@hasna/todos 0.15.33 → 0.15.34

package/dist/mcp/index.js

@@ -4129,6 +4129,7 @@ __export(exports_config, {
   TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
   STORAGE_TABLES: () => STORAGE_TABLES,
+  REMOVED_STORAGE_MODE_ENV_KEYS: () => REMOVED_STORAGE_MODE_ENV_KEYS,
   CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV: () => CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
@@ -4190,25 +4191,36 @@ function assertTodosRemoteStorageConfig(config) {
   if (!isTodosPostgresBackend(config))
     return;
   if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when the postgresql backend is selected`);
   }
 }
 function parseStorageBackend(value) {
   const normalized = clean(value)?.toLowerCase();
   if (!normalized)
     return "sqlite";
-  if (normalized === "sqlite" || normalized === "postgres")
-    return normalized;
-  const legacy = LEGACY_BACKEND_TOKENS[normalized];
-  if (legacy)
-    return legacy;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be sqlite or postgres (legacy values local and remote are accepted)`);
+  if (normalized === "sqlite")
+    return "sqlite";
+  if (normalized === "postgres" || normalized === "postgresql")
+    return "postgres";
+  if (["local", "remote", "cloud", "hybrid", "self_hosted"].includes(normalized)) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} selects the backend. Deployment modes no longer exist: ` + `delete the storage-mode variable and set ${TODOS_STORAGE_ENV.databaseUrl} to select the ` + `postgresql backend, or leave it unset for sqlite.`);
+  }
+  throw new Error(`Storage backend must be sqlite or postgres`);
 }
 function parseStorageMode(value) {
   return parseStorageBackend(value);
 }
 function getTodosStorageBackend(env = process.env) {
-  return parseStorageBackend(readStorageEnv(env, "mode").value);
+  for (const key of REMOVED_STORAGE_MODE_ENV_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `Set ${TODOS_STORAGE_ENV.databaseUrl} to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
+  if (!getTodosStorageDatabaseUrl(env))
+    return "sqlite";
+  if (isTodosShadowEnabled(env))
+    return "sqlite";
+  return "postgres";
 }
 function getTodosStorageMode(env = process.env) {
   return getTodosStorageBackend(env);
@@ -4282,7 +4294,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos", LEGACY_BACKEND_TOKENS;
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, REMOVED_STORAGE_MODE_ENV_KEYS, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
 var init_config = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -4290,7 +4302,6 @@ var init_config = __esm(() => {
   ];
   STORAGE_TABLES = TODOS_STORAGE_TABLES;
   TODOS_STORAGE_ENV = {
-    mode: "HASNA_TODOS_STORAGE_MODE",
     shadow: "HASNA_TODOS_SHADOW",
     databaseUrl: "HASNA_TODOS_DATABASE_URL",
     databaseSsl: "HASNA_TODOS_DATABASE_SSL",
@@ -4307,7 +4318,6 @@ var init_config = __esm(() => {
     syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
   };
   TODOS_STORAGE_FALLBACK_ENV = {
-    mode: "TODOS_STORAGE_MODE",
     shadow: "TODOS_SHADOW",
     databaseUrl: "TODOS_DATABASE_URL",
     databaseSsl: "TODOS_DATABASE_SSL",
@@ -4323,14 +4333,12 @@ var init_config = __esm(() => {
     syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
     syncDryRun: "TODOS_SYNC_DRY_RUN"
   };
-  LEGACY_BACKEND_TOKENS = {
-    local: "sqlite",
-    remote: "postgres",
-    postgresql: "postgres",
-    hybrid: "postgres",
-    self_hosted: "postgres",
-    cloud: "postgres"
-  };
+  REMOVED_STORAGE_MODE_ENV_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
 });
 
