@hasna/todos 0.15.32 → 0.15.34

package/dist/mcp/index.js

@@ -4129,6 +4129,7 @@ __export(exports_config, {
   TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
   STORAGE_TABLES: () => STORAGE_TABLES,
+  REMOVED_STORAGE_MODE_ENV_KEYS: () => REMOVED_STORAGE_MODE_ENV_KEYS,
   CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV: () => CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
@@ -4190,25 +4191,36 @@ function assertTodosRemoteStorageConfig(config) {
   if (!isTodosPostgresBackend(config))
     return;
   if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when the postgresql backend is selected`);
   }
 }
 function parseStorageBackend(value) {
   const normalized = clean(value)?.toLowerCase();
   if (!normalized)
     return "sqlite";
-  if (normalized === "sqlite" || normalized === "postgres")
-    return normalized;
-  const legacy = LEGACY_BACKEND_TOKENS[normalized];
-  if (legacy)
-    return legacy;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be sqlite or postgres (legacy values local and remote are accepted)`);
+  if (normalized === "sqlite")
+    return "sqlite";
+  if (normalized === "postgres" || normalized === "postgresql")
+    return "postgres";
+  if (["local", "remote", "cloud", "hybrid", "self_hosted"].includes(normalized)) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} selects the backend. Deployment modes no longer exist: ` + `delete the storage-mode variable and set ${TODOS_STORAGE_ENV.databaseUrl} to select the ` + `postgresql backend, or leave it unset for sqlite.`);
+  }
+  throw new Error(`Storage backend must be sqlite or postgres`);
 }
 function parseStorageMode(value) {
   return parseStorageBackend(value);
 }
 function getTodosStorageBackend(env = process.env) {
-  return parseStorageBackend(readStorageEnv(env, "mode").value);
+  for (const key of REMOVED_STORAGE_MODE_ENV_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `Set ${TODOS_STORAGE_ENV.databaseUrl} to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
+  if (!getTodosStorageDatabaseUrl(env))
+    return "sqlite";
+  if (isTodosShadowEnabled(env))
+    return "sqlite";
+  return "postgres";
 }
 function getTodosStorageMode(env = process.env) {
   return getTodosStorageBackend(env);
@@ -4282,7 +4294,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos", LEGACY_BACKEND_TOKENS;
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, REMOVED_STORAGE_MODE_ENV_KEYS, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
 var init_config = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -4290,7 +4302,6 @@ var init_config = __esm(() => {
   ];
   STORAGE_TABLES = TODOS_STORAGE_TABLES;
   TODOS_STORAGE_ENV = {
-    mode: "HASNA_TODOS_STORAGE_MODE",
     shadow: "HASNA_TODOS_SHADOW",
     databaseUrl: "HASNA_TODOS_DATABASE_URL",
     databaseSsl: "HASNA_TODOS_DATABASE_SSL",
@@ -4307,7 +4318,6 @@ var init_config = __esm(() => {
     syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
   };
   TODOS_STORAGE_FALLBACK_ENV = {
-    mode: "TODOS_STORAGE_MODE",
     shadow: "TODOS_SHADOW",
     databaseUrl: "TODOS_DATABASE_URL",
     databaseSsl: "TODOS_DATABASE_SSL",
@@ -4323,14 +4333,12 @@ var init_config = __esm(() => {
     syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
     syncDryRun: "TODOS_SYNC_DRY_RUN"
   };
-  LEGACY_BACKEND_TOKENS = {
-    local: "sqlite",
-    remote: "postgres",
-    postgresql: "postgres",
-    hybrid: "postgres",
-    self_hosted: "postgres",
-    cloud: "postgres"
-  };
+  REMOVED_STORAGE_MODE_ENV_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
 });
 
 // src/storage/shadow-outbox-schema.ts
@@ -9677,8 +9685,8 @@ var init_secret_redaction = __esm(() => {
   SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
-    { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
-    { name: "github_oauth", pattern: /\bgho_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_pat", pattern: /\bgh[p]_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_oauth", pattern: /\bgh[o]_[a-zA-Z0-9]{20,}\b/g },
     { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
     { name: "bearer_token", pattern: /\bBearer\s+[a-zA-Z0-9\-._~+/]+=*\b/gi },
