@hasna/todos 0.15.41 → 0.15.47

package/dist/mcp/index.js

@@ -11084,8 +11084,9 @@ var init_event_hooks = __esm(() => {
   VALID_TARGETS = new Set(["stdout", "file", "socket", "script"]);
 });
 
-// node_modules/.bun/@hasna+events@0.1.11/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.16/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join4 } from "path";
@@ -11194,11 +11195,13 @@ function getEventsDataDir(override) {
 
 class JsonEventsStore {
   dataDir;
+  runtime;
   channelsPath;
   eventsPath;
   deliveriesPath;
   constructor(dataDir = getEventsDataDir()) {
     this.dataDir = dataDir;
+    this.runtime = localJsonRuntime(dataDir);
     this.channelsPath = join4(dataDir, "channels.json");
     this.eventsPath = join4(dataDir, "events.json");
     this.deliveriesPath = join4(dataDir, "deliveries.json");
@@ -11246,13 +11249,58 @@ class JsonEventsStore {
     await this.writeJson(this.eventsPath, events);
     return event;
   }
-  async listEvents() {
+  async appendEventOnce(event, options = {}) {
     await this.init();
-    return this.readJson(this.eventsPath, []);
+    const events = await this.readJson(this.eventsPath, []);
+    const dedupe = options.dedupe !== false;
+    if (dedupe) {
+      const existing = findEventByIdentity(events, { id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    events.push(event);
+    await this.writeJson(this.eventsPath, events);
+    return {
+      event,
+      stored: true,
+      deduped: false,
+      identity: { id: event.id, dedupeKey: event.dedupeKey }
+    };
+  }
+  async listEvents(options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    return queryEvents(events, options);
+  }
+  async listEventsPage(options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    const queried = queryEvents(events, {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = queried.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < queried.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async findEventByIdentity(identity) {
     const events = await this.listEvents();
-    return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+    return findEventByIdentity(events, identity);
   }
   async appendDelivery(result) {
     await this.init();
@@ -11303,6 +11351,83 @@ class JsonEventsStore {
     });
   }
 }
+function localJsonRuntime(dataDir = getEventsDataDir()) {
+  return {
+    mode: "local-files",
+    name: "json-events-store",
+    remote: false,
+    localFiles: true,
+    localSqlite: false,
+    postgres: false,
+    s3: false,
+    aws: false,
+    durable: true,
+    idempotency: "best-effort-local",
+    replayCursors: true,
+    description: `Local JSON files in ${dataDir}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+  };
+}
+function encodeLocalJsonEventCursor(offset, options = {}) {
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid event cursor offset: ${offset}`);
+  const payload = {
+    offset,
+    eventId: options.eventId,
+    source: options.source,
+    type: options.type
+  };
+  return `${LOCAL_JSON_EVENT_CURSOR_PREFIX}${Buffer2.from(JSON.stringify(payload), "utf-8").toString("base64url")}`;
+}
+function decodeLocalJsonEventCursor(cursor, options = {}) {
+  if (!cursor)
+    return 0;
+  if (!cursor.startsWith(LOCAL_JSON_EVENT_CURSOR_PREFIX))
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  const rawPayload = cursor.slice(LOCAL_JSON_EVENT_CURSOR_PREFIX.length);
+  let payload;
+  try {
+    payload = JSON.parse(Buffer2.from(rawPayload, "base64url").toString("utf-8"));
+  } catch {
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  }
+  const offset = payload.offset;
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  assertCursorFilter("eventId", payload.eventId, options.eventId);
+  assertCursorFilter("source", payload.source, options.source);
+  assertCursorFilter("type", payload.type, options.type);
+  return offset;
+}
+function normalizeEventPageLimit(limit) {