 // src/storage/shadow-outbox-schema.ts
@@ -9677,8 +9685,8 @@ var init_secret_redaction = __esm(() => {
   SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
-    { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
-    { name: "github_oauth", pattern: /\bgho_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_pat", pattern: /\bgh[p]_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_oauth", pattern: /\bgh[o]_[a-zA-Z0-9]{20,}\b/g },
     { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
     { name: "bearer_token", pattern: /\bBearer\s+[a-zA-Z0-9\-._~+/]+=*\b/gi },
     { name: "jwt", pattern: /\beyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
@@ -9690,7 +9698,7 @@ var init_secret_redaction = __esm(() => {
     /example\.com/i,
     /your-api-key-here/i,
     /sk-test/i,
-    /ghp_xxx/i
+    /gh[p]_xxx/i
   ];
   customRedactors = [];
 });
@@ -21093,40 +21101,38 @@ var init_page_validation = __esm(() => {
 
 // src/cli/cloud-router.ts
 import { resolveStorageClient } from "@hasna/contracts/client/storage";
-import { normalizeStorageMode } from "@hasna/contracts/mode";
 import { randomUUID as randomUUID3 } from "crypto";
 import { resolve as resolvePath } from "path";
-function cleanMode(value) {
-  const normalized = value?.trim().toLowerCase();
-  return normalized || null;
+function assertNoLegacyStorageMode(env = process.env) {
+  for (const key of LEGACY_STORAGE_MODE_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`REMOTE_STORAGE_MODE_REMOVED: ${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `The client uses the on-box SQLite store, or the HTTP API selected by ` + `HASNA_TODOS_API_URL + HASNA_TODOS_API_KEY. ` + `On the server, set HASNA_TODOS_DATABASE_URL to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
 }
 function resolveTodosCliStorageMode(env = process.env) {
-  for (const source of ["HASNA_TODOS_STORAGE_MODE", "TODOS_STORAGE_MODE"]) {
-    if (env[source] !== undefined && env[source].trim() === "") {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source} must not be blank; local SQLite fallback is disabled for invalid routing state`);
-    }
+  assertNoLegacyStorageMode(env);
+  const urlValue = env.HASNA_TODOS_API_URL?.trim();
+  const keyValue = env.HASNA_TODOS_API_KEY?.trim();
+  if (urlValue && keyValue) {
+    return {
+      mode: "http",
+      transport: "http",
+      selected: true,
+      source: "HASNA_TODOS_API_URL+HASNA_TODOS_API_KEY"
+    };
   }
-  const canonical = cleanMode(env.HASNA_TODOS_STORAGE_MODE);
-  const fallback = cleanMode(env.TODOS_STORAGE_MODE);
-  for (const [source, value] of [
-    ["HASNA_TODOS_STORAGE_MODE", canonical],
-    ["TODOS_STORAGE_MODE", fallback]
-  ]) {
-    if (value && !(value in TRANSPORT_TOKENS)) {
-      throw new Error(`REMOTE_STORAGE_MODE_INVALID: ${source}=${value} must be sqlite (local file) or http (hosted /v1 authority); ` + "legacy values local and remote are accepted; " + "local SQLite fallback is disabled for invalid routing state");
-    }
+  if (urlValue) {
+    throw new Error("REMOTE_API_KEY_MISSING: remote Todos storage requires HASNA_TODOS_API_KEY; local SQLite fallback is disabled");
   }
-  const canonicalTransport = canonical ? TRANSPORT_TOKENS[canonical] : null;
-  const fallbackTransport = fallback ? TRANSPORT_TOKENS[fallback] : null;
-  if (canonicalTransport && fallbackTransport && canonicalTransport !== fallbackTransport) {
-    throw new Error(`REMOTE_STORAGE_MODE_CONFLICT: HASNA_TODOS_STORAGE_MODE=${canonical} conflicts with ` + `TODOS_STORAGE_MODE=${fallback}; local SQLite fallback is disabled`);
+  if (keyValue) {
+    throw new Error("REMOTE_API_URL_MISSING: remote Todos storage requires HASNA_TODOS_API_URL; local SQLite fallback is disabled");
   }
-  const transport = canonicalTransport ?? fallbackTransport ?? "sqlite";
   return {
-    mode: transport,
-    transport,
-    selected: transport === "http",
-    source: canonical ? "HASNA_TODOS_STORAGE_MODE" : fallback ? "TODOS_STORAGE_MODE" : "default"
+    mode: "sqlite",
+    transport: "sqlite",
+    selected: false,
+    source: "default"
   };
 }
 function requestedTransport(env) {
@@ -21170,7 +21176,7 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     return {
       selected: true,
       ok: false,
-      mode: cleanMode(env.HASNA_TODOS_STORAGE_MODE) ?? cleanMode(env.TODOS_STORAGE_MODE) ?? "invalid",