     { name: "jwt", pattern: /\beyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
@@ -9690,7 +9698,7 @@ var init_secret_redaction = __esm(() => {
     /example\.com/i,
     /your-api-key-here/i,
     /sk-test/i,
-    /ghp_xxx/i
+    /gh[p]_xxx/i
   ];
   customRedactors = [];
 });
@@ -21093,40 +21101,38 @@ var init_page_validation = __esm(() => {
 
 // src/cli/cloud-router.ts
 import { resolveStorageClient } from "@hasna/contracts/client/storage";
-import { normalizeStorageMode } from "@hasna/contracts/mode";
 import { randomUUID as randomUUID3 } from "crypto";
 import { resolve as resolvePath } from "path";
-function cleanMode(value) {
-  const normalized = value?.trim().toLowerCase();
-  return normalized || null;
+function assertNoLegacyStorageMode(env = process.env) {
+  for (const key of LEGACY_STORAGE_MODE_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`REMOTE_STORAGE_MODE_REMOVED: ${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `The client uses the on-box SQLite store, or the HTTP API selected by ` + `HASNA_TODOS_API_URL + HASNA_TODOS_API_KEY. ` + `On the server, set HASNA_TODOS_DATABASE_URL to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
 }
 function resolveTodosCliStorageMode(env = process.env) {
-  for (const source of ["HASNA_TODOS_STORAGE_MODE", "TODOS_STORAGE_MODE"]) {
-    if (env[source] !== undefined && env[source].trim() === "") {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source} must not be blank; local SQLite fallback is disabled for invalid routing state`);
-    }
+  assertNoLegacyStorageMode(env);
+  const urlValue = env.HASNA_TODOS_API_URL?.trim();
+  const keyValue = env.HASNA_TODOS_API_KEY?.trim();
+  if (urlValue && keyValue) {
+    return {
+      mode: "http",
+      transport: "http",
+      selected: true,
+      source: "HASNA_TODOS_API_URL+HASNA_TODOS_API_KEY"
+    };
   }
-  const canonical = cleanMode(env.HASNA_TODOS_STORAGE_MODE);
-  const fallback = cleanMode(env.TODOS_STORAGE_MODE);
-  for (const [source, value] of [
-    ["HASNA_TODOS_STORAGE_MODE", canonical],
-    ["TODOS_STORAGE_MODE", fallback]
-  ]) {
-    if (value && !(value in TRANSPORT_TOKENS)) {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source}=${value} must be sqlite (local file) or http (hosted /v1 authority); ` + "legacy values local and remote are accepted; " + "local SQLite fallback is disabled for invalid routing state");
-    }
+  if (urlValue) {
+    throw new Error("REMOTE_API_KEY_MISSING: remote Todos storage requires HASNA_TODOS_API_KEY; local SQLite fallback is disabled");
   }
-  const canonicalTransport = canonical ? TRANSPORT_TOKENS[canonical] : null;
-  const fallbackTransport = fallback ? TRANSPORT_TOKENS[fallback] : null;
-  if (canonicalTransport && fallbackTransport && canonicalTransport !== fallbackTransport) {
-    throw new Error(`REMOTE_STORAGE_MODE_CONFLICT: HASNA_TODOS_STORAGE_MODE=${canonical} conflicts with ` + `TODOS_STORAGE_MODE=${fallback}; local SQLite fallback is disabled`);
+  if (keyValue) {
+    throw new Error("REMOTE_API_URL_MISSING: remote Todos storage requires HASNA_TODOS_API_URL; local SQLite fallback is disabled");
   }
-  const transport = canonicalTransport ?? fallbackTransport ?? "sqlite";
   return {
-    mode: transport,
-    transport,
-    selected: transport === "http",
-    source: canonical ? "HASNA_TODOS_STORAGE_MODE" : fallback ? "TODOS_STORAGE_MODE" : "default"
+    mode: "sqlite",
+    transport: "sqlite",
+    selected: false,
+    source: "default"
   };
 }
 function requestedTransport(env) {
@@ -21170,7 +21176,7 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     return {
       selected: true,
       ok: false,
-      mode: cleanMode(env.HASNA_TODOS_STORAGE_MODE) ?? cleanMode(env.TODOS_STORAGE_MODE) ?? "invalid",
+      mode: "invalid",
       api_url_configured: Boolean(env.HASNA_TODOS_API_URL?.trim()),
       api_key_configured: Boolean(env.HASNA_TODOS_API_KEY?.trim()),
       v1_base_url: null,
@@ -21216,27 +21222,12 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     local_fallback: false
   };
 }
