@hasna/todos 0.15.46 → 0.15.49

package/dist/lib/dedupe-projection.d.ts

@@ -0,0 +1,48 @@
+import type { Task, TaskPriority, TaskStatus } from "../types/index.js";
+/**
+ * The ONLY metadata keys the dedup projection carries. This is exactly the
+ * source-key set the fingerprint in `task-dedupe.ts` consumes
+ * (`sourceKeysFor`). Any other metadata — free-form `token`, `api_key`,
+ * `secret`, arbitrary composites — is never projected, so a credential value
+ * sitting in free-form metadata can never reach a dedup workflow's capture.
+ *
+ * Regression O15-00170 (incidents 713001/713022/713043-46/713119): workflows
+ * doing deduplication captured credential-bearing whole-task composites from
+ * `todos list --json` / `--format compact` / `--format csv` because no
+ * package-owned bounded projection existed. This allowlist is the bounded
+ * surface that abstraction provides.
+ */
+export declare const DEDUPE_SOURCE_KEY_ALLOWLIST: readonly ["github_url", "github_issue_url", "github_pr_url", "source_url", "url", "external_url", "issue_url", "github_owner", "github_repo", "github_number"];
+/**
+ * A task reduced to exactly the fields the dedup fingerprint consumes, plus a
+ * bounded source-key metadata object. It deliberately excludes free-form
+ * `metadata`, `tags`, comments, run/plan fields, and every other composite
+ * field of `Task` — the surfaces where credential values leaked. The carried
+ * free-form text (`title`, `description`) is redacted through the same
+ * pattern redactor every other output surface uses, so a credential embedded
+ * in prose never survives into the projection.
+ */
+export interface DedupeTaskProjection {
+    id: string;
+    short_id: string | null;
+    title: string;
+    description: string | null;
+    status: TaskStatus;
+    created_at: string;
+    updated_at: string;
+    project_id: string | null;
+    task_list_id: string | null;
+    assigned_to: string | null;
+    priority: TaskPriority;
+    metadata: Record<string, unknown>;
+}
+/**
+ * Project whole tasks into the bounded dedup shape.
+ *
+ * This is the package-owned "canonical-machine" abstraction: the only way a
+ * dedup workflow may capture task state for deduplication. It never emits a
+ * whole-task composite, so a credential that lives in free-form metadata,
+ * tags, or a nested composite cannot be captured with it.
+ */
+export declare function projectTasksForDedupe(tasks: Task[]): DedupeTaskProjection[];
+//# sourceMappingURL=dedupe-projection.d.ts.map

package/dist/lib/dedupe-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedupe-projection.d.ts","sourceRoot":"","sources":["../../src/lib/dedupe-projection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGxE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,gKAW9B,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAyB3E"}

package/dist/lib/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/lib/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AA6FD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUxD;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAe1C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,EAAE,CAOjE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CAK1D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,GAAG,kBAAkB,CAQtF"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../src/lib/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAqGD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUxD;AAED,wBAAgB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAe1C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,EAAE,CAOjE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CAK1D;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,kBAAkB,GAAG,kBAAkB,CAQtF"}

package/dist/lib/task-dedupe.d.ts

@@ -1,23 +1,19 @@
 import type { Database } from "bun:sqlite";
 import type { Task } from "../types/index.js";
+import { type DedupeTaskProjection } from "./dedupe-projection.js";
 export interface FindDuplicateTasksOptions {
     threshold?: number;
     limit?: number;
     include_archived?: boolean;
 }
-export interface TaskDuplicateProbe {
-    title: string;
-    description?: string | null;
-    metadata?: Record<string, unknown>;
-}
 export interface TaskDuplicateMatch {
-    task: Task;
+    task: DedupeTaskProjection;
     score: number;
     reasons: string[];
 }
 export interface DuplicateTaskCandidate {
-    primary_task: Task;
-    duplicate_task: Task;
+    primary_task: DedupeTaskProjection;
+    duplicate_task: DedupeTaskProjection;
     score: number;
     reasons: string[];
 }
@@ -55,7 +51,7 @@ export declare function findDuplicateTasks(options?: FindDuplicateTasksOptions,
  * Score a prospective task against local tasks without inserting a temporary
  * row. Producer previews use this to report likely duplicates before apply.
  */
-export declare function findDuplicateTasksForInput(input: TaskDuplicateProbe, options?: FindDuplicateTasksOptions, db?: Database): TaskDuplicateMatch[];
+export declare function findDuplicateTasksForInput(input: DedupeTaskProjection, options?: FindDuplicateTasksOptions, db?: Database): TaskDuplicateMatch[];
 export declare function mergeDuplicateTask(input: MergeDuplicateTaskInput, db?: Database): TaskMergeResult;
 export declare const findDuplicateCandidates: typeof findDuplicateTasks;
 //# sourceMappingURL=task-dedupe.d.ts.map

package/dist/lib/task-dedupe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-dedupe.d.ts","sourceRoot":"","sources":["../../src/lib/task-dedupe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAM9C,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,IAAI,CAAC;IACnB,cAAc,EAAE,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,IAAI,CAAC;IACnB,kBAAkB,EAAE,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AA2ND,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,sBAAsB,EAAE,CAqBnH;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,yBAA8B,EACvC,EAAE,CAAC,EAAE,QAAQ,GACZ,kBAAkB,EAAE,CActB;AAqJD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,eAAe,CAiGjG;AAGD,eAAO,MAAM,uBAAuB,2BAAqB,CAAC"}
+{"version":3,"file":"task-dedupe.d.ts","sourceRoot":"","sources":["../../src/lib/task-dedupe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAK9C,OAAO,EAAyB,KAAK,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE1F,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,oBAAoB,CAAC;IACnC,cAAc,EAAE,oBAAoB,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,IAAI,CAAC;IACnB,kBAAkB,EAAE,IAAI,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AA2ND,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,yBAA8B,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,sBAAsB,EAAE,CAwBnH;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,yBAA8B,EACvC,EAAE,CAAC,EAAE,QAAQ,GACZ,kBAAkB,EAAE,CActB;AAqJD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC,EAAE,QAAQ,GAAG,eAAe,CAiGjG;AAGD,eAAO,MAAM,uBAAuB,2BAAqB,CAAC"}