+      mode: "invalid",
       api_url_configured: Boolean(env.HASNA_TODOS_API_URL?.trim()),
       api_key_configured: Boolean(env.HASNA_TODOS_API_KEY?.trim()),
       v1_base_url: null,
@@ -21216,27 +21222,12 @@ function getTodosRemoteAuthorityConfigStatus(env = process.env) {
     local_fallback: false
   };
 }
-function serverStorageMode(normalize = normalizeStorageMode) {
-  const useCache = normalize === normalizeStorageMode;
-  if (useCache && cachedServerMode !== null)
-    return cachedServerMode;
-  for (const candidate of SERVER_MODE_CANDIDATES) {
-    try {
-      normalize(candidate);
-      if (useCache)
-        cachedServerMode = candidate;
-      return candidate;
-    } catch {}
-  }
-  throw new Error(`REMOTE_STORAGE_MODE_UNSUPPORTED: no known server storage mode is accepted by the installed ` + `@hasna/contracts (tried ${SERVER_MODE_CANDIDATES.join(", ")}); the storage-mode enum has changed. ` + `Add the new server token to SERVER_MODE_CANDIDATES in src/cli/cloud-router.ts; ` + `local SQLite fallback is disabled.`);
-}
 function requireTodosRemoteAuthorityEnv(env) {
   const status = getTodosRemoteAuthorityConfigStatus(env);
   if (!status.ok)
     throw new Error(status.issues[0]);
   return {
     ...env,
-    HASNA_TODOS_STORAGE_MODE: serverStorageMode(),
     HASNA_TODOS_API_URL: status.v1_base_url.replace(/\/v1$/, ""),
     HASNA_TODOS_API_KEY: env.HASNA_TODOS_API_KEY.trim()
   };
@@ -21328,7 +21319,12 @@ function getTodosCloudClient(env = process.env) {
   const resolved = resolveStorageClient("todos", requireTodosRemoteAuthorityEnv(env), {
     fetchImpl: (input, init) => globalThis.fetch(input, { ...init, redirect: "manual" })
   });
-  return resolved.transport === "cloud-http" ? protectRemoteClient(resolved.client) : null;
+  if (resolved.transport === "cloud-http")
+    return protectRemoteClient(resolved.client);
+  const transportName = resolved.transport;
+  if (transportName === "http")
+    return protectRemoteClient(resolved.client);
+  return null;
 }
 function unwrapTask(raw) {
   if (raw && typeof raw === "object" && "task" in raw) {
@@ -21799,7 +21795,7 @@ async function cloudResolveTaskListRef(client, ref, projectId) {
     return input.toLowerCase();
   return (await cloudResolveTaskList(client, ref, projectId)).id;
 }
-var UUID_RE, TRANSPORT_TOKENS, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, SERVER_MODE_CANDIDATES, cachedServerMode = null, PRIORITY_RANK, listTagsCapabilityCache;
+var UUID_RE, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabilityCache, gitRefCapabilityCache, remoteCommandCapabilityCache, LEGACY_STORAGE_MODE_KEYS, PRIORITY_RANK, listTagsCapabilityCache;
 var init_cloud_router = __esm(() => {
   init_types();
   init_redaction();
@@ -21808,21 +21804,17 @@ var init_cloud_router = __esm(() => {
   init_adoption_validation();
   init_page_validation();
   UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  TRANSPORT_TOKENS = {
-    sqlite: "sqlite",
-    http: "http",
-    local: "sqlite",
-    remote: "http",
-    self_hosted: "http",
-    cloud: "http",
-    hybrid: "http"
-  };
   completionCapabilityCache = new Map;
   retryCapabilityCache = new Map;
   taskCreatorCapabilityCache = new Map;
   gitRefCapabilityCache = new Map;
   remoteCommandCapabilityCache = new Map;
-  SERVER_MODE_CANDIDATES = ["postgres", "cloud", "self_hosted"];
+  LEGACY_STORAGE_MODE_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
   PRIORITY_RANK = { critical: 0, high: 1, medium: 2, low: 3 };
   listTagsCapabilityCache = new Map;
 });
@@ -35939,7 +35931,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.33",
+    version: "0.15.34",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -36013,9 +36005,7 @@ var init_package = __esm(() => {
       "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
       "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
       "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-      "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
-      "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
-      "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+      "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
       "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
       prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
       postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"