-function serverStorageMode(normalize = normalizeStorageMode) {
-  const useCache = normalize === normalizeStorageMode;
-  if (useCache && cachedServerMode !== null)
-    return cachedServerMode;
-  for (const candidate of SERVER_MODE_CANDIDATES) {
-    try {
-      normalize(candidate);
-      if (useCache)
-        cachedServerMode = candidate;
-      return candidate;
-    } catch {}
-  }
-  throw new Error(`REMOTE_STORAGE_MODE_UNSUPPORTED: no known server storage mode is accepted by the installed ` + `@hasna/contracts (tried ${SERVER_MODE_CANDIDATES.join(", ")}); the storage-mode enum has changed. ` + `Add the new server token to SERVER_MODE_CANDIDATES in src/cli/cloud-router.ts; ` + `local SQLite fallback is disabled.`);
-}
 function requireTodosRemoteAuthorityEnv(env) {
   const status = getTodosRemoteAuthorityConfigStatus(env);
   if (!status.ok)
     throw new Error(status.issues[0]);
   return {
     ...env,
-    HASNA_TODOS_STORAGE_MODE: serverStorageMode(),
     HASNA_TODOS_API_URL: status.v1_base_url.replace(/\/v1$/, ""),
     HASNA_TODOS_API_KEY: env.HASNA_TODOS_API_KEY.trim()
   };
@@ -21312,7 +21303,7 @@ async function requiredRemoteRoute(client, route, request, recognized404Codes =
     return await request();
   } catch (error) {
     const status = error && typeof error === "object" ? error.status : undefined;
-    if (status === 404) {
+    if (status === 404 || status === 405) {
       const body = error && typeof error === "object" ? error.body : undefined;
       const code = body && typeof body === "object" && !Array.isArray(body) ? body.code : undefined;
       if (typeof code === "string" && recognized404Codes.includes(code))
@@ -21328,7 +21319,12 @@ function getTodosCloudClient(env = process.env) {
   const resolved = resolveStorageClient("todos", requireTodosRemoteAuthorityEnv(env), {
     fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" })
   });
-  return resolved.transport === "cloud-http" ? protectRemoteClient(resolved.client) : null;
+  if (resolved.transport === "cloud-http")
+    return protectRemoteClient(resolved.client);
+  const transportName = resolved.transport;
+  if (transportName === "http")
+    return protectRemoteClient(resolved.client);
+  return null;
 }
 function unwrapTask(raw) {
   if (raw && typeof raw === "object" && "task" in raw) {
@@ -21799,7 +21795,7 @@ async function cloudResolveTaskListRef(client, ref, projectId) {
     return input.toLowerCase();
   return (await cloudResolveTaskList(client, ref, projectId)).id;
 }
-var UUID_RE, TRANSPORT_TOKENS, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, SERVER_MODE_CANDIDATES, cachedServerMode = null, PRIORITY_RANK, listTagsCapabilityCache;
+var UUID_RE, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, LEGACY_STORAGE_MODE_KEYS, PRIORITY_RANK, listTagsCapabilityCache;
 var init_cloud_router = __esm(() => {
   init_types();
   init_redaction();
@@ -21808,21 +21804,17 @@ var init_cloud_router = __esm(() => {
   init_adoption_validation();
   init_page_validation();
   UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  TRANSPORT_TOKENS = {
-    sqlite: "sqlite",
-    http: "http",
-    local: "sqlite",
-    remote: "http",
-    self_hosted: "http",
-    cloud: "http",
-    hybrid: "http"
-  };
   completionCapabilityCache = new Map;
   retryCapabilityCache = new Map;
   taskCreatorCapabilityCache = new Map;
   gitRefCapabilityCache = new Map;
   remoteCommandCapabilityCache = new Map;
-  SERVER_MODE_CANDIDATES = ["postgres", "cloud", "self_hosted"];
+  LEGACY_STORAGE_MODE_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
   PRIORITY_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
   listTagsCapabilityCache = new Map;
 });
@@ -35939,7 +35931,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.32",
+    version: "0.15.34",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -36013,9 +36005,7 @@ var init_package = __esm(() => {
       "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
       "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
       "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-      "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
