAC/C,kBAAkB,GAAE,WAAW,CAAC,4BAA4B,CAAa,GACxE,OAAO,CAOT;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,EAC/C,kBAAkB,GAAE,WAAW,CAAC,4BAA4B,CAAa,GACxE,IAAI,CAUN;AAED;;;;;;;;GAQG;AACH,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,EAC/C,kBAAkB,GAAE,WAAW,CAAC,4BAA4B,CAAa,EACzE,IAAI,GAAE,SAAS,MAAM,EAAO,GAC3B,MAAM,GAAG,IAAI,CAYf;AA2XD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,MAAM,EAA0B,EACtC,GAAG,GAAE,GAAwB,GAC5B,+BAA+B,CAqBjC"}
+{"version":3,"file":"stage-a.d.ts","sourceRoot":"","sources":["../../src/cli/stage-a.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,WAAW,CAAC;AAC1C,OAAO,EAKL,KAAK,4BAA4B,EAClC,MAAM,mBAAmB,CAAC;AAE3B,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAE9C,MAAM,MAAM,+BAA+B,GACvC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,IAAI,CAAC;IAAC,WAAW,CAAC,EAAE,oBAAoB,CAAA;CAAE,GACzE;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC1D;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,aAAa,GAAG,YAAY,CAAC;AAE/E;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,+BAA+B,EAC1C,GAAG,GAAE,GAAwB,GAC5B,IAAI,CAMN;AAyBD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;CA8BgB,CAAC;AAkFvD,wBAAgB,kCAAkC,IAAI,WAAW,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAE9F;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,EAC/C,kBAAkB,GAAE,WAAW,CAAC,4BAA4B,CAAa,GACxE,OAAO,CAOT;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,EAC/C,kBAAkB,GAAE,WAAW,CAAC,4BAA4B,CAAa,GACxE,IAAI,CAUN;AAED;;;;;;;;GAQG;AACH,wBAAgB,2CAA2C,CACzD,KAAK,EAAE,+BAA+B,CAAC,OAAO,CAAC,EAC/C,kBAAkB,GAAE,WAAW,CAAC,4BAA4B,CAAa,EACzE,IAAI,GAAE,SAAS,MAAM,EAAO,GAC3B,MAAM,GAAG,IAAI,CAYf;AA2XD;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,MAAM,EAA0B,EACtC,GAAG,GAAE,GAAwB,GAC5B,+BAA+B,CAsCjC"}

package/dist/contracts.js

@@ -4177,6 +4177,7 @@ __export(exports_config, {
   TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
   STORAGE_TABLES: () => STORAGE_TABLES,
+  REMOVED_STORAGE_MODE_ENV_KEYS: () => REMOVED_STORAGE_MODE_ENV_KEYS,
   CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV: () => CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
@@ -4238,25 +4239,36 @@ function assertTodosRemoteStorageConfig(config) {
   if (!isTodosPostgresBackend(config))
     return;
   if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when the postgresql backend is selected`);
   }
 }
 function parseStorageBackend(value) {
   const normalized = clean(value)?.toLowerCase();
   if (!normalized)
     return "sqlite";
-  if (normalized === "sqlite" || normalized === "postgres")
-    return normalized;
-  const legacy = LEGACY_BACKEND_TOKENS[normalized];
-  if (legacy)
-    return legacy;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be sqlite or postgres (legacy values local and remote are accepted)`);
+  if (normalized === "sqlite")
+    return "sqlite";
+  if (normalized === "postgres" || normalized === "postgresql")
+    return "postgres";
+  if (["local", "remote", "cloud", "hybrid", "self_hosted"].includes(normalized)) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} selects the backend. Deployment modes no longer exist: ` + `delete the storage-mode variable and set ${TODOS_STORAGE_ENV.databaseUrl} to select the ` + `postgresql backend, or leave it unset for sqlite.`);
+  }
+  throw new Error(`Storage backend must be sqlite or postgres`);
 }
 function parseStorageMode(value) {
   return parseStorageBackend(value);
 }
 function getTodosStorageBackend(env = process.env) {
-  return parseStorageBackend(readStorageEnv(env, "mode").value);
+  for (const key of REMOVED_STORAGE_MODE_ENV_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `Set ${TODOS_STORAGE_ENV.databaseUrl} to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
+  if (!getTodosStorageDatabaseUrl(env))
+    return "sqlite";
+  if (isTodosShadowEnabled(env))
+    return "sqlite";
+  return "postgres";
 }
 function getTodosStorageMode(env = process.env) {
   return getTodosStorageBackend(env);
@@ -4330,7 +4342,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos", LEGACY_BACKEND_TOKENS;
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, REMOVED_STORAGE_MODE_ENV_KEYS, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
 var init_config = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -4338,7 +4350,6 @@ var init_config = __esm(() => {
   ];
   STORAGE_TABLES = TODOS_STORAGE_TABLES;
   TODOS_STORAGE_ENV = {
-    mode: "HASNA_TODOS_STORAGE_MODE",
     shadow: "HASNA_TODOS_SHADOW",
     databaseUrl: "HASNA_TODOS_DATABASE_URL",
     databaseSsl: "HASNA_TODOS_DATABASE_SSL",
@@ -4355,7 +4366,6 @@ var init_config = __esm(() => {
     syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
   };
   TODOS_STORAGE_FALLBACK_ENV = {
-    mode: "TODOS_STORAGE_MODE",
     shadow: "TODOS_SHADOW",
     databaseUrl: "TODOS_DATABASE_URL",
     databaseSsl: "TODOS_DATABASE_SSL",
@@ -4371,14 +4381,12 @@ var init_config = __esm(() => {
     syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
     syncDryRun: "TODOS_SYNC_DRY_RUN"
   };
-  LEGACY_BACKEND_TOKENS = {
-    local: "sqlite",
-    remote: "postgres",
-    postgresql: "postgres",
-    hybrid: "postgres",
-    self_hosted: "postgres",
-    cloud: "postgres"
-  };
+  REMOVED_STORAGE_MODE_ENV_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
 });
 
 // src/storage/shadow-outbox-schema.ts
@@ -7227,8 +7235,8 @@ var init_secret_redaction = __esm(() => {
   SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
-    { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
-    { name: "github_oauth", pattern: /\bgho_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_pat", pattern: /\bgh[p]_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_oauth", pattern: /\bgh[o]_[a-zA-Z0-9]{20,}\b/g },
     { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
     { name: "bearer_token", pattern: /\bBearer\s+[a-zA-Z0-9\-._~+/]+=*\b/gi },
     { name: "jwt", pattern: /\beyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
@@ -7240,7 +7248,7 @@ var init_secret_redaction = __esm(() => {
     /example\.com/i,
     /your-api-key-here/i,
     /sk-test/i,
-    /ghp_xxx/i
+    /gh[p]_xxx/i
   ];
   customRedactors = [];
 });
@@ -12720,7 +12728,7 @@ var init_tasks = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.32",
+  version: "0.15.34",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -12794,9 +12802,7 @@ var package_default = {
     "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
     "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
     "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
-    "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
-    "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
     "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
     prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
     postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"