package/dist/mcp.js

@@ -41,7 +41,7 @@ var __require = import.meta.require;
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.33",
+  version: "0.15.34",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -115,9 +115,7 @@ var package_default = {
     "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
     "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
     "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
-    "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
-    "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
     "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
     prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
     postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"

package/dist/project-registration.js

@@ -757,8 +757,8 @@ var init_secret_redaction = __esm(() => {
   SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
-    { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
-    { name: "github_oauth", pattern: /\bgho_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_pat", pattern: /\bgh[p]_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_oauth", pattern: /\bgh[o]_[a-zA-Z0-9]{20,}\b/g },
     { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
     { name: "bearer_token", pattern: /\bBearer\s+[a-zA-Z0-9\-._~+/]+=*\b/gi },
     { name: "jwt", pattern: /\beyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
@@ -770,7 +770,7 @@ var init_secret_redaction = __esm(() => {
     /example\.com/i,
     /your-api-key-here/i,
     /sk-test/i,
-    /ghp_xxx/i
+    /gh[p]_xxx/i
   ];
   customRedactors = [];
 });
@@ -4883,6 +4883,7 @@ __export(exports_config, {
   TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
   STORAGE_TABLES: () => STORAGE_TABLES,
+  REMOVED_STORAGE_MODE_ENV_KEYS: () => REMOVED_STORAGE_MODE_ENV_KEYS,
   CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV: () => CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
@@ -4944,25 +4945,36 @@ function assertTodosRemoteStorageConfig(config) {
   if (!isTodosPostgresBackend(config))
     return;
   if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when the postgresql backend is selected`);
   }
 }
 function parseStorageBackend(value) {
   const normalized = clean(value)?.toLowerCase();
   if (!normalized)
     return "sqlite";
-  if (normalized === "sqlite" || normalized === "postgres")
-    return normalized;
-  const legacy = LEGACY_BACKEND_TOKENS[normalized];
-  if (legacy)
-    return legacy;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be sqlite or postgres (legacy values local and remote are accepted)`);
+  if (normalized === "sqlite")
+    return "sqlite";
+  if (normalized === "postgres" || normalized === "postgresql")
+    return "postgres";
+  if (["local", "remote", "cloud", "hybrid", "self_hosted"].includes(normalized)) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} selects the backend. Deployment modes no longer exist: ` + `delete the storage-mode variable and set ${TODOS_STORAGE_ENV.databaseUrl} to select the ` + `postgresql backend, or leave it unset for sqlite.`);
+  }
+  throw new Error(`Storage backend must be sqlite or postgres`);
 }
 function parseStorageMode(value) {
   return parseStorageBackend(value);
 }
 function getTodosStorageBackend(env = process.env) {
-  return parseStorageBackend(readStorageEnv(env, "mode").value);
+  for (const key of REMOVED_STORAGE_MODE_ENV_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `Set ${TODOS_STORAGE_ENV.databaseUrl} to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
+  if (!getTodosStorageDatabaseUrl(env))
+    return "sqlite";
+  if (isTodosShadowEnabled(env))
+    return "sqlite";
+  return "postgres";
 }
 function getTodosStorageMode(env = process.env) {
   return getTodosStorageBackend(env);
@@ -5036,7 +5048,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos", LEGACY_BACKEND_TOKENS;
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, REMOVED_STORAGE_MODE_ENV_KEYS, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
 var init_config2 = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -5044,7 +5056,6 @@ var init_config2 = __esm(() => {
   ];
   STORAGE_TABLES = TODOS_STORAGE_TABLES;
   TODOS_STORAGE_ENV = {
-    mode: "HASNA_TODOS_STORAGE_MODE",
     shadow: "HASNA_TODOS_SHADOW",
     databaseUrl: "HASNA_TODOS_DATABASE_URL",
     databaseSsl: "HASNA_TODOS_DATABASE_SSL",
@@ -5061,7 +5072,6 @@ var init_config2 = __esm(() => {
     syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
   };
   TODOS_STORAGE_FALLBACK_ENV = {
-    mode: "TODOS_STORAGE_MODE",
     shadow: "TODOS_SHADOW",
     databaseUrl: "TODOS_DATABASE_URL",
     databaseSsl: "TODOS_DATABASE_SSL",
@@ -5077,14 +5087,12 @@ var init_config2 = __esm(() => {
     syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
     syncDryRun: "TODOS_SYNC_DRY_RUN"
   };
-  LEGACY_BACKEND_TOKENS = {
-    local: "sqlite",
-    remote: "postgres",
-    postgresql: "postgres",
-    hybrid: "postgres",
-    self_hosted: "postgres",
-    cloud: "postgres"
-  };
+  REMOVED_STORAGE_MODE_ENV_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
 });
 