+  if (limit === undefined)
+    return DEFAULT_EVENT_PAGE_LIMIT;
+  if (!Number.isInteger(limit) || limit < 1)
+    throw new Error(`Event page limit must be a positive integer, got ${limit}`);
+  return Math.min(limit, MAX_EVENT_PAGE_LIMIT);
+}
+function queryEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor) {
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    rows = rows.slice(offset);
+  }
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
+}
+function assertCursorFilter(name, cursorValue, optionValue) {
+  if (cursorValue !== optionValue)
+    throw new Error(`Local JSON event cursor ${name} filter mismatch`);
+}
+function findEventByIdentity(events, identity) {
+  return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+}
 function buildSignatureBase(timestamp2, body) {
   return `${timestamp2}.${body}`;
 }
@@ -11316,21 +11441,27 @@ function now2() {
 function truncate(value, max = 4096) {
   return value.length > max ? `${value.slice(0, max)}...` : value;
 }
-function buildWebhookRequest(event, channel) {
+function buildWebhookRequest(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  for (const name of Object.keys(channel.webhook.headers ?? {})) {
+    if (/^x-hasna-/i.test(name)) {
+      throw new Error(`Webhook header ${name} is reserved for signed delivery metadata`);
+    }
+  }
   const body = JSON.stringify(event);
-  const timestamp2 = event.time;
+  const timestamp2 = options.timestamp ?? new Date().toISOString();
   const headers = {
     "Content-Type": "application/json",
     "User-Agent": "@hasna/events",
     "X-Hasna-Event-Id": event.id,
     "X-Hasna-Event-Type": event.type,
-    "X-Hasna-Timestamp": timestamp2,
-    ...channel.webhook.headers
+    ...channel.webhook.headers,
+    "X-Hasna-Timestamp": timestamp2
   };
-  if (channel.webhook.secret) {
-    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp2, body);
+  const secret = options.secret ?? channel.webhook.secret;
+  if (secret) {
+    headers["X-Hasna-Signature"] = signPayload(secret, timestamp2, body);
   }
   return { body, headers };
 }
@@ -11338,7 +11469,21 @@ async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
   const startedAt = now2();
-  const { body, headers } = buildWebhookRequest(event, channel);
+  let secret = channel.webhook.secret;
+  if (channel.webhook.secretRef) {
+    if (!options.secretResolver) {
+      return failedAttempt(startedAt, "Webhook secret reference has no runtime resolver");
+    }
+    try {
+      secret = await options.secretResolver(channel.webhook.secretRef);
+    } catch {
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+    }
+    if (!secret)
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+  }
+  const timestamp2 = (options.now?.() ?? new Date).toISOString();
+  const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp: timestamp2 });
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
@@ -11370,6 +11515,15 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function failedAttempt(startedAt, error) {
+  return {
+    attempt: 1,
+    status: "failed",
+    startedAt,
+    completedAt: now2(),
+    error
+  };
+}
 async function dispatchCommand(event, channel) {
   if (!channel.command)
     throw new Error(`Channel ${channel.id} has no command config`);
@@ -11458,6 +11612,76 @@ function createDeliveryResult(event, channel, attempts) {
     completedAt: attempts.at(-1)?.completedAt ?? now2()
   };
 }
+
+class EventTypeCatalog {
+  definitions = new Map;
+  register(definition) {
+    this.definitions.set(definition.type, definition);
+    return this;
+  }
+  unregister(type) {
+    return this.definitions.delete(type);
+  }
+  has(type) {
+    return this.definitions.has(type);
+  }
+  get(type) {
+    return this.definitions.get(type);
+  }
+  list() {
+    return [...this.definitions.values()];
+  }
+  validateEvent(event) {
+    const definition = this.definitions.get(event.type);
+    if (!definition)