-      "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
-      "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+      "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
       "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
       prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
       postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"
@@ -46248,7 +46238,7 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
       AS $$ SELECT unaccent('unaccent', $1) $$`,
     `CREATE OR REPLACE FUNCTION todos_try_timestamptz(text)
       RETURNS timestamptz
-      LANGUAGE plpgsql IMMUTABLE PARALLEL SAFE
+      LANGUAGE plpgsql IMMUTABLE PARALLEL UNSAFE
       SET DateStyle TO 'ISO, YMD'
       AS $$
       BEGIN
@@ -51853,9 +51843,14 @@ class PackageOwnedTodosProjectRegistrationAuthority {
     if (request.max_items !== 1) {
       throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_BOUNDS", "max_items must be exactly 1 for terminal receipt lookup");
     }
-    if (request.authority !== "todos" || request.authority_id !== this.capabilityValue.authority_id || request.tenant_id !== this.capabilityValue.tenant_id || request.corpus_id !== this.capabilityValue.corpus_id) {
+    if (request.authority !== "todos" || request.authority_id !== this.capabilityValue.authority_id || request.tenant_id !== this.capabilityValue.tenant_id) {
       throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CAPABILITY_MISMATCH", "receipt lookup does not match this authority capability identity");
     }
+    requireString(request.corpus_id, "corpus_id", {
+      min: 3,
+      max: 128,
+      pattern: AUTHORITY_ROUTE_PATTERN
+    });
     requireString(request.authority_route, "authority_route", {
       min: 3,
       max: 128,
@@ -51886,6 +51881,7 @@ class PackageOwnedTodosProjectRegistrationAuthority {
     }
     const receipt = await this.backend.getReceiptForLookup({
       ...authorityScope(this.capabilityValue),
+      corpus_id: request.corpus_id,
       route: request.authority_route,
       package_version: request.package_version,
       operation_id: request.operation_id,
@@ -51990,9 +51986,15 @@ class PackageOwnedTodosProjectRegistrationAuthority {
       max: 128,
       pattern: PACKAGE_VERSION_PATTERN
     });
+    requireString(sourceRequest.corpus_id, "corpus_id", {
+      min: 3,
+      max: 128,
+      pattern: AUTHORITY_ROUTE_PATTERN
+    });
     assertForwardRequest(sourceRequest, {
       ...this.capabilityValue,
-      package_version: sourceRequest.package_version
+      package_version: sourceRequest.package_version,
+      corpus_id: sourceRequest.corpus_id
     });
     const validation = await this.backend.transaction(async (transaction) => {
       const storedSource = await transaction.getReceiptById(sourceReceipt.receipt_id);
@@ -52007,7 +52009,11 @@ class PackageOwnedTodosProjectRegistrationAuthority {
       if (!receiptLineageMatches(storedSource) || !receiptLineageMatches(accepted) || storedSource.outcome === "duplicate_of_accepted" && (storedSource.duplicate_of_receipt_id !== accepted.receipt_id || storedSource.target_id !== accepted.target_id || storedSource.result_revision !== accepted.result_revision || storedSource.result_digest !== accepted.result_digest)) {
         throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ADOPTION_REJECTED", "receipt authority, operation, request, precondition, or normalized-call lineage changed");
       }
-      const binding = await transaction.getBinding(authorityScope(this.capabilityValue), sourceRequest.resource_kind, sourceRequest.target_selector);
+      const binding = await transaction.getBinding({
+        authority_id: sourceRequest.authority_id,
+        tenant_id: sourceRequest.tenant_id,
+        corpus_id: sourceRequest.corpus_id
+      }, sourceRequest.resource_kind, sourceRequest.target_selector);