 // src/storage/shadow-outbox-schema.ts
@@ -12723,7 +12731,7 @@ import { createHash as createHash7 } from "crypto";
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.33",
+  version: "0.15.34",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -12797,9 +12805,7 @@ var package_default = {
     "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
     "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
     "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
-    "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
-    "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
     "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
     prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
     postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"

package/dist/registry.js

@@ -4177,6 +4177,7 @@ __export(exports_config, {
   TODOS_STORAGE_FALLBACK_ENV: () => TODOS_STORAGE_FALLBACK_ENV,
   TODOS_STORAGE_ENV: () => TODOS_STORAGE_ENV,
   STORAGE_TABLES: () => STORAGE_TABLES,
+  REMOVED_STORAGE_MODE_ENV_KEYS: () => REMOVED_STORAGE_MODE_ENV_KEYS,
   CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV: () => CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV,
   CANONICAL_TODOS_RDS_DATABASE: () => CANONICAL_TODOS_RDS_DATABASE,
   CANONICAL_TODOS_RDS_CLUSTER_ENV: () => CANONICAL_TODOS_RDS_CLUSTER_ENV
@@ -4238,25 +4239,36 @@ function assertTodosRemoteStorageConfig(config) {
   if (!isTodosPostgresBackend(config))
     return;
   if (!config.database?.url) {
-    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when ${TODOS_STORAGE_ENV.mode}=${config.mode}`);
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} is required when the postgresql backend is selected`);
   }
 }
 function parseStorageBackend(value) {
   const normalized = clean(value)?.toLowerCase();
   if (!normalized)
     return "sqlite";
-  if (normalized === "sqlite" || normalized === "postgres")
-    return normalized;
-  const legacy = LEGACY_BACKEND_TOKENS[normalized];
-  if (legacy)
-    return legacy;
-  throw new Error(`${TODOS_STORAGE_ENV.mode} must be sqlite or postgres (legacy values local and remote are accepted)`);
+  if (normalized === "sqlite")
+    return "sqlite";
+  if (normalized === "postgres" || normalized === "postgresql")
+    return "postgres";
+  if (["local", "remote", "cloud", "hybrid", "self_hosted"].includes(normalized)) {
+    throw new Error(`${TODOS_STORAGE_ENV.databaseUrl} selects the backend. Deployment modes no longer exist: ` + `delete the storage-mode variable and set ${TODOS_STORAGE_ENV.databaseUrl} to select the ` + `postgresql backend, or leave it unset for sqlite.`);