+      return { ok: true };
+    return definition.validate(event.data, event);
+  }
+  assertEventValid(event) {
+    const result = this.validateEvent(event);
+    if (!result.ok) {
+      throw new EventValidationError(event.type, result.issues);
+    }
+  }
+}
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue2(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue2(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue2(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue2(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last = parts.at(-1);
+  if (last && last in cursor)
+    cursor[last] = replacement;
+}
 function createEvent(input) {
   return {
     id: input.id ?? randomUUID22(),
@@ -11478,10 +11702,18 @@ class EventsClient {
   store;
   redactors;
   transportOptions;
+  catalog;
+  validateCatalogTypes;
   constructor(options = {}) {
     this.store = options.store ?? new JsonEventsStore(options.dataDir);
     this.redactors = options.redactors ?? [];
-    this.transportOptions = { fetchImpl: options.fetchImpl };
+    this.transportOptions = {
+      fetchImpl: options.fetchImpl,
+      secretResolver: options.secretResolver,
+      now: options.now
+    };
+    this.catalog = options.catalog ?? defaultEventTypeCatalog;
+    this.validateCatalogTypes = options.validateCatalogTypes ?? false;
   }
   async addChannel(input) {
     const timestamp2 = new Date().toISOString();
@@ -11499,18 +11731,40 @@ class EventsClient {
   }
   async emit(input, options = {}) {
     const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
-    if (options.dedupe !== false) {
-      const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
-      if (existing) {
-        return { event: existing, deliveries: [], deduped: true };
-      }
-    }
-    await this.store.appendEvent(event);
-    const deliveries = options.deliver === false ? [] : await this.deliver(event);
-    return { event, deliveries, deduped: false };
-  }
-  async listEvents() {
-    return this.store.listEvents();
+    if (options.validate ?? this.validateCatalogTypes) {
+      this.catalog.assertEventValid(event);
+    }
+    const append = await this.appendEvent(event, { dedupe: options.dedupe !== false });
+    if (append.deduped) {
+      return { event: append.event, deliveries: [], deduped: true };
+    }
+    const deliveries = options.deliver === false ? [] : await this.deliver(append.event);
+    return { event: append.event, deliveries, deduped: false };
+  }
+  async listEvents(options = {}) {
+    if (Object.keys(options).length === 0)
+      return this.store.listEvents();
+    return queryClientEvents(await this.store.listEvents(), options);
+  }
+  async listEventsPage(options = {}) {
+    if (this.store.listEventsPage)
+      return this.store.listEventsPage(options);
+    const events = queryClientEvents(await this.store.listEvents(), {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = events.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < events.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async listDeliveries() {
     return this.store.listDeliveries();
@@ -11578,22 +11832,37 @@ class EventsClient {
     return result;
   }
   async replay(options = {}) {
-    const events = (await this.store.listEvents()).filter((event) => {
-      if (options.eventId && event.id !== options.eventId)
-        return false;
-      if (options.source && event.source !== options.source)
-        return false;
-      if (options.type && event.type !== options.type)
-        return false;
-      return true;
-    });
+    const page = options.cursor || options.limit !== undefined ? await this.listEventsPage(options) : { events: await this.listEvents(options), hasMore: false };
     if (options.dryRun)
-      return { events, deliveries: [] };
+      return { events: page.events, deliveries: [], cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
     const deliveries = [];