       if (!binding || binding.state !== "accepted" || binding.operation_id !== sourceRequest.operation_id || binding.step_id !== sourceRequest.step_id || binding.direction !== "forward" || binding.idempotency_key !== sourceRequest.idempotency_key || binding.request_digest !== sourceRequest.request_digest || binding.precondition_digest !== sourceRequest.precondition_digest || binding.normalized_call_digest !== accepted.normalized_call_digest || binding.target_id !== accepted.target_id || binding.accepted_receipt_id !== accepted.receipt_id || binding.result_revision !== accepted.result_revision || binding.result_digest !== accepted.result_digest) {
         throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ADOPTION_REJECTED", "accepted binding does not match the exact accepted receipt and source lineage");
       }
@@ -59829,8 +59835,8 @@ async function handleV1Request(req, url, dependencies = {}) {
           }
           const created = await store.tasks.create(body2, storageContext);
           const persisted = created?.id ? await store.tasks.get(created.id, storageContext) : null;
-          if (!persisted || persisted.id !== created.id || (persisted.parent_id ?? null) !== (body2.parent_id ?? null) || (persisted.plan_id ?? null) !== (body2.plan_id ?? null)) {
-            return error(500, "TASK_CREATE_PERSISTENCE_UNVERIFIED: task create was acknowledged but authoritative readback did not return the same stored task id, parent_id, and plan_id", { code: "TASK_CREATE_PERSISTENCE_UNVERIFIED" });
+          if (!persisted || persisted.id !== created.id || (persisted.parent_id ?? null) !== (body2.parent_id ?? null) || (persisted.plan_id ?? null) !== (body2.plan_id ?? null) || body2.created_by !== undefined && persisted.created_by !== body2.created_by) {
+            return error(500, "TASK_CREATE_PERSISTENCE_UNVERIFIED: task create was acknowledged but authoritative readback did not return the same stored task id, parent_id, plan_id, and explicit created_by", { code: "TASK_CREATE_PERSISTENCE_UNVERIFIED" });
           }
           return json5({ task: persisted }, 201);
         }

package/dist/mcp.js

@@ -41,7 +41,7 @@ var __require = import.meta.require;
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.32",
+  version: "0.15.34",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -115,9 +115,7 @@ var package_default = {
     "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
     "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
     "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
-    "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
-    "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
     "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
     prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
     postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"

package/dist/project-registration/authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../src/project-registration/authority.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,OAAO,KAAK,EAEV,+BAA+B,EAMhC,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,KAAK,8CAA8C,EACnD,KAAK,sCAAsC,EAC5C,MAAM,eAAe,CAAC;AAEvB,OAAO,EAIL,KAAK,iCAAiC,EACtC,KAAK,wCAAwC,EAE7C,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EAEtC,KAAK,2CAA2C,EAChD,KAAK,qCAAqC,EAC1C,KAAK,oCAAoC,EACzC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,+BAA+B,EACpC,KAAK,oCAAoC,EACzC,KAAK,2CAA2C,EAChD,KAAK,wCAAwC,EAE7C,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,EACrC,MAAM,YAAY,CAAC;AAuBpB,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEvE;AAaD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIrE;AAED,wBAAgB,4CAA4C,CAAC,KAAK,EAAE;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,iCAAiC,CAAC;IAC7C,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,MAAM,CAKT;AA0zBD,qBAAa,6CACb,YAAW,iCAAiC;IAOxC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B,QAAQ,CAAC,SAAS,EAAG,OAAO,CAAU;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqC;IACrE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAA4D;gBAGxE,OAAO,EAAE,+BAA+B,EACzD,OAAO,GAAE,wCAA6C;IAyBlD,UAAU,IAAI,OAAO,CAAC,kCAAkC,CAAC;YAOjD,KAAK;YAiBL,WAAW;YASX,YAAY;YAgBZ,WAAW;YAuBX,yBAAyB;YA2DzB,YAAY;IAsHpB,MAAM,CACV,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,+BAA+B,CAAC;YAsG7B,kBAAkB;IAiE1B,SAAS,CAAC,OAAO,EAAE;QACvB,aAAa,EAAE,oCAAoC,CAAC;QACpD,