+  }
+  throw new Error(`Storage backend must be sqlite or postgres`);
 }
 function parseStorageMode(value) {
   return parseStorageBackend(value);
 }
 function getTodosStorageBackend(env = process.env) {
-  return parseStorageBackend(readStorageEnv(env, "mode").value);
+  for (const key of REMOVED_STORAGE_MODE_ENV_KEYS) {
+    if (Object.hasOwn(env, key) && env[key] !== undefined) {
+      throw new Error(`${key} was removed. Deployment modes no longer exist: delete the storage-mode variable. ` + `Set ${TODOS_STORAGE_ENV.databaseUrl} to select the postgresql backend, ` + `or leave it unset for sqlite.`);
+    }
+  }
+  if (!getTodosStorageDatabaseUrl(env))
+    return "sqlite";
+  if (isTodosShadowEnabled(env))
+    return "sqlite";
+  return "postgres";
 }
 function getTodosStorageMode(env = process.env) {
   return getTodosStorageBackend(env);
@@ -4330,7 +4342,7 @@ function parsePositiveInteger(value, fallback) {
   }
   return parsed;
 }
-var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos", LEGACY_BACKEND_TOKENS;
+var TODOS_STORAGE_TABLES, STORAGE_TABLES, TODOS_STORAGE_ENV, TODOS_STORAGE_FALLBACK_ENV, REMOVED_STORAGE_MODE_ENV_KEYS, CANONICAL_TODOS_RDS_CLUSTER_ENV = "HASNA_TODOS_RDS_CLUSTER", CANONICAL_TODOS_RDS_RUNTIME_PATH_ENV = "HASNA_TODOS_RDS_RUNTIME_PATH", CANONICAL_TODOS_RDS_DATABASE = "todos";
 var init_config = __esm(() => {
   TODOS_STORAGE_TABLES = [
     "todos_sync_records",
@@ -4338,7 +4350,6 @@ var init_config = __esm(() => {
   ];
   STORAGE_TABLES = TODOS_STORAGE_TABLES;
   TODOS_STORAGE_ENV = {
-    mode: "HASNA_TODOS_STORAGE_MODE",
     shadow: "HASNA_TODOS_SHADOW",
     databaseUrl: "HASNA_TODOS_DATABASE_URL",
     databaseSsl: "HASNA_TODOS_DATABASE_SSL",
@@ -4355,7 +4366,6 @@ var init_config = __esm(() => {
     syncDryRun: "HASNA_TODOS_SYNC_DRY_RUN"
   };
   TODOS_STORAGE_FALLBACK_ENV = {
-    mode: "TODOS_STORAGE_MODE",
     shadow: "TODOS_SHADOW",
     databaseUrl: "TODOS_DATABASE_URL",
     databaseSsl: "TODOS_DATABASE_SSL",
@@ -4371,14 +4381,12 @@ var init_config = __esm(() => {
     syncBatchSize: "TODOS_SYNC_BATCH_SIZE",
     syncDryRun: "TODOS_SYNC_DRY_RUN"
   };
-  LEGACY_BACKEND_TOKENS = {
-    local: "sqlite",
-    remote: "postgres",
-    postgresql: "postgres",
-    hybrid: "postgres",
-    self_hosted: "postgres",
-    cloud: "postgres"
-  };
+  REMOVED_STORAGE_MODE_ENV_KEYS = [
+    "HASNA_TODOS_STORAGE_MODE",
+    "HASNA_TODOS_MODE",
+    "TODOS_STORAGE_MODE",
+    "TODOS_MODE"
+  ];
 });
 