-    for (const event of events) {
+    for (const event of page.events) {
       deliveries.push(...await this.deliver(event));
     }
-    return { events, deliveries };
+    return { events: page.events, deliveries, cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
+  }
+  async appendEvent(event, options) {
+    if (this.store.appendEventOnce) {
+      return this.store.appendEventOnce(event, { dedupe: options.dedupe });
+    }
+    if (options.dedupe) {
+      const existing = await this.store.findEventByIdentity({ id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    const stored = await this.store.appendEvent(event);
+    return {
+      event: stored,
+      stored: true,
+      deduped: false,
+      identity: { id: stored.id, dedupeKey: stored.dedupeKey }
+    };
   }
   async applyRedaction(event, channel) {
     let next = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
@@ -11620,43 +11889,19 @@ class EventsClient {
     return createDeliveryResult(event, channel, attempts);
   }
 }
-function redactPaths(event, paths, replacement = "[REDACTED]") {
-  if (paths.length === 0)
-    return event;
-  const copy = structuredClone(event);
-  for (const path of paths) {
-    setPath(copy, path, replacement);
-  }
-  return copy;
-}
-function redactSensitiveKeys(event, replacement = "[REDACTED]") {
-  return redactValue2(event, replacement);
-}
-function shouldRedactKey(key) {
-  return /secret|token|password|api[_-]?key|authorization/i.test(key);
-}
-function redactValue2(value, replacement) {
-  if (Array.isArray(value))
-    return value.map((item) => redactValue2(item, replacement));
-  if (!value || typeof value !== "object")
-    return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-    key,
-    shouldRedactKey(key) ? replacement : redactValue2(item, replacement)
-  ]));
-}
-function setPath(input, path, replacement) {
-  const parts = path.split(".");
-  let cursor = input;
-  for (const part of parts.slice(0, -1)) {
-    const next = cursor[part];
-    if (!next || typeof next !== "object")
-      return;
-    cursor = next;
-  }
-  const last = parts.at(-1);
-  if (last && last in cursor)
-    cursor[last] = replacement;
+function queryClientEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor)
+    rows = rows.slice(decodeLocalJsonEventCursor(options.cursor, options));
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
 }
 function normalizeTime(value) {
   if (!value)
@@ -11670,9 +11915,22 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
-var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", DEFAULT_SIGNATURE_TOLERANCE_MS;
+var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
 var init_dist = __esm(() => {
   DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+  EventValidationError = class EventValidationError extends Error {
+    eventType;
+    issues;
+    constructor(eventType, issues) {
+      const detail = issues.map((issue) => `${issue.path || "<root>"}: ${issue.message}`).join("; ");
+      super(`Event validation failed for type "${eventType}": ${detail}`);
+      this.name = "EventValidationError";
+      this.eventType = eventType;
+      this.issues = issues;
+    }
+  };
+  defaultEventTypeCatalog = new EventTypeCatalog;
+  APP_EVENT_V1_MAX_DATA_BYTES = 32 * 1024;
 });
 
 // src/db/task-lists.ts
@@ -12511,8 +12769,12 @@ async function deliverWebhook(wh, event, body, attempt, db) {
       const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
       headers["X-Webhook-Signature"] = Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
     }
-    const resp = await fetch(wh.url, { method: "POST", headers, body });
+    const resp = await fetch(wh.url, { method: "POST", headers, body, redirect: "manual" });
     const respText = await resp.text().catch(() => "");
+    if (resp.status >= 300 && resp.status < 400) {
+      logDelivery(db, wh.id, event, body, resp.status, "Blocked: webhook URL returned a 3xx redirect; redirects are never followed (SSRF prevention)", attempt);