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,8BAA8B,CAAC;IA0BrC,aAAa,CACjB,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,oCAAoC,CAAC;IA6E1C,oBAAoB,CACxB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,wBAAwB,CAAC;IA2I9B,iCAAiC,CACrC,aAAa,EAAE,+BAA+B,EAC9C,aAAa,EAAE,+BAA+B,EAC9C,aAAa,EAAE,2CAA2C,GACzD,OAAO,CAAC,wCAAwC,CAAC;YA8LtC,qBAAqB;IAgC7B,UAAU,CACd,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,+BAA+B,CAAC;IAqLrC,aAAa,CACjB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,2CAA2C,CAAC;CAuDxD;AAED,wBAAgB,4CAA4C,CAC1D,EAAE,EAAE,QAAQ,EACZ,OAAO,GAAE,wCAA6C,GACrD,iCAAiC,CAKnC;AAED,wBAAgB,+CAA+C,CAC7D,MAAM,EAAE,sCAAsC,EAC9C,OAAO,GAAE,wCAAwC,GAC7C,8CAAmD,GACtD,iCAAiC,CAenC"}
+{"version":3,"file":"authority.d.ts","sourceRoot":"","sources":["../../src/project-registration/authority.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,OAAO,KAAK,EAEV,+BAA+B,EAMhC,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,KAAK,8CAA8C,EACnD,KAAK,sCAAsC,EAC5C,MAAM,eAAe,CAAC;AAEvB,OAAO,EAIL,KAAK,iCAAiC,EACtC,KAAK,wCAAwC,EAE7C,KAAK,kCAAkC,EACvC,KAAK,iCAAiC,EAEtC,KAAK,2CAA2C,EAChD,KAAK,qCAAqC,EAC1C,KAAK,oCAAoC,EACzC,KAAK,+BAA+B,EACpC,KAAK,8BAA8B,EACnC,KAAK,+BAA+B,EACpC,KAAK,oCAAoC,EACzC,KAAK,2CAA2C,EAChD,KAAK,wCAAwC,EAE7C,KAAK,wBAAwB,EAC7B,KAAK,+BAA+B,EACrC,MAAM,YAAY,CAAC;AAuBpB,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEvE;AAaD,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIrE;AAED,wBAAgB,4CAA4C,CAAC,KAAK,EAAE;IAClE,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,iCAAiC,CAAC;IAC7C,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B,GAAG,MAAM,CAKT;AA0zBD,qBAAa,6CACb,YAAW,iCAAiC;IAOxC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B,QAAQ,CAAC,SAAS,EAAG,OAAO,CAAU;IACtC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqC;IACrE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAA4D;gBAGxE,OAAO,EAAE,+BAA+B,EACzD,OAAO,GAAE,wCAA6C;IAyBlD,UAAU,IAAI,OAAO,CAAC,kCAAkC,CAAC;YAOjD,KAAK;YAiBL,WAAW;YASX,YAAY;YAgBZ,WAAW;YAuBX,yBAAyB;YA2DzB,YAAY;IAsHpB,MAAM,CACV,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,+BAA+B,CAAC;YAsG7B,kBAAkB;IAiE1B,SAAS,CAAC,OAAO,EAAE;QACvB,aAAa,EAAE,oCAAoC,CAAC;QACpD,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,cAAc,EAAE,MAAM,CAAC;KACxB,GAAG,OAAO,CAAC,8BAA8B,CAAC;IA0BrC,aAAa,CACjB,OAAO,EAAE,qCAAqC,GAC7C,OAAO,CAAC,oCAAoC,CAAC;IAkF1C,oBAAoB,CACxB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,wBAAwB,CAAC;IA2I9B,iCAAiC,CACrC,aAAa,EAAE,+BAA+B,EAC9C,aAAa,EAAE,+BAA+B,EAC9C,aAAa,EAAE,2CAA2C,GACzD,OAAO,CAAC,wCAAwC,CAAC;YAwMtC,qBAAqB;IAgC7B,UAAU,CACd,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,+BAA+B,CAAC;IAqLrC,aAAa,CACjB,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,2CAA2C,CAAC;CAuDxD;AAED,wBAAgB,4CAA4C,CAC1D,EAAE,EAAE,QAAQ,EACZ,OAAO,GAAE,wCAA6C,GACrD,iCAAiC,CAKnC;AAED,wBAAgB,+CAA+C,CAC7D,MAAM,EAAE,sCAAsC,EAC9C,OAAO,GAAE,wCAAwC,GAC7C,8CAAmD,GACtD,iCAAiC,CAenC"}

package/dist/project-registration.js

@@ -757,8 +757,8 @@ var init_secret_redaction = __esm(() => {
   SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
-    { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
-    { name: "github_oauth", pattern: /\bgho_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_pat", pattern: /\bgh[p]_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_oauth", pattern: /\bgh[o]_[a-zA-Z0-9]{20,}\b/g },
     { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
     { name: "bearer_token", pattern: /\bBearer\s+[a-zA-Z0-9\-._~+/]+=*\b/gi },
     { name: "jwt", pattern: /\beyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
@@ -770,7 +770,7 @@ var init_secret_redaction = __esm(() => {
     /example\.com/i,
     /your-api-key-here/i,
     /sk-test/i,
-    /ghp_xxx/i
+    /gh[p]_xxx/i
   ];
   customRedactors = [];
 });
@@ -4883,6 +4883,7 @@ __export(exports_config, {
   TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
   STORAGE_TABLES: () => STORAGE_TABLES,
+  REMOVED_STORAGE_MODE_ENV_KEYS: () => REMOVED_STORAGE_MODE_ENV_KEYS,
   CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV: () => CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