 // src/storage/shadow-outbox-schema.ts
@@ -7227,8 +7235,8 @@ var init_secret_redaction = __esm(() => {
   SECRET_REDACTION_SCHEMA = ["todos", "secret_redaction", "v1"].join(".");
   DEFAULT_PATTERNS = [
     { name: "openai_sk", pattern: /\bsk-[a-zA-Z0-9]{10,}\b/g },
-    { name: "github_pat", pattern: /\bghp_[a-zA-Z0-9]{20,}\b/g },
-    { name: "github_oauth", pattern: /\bgho_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_pat", pattern: /\bgh[p]_[a-zA-Z0-9]{20,}\b/g },
+    { name: "github_oauth", pattern: /\bgh[o]_[a-zA-Z0-9]{20,}\b/g },
     { name: "aws_access_key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
     { name: "bearer_token", pattern: /\bBearer\s+[a-zA-Z0-9\-._~+/]+=*\b/gi },
     { name: "jwt", pattern: /\beyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\b/g },
@@ -7240,7 +7248,7 @@ var init_secret_redaction = __esm(() => {
     /example\.com/i,
     /your-api-key-here/i,
     /sk-test/i,
-    /ghp_xxx/i
+    /gh[p]_xxx/i
   ];
   customRedactors = [];
 });
@@ -12720,7 +12728,7 @@ var init_tasks = __esm(() => {
 // package.json
 var package_default = {
   name: "@hasna/todos",
-  version: "0.15.33",
+  version: "0.15.34",
   description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
   type: "module",
   main: "dist/index.js",
@@ -12794,9 +12802,7 @@ var package_default = {
     "verify:release": "bun run scripts/verify-public-release.ts --mode=review",
     "verify:release-review": "bun run scripts/verify-npm-release-agent-review.ts",
     "verify:attested-container-candidate": "bun run scripts/attested-container-candidate.ts verify",
-    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts scripts/attested-container-compatibility-vector.test.ts",
-    "emit:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts emit",
-    "verify:iapp-deployment-compatibility-vector": "bun run scripts/attested-container-compatibility-vector.ts verify",
+    "test:attested-container-candidate": "bun test scripts/attested-container-candidate.test.ts",
     "issue:release-review": "bun run scripts/issue-npm-release-agent-review.ts",
     prepublishOnly: "bun run scripts/verify-public-release.ts --mode=publish",
     postinstall: "mkdir -p $HOME/.hasna/todos $HOME/.hasna/todos/training 2>/dev/null || true"

package/dist/release-provenance.json

@@ -1,9 +1,9 @@
 {
   "packageName": "@hasna/todos",
-  "packageVersion": "0.15.33",
+  "packageVersion": "0.15.34",
   "repository": "https://github.com/hasna/todos.git",
-  "gitCommit": "d86b0721ae23c9bff7a6367c368fd013a90dbccf",
-  "gitTree": "613309ebf627e51be287de4225b14ea2aa01b018",
-  "sourceTreeSha256": "424aca393648a969344a7e1a40dcfbe79b1fca601129f1193e2628bb1547618d",
-  "generatedAt": "2026-08-14T05:31:50.000Z"
+  "gitCommit": "1e6a7cf5727c4e29cc48d4fabad68602a1bdb183",
+  "gitTree": "2a0facd155af45e5d46ced7ae193643b223ff4e5",
+  "sourceTreeSha256": "e735d06856448b5f3f5903fa141b5201c768077e6531fb7761ab65b5f54a1b8a",
+  "generatedAt": "2026-08-15T18:18:40.000Z"
 }