+      return;
+    }
     logDelivery(db, wh.id, event, body, resp.status, respText.slice(0, 1000), attempt);
     if (resp.status >= 400 && attempt < MAX_RETRY_ATTEMPTS) {
       const delay = RETRY_BASE_DELAY_MS * Math.pow(2, attempt - 1);
@@ -13289,7 +13551,7 @@ function getTaskGraph(taskId, direction = "both", db) {
     const deps = getTaskDependencies(t.id, d);
     const hasUnfinishedDeps = deps.some((dep) => {
       const depTask = getTask(dep.depends_on, d);
-      return depTask && depTask.status !== "completed";
+      return depTask && isBlockingDependencyStatus(depTask.status);
     });
     return { id: t.id, short_id: t.short_id, title: t.title, status: t.status, priority: t.priority, is_blocked: hasUnfinishedDeps };
   }
@@ -13549,7 +13811,7 @@ function getBlockingDeps(id, db) {
   const blocking = [];
   for (const dep of deps) {
     const task = getTask(dep.depends_on, d);
-    if (task && task.status !== "completed")
+    if (task && isBlockingDependencyStatus(task.status))
       blocking.push(task);
   }
   return blocking;
@@ -13873,7 +14135,7 @@ function getNextTask(agentId, filters, db) {
     conditions.push(`id IN (SELECT task_id FROM task_tags WHERE tag IN (${placeholders}))`);
     params.push(...filters.tags);
   }
-  conditions.push("id NOT IN (SELECT td.task_id FROM task_dependencies td JOIN tasks dep ON dep.id = td.depends_on WHERE dep.status != 'completed')");
+  conditions.push("id NOT IN (SELECT td.task_id FROM task_dependencies td JOIN tasks dep ON dep.id = td.depends_on WHERE dep.status NOT IN ('completed', 'cancelled'))");
   const where = conditions.join(" AND ");
   let recentProjectIds = [];
   const assignedAliasParams = [];
@@ -13917,7 +14179,7 @@ function getActiveWork(filters, db) {
 }
 function getTasksChangedSince(since, filters, db) {
   const d = db || getDatabase();
-  const conditions = ["updated_at > ?"];
+  const conditions = ["(julianday(updated_at) IS NULL OR julianday(updated_at) > julianday(?))"];
   const params = [since];
   if (filters?.project_id) {
     conditions.push("project_id = ?");
@@ -18867,6 +19129,60 @@ var init_assignee_context = __esm(() => {
   init_assignee_validation();
 });
 
+// src/lib/instant-compare.ts
+function isLeapYear(year) {
+  return year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+}
+function sqliteJulianDay(value) {
+  const m = SQLITE_STAMP.exec(value);
+  if (!m)
+    return null;
+  const year = Number(m[1]);
+  const month = Number(m[2]);
+  const day = Number(m[3]);
+  const hour = m[4] === undefined ? 0 : Number(m[4]);
+  const minute = m[5] === undefined ? 0 : Number(m[5]);
+  const second = m[6] === undefined ? 0 : Number(m[6]);
+  const frac = m[7];
+  const sign = m[8];
+  const offsetHour = m[9];
+  const offsetMinute = m[10];
+  if (month < 1 || month > 12)
+    return null;
+  if (hour > 23 || minute > 59 || second > 59)
+    return null;
+  const maxDay = (DAYS_IN_MONTH[month - 1] ?? 0) + (month === 2 && isLeapYear(year) ? 1 : 0);
+  if (day < 1 || day > maxDay)
+    return null;
+  let offsetMinutes = 0;
+  if (sign !== undefined) {
+    const oh = Number(offsetHour ?? "0");
+    const om = Number(offsetMinute ?? "0");
+    if (oh > 23 || om > 59)
+      return null;
+    offsetMinutes = oh * 60 + om;
+    if (sign === "-")
+      offsetMinutes = -offsetMinutes;
+  }
+  const micros = frac === undefined ? 0 : Number((frac + "000000").slice(0, 6));
+  const ms = Date.UTC(year, month - 1, day, hour, minute, second);
+  return (ms + micros / 1000) / 86400000 + 2440587.5 - offsetMinutes / 1440;
+}
+function changedSinceStampNewer(stamp, since) {
+  const stampJd = sqliteJulianDay(stamp);
+  if (stampJd === null)
+    return true;
+  const sinceJd = sqliteJulianDay(since);
+  if (sinceJd === null)
+    return false;
+  return stampJd > sinceJd;
+}
+var SQLITE_STAMP, DAYS_IN_MONTH;
+var init_instant_compare = __esm(() => {