@@ -4944,25 +4945,36 @@ function assertTodosRemoteStorageConfig(config) {
   if (!isTodosPostgresBackend(config))
     return;
   if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when the postgresql backend is selected`);
   }
 }
 function parseStorageBackend(value) {
   const normalized = clean(value)?.toLowerCase();
   if (!normalized)
     return "sqlite";
-  if (normalized === "sqlite" || normalized === "postgres")
-    return normalized;
-  const legacy = LEGACY_BACKEND_TOKENS[normalized];
-  if (legacy)
-    return legacy;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be sqlite or postgres (legacy values local and remote are accepted)`);
+  if (normalized === "sqlite")
+    return "sqlite";
+  if (normalized === "postgres" || normalized === "postgresql")
+    return "postgres";
+  if (["local", "remote", "cloud", "hybrid", "self_hosted"].includes(normalized)) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} selects the backend. Deployment modes no longer exist: ` + `delete the storage-mode variable and set ${TODOS_STORAGE_ENV.databaseUrl} to select the ` + `postgresql backend, or leave it unset for sqlite.`);
+  }
+  throw new Error(`Storage backend must be sqlite or postgres`);
 }
 function parseStorageMode(value) {
   return parseStorageBackend(value);
 }
 function getTodosStorageBackend(env = process.env) {
-  return parseStorageBackend(readStorageEnv(env, "mode").value);
+  for (const key of REMOVED_STORAGE_MODE_ENV_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `Set ${TODOS_STORAGE_ENV.databaseUrl} to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
+  if (!getTodosStorageDatabaseUrl(env))
+    return "sqlite";
+  if (isTodosShadowEnabled(env))
+    return "sqlite";
+  return "postgres";
 }
 function getTodosStorageMode(env = process.env) {
   return getTodosStorageBackend(env);
@@ -5036,7 +5048,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos", LEGACY_BACKEND_TOKENS;
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, REMOVED_STORAGE_MODE_ENV_KEYS, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
 var init_config2 = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -5044,7 +5056,6 @@ var init_config2 = __esm(() => {
   ];
   STORAGE_TABLES = TODOS_STORAGE_TABLES;
   TODOS_STORAGE_ENV = {
-    mode: "HASNA_TODOS_STORAGE_MODE",
     shadow: "HASNA_TODOS_SHADOW",
     databaseUrl: "HASNA_TODOS_DATABASE_URL",
     databaseSsl: "HASNA_TODOS_DATABASE_SSL",
@@ -5061,7 +5072,6 @@ var init_config2 = __esm(() => {
     syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
   };
   TODOS_STORAGE_FALLBACK_ENV = {
-    mode: "TODOS_STORAGE_MODE",
     shadow: "TODOS_SHADOW",
     databaseUrl: "TODOS_DATABASE_URL",
     databaseSsl: "TODOS_DATABASE_SSL",
@@ -5077,14 +5087,12 @@ var init_config2 = __esm(() => {
     syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
     syncDryRun: "TODOS_SYNC_DRY_RUN"
   };
-  LEGACY_BACKEND_TOKENS = {
-    local: "sqlite",
-    remote: "postgres",
-    postgresql: "postgres",
-    hybrid: "postgres",
-    self_hosted: "postgres",
-    cloud: "postgres"
-  };
+  REMOVED_STORAGE_MODE_ENV_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
 });
 
 // src/storage/shadow-outbox-schema.ts
@@ -12723,7 +12731,7 @@ import { createHash as createHash7 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.32",
+  version: "0.15.34",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -12797,9 +12805,7 @@ var package_default = {
     "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
     "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
     "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
-    "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
-    "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
     "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
     prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
     postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"
@@ -12963,7 +12969,7 @@ function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABL
       AS $$ SELECT unaccent('unaccent', $1) $$`,
     `CREATE OR REPLACE FUNCTION todos_try_timestamptz(text)
       RETURNS timestamptz