+  SQLITE_STAMP = /^(\d{4})-(\d{2})-(\d{2})(?:[ T](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d+))?)?(?:Z|([+-])(\d{2}):(\d{2}))?)?$/;
+  DAYS_IN_MONTH = [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+});
+
 // src/lib/plan-project-link-contract.ts
 import { createHash as createHash3 } from "crypto";
 function canonicalPlanProjectLinkJson(value) {
@@ -21920,6 +22236,7 @@ var UUID_RE, completionCapabilityCache, retryCapabilityCache, taskCreatorCapabil
 var init_cloud_router = __esm(() => {
   init_types();
   init_redaction();
+  init_instant_compare();
   init_plan_project_link_contract();
   init_http_client();
   init_adoption_validation();
@@ -34724,7 +35041,7 @@ function scoreHealth(scope, scopeId, db) {
     const blockers = d.query(`SELECT dep.id, dep.short_id, dep.title, dep.status
          FROM task_dependencies td
          JOIN tasks dep ON dep.id = td.depends_on
-         WHERE td.task_id = ? AND dep.status != 'completed'`).all(task.id);
+         WHERE td.task_id = ? AND dep.status NOT IN ('completed', 'cancelled')`).all(task.id);
     return { id: task.id, short_id: task.short_id, title: redactEvidenceText(task.title), blockers };
   }).filter((entry) => entry.blockers.length > 0);
   const overdue = tasks.filter((task) => activeTaskIds.has(task.id) && Boolean(task.due_at && task.due_at < generatedAt)).map((task) => ({ id: task.id, short_id: task.short_id, title: redactEvidenceText(task.title), due_at: task.due_at }));
@@ -36047,7 +36364,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.41",
+    version: "0.15.47",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -36165,18 +36482,19 @@ var init_package = __esm(() => {
     author: "Andrei Hasna <andrei@hasna.com>",
     license: "Apache-2.0",
     dependencies: {
-      "@hasna/contracts": "0.13.3",
+      "@hasna/contracts": "0.13.4",
       "@hasna/events": "^0.1.11",
       "@modelcontextprotocol/sdk": "^1.12.1",
       chalk: "^5.4.1",
       commander: "^13.1.0",
       ink: "^5.2.0",
       react: "^18.3.1",
-      zod: "^3.24.2"
+      zod: "3.25.76"
     },
     overrides: {
       ajv: "8.20.0",
-      "fast-uri": "3.1.2"
+      "fast-uri": "3.1.2",
+      zod: "3.25.76"
     },
     devDependencies: {
       "@types/bun": "^1.2.4",
@@ -46241,7 +46559,7 @@ function matchesExtraFilters(task2, filter) {
   }
   if (filter.tags?.length) {
     const taskTags = new Set(task2.tags ?? []);
-    if (!filter.tags.every((tag) => taskTags.has(tag)))
+    if (!filter.tags.some((tag) => taskTags.has(tag)))
       return false;
   }
   if (filter.include_subtasks !== true && filter.parent_id === undefined && task2.parent_id)
@@ -47433,11 +47751,18 @@ class PostgresJsonRecordStore {
     return context?.requestId ?? this.sourceMachineId ?? null;
   }
   async ensureSchema() {
-    this.schemaReady ??= (async () => {
-      for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
-        await this.options.client.query(sql);
-      }
-    })();
+    if (!this.schemaReady) {
+      this.schemaReady = (async () => {
+        await retryOnTransientPostgresError(async () => {
+          for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
+            await this.options.client.query(sql);
+          }
+        });
+      })().catch((error) => {
+        this.schemaReady = null;
+        throw error;
+      });
+    }
     await this.schemaReady;
   }
   async get(type, id) {
@@ -47846,13 +48171,14 @@ class PostgresJsonRecordStore {
     throw new Error(divergentAuditHistoryReplayError(value.id));
   }
   async withTaskParentIntegrityTransaction(fn) {
-    if (typeof this.options.client.transaction !== "function") {
+    const transaction = this.options.client.transaction;
+    if (typeof transaction !== "function") {
       throw new Error("TASK_PARENT_ATOMICITY_UNAVAILABLE: PostgreSQL parent writes and task deletion require transaction(callback)");
     }
-    return this.options.client.transaction(async (client) => {
+    return retryOnTransientPostgresError(() => transaction(async (client) => {
       await client.query("/* todos:task-parent-integrity-lock */ SELECT pg_advisory_xact_lock(hashtextextended($1 || ':task-parent-integrity', 0))", [this.service]);
       return fn(client);
-    });
+    }));
   }
   async upsertTaskWithPlanMembershipGuard(value, guardedPlanIds, explicitProject, context = {}, parentGuard, queryClient) {
     const planIds = [...new Set(guardedPlanIds.filter(Boolean))].sort();
@@ -49199,7 +49525,7 @@ async function getActiveWork2(filters, store) {
   }));
 }
 async function getChangedSince(since, filters, store) {
-  return (await listTasks3(filters ?? {}, store)).filter((task2) => task2.updated_at > since);
+  return (await listTasks3(filters ?? {}, store)).filter((task2) => changedSinceStampNewer(task2.updated_at ?? "", since));
 }
 async function createProject2(input, store, context) {
   const timestamp4 = new Date().toISOString();
@@ -49735,6 +50061,35 @@ function compareClock(left, right) {
 function numberValue3(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
 }
+function isTransientPostgresError(error) {
+  if (typeof error !== "object" || error === null)
+    return false;
+  const candidate = error;
+  const states = [candidate.code, candidate.errno, candidate.sqlState, candidate.sqlstate];
+  if (typeof candidate.cause === "object" && candidate.cause !== null) {
+    const cause = candidate.cause;
+    states.push(cause.code, cause.errno, cause.sqlState, cause.sqlstate);
+  }
+  if (states.some((state) => typeof state === "string" && TRANSIENT_POSTGRES_SQLSTATES.has(state))) {
+    return true;
+  }
+  const message = typeof candidate.message === "string" ? candidate.message : candidate.cause?.message;
+  return typeof message === "string" && TRANSIENT_POSTGRES_MESSAGE_MARKERS.some((marker) => message.includes(marker));
+}
+async function retryOnTransientPostgresError(fn, attempts = 2, delayMs = 150) {
+  let lastError;
+  for (let attempt = 1;attempt <= attempts; attempt += 1) {
+    try {
+      return await fn();
+    } catch (error) {
+      lastError = error;
+      if (!isTransientPostgresError(error) || attempt === attempts)
+        throw error;
+      await new Promise((resolve16) => setTimeout(resolve16, delayMs * attempt));
+    }
+  }
+  throw lastError;
+}
 function isPostgresUniqueViolation(error) {
   if (typeof error !== "object" || error === null)
     return false;
@@ -49754,10 +50109,11 @@ function postgresConstraintName(error) {
   const constraint = candidate.constraint ?? candidate.constraint_name ?? cause?.constraint ?? cause?.constraint_name;
   return typeof constraint === "string" ? constraint : "";
 }
-var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_TIEBREAK = "CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC", TASK_ORDER_BY;
+var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_TIEBREAK = "CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC", TASK_ORDER_BY, TRANSIENT_POSTGRES_SQLSTATES, TRANSIENT_POSTGRES_MESSAGE_MARKERS;
 var init_postgres_adapter = __esm(() => {
   init_types();
   init_creator_identity();
+  init_instant_compare();
   init_plan_project_link_contract();
   init_stale_lock_handoff();
   init_postgres_sync();
@@ -49767,6 +50123,12 @@ var init_postgres_adapter = __esm(() => {
   init_audit_history_import();
   init_canonical();
   TASK_ORDER_BY = `ORDER BY ${TASK_ORDER_TIEBREAK}`;
+  TRANSIENT_POSTGRES_SQLSTATES = new Set(["55P03", "40P01", "40001"]);
+  TRANSIENT_POSTGRES_MESSAGE_MARKERS = [
+    "canceling statement due to lock timeout",
+    "deadlock detected",
+    "could not serialize access"
+  ];
 });
 
 // src/pr-groups/postgres.ts
@@ -50188,10 +50550,19 @@ class PostgresPrGroupLedgerPersistence {
     this.client = client;
   }
   async ensureSchema() {
-    this.schemaReady ??= (async () => {
-      for (const statement of postgresPrGroupSchemaSql())