-      LANGUAGE plpgsql IMMUTABLE PARALLEL SAFE
+      LANGUAGE plpgsql IMMUTABLE PARALLEL UNSAFE
       SET DateStyle TO 'ISO, YMD'
       AS $$
       BEGIN
@@ -19734,9 +19740,14 @@ class PackageOwnedTodosProjectRegistrationAuthority {
     if (request.max_items !== 1) {
       throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_INVALID_BOUNDS", "max_items must be exactly 1 for terminal receipt lookup");
     }
-    if (request.authority !== "todos" || request.authority_id !== this.capabilityValue.authority_id || request.tenant_id !== this.capabilityValue.tenant_id || request.corpus_id !== this.capabilityValue.corpus_id) {
+    if (request.authority !== "todos" || request.authority_id !== this.capabilityValue.authority_id || request.tenant_id !== this.capabilityValue.tenant_id) {
       throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_CAPABILITY_MISMATCH", "receipt lookup does not match this authority capability identity");
     }
+    requireString(request.corpus_id, "corpus_id", {
+      min: 3,
+      max: 128,
+      pattern: AUTHORITY_ROUTE_PATTERN
+    });
     requireString(request.authority_route, "authority_route", {
       min: 3,
       max: 128,
@@ -19767,6 +19778,7 @@ class PackageOwnedTodosProjectRegistrationAuthority {
     }
     const receipt = await this.backend.getReceiptForLookup({
       ...authorityScope(this.capabilityValue),
+      corpus_id: request.corpus_id,
       route: request.authority_route,
       package_version: request.package_version,
       operation_id: request.operation_id,
@@ -19871,9 +19883,15 @@ class PackageOwnedTodosProjectRegistrationAuthority {
       max: 128,
       pattern: PACKAGE_VERSION_PATTERN
     });
+    requireString(sourceRequest.corpus_id, "corpus_id", {
+      min: 3,
+      max: 128,
+      pattern: AUTHORITY_ROUTE_PATTERN
+    });
     assertForwardRequest(sourceRequest, {
       ...this.capabilityValue,
-      package_version: sourceRequest.package_version
+      package_version: sourceRequest.package_version,
+      corpus_id: sourceRequest.corpus_id
     });
     const validation = await this.backend.transaction(async (transaction) => {
       const storedSource = await transaction.getReceiptById(sourceReceipt.receipt_id);
@@ -19888,7 +19906,11 @@ class PackageOwnedTodosProjectRegistrationAuthority {
       if (!receiptLineageMatches(storedSource) || !receiptLineageMatches(accepted) || storedSource.outcome === "duplicate_of_accepted" && (storedSource.duplicate_of_receipt_id !== accepted.receipt_id || storedSource.target_id !== accepted.target_id || storedSource.result_revision !== accepted.result_revision || storedSource.result_digest !== accepted.result_digest)) {
         throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ADOPTION_REJECTED", "receipt authority, operation, request, precondition, or normalized-call lineage changed");
       }
-      const binding = await transaction.getBinding(authorityScope(this.capabilityValue), sourceRequest.resource_kind, sourceRequest.target_selector);
+      const binding = await transaction.getBinding({
+        authority_id: sourceRequest.authority_id,
+        tenant_id: sourceRequest.tenant_id,
+        corpus_id: sourceRequest.corpus_id
+      }, sourceRequest.resource_kind, sourceRequest.target_selector);
       if (!binding || binding.state !== "accepted" || binding.operation_id !== sourceRequest.operation_id || binding.step_id !== sourceRequest.step_id || binding.direction !== "forward" || binding.idempotency_key !== sourceRequest.idempotency_key || binding.request_digest !== sourceRequest.request_digest || binding.precondition_digest !== sourceRequest.precondition_digest || binding.normalized_call_digest !== accepted.normalized_call_digest || binding.target_id !== accepted.target_id || binding.accepted_receipt_id !== accepted.receipt_id || binding.result_revision !== accepted.result_revision || binding.result_digest !== accepted.result_digest) {
         throw new TodosProjectRegistrationError("TODOS_PROJECT_REGISTRATION_ADOPTION_REJECTED", "accepted binding does not match the exact accepted receipt and source lineage");
       }