-        await this.client.query(statement);
-    })();
+    if (this.schemaReady === null) {
+      const attempt = (async () => {
+        for (const statement of postgresPrGroupSchemaSql())
+          await this.client.query(statement);
+      })();
+      this.schemaReady = attempt;
+      try {
+        await attempt;
+      } catch (error) {
+        this.schemaReady = null;
+        throw error;
+      }
+    }
     return this.schemaReady;
   }
   async transaction(fn) {
@@ -50609,14 +50980,23 @@ class PostgresTodosProjectRegistrationBackend {
     this.cursorTableName = safeIdentifier(options.cursorTableName ?? "todos_sync_cursors", "cursorTableName");
   }
   async ensureSchema() {
-    this.schemaReady ??= (async () => {
-      for (const statement of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
-        await this.client.query(statement);
-      }
-      for (const statement of postgresTodosProjectRegistrationSchemaSql()) {
-        await this.client.query(statement);
+    if (this.schemaReady === null) {
+      const attempt = (async () => {
+        for (const statement of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
+          await this.client.query(statement);
+        }
+        for (const statement of postgresTodosProjectRegistrationSchemaSql()) {
+          await this.client.query(statement);
+        }
+      })();
+      this.schemaReady = attempt;
+      try {
+        await attempt;
+      } catch (error) {
+        this.schemaReady = null;
+        throw error;
       }
-    })();
+    }
     await this.schemaReady;
   }
   async transaction(fn) {
@@ -53326,12 +53706,21 @@ class PostgresTodosTaskManifestBackend {
     this.tenantId = options.tenantId ?? "default";
   }
   async ensureSchema() {
-    this.schemaReady ??= (async () => {
-      for (const sql of postgresTodosSyncSchemaSql(this.tableName))
-        await this.client.query(sql);
-      for (const sql of postgresTodosTaskManifestSchemaSql(this.tenantId))
-        await this.client.query(sql);
-    })();
+    if (this.schemaReady === null) {
+      const attempt = (async () => {
+        for (const sql of postgresTodosSyncSchemaSql(this.tableName))
+          await this.client.query(sql);
+        for (const sql of postgresTodosTaskManifestSchemaSql(this.tenantId))
+          await this.client.query(sql);
+      })();
+      this.schemaReady = attempt;
+      try {
+        await attempt;
+      } catch (error) {
+        this.schemaReady = null;
+        throw error;
+      }
+    }
     await this.schemaReady;
   }
   async insertSync(tx, objectType2, objectId, payload, now4) {
@@ -54631,12 +55020,21 @@ class PostgresTodosTaskSubtreeTransferBackend {
     this.tenantId = options.tenantId ?? "default";
   }
   async ensureSchema() {
-    this.schemaReady ??= (async () => {
-      for (const sql of postgresTodosSyncSchemaSql(this.tableName))
-        await this.client.query(sql);
-      for (const sql of postgresTodosTaskSubtreeTransferSchemaSql())
-        await this.client.query(sql);
-    })();
+    if (this.schemaReady === null) {
+      const attempt = (async () => {
+        for (const sql of postgresTodosSyncSchemaSql(this.tableName))
+          await this.client.query(sql);
+        for (const sql of postgresTodosTaskSubtreeTransferSchemaSql())
+          await this.client.query(sql);
+      })();
+      this.schemaReady = attempt;
+      try {
+        await attempt;
+      } catch (error) {
+        this.schemaReady = null;
+        throw error;
+      }
+    }
     await this.schemaReady;
   }
   async snapshot(client, input, forUpdate = false) {
@@ -55723,7 +56121,10 @@ async function ensureCloudSchema() {
       await client.query(sql);
     }
     await getApiKeyStore().ensureSchema();
-  })();
+  })().catch((error) => {
+    schemaEnsured = null;
+    throw error;
+  });
   return schemaEnsured;
 }
 async function ensureCloudCommentCursorIndex() {